{"schema":"cgrcc.registry.v1","release":"2026-10-16.scoring.1","sourceAsOf":"Dates and verification scope are recorded per source","batch":{"status":"COMPLETED","batches":[{"id":"missionsafe-20261016-v1","release":"2026-10-16.missionsafe.1","status":"COMPLETED","started_at":"2026-10-16T10:38:13.273Z","completed_at":"2026-10-16T10:40:13.953Z"},{"id":"policy-scoring-20261016-v1","release":"2026-10-16.scoring.1","status":"COMPLETED","started_at":"2026-10-16T11:03:45.585Z","completed_at":"2026-10-16T11:04:24.971Z"}]},"counts":{"versionsByKind":{"control":489,"framework":70,"guidance":315,"historical_finding":18,"implementation_template":35,"overlay":18,"policy":71,"proposal":80,"reference_bundle":3,"requirement":264,"rule":413,"scoring_model":9,"source_note":49,"test":137},"uniqueByKind":{"control":417,"framework":53,"guidance":315,"historical_finding":18,"implementation_template":35,"overlay":18,"policy":37,"proposal":80,"reference_bundle":3,"requirement":264,"rule":413,"scoring_model":9,"source_note":49,"test":137},"sources":82,"recordVersions":1971,"sourceRows":1783,"provenance":5603,"relationships":4559,"unresolvedRelationships":0,"uploadedWorkbooks":4,"distinctWorkbookBytes":3,"ruleScores":413},"manifests":[{"filename":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","duplicateOf":null,"sheetCount":15},{"filename":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","duplicateOf":null,"sheetCount":8},{"filename":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","duplicateOf":null,"sheetCount":22},{"filename":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","duplicateOf":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","sheetCount":22},{"filename":"POLICY.md","sha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea","sourceKey":"policy-guide-taimscore@e8334126d25759e0","lineCount":651,"sourceType":"Markdown secondary guidance","duplicateOf":null},{"filename":"POLICY(1).md","sha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","lineCount":297,"sourceType":"Markdown secondary guidance","duplicateOf":null},{"filename":"POLICY(2).md","sha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","lineCount":246,"sourceType":"Markdown secondary guidance","duplicateOf":null},{"filename":"POLICY(3).md","sha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","lineCount":272,"sourceType":"Markdown secondary guidance","duplicateOf":null},{"filename":"POLICY(4).md","sha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","lineCount":490,"sourceType":"Markdown secondary guidance","duplicateOf":null},{"filename":"POLICY(5).md","sha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","lineCount":471,"sourceType":"Markdown secondary guidance","duplicateOf":null},{"filename":"POLICY(6).md","sha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","lineCount":297,"sourceType":"Markdown secondary guidance","duplicateOf":null},{"filename":"POLICY(7).md","sha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","lineCount":539,"sourceType":"Markdown secondary guidance","duplicateOf":null},{"filename":"POLICY(8).md","sha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","lineCount":602,"sourceType":"Markdown secondary guidance","duplicateOf":null},{"filename":"POLICY(9).md","sha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","lineCount":454,"sourceType":"Markdown secondary guidance","duplicateOf":null},{"filename":"POLICY(10).md","sha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","lineCount":398,"sourceType":"Markdown secondary guidance","duplicateOf":null}],"notices":["Imported workbook statements and crosswalks are source-reported design material, not verified legal interpretations or live enforcement.","Workbook source date: 20 August 2026. Publisher references were not revalidated for this import.","Two v2 uploads are byte-identical; both provenance identities are retained without inflating unique counts.","Source-reported approval, support, maturity and applicability never activate an organization policy.","Prototype expansion matches remain draft and may be semantically incorrect.","Existing AIR rule IDs, releases, review history and discovery tables remain unchanged.","Organization profile answers and workbook maturity scores are not published as organizational facts.","Supplied POLICY.md files are secondary product guidance, not verified publisher text or claims about deployed platform capabilities.","EO 14110 is retained as historical material: official Federal Register records its revocation by EO 14148 on 20 January 2025.","TAIMScore 0–4 maturity, the five-dimension workbook model and mission readiness gates remain distinct.","Commonality is an observed recurrence index; neither frequency nor a planning score establishes legal applicability or safety."],"records":[{"key":"MD-CTRL-EU-AI-ACT-10-2-@a7dce78116ce2014","id":"MD-CTRL-EU-AI-ACT-10-2-","version":"a7dce78116ce2014","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"10(2): Training, validation, and testing datasets must be subject to data governance and management practices covering:","statement":"**10(2):** Training, validation, and testing datasets must be subject to data governance and management practices covering:\n- Relevant design choices\n- Data collection and procurement processes\n- Relevant data preparation processing operations (labeling, cleaning, enrichment, aggregation)\n- Formulation of relevant assumptions\n- Assessment of availability, quantity, and suitability\n- Examination of possible biases\n- Identification of relevant data gaps or shortcomings and remediation","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"10(2)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-10-3-@1ce76d7345575584","id":"MD-CTRL-EU-AI-ACT-10-3-","version":"1ce76d7345575584","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"10(3): Datasets must be relevant, sufficiently representative, and to the best extent possible, free from errors and complete given the intended purpose.","statement":"**10(3):** Datasets must be relevant, sufficiently representative, and to the best extent possible, free from errors and complete given the intended purpose.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"10(3)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-10-4-@aa75ff3914ffc284","id":"MD-CTRL-EU-AI-ACT-10-4-","version":"aa75ff3914ffc284","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"10(4): Datasets must have appropriate statistical properties relative to the persons or groups of persons on which the system will be used (including characteristics of the geographic, behavioral, and functional settings).","statement":"**10(4):** Datasets must have appropriate statistical properties relative to the persons or groups of persons on which the system will be used (including characteristics of the geographic, behavioral, and functional settings).","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"10(4)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-10-5-@7e0bc0ba9d6d6412","id":"MD-CTRL-EU-AI-ACT-10-5-","version":"7e0bc0ba9d6d6412","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"10(5): Special categories of data may be processed for bias detection and correction — strictly limited to this purpose.","statement":"**10(5):** Special categories of data may be processed for bias detection and correction — strictly limited to this purpose.\n\n**GOVERN mapping:** GOVERN Data Governance module tracks dataset lineage for high-risk systems. Bias evaluation records attach to each system's compliance record. Data provenance reports generated for Article 10 documentation requirements.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"10(5)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-13-1-@e4de22262c5355d6","id":"MD-CTRL-EU-AI-ACT-13-1-","version":"e4de22262c5355d6","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"13(1): Instructions must contain concise, complete, correct, and clear information relevant and useful to the deployer.","statement":"**13(1):** Instructions must contain concise, complete, correct, and clear information relevant and useful to the deployer.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"13(1)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-13-2-@ae3ce4bab942592a","id":"MD-CTRL-EU-AI-ACT-13-2-","version":"ae3ce4bab942592a","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"13(2): Instructions must include:","statement":"**13(2):** Instructions must include:\n- Identity and contact details of provider\n- Characteristics, capabilities, and limitations of the high-risk AI system including:\n  - Its intended purpose\n  - Level of accuracy, robustness, and cybersecurity\n  - Circumstances that may lead to risks\n  - Performance with respect to specific groups of persons\n  - Input data specifications\n  - Relevant information for human oversight\n- Changes and their impact on performance\n- Human oversight measures\n- Expected lifetime and maintenance","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"13(2)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-13-3-@f228d898e674d933","id":"MD-CTRL-EU-AI-ACT-13-3-","version":"f228d898e674d933","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"13(3)(b): Where relevant, instructions must include information about:","statement":"**13(3)(b):** Where relevant, instructions must include information about:\n- The intended purpose\n- Level of accuracy, robustness, and cybersecurity\n- Any known or foreseeable circumstances that may lead to risk to health, safety, or fundamental rights\n- Technical capabilities and limitations including any biases\n- Where applicable, performance data in terms of relevant groups of persons\n\n**GOVERN mapping:** GOVERN Compliance Portal generates Article 13-compliant system cards for each registered high-risk AI system. System cards auto-populate from GOVERN Risk Engine assessments and are version-controlled with change history.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"13(3)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-14-1-@f52eff8120a90c2e","id":"MD-CTRL-EU-AI-ACT-14-1-","version":"f52eff8120a90c2e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"14(1): Measures for human oversight must be proportionate to the risks, degree of autonomy, and context of use.","statement":"**14(1):** Measures for human oversight must be proportionate to the risks, degree of autonomy, and context of use.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"14(1)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-14-2-@5e8d41765cdf2e60","id":"MD-CTRL-EU-AI-ACT-14-2-","version":"5e8d41765cdf2e60","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"14(2): Human oversight must aim to prevent or minimize risks to health, safety, or fundamental rights when the system is used as intended.","statement":"**14(2):** Human oversight must aim to prevent or minimize risks to health, safety, or fundamental rights when the system is used as intended.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"14(2)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-14-3-@8f0eaa8f1c405ff4","id":"MD-CTRL-EU-AI-ACT-14-3-","version":"8f0eaa8f1c405ff4","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"14(3): High-risk AI systems must allow the persons assigned to human oversight to:","statement":"**14(3):** High-risk AI systems must allow the persons assigned to human oversight to:\n- (a) Fully understand the capacities and limitations of the high-risk AI system and monitor its operation\n- (b) Be aware of the possible tendency of automatically relying or over-relying on the output produced by the system (automation bias)\n- (c) Correctly interpret the output of the high-risk AI system in light of context\n- (d) Decide, in any particular situation, not to use the system or override, disregard, or reverse the output\n- (e) Intervene in the system operation or interrupt it through a \"stop\" button or similar procedure","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"14(3)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-14-4-@ca77c391a877ecbb","id":"MD-CTRL-EU-AI-ACT-14-4-","version":"ca77c391a877ecbb","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"14(4): For high-risk AI systems intended to be used in contexts where output could have a significant impact on fundamental rights (law enforcement, employment, credit): oversight measures must include mechanisms ensuring that no output is actioned without meaningful human review.","statement":"**14(4):** For high-risk AI systems intended to be used in contexts where output could have a significant impact on fundamental rights (law enforcement, employment, credit): oversight measures must include mechanisms ensuring that no output is actioned without meaningful human review.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"14(4)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-14-5-@af795797cc364252","id":"MD-CTRL-EU-AI-ACT-14-5-","version":"af795797cc364252","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"14(5): For general-purpose AI systems used as high-risk AI components: specific oversight measures must be implemented by the integrating provider.","statement":"**14(5):** For general-purpose AI systems used as high-risk AI components: specific oversight measures must be implemented by the integrating provider.\n\n**GOVERN mapping:** GOVERN Human Oversight module tracks oversight controls for each high-risk system. Assigns Human Oversight Officers (HOO), logs override decisions, tracks automation bias incidents, and generates Article 14 compliance evidence.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"14(5)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-15-1-@b3e518f9d429b45e","id":"MD-CTRL-EU-AI-ACT-15-1-","version":"b3e518f9d429b45e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"15(1): High-risk AI systems must be designed and developed to achieve an appropriate level of accuracy, robustness, and cybersecurity, and to perform consistently in those respects throughout their lifecycle.","statement":"**15(1):** High-risk AI systems must be designed and developed to achieve an appropriate level of accuracy, robustness, and cybersecurity, and to perform consistently in those respects throughout their lifecycle.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"15(1)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-15-2-@503fca7940ba7748","id":"MD-CTRL-EU-AI-ACT-15-2-","version":"503fca7940ba7748","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"15(2): Levels of accuracy and accuracy metrics must be declared in the instructions for use.","statement":"**15(2):** Levels of accuracy and accuracy metrics must be declared in the instructions for use.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"15(2)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-15-3-@cf8a59d9043b2983","id":"MD-CTRL-EU-AI-ACT-15-3-","version":"cf8a59d9043b2983","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"15(3): High-risk AI systems must be resilient against:","statement":"**15(3):** High-risk AI systems must be resilient against:\n- Errors\n- Faults\n- Inconsistencies within the system and environment\n- Reasonably foreseeable attempts by unauthorized parties to alter use or performance (adversarial manipulation)\n- Feedback loops from repeated deployment","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"15(3)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-15-4-@1e19ebf3d5aebd44","id":"MD-CTRL-EU-AI-ACT-15-4-","version":"1e19ebf3d5aebd44","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"15(4): Technical robustness must include resilience against attempts to alter the system through adversarial attacks. Must prevent malicious manipulation that changes system behavior or output in a way that compromises health, safety, or fundamental rights.","statement":"**15(4):** Technical robustness must include resilience against attempts to alter the system through adversarial attacks. Must prevent malicious manipulation that changes system behavior or output in a way that compromises health, safety, or fundamental rights.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"15(4)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-15-5-@f5fb81f718cfe769","id":"MD-CTRL-EU-AI-ACT-15-5-","version":"f5fb81f718cfe769","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"15(5): For AI systems used in biometric identification: additional cybersecurity requirements apply to prevent unauthorized access to biometric data.","statement":"**15(5):** For AI systems used in biometric identification: additional cybersecurity requirements apply to prevent unauthorized access to biometric data.\n\n**GOVERN mapping:** GOVERN Security Module tracks accuracy metrics, robustness test results, and cybersecurity posture for each high-risk system. Red team evaluation records attach to compliance file. Adversarial testing cadence enforced by Policy Engine.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"15(5)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-52-1-@058abb0e89a7813e","id":"MD-CTRL-EU-AI-ACT-52-1-","version":"058abb0e89a7813e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"52(1) — Transparency obligations for all GPAI providers:","statement":"**52(1) — Transparency obligations for all GPAI providers:**\n- Provide technical documentation to downstream providers integrating the model (sufficient for them to comply with their own obligations)\n- Provide information and documentation to deployers and downstream providers as needed\n- Establish a policy to respect EU copyright law including compliance with the opt-out mechanism under Directive 2019/790 Article 4(3)\n- Publish a sufficiently detailed summary of the content used for training","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"52(1)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-52-2-@fcd1dc217971ff35","id":"MD-CTRL-EU-AI-ACT-52-2-","version":"fcd1dc217971ff35","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"52(2) — Systemic risk GPAI models (high-capability threshold):","statement":"**52(2) — Systemic risk GPAI models (high-capability threshold):**\n\nA GPAI model is deemed to have systemic risk if it is trained with more than 10^25 FLOPs, or is designated as such by the AI Office based on other capability indicators.\n\nAdditional obligations for systemic-risk GPAI models:\n- Perform model evaluation prior to release (including adversarial testing)\n- Assess and mitigate systemic risks identified at EU level\n- Track, document, and report serious incidents and corrective measures to the AI Office\n- Implement cybersecurity protections commensurate with systemic risk profile\n- Report energy consumption during training and inference","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"52(2)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-52-5-@5a666ea0f8aca324","id":"MD-CTRL-EU-AI-ACT-52-5-","version":"5a666ea0f8aca324","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"52(5): Codes of practice serve as the presumption of conformity mechanism for GPAI obligations.","statement":"**52(5):** Codes of practice serve as the presumption of conformity mechanism for GPAI obligations.\n\n**GOVERN mapping:** GOVERN GPAI module tracks provider compliance with Article 52 for any GPAI model integrated into customer workflows. Documentation coverage checker verifies technical documentation completeness. Copyright compliance records maintained. Systemic risk assessment status tracked.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"52(5)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-71-1-@0bbab87f8356282e","id":"MD-CTRL-EU-AI-ACT-71-1-","version":"0bbab87f8356282e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"71(1): The AI Office shall facilitate the drawing up of codes of practice to contribute to the proper application of the Regulation.","statement":"**71(1):** The AI Office shall facilitate the drawing up of codes of practice to contribute to the proper application of the Regulation.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"71(1)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-71-3-@e33680f9cc493c26","id":"MD-CTRL-EU-AI-ACT-71-3-","version":"e33680f9cc493c26","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"71(3): Codes of practice shall include at minimum:","statement":"**71(3):** Codes of practice shall include at minimum:\n- Descriptions of GPAI models covered\n- Specific obligations covered by the code\n- Benchmarks and metrics for measuring compliance\n- Testing and evaluation methodologies","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"71(3)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-71-4-@4821a27b7f16337b","id":"MD-CTRL-EU-AI-ACT-71-4-","version":"4821a27b7f16337b","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"71(4): Codes of practice finalized by August 2, 2025.","statement":"**71(4):** Codes of practice finalized by August 2, 2025.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"71(4)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-71-7-@3d02e8cd9482f5bd","id":"MD-CTRL-EU-AI-ACT-71-7-","version":"3d02e8cd9482f5bd","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"71(7): Where a GPAI model provider complies with a code of practice, there is a presumption of conformity with the covered obligations.","statement":"**71(7):** Where a GPAI model provider complies with a code of practice, there is a presumption of conformity with the covered obligations.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"71(7)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-71-8-@dcf40a65d12e2da2","id":"MD-CTRL-EU-AI-ACT-71-8-","version":"dcf40a65d12e2da2","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"71(8): The AI Office shall monitor and evaluate the effectiveness of codes of practice.","statement":"**71(8):** The AI Office shall monitor and evaluate the effectiveness of codes of practice.\n\n**Codes of practice status (as of early 2026):**\n- GPAI Code of Practice: Drafting initiated Q4 2024 with multi-stakeholder working groups covering transparency, copyright, systemic risk evaluation, and incident reporting. Target finalization: August 2025.\n\n**GOVERN mapping:** GOVERN tracks which codes of practice each GPAI provider has signed onto. Compliance Portal displays presumption-of-conformity status per code.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"71(8)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-9-1-@5bec8b894d92882b","id":"MD-CTRL-EU-AI-ACT-9-1-","version":"5bec8b894d92882b","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"9(1): The risk management system is a continuous iterative process throughout the lifecycle, requiring regular systematic updating.","statement":"**9(1):** The risk management system is a continuous iterative process throughout the lifecycle, requiring regular systematic updating.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"9(1)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-9-2-@51c3f8ab111e3ef5","id":"MD-CTRL-EU-AI-ACT-9-2-","version":"51c3f8ab111e3ef5","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"9(2): The risk management system must include:","statement":"**9(2):** The risk management system must include:\n- Identification and analysis of known and reasonably foreseeable risks to health, safety, and fundamental rights\n- Estimation and evaluation of risks arising from intended use and reasonably foreseeable misuse\n- Evaluation of risks based on post-market monitoring data\n- Adoption of appropriate risk management measures","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"9(2)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-9-4-@e401d0abd504c8b1","id":"MD-CTRL-EU-AI-ACT-9-4-","version":"e401d0abd504c8b1","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"9(4): Risk management measures must consider effects and possible interactions resulting from the combined application of requirements in Articles 10–15.","statement":"**9(4):** Risk management measures must consider effects and possible interactions resulting from the combined application of requirements in Articles 10–15.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"9(4)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-9-5-@fdc5560100fd6335","id":"MD-CTRL-EU-AI-ACT-9-5-","version":"fdc5560100fd6335","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"9(5): High-risk AI systems tested in real-world conditions before placement on market.","statement":"**9(5):** High-risk AI systems tested in real-world conditions before placement on market.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"9(5)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-9-6-@a9ee456f4433d8fe","id":"MD-CTRL-EU-AI-ACT-9-6-","version":"a9ee456f4433d8fe","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"9(6): Testing must be performed against metrics and probabilistic thresholds appropriate to the intended purpose.","statement":"**9(6):** Testing must be performed against metrics and probabilistic thresholds appropriate to the intended purpose.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"9(6)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-9-7-@262fe538cb34eacc","id":"MD-CTRL-EU-AI-ACT-9-7-","version":"262fe538cb34eacc","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"9(7): Testing for children, elderly, persons with disabilities, and historically disadvantaged groups where likely affected.","statement":"**9(7):** Testing for children, elderly, persons with disabilities, and historically disadvantaged groups where likely affected.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"9(7)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-EU-AI-ACT-9-8-@e3fa4515dc9c64e3","id":"MD-CTRL-EU-AI-ACT-9-8-","version":"e3fa4515dc9c64e3","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"9(8): For systems interacting with natural persons: risks from vulnerable populations must be explicitly addressed.","statement":"**9(8):** For systems interacting with natural persons: risks from vulnerable populations must be explicitly addressed.\n\n**GOVERN mapping:** GOVERN Risk Engine automates the Article 9 lifecycle. Risk assessments are created at onboarding, updated with each significant change, linked to post-market monitoring alerts, and stored with audit trail. Risk scores feed the Compliance Portal dashboard.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"sourceControlId":"9(8)","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-ISO-42001-6.1.1@60c86a4b6f52bb30","id":"MD-CTRL-ISO-42001-6.1.1","version":"60c86a4b6f52bb30","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"6.1.1 — General:","statement":"**6.1.1 — General:**\nWhen planning the AIMS, the organization must consider the context (Clause 4.1 and 4.2) and determine:\n- Risks and opportunities that need to be addressed\n- How to integrate and implement actions into AIMS processes\n- How to evaluate the effectiveness of those actions\n\nAI-specific planning must address:\n- Risks related to data quality and bias\n- Risks related to model performance and reliability\n- Risks related to unintended use and misuse\n- Risks related to the AI system's impact on affected parties\n- Opportunities to improve processes, products, or services through AI\n- Opportunities to advance the organization's responsible AI commitments","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"6.1.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-ISO-42001-6.1.2@f5ba6f854ea753db","id":"MD-CTRL-ISO-42001-6.1.2","version":"f5ba6f854ea753db","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"6.1.2 — AI risk assessment:","statement":"**6.1.2 — AI risk assessment:**\nThe organization must establish and maintain a process for AI risk assessment that:\n- Identifies AI risks (the what could go wrong)\n- Analyzes AI risks (likelihood and impact)\n- Evaluates AI risks against risk criteria\n- Produces comparable and reproducible results\n- Documents risk assessment results","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"6.1.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-ISO-42001-6.1.3@4cbac668c4e2aafb","id":"MD-CTRL-ISO-42001-6.1.3","version":"4cbac668c4e2aafb","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"6.1.3 — AI risk treatment:","statement":"**6.1.3 — AI risk treatment:**\nBased on risk assessment results, the organization must:\n- Select appropriate risk treatment options (modify, retain, avoid, share)\n- Determine controls needed (referencing Annex A)\n- Formulate and implement a risk treatment plan\n- Obtain acceptance of residual risks from risk owners\n\n**6.2 — AI objectives and planning to achieve them:**\nThe organization must establish measurable AI objectives at relevant functions and levels:\n- Consistent with AI policy\n- Measurable (where practicable)\n- Monitored and communicated\n- Updated as appropriate\n\nFor each AI objective, the organization must determine: what will be done, what resources are required, who will be responsible, when it will be completed, and how results will be evaluated.\n\n**6.3 — Planning of changes:**\nChanges to the AIMS must be planned and implemented in a controlled manner, considering the purpose, potential consequences, resource availability, and responsibilities.\n\n**GOVERN mapping:** GOVERN Risk Engine operationalizes Clause 6.1.2 and 6.1.3. Risk assessment workflows, risk treatment plans, and residual risk acceptance records are generated and stored. GOVERN Objectives Module tracks AI objectives and progress metrics.\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"6.1.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-ISO-42001-7.5.1@69707987c069fc16","id":"MD-CTRL-ISO-42001-7.5.1","version":"69707987c069fc16","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"7.5.1 — General: The AIMS must include documented information required by the standard plus additional documented information the organization determines is necessary for AIMS effectiveness.","statement":"**7.5.1 — General:** The AIMS must include documented information required by the standard plus additional documented information the organization determines is necessary for AIMS effectiveness.","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"7.5.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-ISO-42001-7.5.2@a71f6796e748a2e8","id":"MD-CTRL-ISO-42001-7.5.2","version":"a71f6796e748a2e8","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"7.5.2 — Creating and updating: Documented information must have appropriate identification, format, media, review, and approval.","statement":"**7.5.2 — Creating and updating:** Documented information must have appropriate identification, format, media, review, and approval.","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"7.5.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-ISO-42001-7.5.3@941f62a64cb49911","id":"MD-CTRL-ISO-42001-7.5.3","version":"941f62a64cb49911","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"7.5.3 — Control of documented information: Documented information must be available, protected, controlled for distribution, access, and retrieval. Changes must be controlled. External documented information must be identified and controlled.","statement":"**7.5.3 — Control of documented information:** Documented information must be available, protected, controlled for distribution, access, and retrieval. Changes must be controlled. External documented information must be identified and controlled.\n\n**GOVERN mapping:** GOVERN Compliance Portal is the documented information system. All AIMS records, risk assessments, training logs, incident reports, and audit trails maintained. Competency tracking module supports Clause 7.2.\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"7.5.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AC-1@ffc5aee74d3fc65e","id":"MD-CTRL-NIST-800-53-AC-1","version":"ffc5aee74d3fc65e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AC-1 — Access Control Policy and Procedures","statement":"**AC-1 — Access Control Policy and Procedures**\nRequires documented access control policy covering all system components. For AI systems: policy must explicitly address access to model weights, training data repositories, inference endpoints, and AI pipeline components.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AC-1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AC-17@933a2051223687b5","id":"MD-CTRL-NIST-800-53-AC-17","version":"933a2051223687b5","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AC-17 — Remote Access","statement":"**AC-17 — Remote Access**\nControls remote access to systems. For AI systems: remote access to AI training infrastructure, MLOps platforms, and model registries must be authenticated, encrypted, and logged.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AC-17","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AC-2@3f85328fe1521853","id":"MD-CTRL-NIST-800-53-AC-2","version":"3f85328fe1521853","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AC-2 — Account Management","statement":"**AC-2 — Account Management**\nRequires lifecycle management of accounts with access to system resources. For AI systems: manage accounts for data scientists, ML engineers, inference API users, and automated pipeline service accounts. Monitor for unused accounts with access to model artifacts.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AC-2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AC-22@0d85b298668b280c","id":"MD-CTRL-NIST-800-53-AC-22","version":"0d85b298668b280c","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AC-22 — Publicly Accessible Content","statement":"**AC-22 — Publicly Accessible Content**\nControls information posted to publicly accessible systems. For AI systems: verify that publicly accessible AI APIs do not expose sensitive training data or model internals. Validate that AI-generated content does not inadvertently disclose restricted information.\n\n**GOVERN Assess Evaluation:** AC family evaluated via infrastructure configuration review, access control matrix review, and API access pattern analysis.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AC-22","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AC-3@87ed3ce01e96d062","id":"MD-CTRL-NIST-800-53-AC-3","version":"87ed3ce01e96d062","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AC-3 — Access Enforcement","statement":"**AC-3 — Access Enforcement**\nRequires enforcement of approved authorizations. For AI systems: enforce role-based access to training data (read vs. write), model artifacts (read vs. deploy), and inference APIs. Use attribute-based access control (ABAC) for fine-grained control over which users can query which AI models.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AC-3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AC-4@641056b3e2b83cb1","id":"MD-CTRL-NIST-800-53-AC-4","version":"641056b3e2b83cb1","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AC-4 — Information Flow Enforcement","statement":"**AC-4 — Information Flow Enforcement**\nControls information flow within and between systems. For AI systems: control data flows from sensitive source systems into AI training pipelines. Prevent unauthorized exfiltration of AI model outputs that may contain sensitive information (e.g., model inversion attacks, membership inference).","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AC-4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AC-6@6cce771a8ebe982b","id":"MD-CTRL-NIST-800-53-AC-6","version":"6cce771a8ebe982b","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AC-6 — Least Privilege","statement":"**AC-6 — Least Privilege**\nRequires minimum necessary access. For AI systems: service accounts running AI inference should have only the permissions required for inference, not training or deployment. Data scientists should not have production deployment rights.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AC-6","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AU-1@d05ac18178adc30d","id":"MD-CTRL-NIST-800-53-AU-1","version":"d05ac18178adc30d","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AU-1 — Audit and Accountability Policy and Procedures","statement":"**AU-1 — Audit and Accountability Policy and Procedures**\nRequires documented audit policy. For AI systems: audit policy must address what AI system events are logged (inference requests, decision outputs, model deployments, training runs, configuration changes) and how logs are protected.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AU-1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AU-10@08f387c8911d4d05","id":"MD-CTRL-NIST-800-53-AU-10","version":"08f387c8911d4d05","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AU-10 — Non-Repudiation","statement":"**AU-10 — Non-Repudiation**\nProvides evidence that actions cannot be denied. For AI systems: digital signing of AI inference requests and responses supports non-repudiation for high-stakes AI decisions (medical, financial, legal, regulatory).","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AU-10","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AU-11@a26d421379fb44f1","id":"MD-CTRL-NIST-800-53-AU-11","version":"a26d421379fb44f1","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AU-11 — Audit Record Retention","statement":"**AU-11 — Audit Record Retention**\nDefines retention periods. For AI systems: retain AI decision logs for the period required by applicable regulations. EU AI Act requires post-market monitoring records for 10 years for high-risk AI systems. Financial services AI decisions may require 5–7 year retention.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AU-11","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AU-12@037fdf52ec2a4527","id":"MD-CTRL-NIST-800-53-AU-12","version":"037fdf52ec2a4527","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AU-12 — Audit Record Generation","statement":"**AU-12 — Audit Record Generation**\nRequires audit record generation capability. For AI systems: ensure every AI system component (inference API, model serving infrastructure, training pipeline) generates audit records that flow to the centralized audit repository.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AU-12","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AU-14@5bd76e6a91f17539","id":"MD-CTRL-NIST-800-53-AU-14","version":"5bd76e6a91f17539","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AU-14 — Session Audit","statement":"**AU-14 — Session Audit**\nRequires logging of session activity. For AI systems: log user sessions interacting with AI systems, capturing the sequence of AI queries and human actions taken on AI outputs.\n\n**GOVERN Assess Evaluation:** AU family evaluated via log completeness review, retention period verification, and AI decision log format assessment.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AU-14","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AU-2@ab193a7febc8a215","id":"MD-CTRL-NIST-800-53-AU-2","version":"ab193a7febc8a215","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AU-2 — Event Logging","statement":"**AU-2 — Event Logging**\nDefines events to be logged. For AI systems, required events include:\n- Inference API calls (timestamp, user/system ID, input hash, output hash)\n- Model deployment events (which model version deployed by whom)\n- Training run initiation and completion\n- Access to training data repositories\n- Model configuration changes\n- Anomalous output events (outputs flagged by monitoring)\n- Human override of AI decisions","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AU-2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AU-3@a5a2547b7300a36e","id":"MD-CTRL-NIST-800-53-AU-3","version":"a5a2547b7300a36e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AU-3 — Content of Audit Records","statement":"**AU-3 — Content of Audit Records**\nDefines the content of audit log entries. For AI systems: logs must capture sufficient context to reconstruct the AI decision — model version, input parameters, output, confidence score, and the identity of the requesting user or system.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AU-3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AU-6@83cd30f14c8fa126","id":"MD-CTRL-NIST-800-53-AU-6","version":"83cd30f14c8fa126","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AU-6 — Audit Record Review, Analysis, and Reporting","statement":"**AU-6 — Audit Record Review, Analysis, and Reporting**\nRequires regular review of audit logs. For AI systems: periodic review of AI decision logs for anomalies, bias patterns, unusual access, and evidence of adversarial inputs.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AU-6","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-AU-9@fcde7a027e522d94","id":"MD-CTRL-NIST-800-53-AU-9","version":"fcde7a027e522d94","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"AU-9 — Protection of Audit Information","statement":"**AU-9 — Protection of Audit Information**\nPrevents unauthorized access to audit logs. For AI systems: AI decision logs must be write-protected and stored independently of the systems that generate them (defense against log tampering after adversarial incident).","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"AU-9","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CA-1@1f09cd22b9f67243","id":"MD-CTRL-NIST-800-53-CA-1","version":"1f09cd22b9f67243","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CA-1 — Assessment, Authorization, and Monitoring Policy and Procedures","statement":"**CA-1 — Assessment, Authorization, and Monitoring Policy and Procedures**\nRequires documented policy for system authorization. For AI systems: policy must address the AI-specific assessment activities required before authorization, including AI RMF MEASURE activities, bias assessments, and adversarial robustness testing.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CA-1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CA-2@29a21d24d3f9cded","id":"MD-CTRL-NIST-800-53-CA-2","version":"29a21d24d3f9cded","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CA-2 — Control Assessments","statement":"**CA-2 — Control Assessments**\nRequires regular assessment of security controls. For AI systems: control assessments must include AI-specific controls (model integrity, output monitoring, bias metrics) in addition to traditional security controls.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CA-2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CA-3@e0d9f1d2eb445d9c","id":"MD-CTRL-NIST-800-53-CA-3","version":"e0d9f1d2eb445d9c","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CA-3 — Information Exchange","statement":"**CA-3 — Information Exchange**\nControls connections between systems. For AI systems: document all API integrations between the AI system and other systems. Assess risk of each integration. Control data flows through formal interconnection agreements.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CA-3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CA-5@bd5759ed9df51fc9","id":"MD-CTRL-NIST-800-53-CA-5","version":"bd5759ed9df51fc9","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CA-5 — Plan of Action and Milestones (POA&M)","statement":"**CA-5 — Plan of Action and Milestones (POA&M)**\nRequires tracking of identified security weaknesses. For AI systems: AI-specific findings from assessments (bias issues, adversarial vulnerabilities, explainability gaps) must be tracked in the POA&M with remediation milestones.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CA-5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CA-6@69232618983df2fe","id":"MD-CTRL-NIST-800-53-CA-6","version":"69232618983df2fe","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CA-6 — Authorization","statement":"**CA-6 — Authorization**\nRequires formal authorization before operation. For AI systems: ATO package for an AI system must include AI RMF documentation, bias assessment results, TEVV documentation, and monitoring plan in addition to standard 800-53 control documentation.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CA-6","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CA-7@392ed8f13a4bfca4","id":"MD-CTRL-NIST-800-53-CA-7","version":"392ed8f13a4bfca4","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CA-7 — Continuous Monitoring","statement":"**CA-7 — Continuous Monitoring**\nRequires ongoing monitoring of security controls. For AI systems: continuous monitoring program must include AI-specific metrics (model performance drift, bias metric trends, anomalous output rates, adversarial probe detection) alongside traditional security monitoring.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CA-7","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CA-8@451236ee100f65b6","id":"MD-CTRL-NIST-800-53-CA-8","version":"451236ee100f65b6","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CA-8 — Penetration Testing","statement":"**CA-8 — Penetration Testing**\nRequires periodic penetration testing. For AI systems: penetration testing scope must include AI-specific attack surfaces — prompt injection, model inversion, membership inference, adversarial examples, and model extraction attacks.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CA-8","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CA-9@c9f9401ec0608756","id":"MD-CTRL-NIST-800-53-CA-9","version":"c9f9401ec0608756","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CA-9 — Internal System Connections","statement":"**CA-9 — Internal System Connections**\nControls internal connections. For AI systems: document and assess internal connections between AI inference services, model registries, training pipelines, and data stores.\n\n**GOVERN Assess Evaluation:** CA family evaluated by reviewing ATO documentation, continuous monitoring plans, and penetration test scope coverage of AI attack surfaces.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CA-9","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CM-1@bc57786ef48c3c55","id":"MD-CTRL-NIST-800-53-CM-1","version":"bc57786ef48c3c55","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CM-1 — Configuration Management Policy and Procedures","statement":"**CM-1 — Configuration Management Policy and Procedures**\nRequires documented CM policy. For AI systems: CM policy must explicitly address model versioning, model registry governance, hyperparameter configuration control, and deployment pipeline security.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CM-1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CM-10@657eeba351ec85bb","id":"MD-CTRL-NIST-800-53-CM-10","version":"657eeba351ec85bb","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CM-10 — Software Usage Restrictions","statement":"**CM-10 — Software Usage Restrictions**\nControls software licensing. For AI systems: verify licensing for all AI frameworks, pre-trained models, and datasets used. Track license terms that may restrict commercial use or require disclosure of derivative works.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CM-10","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CM-11@e8634afde5343f2c","id":"MD-CTRL-NIST-800-53-CM-11","version":"e8634afde5343f2c","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CM-11 — User-Installed Software","statement":"**CM-11 — User-Installed Software**\nControls unauthorized software. For AI systems: prevent data scientists and engineers from installing unapproved AI frameworks, libraries, or models on production systems.\n\n**GOVERN Assess Evaluation:** CM family evaluated via model registry review, change control log analysis, and AI component inventory verification.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CM-11","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CM-2@6ca208a8af9d92e7","id":"MD-CTRL-NIST-800-53-CM-2","version":"6ca208a8af9d92e7","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CM-2 — Baseline Configuration","statement":"**CM-2 — Baseline Configuration**\nRequires maintained baseline configurations. For AI systems: the baseline includes the model version (artifact hash), inference server configuration, input/output schema, performance benchmarks, and approved dependency versions. Any deviation from baseline requires change control.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CM-2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CM-3@e91dda2288deb770","id":"MD-CTRL-NIST-800-53-CM-3","version":"e91dda2288deb770","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CM-3 — Configuration Change Control","statement":"**CM-3 — Configuration Change Control**\nRequires change control process. For AI systems: any change to a deployed model (fine-tuning, RAG corpus update, prompt template change, system prompt modification, threshold change) requires a change control ticket, impact assessment, and authorization.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CM-3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CM-4@d0963b8777d1594a","id":"MD-CTRL-NIST-800-53-CM-4","version":"d0963b8777d1594a","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CM-4 — Impact Analyses","statement":"**CM-4 — Impact Analyses**\nRequires analysis before changes are implemented. For AI systems: AI model update impact analysis must include bias re-assessment, performance regression testing, safety testing, and review of changes to output distribution.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CM-4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CM-6@63db226c32ee8b80","id":"MD-CTRL-NIST-800-53-CM-6","version":"63db226c32ee8b80","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CM-6 — Configuration Settings","statement":"**CM-6 — Configuration Settings**\nRequires configuration of security settings. For AI systems: define and enforce configuration standards for AI serving infrastructure — disable debug endpoints, enforce output filtering, set rate limits, configure authentication on inference APIs.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CM-6","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CM-7@a69c75d907ebf563","id":"MD-CTRL-NIST-800-53-CM-7","version":"a69c75d907ebf563","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CM-7 — Least Functionality","statement":"**CM-7 — Least Functionality**\nRequires minimum functionality. For AI systems: disable unused inference capabilities, model endpoints not in active use, and administrative interfaces. Apply principle of least functionality to AI system capabilities.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CM-7","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-CM-8@1d08274a0812ff53","id":"MD-CTRL-NIST-800-53-CM-8","version":"1d08274a0812ff53","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"CM-8 — System Component Inventory","statement":"**CM-8 — System Component Inventory**\nRequires inventory of system components. For AI systems: maintain an inventory that includes all AI models (with artifact hashes), model versions, training dataset versions, framework dependencies, and third-party AI components (APIs, SDKs, pre-trained models).","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"CM-8","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IA-1@44eec4dafeb6ab22","id":"MD-CTRL-NIST-800-53-IA-1","version":"44eec4dafeb6ab22","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IA-1 — Identification and Authentication Policy and Procedures","statement":"**IA-1 — Identification and Authentication Policy and Procedures**\nRequires documented IA policy. For AI systems: policy must address authentication for human users of AI systems, authentication of AI service accounts, and authentication of AI API clients.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IA-1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IA-10@844b4ea2fbfe06a2","id":"MD-CTRL-NIST-800-53-IA-10","version":"844b4ea2fbfe06a2","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IA-10 — Adaptive Authentication","statement":"**IA-10 — Adaptive Authentication**\nAllows risk-based authentication. For AI systems: consider step-up authentication for high-stakes AI API calls (e.g., AI-assisted financial transactions, medical AI recommendations, identity verification).\n\n**GOVERN Assess Evaluation:** IA family evaluated via authentication mechanism review, credential management policy assessment, and service account inventory.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IA-10","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IA-2@4dbd18c7d07a8c02","id":"MD-CTRL-NIST-800-53-IA-2","version":"4dbd18c7d07a8c02","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IA-2 — Identification and Authentication (Organizational Users)","statement":"**IA-2 — Identification and Authentication (Organizational Users)**\nRequires multi-factor authentication for users. For AI systems: MFA required for access to AI model registries, training platforms, MLOps dashboards, and inference API administrative interfaces.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IA-2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IA-3@e59257ab71b137d1","id":"MD-CTRL-NIST-800-53-IA-3","version":"e59257ab71b137d1","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IA-3 — Device Identification and Authentication","statement":"**IA-3 — Device Identification and Authentication**\nRequires device-level authentication. For AI systems: inference server instances, training workers, and pipeline automation agents must authenticate to the AI system infrastructure before receiving credentials or accessing model artifacts.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IA-3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IA-4@5ccb98ae4773b0ae","id":"MD-CTRL-NIST-800-53-IA-4","version":"5ccb98ae4773b0ae","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IA-4 — Identifier Management","statement":"**IA-4 — Identifier Management**\nManages identifiers for users and devices. For AI systems: assign unique identifiers to each AI model version, each training run, and each inference service instance. Use identifiers for audit trail traceability.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IA-4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IA-5@6912705fe10577c0","id":"MD-CTRL-NIST-800-53-IA-5","version":"6912705fe10577c0","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IA-5 — Authenticator Management","statement":"**IA-5 — Authenticator Management**\nManages credentials. For AI systems: rotate API keys for AI inference endpoints regularly. Store AI system credentials in secrets management systems (not in code repositories or configuration files). Audit credential access.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IA-5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IA-8@1e9c45672f8be5e2","id":"MD-CTRL-NIST-800-53-IA-8","version":"1e9c45672f8be5e2","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IA-8 — Identification and Authentication (Non-Organizational Users)","statement":"**IA-8 — Identification and Authentication (Non-Organizational Users)**\nAddresses external user authentication. For AI systems: users outside the organization accessing AI APIs (customers, partners) must be authenticated. Define authentication requirements in AI API access policies.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IA-8","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IA-9@3b4a7410abb86aa0","id":"MD-CTRL-NIST-800-53-IA-9","version":"3b4a7410abb86aa0","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IA-9 — Service Identification and Authentication","statement":"**IA-9 — Service Identification and Authentication**\nRequires mutual authentication for services. For AI systems: AI microservices (inference, training, data pipelines) must mutually authenticate using service mesh identities or mTLS. Prevent rogue services from impersonating AI system components.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IA-9","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IR-1@dae3790d9c539d4f","id":"MD-CTRL-NIST-800-53-IR-1","version":"dae3790d9c539d4f","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IR-1 — Incident Response Policy and Procedures","statement":"**IR-1 — Incident Response Policy and Procedures**\nRequires documented IR policy. For AI systems: IR policy must explicitly address AI incident types and response procedures.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IR-1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IR-2@18e62078d0aaf86e","id":"MD-CTRL-NIST-800-53-IR-2","version":"18e62078d0aaf86e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IR-2 — Incident Response Training","statement":"**IR-2 — Incident Response Training**\nRequires training on incident response. For AI systems: training must cover AI-specific incident scenarios: how to recognize bias-related harms, how to respond to adversarial attacks, when to suspend an AI system, and how to notify affected users.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IR-2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IR-3@c3539103480ee029","id":"MD-CTRL-NIST-800-53-IR-3","version":"c3539103480ee029","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IR-3 — Incident Response Testing","statement":"**IR-3 — Incident Response Testing**\nRequires testing of incident response capability. For AI systems: tabletop exercises should include AI incident scenarios — bias discovery, model poisoning, hallucination causing harm, AI system outage during critical operations.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IR-3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IR-4@74f271e15a55d06f","id":"MD-CTRL-NIST-800-53-IR-4","version":"74f271e15a55d06f","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IR-4 — Incident Handling","statement":"**IR-4 — Incident Handling**\nRequires incident handling capability. For AI systems: incident handling procedures must include:\n- Detection criteria for AI incidents (performance degradation thresholds, bias metric breach, anomalous output volume, user harm reports)\n- Containment options (suspend specific model endpoints, roll back to prior model version, enable human override, reduce inference rate)\n- Eradication steps (identify root cause — training data issue, model issue, adversarial input, infrastructure issue)\n- Recovery steps (revalidate model before restoring service, notify affected users, document lessons learned)\n- Post-incident review requirements","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IR-4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IR-5@e55da11cb54be2d6","id":"MD-CTRL-NIST-800-53-IR-5","version":"e55da11cb54be2d6","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IR-5 — Incident Monitoring","statement":"**IR-5 — Incident Monitoring**\nRequires incident tracking. For AI systems: track AI incidents in the incident tracking system with AI-specific fields (model version, affected use case, number of users/decisions affected, harm category).","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IR-5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IR-6@9e4dcdda8ecccb40","id":"MD-CTRL-NIST-800-53-IR-6","version":"9e4dcdda8ecccb40","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IR-6 — Incident Reporting","statement":"**IR-6 — Incident Reporting**\nRequires incident reporting. For AI systems: define thresholds for external notification of AI incidents (e.g., EU AI Act Article 62 requires notification of serious incidents for high-risk AI systems within 15 days of becoming aware). Define internal reporting escalation paths.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IR-6","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IR-7@fa507783126d7133","id":"MD-CTRL-NIST-800-53-IR-7","version":"fa507783126d7133","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IR-7 — Incident Response Assistance","statement":"**IR-7 — Incident Response Assistance**\nRequires access to incident response assistance. For AI systems: identify subject matter experts for AI incident types (ML engineers for model issues, data scientists for bias, security team for adversarial attacks, legal for regulatory notification).","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IR-7","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-IR-8@51f32f068339c089","id":"MD-CTRL-NIST-800-53-IR-8","version":"51f32f068339c089","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"IR-8 — Incident Response Plan","statement":"**IR-8 — Incident Response Plan**\nRequires a documented incident response plan. For AI systems: the IR plan must include an AI incident annex covering AI-specific scenarios, containment options, rollback procedures, and notification requirements.\n\n**GOVERN Assess Evaluation:** IR family evaluated via IR plan review, AI incident scenario coverage, and incident response test records.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"IR-8","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-PM-1@69750f5f0416c2fa","id":"MD-CTRL-NIST-800-53-PM-1","version":"69750f5f0416c2fa","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"PM-1 — Information Security Program Plan","statement":"**PM-1 — Information Security Program Plan**\nRequires a documented security program plan. For AI systems: the program plan must address AI risk management as a component of the overall security program. Reference the organizational AI governance policy.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"PM-1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-PM-10@021385ebe95aa945","id":"MD-CTRL-NIST-800-53-PM-10","version":"021385ebe95aa945","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"PM-10 — Authorization Process","statement":"**PM-10 — Authorization Process**\nRequires a process for authorizing systems. For AI systems: the authorization process must include AI-specific assessment requirements — AI RMF documentation, bias assessment, TEVV documentation, monitoring plan — as prerequisites for ATO.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"PM-10","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-PM-11@6404267950f4384c","id":"MD-CTRL-NIST-800-53-PM-11","version":"6404267950f4384c","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"PM-11 — Mission and Business Process Definition","statement":"**PM-11 — Mission and Business Process Definition**\nRequires documentation of organizational missions. For AI systems: document how AI systems support organizational missions and business processes. Use this to determine AI system criticality and applicable security controls.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"PM-11","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-PM-2@795047a8cbe9fbb5","id":"MD-CTRL-NIST-800-53-PM-2","version":"795047a8cbe9fbb5","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"PM-2 — Information Security Program Leadership Roles","statement":"**PM-2 — Information Security Program Leadership Roles**\nRequires leadership accountability. For AI systems: designate an AI governance lead (Chief AI Officer, AI Risk Officer, or equivalent) with clear authority and accountability for organizational AI risk management.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"PM-2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-PM-28@1535dca973c04265","id":"MD-CTRL-NIST-800-53-PM-28","version":"1535dca973c04265","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"PM-28 — Risk Framing","statement":"**PM-28 — Risk Framing**\nRequires identification of key risk assumptions. For AI systems: document assumptions about AI system risk (e.g., assumed attack surface, assumed user population, assumed operating environment). Revisit assumptions when context changes.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"PM-28","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-PM-30@bd194fc8faba5a62","id":"MD-CTRL-NIST-800-53-PM-30","version":"bd194fc8faba5a62","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"PM-30 — Supply Chain Risk Management Strategy","statement":"**PM-30 — Supply Chain Risk Management Strategy**\nRequires supply chain risk strategy. For AI systems: AI supply chain risks (third-party models, training datasets, AI frameworks, cloud AI services) must be addressed in the supply chain risk strategy.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"PM-30","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-PM-31@8ec47a6977771a5d","id":"MD-CTRL-NIST-800-53-PM-31","version":"8ec47a6977771a5d","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"PM-31 — Continuous Improvement","statement":"**PM-31 — Continuous Improvement**\nRequires continuous improvement processes. For AI systems: establish feedback loops from AI monitoring, incident response, and user feedback into AI system improvement. Track improvement outcomes.\n\n**GOVERN Assess Evaluation:** PM family evaluated via program documentation review, leadership accountability assessment, and risk management strategy review.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"PM-31","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-PM-9@7503567857e7df87","id":"MD-CTRL-NIST-800-53-PM-9","version":"7503567857e7df87","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"PM-9 — Risk Management Strategy","statement":"**PM-9 — Risk Management Strategy**\nRequires a documented risk management strategy. For AI systems: the risk management strategy must include AI risks as a recognized risk category with defined risk tolerance, treatment approaches, and escalation criteria.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"PM-9","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-RA-1@d702535aea729240","id":"MD-CTRL-NIST-800-53-RA-1","version":"d702535aea729240","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"RA-1 — Risk Assessment Policy and Procedures","statement":"**RA-1 — Risk Assessment Policy and Procedures**\nRequires documented risk assessment policy. For AI systems: policy must include AI-specific risk assessment methodology, frequency of AI risk assessments, and required inputs (model documentation, TEVV results, bias assessments).","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"RA-1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-RA-10@eba55ec082405cec","id":"MD-CTRL-NIST-800-53-RA-10","version":"eba55ec082405cec","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"RA-10 — Threat Hunting","statement":"**RA-10 — Threat Hunting**\nRequires proactive threat hunting. For AI systems: include AI-specific threat hunting — monitoring for signs of data poisoning, model theft attempts, adversarial probe patterns, and unauthorized model access.\n\n**GOVERN Assess Evaluation:** RA family evaluated via risk assessment documentation, AI threat model review, and vulnerability assessment scope verification.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"RA-10","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-RA-2@142900acfb09c925","id":"MD-CTRL-NIST-800-53-RA-2","version":"142900acfb09c925","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"RA-2 — Security Categorization","statement":"**RA-2 — Security Categorization**\nRequires categorization of information systems by impact. For AI systems: categorize the AI system using FIPS 199 criteria (low/moderate/high for confidentiality, integrity, availability). Consider AI-specific impacts: a bias-laden AI system may have high integrity impact even if confidentiality and availability are low.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"RA-2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-RA-3@d00b852124c3dec7","id":"MD-CTRL-NIST-800-53-RA-3","version":"d00b852124c3dec7","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"RA-3 — Risk Assessment","statement":"**RA-3 — Risk Assessment**\nRequires formal risk assessment. For AI systems: risk assessment must include:\n- AI-specific threats (adversarial attacks, data poisoning, model theft, prompt injection)\n- AI-specific vulnerabilities (training data quality, model robustness, explainability gaps)\n- AI-specific impacts (discriminatory outcomes, decision errors at scale, privacy violations through model inversion)\n- AI-specific likelihood factors (system accessibility, attacker sophistication, data sensitivity)","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"RA-3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-RA-5@57426b8d738375a3","id":"MD-CTRL-NIST-800-53-RA-5","version":"57426b8d738375a3","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"RA-5 — Vulnerability Monitoring and Scanning","statement":"**RA-5 — Vulnerability Monitoring and Scanning**\nRequires vulnerability scanning. For AI systems: in addition to traditional vulnerability scanning, conduct AI-specific vulnerability assessments including adversarial robustness testing, bias audits, and model security evaluations.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"RA-5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-RA-7@ee7ce7823a829c1c","id":"MD-CTRL-NIST-800-53-RA-7","version":"ee7ce7823a829c1c","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"RA-7 — Risk Response","statement":"**RA-7 — Risk Response**\nRequires documented risk responses. For AI systems: document risk responses for AI-specific risks — model retraining to address bias, adversarial training to address robustness gaps, access control hardening for model theft risks, output filtering for harmful content risks.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"RA-7","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-RA-9@70a28b2a6c497cc9","id":"MD-CTRL-NIST-800-53-RA-9","version":"70a28b2a6c497cc9","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"RA-9 — Criticality Analysis","statement":"**RA-9 — Criticality Analysis**\nRequires analysis of AI component criticality. For AI systems: identify which AI components are most critical to organizational mission. Apply enhanced controls to critical AI components.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"RA-9","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SA-1@309b07e6cc036608","id":"MD-CTRL-NIST-800-53-SA-1","version":"309b07e6cc036608","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SA-1 — System and Services Acquisition Policy and Procedures","statement":"**SA-1 — System and Services Acquisition Policy and Procedures**\nRequires documented acquisition policy. For AI systems: acquisition policy must address AI-specific procurement requirements — vendor AI governance practices, model transparency documentation, bias testing evidence, security assessment requirements.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SA-1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SA-10@a4d719708b6892dc","id":"MD-CTRL-NIST-800-53-SA-10","version":"a4d719708b6892dc","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SA-10 — Developer Configuration Management","statement":"**SA-10 — Developer Configuration Management**\nRequires developer CM practices. For AI systems: require from AI developers: model version control, reproducibility of training runs, documentation of training data provenance, and change tracking for model updates.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SA-10","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SA-11@12de82f7c2a7535a","id":"MD-CTRL-NIST-800-53-SA-11","version":"12de82f7c2a7535a","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SA-11 — Developer Testing and Evaluation","statement":"**SA-11 — Developer Testing and Evaluation**\nRequires developer security testing. For AI systems: require from AI developers: evidence of security testing (adversarial robustness, model inversion resistance), bias testing across protected categories, and TEVV documentation.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SA-11","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SA-15@cefad96f4aebe687","id":"MD-CTRL-NIST-800-53-SA-15","version":"cefad96f4aebe687","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SA-15 — Development Process, Standards, and Tools","statement":"**SA-15 — Development Process, Standards, and Tools**\nRequires secure development practices. For AI systems: require AI development teams to use approved, version-controlled ML frameworks. Scan AI dependencies for vulnerabilities. Use secure ML development environments.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SA-15","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SA-16@db44a794b2764652","id":"MD-CTRL-NIST-800-53-SA-16","version":"db44a794b2764652","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SA-16 — Developer-Provided Training","statement":"**SA-16 — Developer-Provided Training**\nRequires developer training provision. For AI systems: require AI vendors to provide training on AI system limitations, appropriate use cases, and risk indicators operators should monitor.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SA-16","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SA-17@2d9b2c327e2565c2","id":"MD-CTRL-NIST-800-53-SA-17","version":"2d9b2c327e2565c2","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SA-17 — Developer Security and Privacy Architecture","statement":"**SA-17 — Developer Security and Privacy Architecture**\nRequires architectural documentation from developers. For AI systems: require architectural documentation showing how AI system components are secured, how data flows are protected, and how privacy is maintained.\n\n**GOVERN Assess Evaluation:** SA family evaluated via procurement policy review, vendor contract analysis, and third-party AI service inventory assessment.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SA-17","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SA-3@b815d0da54550870","id":"MD-CTRL-NIST-800-53-SA-3","version":"b815d0da54550870","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SA-3 — System Development Life Cycle","statement":"**SA-3 — System Development Life Cycle**\nRequires SDLC security integration. For AI systems: the AI development lifecycle (data collection, model training, validation, deployment, monitoring) must integrate security and privacy at each stage. Align with ML-specific SDLC frameworks (MLOps, ModelOps).","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SA-3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SA-4@2089f0161299c68f","id":"MD-CTRL-NIST-800-53-SA-4","version":"2089f0161299c68f","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SA-4 — Acquisition Process","statement":"**SA-4 — Acquisition Process**\nRequires security requirements in acquisitions. For AI systems: include AI-specific security and governance requirements in all AI procurement contracts:\n- Model transparency and documentation requirements\n- Bias testing evidence requirements\n- Security assessment results\n- Data handling and privacy requirements\n- Incident response obligations\n- Access to model cards and technical documentation\n- Audit rights","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SA-4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SA-5@e77f15a31d58575e","id":"MD-CTRL-NIST-800-53-SA-5","version":"e77f15a31d58575e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SA-5 — System Documentation","statement":"**SA-5 — System Documentation**\nRequires system documentation from vendors. For AI systems: require from AI vendors: model cards, data sheets, technical documentation of model architecture and training, known limitations, performance benchmarks, bias evaluation results.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SA-5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SA-8@2b86c88f0eecd714","id":"MD-CTRL-NIST-800-53-SA-8","version":"2b86c88f0eecd714","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SA-8 — Security and Privacy Engineering Principles","statement":"**SA-8 — Security and Privacy Engineering Principles**\nRequires security and privacy engineering. For AI systems: apply privacy-by-design to AI systems. Consider privacy-preserving ML techniques (differential privacy, federated learning) where applicable. Document privacy engineering decisions.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SA-8","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SA-9@3c5e2b7020feae29","id":"MD-CTRL-NIST-800-53-SA-9","version":"3c5e2b7020feae29","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SA-9 — External System Services","statement":"**SA-9 — External System Services**\nControls external service dependencies. For AI systems: document all third-party AI services used (LLM APIs, computer vision APIs, speech recognition services). Assess risk of each dependency. Ensure continuity if third-party service is discontinued.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SA-9","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SC-1@b4d57711604fb27e","id":"MD-CTRL-NIST-800-53-SC-1","version":"b4d57711604fb27e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SC-1 — System and Communications Protection Policy and Procedures","statement":"**SC-1 — System and Communications Protection Policy and Procedures**\nRequires documented communications protection policy. For AI systems: policy must address encryption of AI training data, model artifacts, and inference API communications.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SC-1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SC-12@8dfd4e26096126e7","id":"MD-CTRL-NIST-800-53-SC-12","version":"8dfd4e26096126e7","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SC-12 — Cryptographic Key Establishment and Management","statement":"**SC-12 — Cryptographic Key Establishment and Management**\nRequires cryptographic key management. For AI systems: manage cryptographic keys used to sign model artifacts, encrypt training data, and authenticate AI service accounts. Use hardware security modules (HSMs) for high-value key material.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SC-12","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SC-13@c27d59cc80254553","id":"MD-CTRL-NIST-800-53-SC-13","version":"c27d59cc80254553","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SC-13 — Cryptographic Protection","statement":"**SC-13 — Cryptographic Protection**\nRequires approved cryptographic mechanisms. For AI systems: use NIST-approved algorithms for all AI system encryption. Consider post-quantum cryptography for long-lived model artifacts.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SC-13","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SC-28@26a647ade2207565","id":"MD-CTRL-NIST-800-53-SC-28","version":"26a647ade2207565","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SC-28 — Protection of Information at Rest","statement":"**SC-28 — Protection of Information at Rest**\nRequires encryption of stored information. For AI systems: encrypt AI training datasets, model artifacts (weights, embeddings), and AI decision logs at rest. Define encryption key management for model storage.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SC-28","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SC-39@7c12ddd5379d47ac","id":"MD-CTRL-NIST-800-53-SC-39","version":"7c12ddd5379d47ac","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SC-39 — Process Isolation","statement":"**SC-39 — Process Isolation**\nRequires process isolation. For AI systems: isolate AI inference processes from other system processes. Prevent inference workloads from accessing training data repositories, administrative interfaces, or other sensitive resources.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SC-39","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SC-45@fe95bc3ea1490562","id":"MD-CTRL-NIST-800-53-SC-45","version":"fe95bc3ea1490562","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SC-45 — System Time Synchronization","statement":"**SC-45 — System Time Synchronization**\nRequires time synchronization. For AI systems: accurate timestamps are critical for AI audit logs, incident correlation, and regulatory compliance. Ensure AI system infrastructure uses synchronized time sources.\n\n**GOVERN Assess Evaluation:** SC family evaluated via network architecture review, encryption configuration assessment, and data protection control verification.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SC-45","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SC-5@ce265468b83475c0","id":"MD-CTRL-NIST-800-53-SC-5","version":"ce265468b83475c0","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SC-5 — Denial-of-Service Protection","statement":"**SC-5 — Denial-of-Service Protection**\nRequires DoS protection. For AI systems: AI inference APIs are targets for abuse (computational DoS via complex queries, resource exhaustion via high-frequency requests). Implement rate limiting, query complexity limits, and abuse detection for AI inference endpoints.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SC-5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SC-7@d10fc1ec31afd8d6","id":"MD-CTRL-NIST-800-53-SC-7","version":"d10fc1ec31afd8d6","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SC-7 — Boundary Protection","statement":"**SC-7 — Boundary Protection**\nRequires network boundary controls. For AI systems: AI inference services, model registries, and training infrastructure should be network-isolated. Control ingress and egress. Use API gateways for inference endpoint exposure.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SC-7","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SC-8@7b948b208b7abf07","id":"MD-CTRL-NIST-800-53-SC-8","version":"7b948b208b7abf07","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SC-8 — Transmission Confidentiality and Integrity","statement":"**SC-8 — Transmission Confidentiality and Integrity**\nRequires protection of transmitted information. For AI systems: encrypt all inference API communications (TLS 1.3 minimum). Protect training data pipelines with encryption in transit. Sign model artifact transfers to verify integrity.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SC-8","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SI-1@4ac016ff436432f1","id":"MD-CTRL-NIST-800-53-SI-1","version":"4ac016ff436432f1","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SI-1 — System and Information Integrity Policy and Procedures","statement":"**SI-1 — System and Information Integrity Policy and Procedures**\nRequires documented integrity policy. For AI systems: integrity policy must address model artifact integrity verification, training data integrity controls, and output integrity monitoring.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SI-1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SI-10@bc113287605ea9a9","id":"MD-CTRL-NIST-800-53-SI-10","version":"bc113287605ea9a9","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SI-10 — Information Input Validation","statement":"**SI-10 — Information Input Validation**\nRequires validation of information inputs. For AI systems: validate inputs to AI inference APIs — length limits, content type validation, schema validation, and detection of adversarial inputs. Reject malformed or potentially adversarial inputs before they reach the model.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SI-10","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SI-12@795eeae5d78bd687","id":"MD-CTRL-NIST-800-53-SI-12","version":"795eeae5d78bd687","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SI-12 — Information Management and Retention","statement":"**SI-12 — Information Management and Retention**\nRequires information management policies. For AI systems: define retention policies for AI training data, model artifacts, inference logs, and bias assessment records. Comply with applicable legal and regulatory retention requirements.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SI-12","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SI-14@3c584cf219106ab8","id":"MD-CTRL-NIST-800-53-SI-14","version":"3c584cf219106ab8","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SI-14 — Non-Persistence","statement":"**SI-14 — Non-Persistence**\nRequires non-persistence of certain data. For AI systems: AI systems that process PII or sensitive data should not persist sensitive inputs beyond what is required for the inference operation. Define data minimization policies for AI inference.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SI-14","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SI-19@95632491c2dd0957","id":"MD-CTRL-NIST-800-53-SI-19","version":"95632491c2dd0957","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SI-19 — De-Identification","statement":"**SI-19 — De-Identification**\nRequires de-identification of PII. For AI systems: de-identify training data containing PII before use in model training. Apply differential privacy techniques where de-identification is insufficient. Verify de-identification effectiveness.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SI-19","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SI-2@8334352df167f779","id":"MD-CTRL-NIST-800-53-SI-2","version":"8334352df167f779","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SI-2 — Flaw Remediation","statement":"**SI-2 — Flaw Remediation**\nRequires patching and remediation of flaws. For AI systems: flaws include both traditional software vulnerabilities in AI infrastructure and AI-specific issues (discovered bias, adversarial vulnerabilities, performance degradation). Define remediation processes for AI-specific flaws.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SI-2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SI-20@c8ecbf25dfb02463","id":"MD-CTRL-NIST-800-53-SI-20","version":"c8ecbf25dfb02463","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SI-20 — Tainting","statement":"**SI-20 — Tainting**\nControls information tainting. For AI systems: track provenance of data that flows into AI training pipelines. Detect when tainted (compromised or low-quality) data contaminates training datasets.\n\n**GOVERN Assess Evaluation:** SI family evaluated via model integrity verification review, input validation assessment, monitoring coverage analysis, and output integrity control review.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SI-20","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SI-3@36a9351db2e579f5","id":"MD-CTRL-NIST-800-53-SI-3","version":"36a9351db2e579f5","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SI-3 — Malicious Code Protection","statement":"**SI-3 — Malicious Code Protection**\nRequires malware protection. For AI systems: AI development environments are targets for malware that steals model artifacts or poisons training data. Apply malware protection to AI development and serving infrastructure.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SI-3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SI-4@ef1e6b7493043f32","id":"MD-CTRL-NIST-800-53-SI-4","version":"ef1e6b7493043f32","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SI-4 — System Monitoring","statement":"**SI-4 — System Monitoring**\nRequires system monitoring. For AI systems: monitoring must include AI-specific indicators of compromise: anomalous inference patterns, model performance drift, unusual output distributions, signs of adversarial probing, data exfiltration through model inference (model inversion).","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SI-4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SI-5@c971f424e49dc627","id":"MD-CTRL-NIST-800-53-SI-5","version":"c971f424e49dc627","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SI-5 — Security Alerts, Advisories, and Directives","statement":"**SI-5 — Security Alerts, Advisories, and Directives**\nRequires response to security alerts. For AI systems: subscribe to AI security vulnerability feeds. Track CVEs affecting AI frameworks (TensorFlow, PyTorch, Hugging Face). Respond to AI-specific security advisories.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SI-5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SI-7@0e6f9a93a3f85800","id":"MD-CTRL-NIST-800-53-SI-7","version":"0e6f9a93a3f85800","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SI-7 — Software, Firmware, and Information Integrity","statement":"**SI-7 — Software, Firmware, and Information Integrity**\nRequires integrity verification of software and data. For AI systems:\n- Hash and sign model artifacts; verify integrity before deployment\n- Verify integrity of training datasets before training runs\n- Detect unauthorized modifications to AI system components\n- Use model provenance tracking to verify model origin","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SI-7","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-800-53-SI-8@bc876d5de3499002","id":"MD-CTRL-NIST-800-53-SI-8","version":"bc876d5de3499002","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"SI-8 — Spam and Phishing Protection","statement":"**SI-8 — Spam and Phishing Protection**\nRequires anti-spam protection. For AI systems: AI systems that process email, documents, or user-submitted content must include input validation to prevent prompt injection via malicious content in processed data.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"SI-8","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-1@0de2bf71e02dd5cd","id":"MD-CTRL-NIST-AI-RMF-GV-1","version":"0de2bf71e02dd5cd","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-1: Policies, Processes, Procedures, and Practices","statement":"**GV-1: Policies, Processes, Procedures, and Practices**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-1.1@bdbcfd71ba42be06","id":"MD-CTRL-NIST-AI-RMF-GV-1.1","version":"bdbcfd71ba42be06","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-1.1 — Organizational policies and practices are in place to plan, prioritize, govern, and monitor AI risk management activities.","statement":"GV-1.1 — Organizational policies and practices are in place to plan, prioritize, govern, and monitor AI risk management activities.\n*Playbook:* Document an AI governance policy. Assign an AI risk owner. Define scope of covered AI systems. Establish a review cadence. Communicate the policy organization-wide.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-1.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-1.2@ab473567d15e4af5","id":"MD-CTRL-NIST-AI-RMF-GV-1.2","version":"ab473567d15e4af5","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-1.2 — Organizational teams are committed to a culture that considers and communicates AI risks.","statement":"GV-1.2 — Organizational teams are committed to a culture that considers and communicates AI risks.\n*Playbook:* Executive messaging on responsible AI. Include AI risk in team onboarding. Hold periodic AI risk awareness sessions. Create channels for raising AI risk concerns.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-1.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-1.3@d22d1e83339c8c63","id":"MD-CTRL-NIST-AI-RMF-GV-1.3","version":"d22d1e83339c8c63","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-1.3 — Organizational leadership takes responsibility for decisions about risks associated with AI system development and deployment.","statement":"GV-1.3 — Organizational leadership takes responsibility for decisions about risks associated with AI system development and deployment.\n*Playbook:* Assign a named AI executive sponsor. Document leadership sign-off on high-risk AI decisions. Create escalation paths for unresolved AI risks.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-1.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-1.4@2020dd450f236171","id":"MD-CTRL-NIST-AI-RMF-GV-1.4","version":"2020dd450f236171","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-1.4 — Organizational teams are committed to transparent organizational practices and policies.","statement":"GV-1.4 — Organizational teams are committed to transparent organizational practices and policies.\n*Playbook:* Publish AI system disclosure policies. Define what AI use is disclosed to users. Maintain an internal inventory of AI systems.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-1.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-1.5@aaaf26ad3a8a4fd4","id":"MD-CTRL-NIST-AI-RMF-GV-1.5","version":"aaaf26ad3a8a4fd4","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-1.5 — Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review.","statement":"GV-1.5 — Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review.\n*Playbook:* Set a minimum annual review of AI governance practices. Define who owns each monitoring activity. Track metrics on governance effectiveness.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-1.5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-1.6@be0e2e03a9219756","id":"MD-CTRL-NIST-AI-RMF-GV-1.6","version":"be0e2e03a9219756","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-1.6 — Policies and procedures are in place for the organizational risk governance and oversight of AI systems developed, used, or acquired from third parties, and for risk management of AI-specific supply chain issues including third-party data and AI components.","statement":"GV-1.6 — Policies and procedures are in place for the organizational risk governance and oversight of AI systems developed, used, or acquired from third parties, and for risk management of AI-specific supply chain issues including third-party data and AI components.\n*Playbook:* Require AI risk documentation from AI vendors. Assess third-party AI models against the same criteria as internal models. Track AI components in the software supply chain.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-1.6","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-2@69f0fa0562a7bb7b","id":"MD-CTRL-NIST-AI-RMF-GV-2","version":"69f0fa0562a7bb7b","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-2: Accountability Structures","statement":"**GV-2: Accountability Structures**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-2.1@6f97ef6893eb6791","id":"MD-CTRL-NIST-AI-RMF-GV-2.1","version":"6f97ef6893eb6791","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-2.1 — Roles and responsibilities and organizational accountabilities for personnel involved with the design, development, deployment, assessment and monitoring of AI systems are established.","statement":"GV-2.1 — Roles and responsibilities and organizational accountabilities for personnel involved with the design, development, deployment, assessment and monitoring of AI systems are established.\n*Playbook:* Publish a RACI matrix for AI lifecycle roles. Define AI-specific responsibilities for existing roles (data scientists, engineers, product managers, legal, compliance, audit).","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-2.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-2.2@14c9e3dd1e7ae2d2","id":"MD-CTRL-NIST-AI-RMF-GV-2.2","version":"14c9e3dd1e7ae2d2","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-2.2 — The risk or legal review function is documented and accountable to senior leadership.","statement":"GV-2.2 — The risk or legal review function is documented and accountable to senior leadership.\n*Playbook:* Establish AI legal/risk review function with direct reporting to senior leadership. Document review authority and scope.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-2.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-2.3@61c182f47632821e","id":"MD-CTRL-NIST-AI-RMF-GV-2.3","version":"61c182f47632821e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-2.3 — Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.","statement":"GV-2.3 — Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.\n*Playbook:* Document board-level or C-suite AI risk acknowledgments. Create board AI risk reporting cadence. Obtain leadership attestation for high-risk AI deployments.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-2.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-3@1558fb47f7cf9932","id":"MD-CTRL-NIST-AI-RMF-GV-3","version":"1558fb47f7cf9932","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-3: Workforce Diversity, Equity, Inclusion, and Accessibility","statement":"**GV-3: Workforce Diversity, Equity, Inclusion, and Accessibility**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-3.1@91b2ef14962b8d77","id":"MD-CTRL-NIST-AI-RMF-GV-3.1","version":"91b2ef14962b8d77","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-3.1 — Organizational policies and practices are in place to foster a critical thinking culture.","statement":"GV-3.1 — Organizational policies and practices are in place to foster a critical thinking culture.\n*Playbook:* Create a structured process for raising AI concerns. Ensure no retaliation for raising AI risks. Establish red-team or devil's advocate processes for high-risk AI decisions.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-3.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-3.2@3a67f386bc577301","id":"MD-CTRL-NIST-AI-RMF-GV-3.2","version":"3a67f386bc577301","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-3.2 — Policies, practices, and mechanisms are in place for the training and certification of AI personnel.","statement":"GV-3.2 — Policies, practices, and mechanisms are in place for the training and certification of AI personnel.\n*Playbook:* Define AI literacy requirements by role. Provide AI ethics training. Track completion. Consider external certifications for key AI risk roles.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-3.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-3.3@38c99ab4d4ea7203","id":"MD-CTRL-NIST-AI-RMF-GV-3.3","version":"38c99ab4d4ea7203","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-3.3 — Fairness and bias — human factors and diversity considerations exist in organizational policies and practices across the AI lifecycle.","statement":"GV-3.3 — Fairness and bias — human factors and diversity considerations exist in organizational policies and practices across the AI lifecycle.\n*Playbook:* Assess AI team demographic diversity. Document processes for incorporating diverse perspectives in AI system design reviews. Engage external reviewers from affected communities for high-impact systems.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-3.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-4@3556d8bf940083af","id":"MD-CTRL-NIST-AI-RMF-GV-4","version":"3556d8bf940083af","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-4: Organizational Teams Are Committed","statement":"**GV-4: Organizational Teams Are Committed**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-4.1@a974cd747263f200","id":"MD-CTRL-NIST-AI-RMF-GV-4.1","version":"a974cd747263f200","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-4.1 — Organizational policies and practices are in place to foster AI risk awareness and to create a culture of trustworthy, responsible AI.","statement":"GV-4.1 — Organizational policies and practices are in place to foster AI risk awareness and to create a culture of trustworthy, responsible AI.\n*Playbook:* Publish organizational AI ethics principles. Incorporate AI responsibility into performance expectations. Make AI risk training mandatory for AI-involved roles.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-4.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-4.2@a622ff3f078e93cf","id":"MD-CTRL-NIST-AI-RMF-GV-4.2","version":"a622ff3f078e93cf","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-4.2 — Organizational teams document the risks and potential impacts of AI technologies applied to their functions and using their data.","statement":"GV-4.2 — Organizational teams document the risks and potential impacts of AI technologies applied to their functions and using their data.\n*Playbook:* Require each business unit using AI to maintain an AI risk register. Include AI risk documentation in project intake processes.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-4.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-5@93dc995b8ff9abde","id":"MD-CTRL-NIST-AI-RMF-GV-5","version":"93dc995b8ff9abde","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-5: Organizational Risk Strategy","statement":"**GV-5: Organizational Risk Strategy**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-5.1@84d34fd03f15c80e","id":"MD-CTRL-NIST-AI-RMF-GV-5.1","version":"84d34fd03f15c80e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-5.1 — Organizational risk policies include and are inclusive of AI risks.","statement":"GV-5.1 — Organizational risk policies include and are inclusive of AI risks.\n*Playbook:* Update enterprise risk management policies to explicitly include AI risks. Map AI risks to existing risk categories (operational, reputational, legal, financial).","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-5.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-5.2@965d4067681d82b9","id":"MD-CTRL-NIST-AI-RMF-GV-5.2","version":"965d4067681d82b9","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-5.2 — Risk tolerance for the development and deployment of AI systems — including organizational risk tolerance for known trustworthiness limitations of AI systems — is established, communicated, and regularly reviewed.","statement":"GV-5.2 — Risk tolerance for the development and deployment of AI systems — including organizational risk tolerance for known trustworthiness limitations of AI systems — is established, communicated, and regularly reviewed.\n*Playbook:* Define risk tolerance thresholds for each AI risk category. Document acceptable levels of AI system error rates, bias thresholds, and explainability requirements. Review tolerance annually or upon significant AI deployment changes.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-5.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-6@a4ba43eaa1337653","id":"MD-CTRL-NIST-AI-RMF-GV-6","version":"a4ba43eaa1337653","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-6: Policies and Procedures","statement":"**GV-6: Policies and Procedures**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-6","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-6.1@7209d881fb2885bc","id":"MD-CTRL-NIST-AI-RMF-GV-6.1","version":"7209d881fb2885bc","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-6.1 — Policies and procedures are in place for the identification and documentation of legal requirements related to AI use, including international requirements for AI systems used in multiple jurisdictions.","statement":"GV-6.1 — Policies and procedures are in place for the identification and documentation of legal requirements related to AI use, including international requirements for AI systems used in multiple jurisdictions.\n*Playbook:* Conduct legal inventory of applicable AI regulations per jurisdiction. Map AI systems to applicable requirements (EU AI Act, CCPA, HIPAA, sector-specific rules). Update as regulations change.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-6.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-GV-6.2@4c79e228b7ca2411","id":"MD-CTRL-NIST-AI-RMF-GV-6.2","version":"4c79e228b7ca2411","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-6.2 — Organizational risk policies are inclusive of regulatory compliance and legal requirements.","statement":"GV-6.2 — Organizational risk policies are inclusive of regulatory compliance and legal requirements.\n*Playbook:* Incorporate regulatory requirements into AI risk management policies. Assign compliance owners for each applicable regulation. Track compliance posture in governance reporting.\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-6.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-1@3d2e30ac47caad63","id":"MD-CTRL-NIST-AI-RMF-MG-1","version":"3d2e30ac47caad63","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-1: Risk Response Plans","statement":"**MG-1: Risk Response Plans**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-1.1@c8fc8c5d1f8338ae","id":"MD-CTRL-NIST-AI-RMF-MG-1.1","version":"c8fc8c5d1f8338ae","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-1.1 — A set of risk treatment options (responses) are documented for AI risks including the avoidance, acceptance, transfer, and control of risks.","statement":"MG-1.1 — A set of risk treatment options (responses) are documented for AI risks including the avoidance, acceptance, transfer, and control of risks.\n*Playbook:* Define available risk treatment options. Document criteria for selecting each treatment type. Document selected treatment with rationale for each identified risk.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-1.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-1.2@4767f43db3a271de","id":"MD-CTRL-NIST-AI-RMF-MG-1.2","version":"4767f43db3a271de","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-1.2 — Treatment of AI risks includes a determination of residual risks after the risk response plan has been implemented.","statement":"MG-1.2 — Treatment of AI risks includes a determination of residual risks after the risk response plan has been implemented.\n*Playbook:* Assess residual risk after each treatment. Document residual risk level and acceptability. Obtain approval for deployment if residual risk is within tolerance.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-1.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-1.3@0d3757fb71970b26","id":"MD-CTRL-NIST-AI-RMF-MG-1.3","version":"0d3757fb71970b26","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-1.3 — Responses to the AI risks deemed high priority are developed, planned, and documented.","statement":"MG-1.3 — Responses to the AI risks deemed high priority are developed, planned, and documented.\n*Playbook:* Create expedited response planning process for high-priority risks. Define SLA for high-priority risk treatment. Track response implementation.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-1.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-2@1612f29b60ecb89e","id":"MD-CTRL-NIST-AI-RMF-MG-2","version":"1612f29b60ecb89e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-2: Risk Response Execution","statement":"**MG-2: Risk Response Execution**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-2.1@56900e8e5880f6ab","id":"MD-CTRL-NIST-AI-RMF-MG-2.1","version":"56900e8e5880f6ab","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-2.1 — Resources required to manage AI risks are taken into account including the staff, budget, and compute required for implementation.","statement":"MG-2.1 — Resources required to manage AI risks are taken into account including the staff, budget, and compute required for implementation.\n*Playbook:* Document resource requirements for AI risk management activities. Include AI risk management in organizational budgeting. Track resource utilization.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-2.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-2.2@05301d4e5281ab61","id":"MD-CTRL-NIST-AI-RMF-MG-2.2","version":"05301d4e5281ab61","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-2.2 — Mechanisms are in place and applied to sustain the value of deployed AI systems and to manage the risks of AI system decommissioning, including appropriate archiving of useful elements.","statement":"MG-2.2 — Mechanisms are in place and applied to sustain the value of deployed AI systems and to manage the risks of AI system decommissioning, including appropriate archiving of useful elements.\n*Playbook:* Document AI system lifecycle stages including decommissioning. Create decommissioning checklist. Archive model artifacts, documentation, and decision records before decommission.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-2.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-2.3@6d48f395ec619a37","id":"MD-CTRL-NIST-AI-RMF-MG-2.3","version":"6d48f395ec619a37","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-2.3 — Procedures are followed to respond to and recover from a previously unknown risk.","statement":"MG-2.3 — Procedures are followed to respond to and recover from a previously unknown risk.\n*Playbook:* Create AI incident response procedure. Include discovery, triage, containment, notification, and recovery steps. Test procedure periodically.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-2.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-2.4@b934cd7280da0290","id":"MD-CTRL-NIST-AI-RMF-MG-2.4","version":"b934cd7280da0290","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-2.4 — Mechanisms are in place to allow personnel to report problems to management.","statement":"MG-2.4 — Mechanisms are in place to allow personnel to report problems to management.\n*Playbook:* Establish internal reporting channels for AI risk findings. Protect reporters from retaliation. Define escalation process. Track report resolution.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-2.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-3@51ec0c06c6e0589e","id":"MD-CTRL-NIST-AI-RMF-MG-3","version":"51ec0c06c6e0589e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-3: Risk Treatment Feedback","statement":"**MG-3: Risk Treatment Feedback**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-3.1@c848d8590de967bc","id":"MD-CTRL-NIST-AI-RMF-MG-3.1","version":"c848d8590de967bc","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-3.1 — Risk treatment strategies and methods are documented, as are the reasons for the selection of risk treatment options.","statement":"MG-3.1 — Risk treatment strategies and methods are documented, as are the reasons for the selection of risk treatment options.\n*Playbook:* Document each treatment decision with rationale. Record alternatives considered. Maintain treatment rationale for audit purposes.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-3.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-3.2@c0f884a2359551c6","id":"MD-CTRL-NIST-AI-RMF-MG-3.2","version":"c0f884a2359551c6","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-3.2 — Treatment of AI risks includes a determination of residual risk after the risk response plan has been implemented.","statement":"MG-3.2 — Treatment of AI risks includes a determination of residual risk after the risk response plan has been implemented.\n*Playbook:* Conduct post-treatment residual risk assessment. Document residual risk level. Verify residual risk is within organizational tolerance.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-3.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-3.3@610a85d7bb36dc41","id":"MD-CTRL-NIST-AI-RMF-MG-3.3","version":"610a85d7bb36dc41","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-3.3 — Feedback processes are in place to inform updates to the risk mapping, risk analysis, risk treatment, and monitoring activities.","statement":"MG-3.3 — Feedback processes are in place to inform updates to the risk mapping, risk analysis, risk treatment, and monitoring activities.\n*Playbook:* Define feedback loop from MANAGE findings to MAP and MEASURE. Review effectiveness of risk treatments periodically. Update MAP risk inventory based on treatment outcomes.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-3.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-3.4@c198b1aab695886f","id":"MD-CTRL-NIST-AI-RMF-MG-3.4","version":"c198b1aab695886f","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-3.4 — Risk treatment plans for AI systems are maintained and updated regularly.","statement":"MG-3.4 — Risk treatment plans for AI systems are maintained and updated regularly.\n*Playbook:* Schedule regular treatment plan reviews. Update plans when AI system context changes. Document plan revision history.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-3.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-4@c5f5cc304b06fbc9","id":"MD-CTRL-NIST-AI-RMF-MG-4","version":"c5f5cc304b06fbc9","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-4: Risk Communication","statement":"**MG-4: Risk Communication**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-4.1@e3b40befb48fe092","id":"MD-CTRL-NIST-AI-RMF-MG-4.1","version":"e3b40befb48fe092","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-4.1 — Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors across the AI lifecycle.","statement":"MG-4.1 — Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors across the AI lifecycle.\n*Playbook:* Activate monitoring plan at deployment. Capture user feedback and operational data. Review monitoring data on defined cadence.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-4.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-4.2@7821ca590c95a3b6","id":"MD-CTRL-NIST-AI-RMF-MG-4.2","version":"7821ca590c95a3b6","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-4.2 — Measurable performance improvements or declines and other changes in deployed AI system trustworthiness are evaluated and documented.","statement":"MG-4.2 — Measurable performance improvements or declines and other changes in deployed AI system trustworthiness are evaluated and documented.\n*Playbook:* Track performance trends over time. Document significant changes in AI system behavior. Evaluate whether changes require risk re-assessment.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-4.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-4.3@4b10893d8fcf1c84","id":"MD-CTRL-NIST-AI-RMF-MG-4.3","version":"4b10893d8fcf1c84","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-4.3 — Feedback processes for improvement are followed for deployed AI systems.","statement":"MG-4.3 — Feedback processes for improvement are followed for deployed AI systems.\n*Playbook:* Use monitoring and feedback data to drive AI system improvements. Document improvement actions taken. Track improvement outcomes.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-4.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MG-4.4@ef983e76a584418a","id":"MD-CTRL-NIST-AI-RMF-MG-4.4","version":"ef983e76a584418a","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-4.4 — Organizational teams communicate with personnel to report problems and suggest opportunities for improvement across the AI lifecycle.","statement":"MG-4.4 — Organizational teams communicate with personnel to report problems and suggest opportunities for improvement across the AI lifecycle.\n*Playbook:* Create internal communication forums for AI risk findings. Include AI risk in team retrospectives and reviews. Reward problem identification and improvement suggestions.\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-4.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-1@46fa049af6fa11e7","id":"MD-CTRL-NIST-AI-RMF-MP-1","version":"46fa049af6fa11e7","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-1: Context Is Established","statement":"**MP-1: Context Is Established**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-1.1@948bbc263b6bf018","id":"MD-CTRL-NIST-AI-RMF-MP-1.1","version":"948bbc263b6bf018","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-1.1 — Intended purpose, potentially beneficial uses, context of use, and risks of AI systems are understood and documented.","statement":"MP-1.1 — Intended purpose, potentially beneficial uses, context of use, and risks of AI systems are understood and documented.\n*Playbook:* Create an AI system fact sheet for every AI deployment. Document intended use cases, foreseeable misuse, affected populations, and deployment environment.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-1.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-1.2@d6c1d3bfbec54b27","id":"MD-CTRL-NIST-AI-RMF-MP-1.2","version":"d6c1d3bfbec54b27","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-1.2 — Scientific findings, technical standards, and trustworthiness of AI systems are understood, documented, and communicated.","statement":"MP-1.2 — Scientific findings, technical standards, and trustworthiness of AI systems are understood, documented, and communicated.\n*Playbook:* Produce or obtain model cards for AI models in use. Document training data sources, architecture, known limitations, and applicable standards.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-1.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-1.3@4dc810d10cd18048","id":"MD-CTRL-NIST-AI-RMF-MP-1.3","version":"4dc810d10cd18048","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-1.3 — Potential benefits of intended AI system deployment — including financial, societal, and broadly beneficial uses — are examined and documented.","statement":"MP-1.3 — Potential benefits of intended AI system deployment — including financial, societal, and broadly beneficial uses — are examined and documented.\n*Playbook:* Document the anticipated benefits of the AI system. Include quantified estimates where possible. Consider benefits to all stakeholder groups.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-1.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-1.4@ace0923cc2ee941c","id":"MD-CTRL-NIST-AI-RMF-MP-1.4","version":"ace0923cc2ee941c","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-1.4 — Risks or harms of deployed AI systems — and their potential consequences to individuals, groups, communities, organizations, and society — are examined and documented.","statement":"MP-1.4 — Risks or harms of deployed AI systems — and their potential consequences to individuals, groups, communities, organizations, and society — are examined and documented.\n*Playbook:* Conduct AI impact assessment before deployment. Identify affected populations. Document high-risk harm scenarios. Engage affected communities for high-impact systems.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-1.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-1.5@a7ff6a88b989b09c","id":"MD-CTRL-NIST-AI-RMF-MP-1.5","version":"a7ff6a88b989b09c","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-1.5 — Likelihood and magnitude of each identified AI system risk or impact are estimated and documented.","statement":"MP-1.5 — Likelihood and magnitude of each identified AI system risk or impact are estimated and documented.\n*Playbook:* Score each identified risk on likelihood and magnitude. Use a consistent scoring methodology. Document rationale for scores.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-1.5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-1.6@4b5819ed7019fad3","id":"MD-CTRL-NIST-AI-RMF-MP-1.6","version":"4b5819ed7019fad3","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-1.6 — Risks or harms from third-party use of the organization's data or AI systems, including data provenance, data quality, and supply chain risks, are documented.","statement":"MP-1.6 — Risks or harms from third-party use of the organization's data or AI systems, including data provenance, data quality, and supply chain risks, are documented.\n*Playbook:* Assess data provenance and quality for all training and inference data. Document third-party data use agreements. Evaluate AI supply chain risks.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-1.6","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-2@7ed5f2910241eb56","id":"MD-CTRL-NIST-AI-RMF-MP-2","version":"7ed5f2910241eb56","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-2: Scientific Basis of AI Risk","statement":"**MP-2: Scientific Basis of AI Risk**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-2.1@d4b8bcdeb93c2a5a","id":"MD-CTRL-NIST-AI-RMF-MP-2.1","version":"d4b8bcdeb93c2a5a","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-2.1 — Scientific community norms for validating AI risks and potential impacts are followed.","statement":"MP-2.1 — Scientific community norms for validating AI risks and potential impacts are followed.\n*Playbook:* Reference peer-reviewed methods for AI evaluation. Use standardized benchmarks where available. Document validation methodology and limitations.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-2.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-2.2@7a833f69ddb44d12","id":"MD-CTRL-NIST-AI-RMF-MP-2.2","version":"7a833f69ddb44d12","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-2.2 — Risk classifications are defined by the organization and used in AI risk classification decisions.","statement":"MP-2.2 — Risk classifications are defined by the organization and used in AI risk classification decisions.\n*Playbook:* Define a risk taxonomy with clear classification criteria. Apply consistently across AI systems. Document classification decisions with rationale.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-2.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-2.3@2818bc1bf5b0b45e","id":"MD-CTRL-NIST-AI-RMF-MP-2.3","version":"2818bc1bf5b0b45e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-2.3 — AI system risk and benefit analysis incorporates considerations of affected individuals and groups.","statement":"MP-2.3 — AI system risk and benefit analysis incorporates considerations of affected individuals and groups.\n*Playbook:* Disaggregate risk and benefit analysis by affected population. Identify groups at disproportionate risk. Engage stakeholder representation in analysis.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-2.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-3@0197e7801ff1eef2","id":"MD-CTRL-NIST-AI-RMF-MP-3","version":"0197e7801ff1eef2","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-3: AI Capabilities and Limitations","statement":"**MP-3: AI Capabilities and Limitations**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-3.1@d746171a4ecb38ae","id":"MD-CTRL-NIST-AI-RMF-MP-3.1","version":"d746171a4ecb38ae","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-3.1 — Potential impacts of bias are characterized in data, models, and downstream uses and impacts are documented.","statement":"MP-3.1 — Potential impacts of bias are characterized in data, models, and downstream uses and impacts are documented.\n*Playbook:* Conduct bias analysis on training data and model outputs. Use established bias metrics (demographic parity, equalized odds, etc.). Document known bias characteristics and acceptable thresholds.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-3.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-3.2@9bb861a173d6c988","id":"MD-CTRL-NIST-AI-RMF-MP-3.2","version":"9bb861a173d6c988","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-3.2 — Scientific methods — including those from risk sciences, harm sciences, and social sciences — are used to inform bias assessments and documentation.","statement":"MP-3.2 — Scientific methods — including those from risk sciences, harm sciences, and social sciences — are used to inform bias assessments and documentation.\n*Playbook:* Engage multidisciplinary expertise in bias assessments. Reference validated bias assessment methodologies. Document methodology choices and limitations.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-3.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-3.3@164d4cf369dbdb7b","id":"MD-CTRL-NIST-AI-RMF-MP-3.3","version":"164d4cf369dbdb7b","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-3.3 — Processes for operator and user feedback about AI system performance and trustworthiness are established and integrated into AI system updates.","statement":"MP-3.3 — Processes for operator and user feedback about AI system performance and trustworthiness are established and integrated into AI system updates.\n*Playbook:* Establish feedback channels for operators and users. Define process for triaging and acting on feedback. Document feedback integration into model updates.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-3.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-4@116809592f02d31d","id":"MD-CTRL-NIST-AI-RMF-MP-4","version":"116809592f02d31d","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-4: Risks Are Prioritized","statement":"**MP-4: Risks Are Prioritized**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-4.1@19ef7cb4c6564ed8","id":"MD-CTRL-NIST-AI-RMF-MP-4.1","version":"19ef7cb4c6564ed8","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-4.1 — The organization's risk tolerance for the AI system under consideration is established, communicated, and incorporated into the risk identification and classification process.","statement":"MP-4.1 — The organization's risk tolerance for the AI system under consideration is established, communicated, and incorporated into the risk identification and classification process.\n*Playbook:* Apply organizational risk tolerance thresholds at the system level. Document whether system risk level is within tolerance. Escalate systems outside tolerance before deployment.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-4.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-4.2@8c1931b7addc0936","id":"MD-CTRL-NIST-AI-RMF-MP-4.2","version":"8c1931b7addc0936","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-4.2 — Risk levels of AI systems at deployment are documented per risk classification and tolerance levels.","statement":"MP-4.2 — Risk levels of AI systems at deployment are documented per risk classification and tolerance levels.\n*Playbook:* Assign a risk rating to each AI system at deployment. Document the basis for the rating. Update ratings as system context changes.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-4.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-5@85c46fc251a9ab85","id":"MD-CTRL-NIST-AI-RMF-MP-5","version":"85c46fc251a9ab85","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-5: Organizational Risk Management","statement":"**MP-5: Organizational Risk Management**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-5.1@996cf16264eaf3ff","id":"MD-CTRL-NIST-AI-RMF-MP-5.1","version":"996cf16264eaf3ff","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-5.1 — Likelihood of encountering AI risks given use of AI and organizational risk tolerances is determined.","statement":"MP-5.1 — Likelihood of encountering AI risks given use of AI and organizational risk tolerances is determined.\n*Playbook:* Calculate exposure to AI risk across the AI portfolio. Consider frequency of AI use, affected populations, and deployment environment. Document exposure analysis.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-5.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-5.2@1b0bb9682f4942e2","id":"MD-CTRL-NIST-AI-RMF-MP-5.2","version":"1b0bb9682f4942e2","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-5.2 — Organizations are transparent about known limitations and where knowledge is incomplete.","statement":"MP-5.2 — Organizations are transparent about known limitations and where knowledge is incomplete.\n*Playbook:* Publish limitations documentation for AI systems. Communicate limitations to operators and users. Acknowledge uncertainty in risk estimates.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-5.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-5.3@b6c9d0c08416d3ad","id":"MD-CTRL-NIST-AI-RMF-MP-5.3","version":"b6c9d0c08416d3ad","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-5.3 — Organizational risk policies include and are inclusive of AI risks.","statement":"MP-5.3 — Organizational risk policies include and are inclusive of AI risks.\n*Playbook:* Verify AI risk is explicitly addressed in enterprise risk policies. Update policies as AI use evolves.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-5.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-5.4@7121982e45e8874f","id":"MD-CTRL-NIST-AI-RMF-MP-5.4","version":"7121982e45e8874f","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-5.4 — Risk tolerance for the development and deployment of AI systems is established, communicated, and regularly reviewed.","statement":"MP-5.4 — Risk tolerance for the development and deployment of AI systems is established, communicated, and regularly reviewed.\n*Playbook:* Establish formal risk tolerance review cadence. Document tolerance levels and their basis. Communicate tolerance levels to all AI-involved teams.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-5.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MP-5.5@19531afae23ba3c1","id":"MD-CTRL-NIST-AI-RMF-MP-5.5","version":"19531afae23ba3c1","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-5.5 — Practices and documentation establish how identified risks will be addressed and where they fall in the organization's risk management framework.","statement":"MP-5.5 — Practices and documentation establish how identified risks will be addressed and where they fall in the organization's risk management framework.\n*Playbook:* Document risk treatment methodology. Map AI risks to enterprise risk management processes. Ensure AI risks receive equivalent treatment as other enterprise risks.\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-5.5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-1@3db895bbb56b2968","id":"MD-CTRL-NIST-AI-RMF-MS-1","version":"3db895bbb56b2968","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-1: Risk Metrics and Methods","statement":"**MS-1: Risk Metrics and Methods**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-1.1@a54bc54c8aa5c92e","id":"MD-CTRL-NIST-AI-RMF-MS-1.1","version":"a54bc54c8aa5c92e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-1.1 — Approaches and metrics for measurement of AI risks and trustworthiness characteristics reflect deployment context and organizational risk tolerance.","statement":"MS-1.1 — Approaches and metrics for measurement of AI risks and trustworthiness characteristics reflect deployment context and organizational risk tolerance.\n*Playbook:* Define metrics for each NIST AI trustworthiness dimension: accuracy, fairness, transparency, privacy, security, reliability. Calibrate metric thresholds to risk tolerance.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-1.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-1.2@6a2f2ebcef2e6151","id":"MD-CTRL-NIST-AI-RMF-MS-1.2","version":"6a2f2ebcef2e6151","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-1.2 — Trustworthiness characteristics of AI systems are assessed independently and in the context of AI systems to which they may be connected.","statement":"MS-1.2 — Trustworthiness characteristics of AI systems are assessed independently and in the context of AI systems to which they may be connected.\n*Playbook:* Conduct standalone system assessments. Also assess AI systems in the context of their integrations and dependencies. Document interconnected system risks.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-1.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-1.3@4bb2f120858c1ad3","id":"MD-CTRL-NIST-AI-RMF-MS-1.3","version":"4bb2f120858c1ad3","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-1.3 — Internal experts are consulted to assess AI risks.","statement":"MS-1.3 — Internal experts are consulted to assess AI risks.\n*Playbook:* Define which AI risk assessments require expert review. Maintain a list of qualified internal reviewers. Document expert review findings.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-1.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-2@f56b66173a3f92e8","id":"MD-CTRL-NIST-AI-RMF-MS-2","version":"f56b66173a3f92e8","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-2: Risk Analysis","statement":"**MS-2: Risk Analysis**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-2.1@1d81c09bf1afde53","id":"MD-CTRL-NIST-AI-RMF-MS-2.1","version":"1d81c09bf1afde53","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-2.1 — Test sets, metrics, and details about the tools used during test, evaluation, validation, and verification (TEVV) are documented.","statement":"MS-2.1 — Test sets, metrics, and details about the tools used during test, evaluation, validation, and verification (TEVV) are documented.\n*Playbook:* Document all test datasets, evaluation metrics, validation methods, and tools used in AI system assessment. Retain test artifacts. Track TEVV coverage.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-2.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-2.2@829bb463942d1486","id":"MD-CTRL-NIST-AI-RMF-MS-2.2","version":"829bb463942d1486","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-2.2 — AI system trustworthiness characteristics are calibrated for risks of under- and over-reliance on AI systems.","statement":"MS-2.2 — AI system trustworthiness characteristics are calibrated for risks of under- and over-reliance on AI systems.\n*Playbook:* Test for appropriate confidence calibration. Evaluate uncertainty quantification. Assess whether users appropriately rely on AI outputs in practice.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-2.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-2.3@1f93e70b9d8b4eb9","id":"MD-CTRL-NIST-AI-RMF-MS-2.3","version":"1f93e70b9d8b4eb9","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-2.3 — AI system performance and trustworthiness characteristics are evaluated regularly against benchmarks.","statement":"MS-2.3 — AI system performance and trustworthiness characteristics are evaluated regularly against benchmarks.\n*Playbook:* Define performance benchmarks for each AI system. Establish evaluation cadence (minimum annually; more frequently for high-risk systems). Document benchmark results.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-2.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-2.4@621355bb503e08e8","id":"MD-CTRL-NIST-AI-RMF-MS-2.4","version":"621355bb503e08e8","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-2.4 — The ability of humans to interpret AI system outputs when needed is evaluated on a regular basis.","statement":"MS-2.4 — The ability of humans to interpret AI system outputs when needed is evaluated on a regular basis.\n*Playbook:* Test explainability mechanisms with representative users. Measure whether explanations improve appropriate reliance. Document explainability evaluation results.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-2.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-2.5@9cd16c6b1ee118d7","id":"MD-CTRL-NIST-AI-RMF-MS-2.5","version":"9cd16c6b1ee118d7","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-2.5 — Risk characteristics established in MAP are employed in the measurement and analysis of AI system risks and trustworthiness.","statement":"MS-2.5 — Risk characteristics established in MAP are employed in the measurement and analysis of AI system risks and trustworthiness.\n*Playbook:* Verify traceability from MAP risk inventory to MEASURE evaluation plan. Ensure all identified risks have corresponding measurement activities.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-2.5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-2.6@67a44d3238b92bf7","id":"MD-CTRL-NIST-AI-RMF-MS-2.6","version":"67a44d3238b92bf7","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-2.6 — Risk or performance characteristics established in and of AI systems are verified with the relevant populations.","statement":"MS-2.6 — Risk or performance characteristics established in and of AI systems are verified with the relevant populations.\n*Playbook:* Conduct evaluation studies with representative samples of affected populations. Disaggregate results by demographic group. Document population-level validation findings.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-2.6","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-3@7c5dfb51d57ba7ef","id":"MD-CTRL-NIST-AI-RMF-MS-3","version":"7c5dfb51d57ba7ef","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-3: Performance Monitoring","statement":"**MS-3: Performance Monitoring**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-3.1@2ba441a6cb62d709","id":"MD-CTRL-NIST-AI-RMF-MS-3.1","version":"2ba441a6cb62d709","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-3.1 — Ongoing monitoring plans are in place to address the identified AI risks and trustworthiness characteristics of the AI system.","statement":"MS-3.1 — Ongoing monitoring plans are in place to address the identified AI risks and trustworthiness characteristics of the AI system.\n*Playbook:* Document a monitoring plan for each deployed AI system. Define monitored metrics, monitoring frequency, alert thresholds, and escalation procedures.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-3.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-3.2@ad1af42485a958a4","id":"MD-CTRL-NIST-AI-RMF-MS-3.2","version":"ad1af42485a958a4","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-3.2 — The risk or performance characteristics of the AI system to be deployed are examined and documented.","statement":"MS-3.2 — The risk or performance characteristics of the AI system to be deployed are examined and documented.\n*Playbook:* Complete pre-deployment performance review. Document performance against defined thresholds. Obtain approval before deployment.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-3.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-3.3@dac1b0c4325b68cc","id":"MD-CTRL-NIST-AI-RMF-MS-3.3","version":"dac1b0c4325b68cc","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-3.3 — AI system risks and trustworthiness are measured in deployment and monitoring contexts.","statement":"MS-3.3 — AI system risks and trustworthiness are measured in deployment and monitoring contexts.\n*Playbook:* Implement production monitoring for key metrics. Capture performance data continuously. Store monitoring data for review.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-3.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-3.4@0b8137f06e7a2949","id":"MD-CTRL-NIST-AI-RMF-MS-3.4","version":"0b8137f06e7a2949","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-3.4 — Feedback processes for end users and impacted communities to report problems and provide feedback are established.","statement":"MS-3.4 — Feedback processes for end users and impacted communities to report problems and provide feedback are established.\n*Playbook:* Create accessible feedback channels for end users. Establish triage process for reported issues. Close the loop by communicating actions taken.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-3.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-4@5ca3ca99c4aa3259","id":"MD-CTRL-NIST-AI-RMF-MS-4","version":"5ca3ca99c4aa3259","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-4: Feedback Integration","statement":"**MS-4: Feedback Integration**","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-4.1@b643563d272a7c58","id":"MD-CTRL-NIST-AI-RMF-MS-4.1","version":"b643563d272a7c58","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-4.1 — Measurement approaches for identifying AI risks are connected to organizational risk tolerance and relevant laws, regulations, and standards.","statement":"MS-4.1 — Measurement approaches for identifying AI risks are connected to organizational risk tolerance and relevant laws, regulations, and standards.\n*Playbook:* Map measurement methodologies to applicable regulatory requirements. Verify that measured thresholds satisfy legal requirements. Update measurement approaches as regulations change.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-4.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-NIST-AI-RMF-MS-4.2@555cf50a631386bb","id":"MD-CTRL-NIST-AI-RMF-MS-4.2","version":"555cf50a631386bb","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-4.2 — Measurement results inform updates to the risk mapping and risk management approaches.","statement":"MS-4.2 — Measurement results inform updates to the risk mapping and risk management approaches.\n*Playbook:* Establish a process for measurement findings to feed back into MAP risk classification and MG treatment plans. Document feedback loop. Track improvements resulting from measurement.\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-4.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-1.1@6e663e1f167b8156","id":"MD-CTRL-TAIMSCORE-GV-1.1","version":"6e663e1f167b8156","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-1.1 — Organizational policies and practices are in place to plan, prioritize, govern, and monitor AI risk management activities.","statement":"**GV-1.1** — Organizational policies and practices are in place to plan, prioritize, govern, and monitor AI risk management activities.\n- Requires documented AI governance charter or policy\n- Must define scope of AI systems covered\n- Must assign accountability for AI risk oversight\n- GOVERN component: Policy Engine — loads framework, tracks compliance posture","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-1.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-1.2@0d5ccdb59c43f67c","id":"MD-CTRL-TAIMSCORE-GV-1.2","version":"0d5ccdb59c43f67c","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-1.2 — Organizational teams are committed to a culture that considers and communicates AI risks.","statement":"**GV-1.2** — Organizational teams are committed to a culture that considers and communicates AI risks.\n- Requires executive-level AI risk acknowledgment\n- Requires training and awareness program for AI risk\n- GOVERN component: Awareness module, council deliberation records","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-1.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-1.3@a27b166c02aaa4c8","id":"MD-CTRL-TAIMSCORE-GV-1.3","version":"a27b166c02aaa4c8","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-1.3 — Organizational leadership takes responsibility for decisions about risks associated with AI system development and deployment.","statement":"**GV-1.3** — Organizational leadership takes responsibility for decisions about risks associated with AI system development and deployment.\n- Requires named AI risk owner at leadership level\n- Requires escalation path for high-risk AI decisions\n- GOVERN component: Role assignment, accountability ledger","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-1.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-1.4@488e5873c755f8ab","id":"MD-CTRL-TAIMSCORE-GV-1.4","version":"488e5873c755f8ab","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-1.4 — Organizational teams are committed to transparent organizational practices and policies.","statement":"**GV-1.4** — Organizational teams are committed to transparent organizational practices and policies.\n- Requires disclosure framework for AI system use\n- Requires stakeholder communication plan\n- GOVERN component: Disclosure report generator","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-1.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-1.5@ff95c40e6e8afd0a","id":"MD-CTRL-TAIMSCORE-GV-1.5","version":"ff95c40e6e8afd0a","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-1.5 — Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review.","statement":"**GV-1.5** — Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review.\n- Requires defined review cadence (minimum annual)\n- Requires metrics for monitoring effectiveness\n- GOVERN component: Continuous monitoring dashboard, alert engine","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-1.5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-1.6@e3506b0dd4dcada0","id":"MD-CTRL-TAIMSCORE-GV-1.6","version":"e3506b0dd4dcada0","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-1.6 — Policies and procedures are in place for the organizational risk governance and oversight of AI systems developed, used, or acquired from third parties, and for risk management of AI-specific supply chain issues including third-party data and AI components.","statement":"**GV-1.6** — Policies and procedures are in place for the organizational risk governance and oversight of AI systems developed, used, or acquired from third parties, and for risk management of AI-specific supply chain issues including third-party data and AI components.\n- Requires third-party AI vendor assessment process\n- Requires AI supply chain risk policy\n- GOVERN component: Third-party assess mode, vendor registry\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-1.6","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-2.1@9aac291827958bcc","id":"MD-CTRL-TAIMSCORE-GV-2.1","version":"9aac291827958bcc","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-2.1 — Roles and responsibilities and organizational accountabilities for personnel involved with the design, development, deployment, assessment and monitoring of AI systems are established.","statement":"**GV-2.1** — Roles and responsibilities and organizational accountabilities for personnel involved with the design, development, deployment, assessment and monitoring of AI systems are established.\n- Requires RACI matrix for AI roles\n- Requires defined responsibilities for data scientists, ML engineers, risk officers, legal, compliance\n- GOVERN component: Role registry, accountability matrix","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-2.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-2.2@f6568a2a29410b49","id":"MD-CTRL-TAIMSCORE-GV-2.2","version":"f6568a2a29410b49","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-2.2 — The risk or legal review function is documented and accountable to senior leadership.","statement":"**GV-2.2** — The risk or legal review function is documented and accountable to senior leadership.\n- Requires documented reporting structure for AI legal/risk function\n- GOVERN component: Governance structure documentation","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-2.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-2.3@0a20efca2d26ce0b","id":"MD-CTRL-TAIMSCORE-GV-2.3","version":"0a20efca2d26ce0b","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-2.3 — Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.","statement":"**GV-2.3** — Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.\n- Requires board-level or C-suite AI risk acknowledgment records\n- GOVERN component: Executive attestation module\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-2.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-3.1@b037ccbc754dd889","id":"MD-CTRL-TAIMSCORE-GV-3.1","version":"b037ccbc754dd889","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-3.1 — Organizational policies and practices are in place to foster a critical thinking culture.","statement":"**GV-3.1** — Organizational policies and practices are in place to foster a critical thinking culture.\n- Requires documented process for raising AI risk concerns\n- Requires psychological safety mechanisms\n- GOVERN component: Risk flagging interface, anonymous reporting channel","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-3.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-3.2@d334db8c2a02abc6","id":"MD-CTRL-TAIMSCORE-GV-3.2","version":"d334db8c2a02abc6","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-3.2 — Policies, practices, and mechanisms are in place for the training and certification of AI personnel.","statement":"**GV-3.2** — Policies, practices, and mechanisms are in place for the training and certification of AI personnel.\n- Requires defined AI literacy curriculum\n- Requires certification tracking for key roles\n- GOVERN component: Training tracker, certification registry","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-3.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-3.3@61a4b460a66a359d","id":"MD-CTRL-TAIMSCORE-GV-3.3","version":"61a4b460a66a359d","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-3.3 — Fairness and bias — human factors and diversity considerations exist in organizational policies and practices across the AI lifecycle.","statement":"**GV-3.3** — Fairness and bias — human factors and diversity considerations exist in organizational policies and practices across the AI lifecycle.\n- Requires demographic diversity analysis in AI teams\n- Requires process for incorporating diverse perspectives in AI design\n- GOVERN component: Diversity and inclusion assessment panel\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-3.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-4.1@d2118a7c50a2b41f","id":"MD-CTRL-TAIMSCORE-GV-4.1","version":"d2118a7c50a2b41f","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-4.1 — Organizational policies and practices are in place to foster AI risk awareness and to create a culture of trustworthy, responsible AI.","statement":"**GV-4.1** — Organizational policies and practices are in place to foster AI risk awareness and to create a culture of trustworthy, responsible AI.\n- Requires AI ethics principles documented and socialized\n- Requires leadership messaging on responsible AI\n- GOVERN component: Culture assessment, policy publication engine","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-4.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-4.2@b8a13ffd5ef872bb","id":"MD-CTRL-TAIMSCORE-GV-4.2","version":"b8a13ffd5ef872bb","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-4.2 — Organizational teams document the risks and potential impacts of AI technologies applied to their functions and using their data.","statement":"**GV-4.2** — Organizational teams document the risks and potential impacts of AI technologies applied to their functions and using their data.\n- Requires business unit AI risk registers\n- Requires impact documentation per AI use case\n- GOVERN component: Risk register, per-system risk ledger\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-4.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-5.1@4341729d33eff527","id":"MD-CTRL-TAIMSCORE-GV-5.1","version":"4341729d33eff527","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-5.1 — Organizational risk policies include and are inclusive of AI risks.","statement":"**GV-5.1** — Organizational risk policies include and are inclusive of AI risks.\n- Requires AI risk integrated into enterprise risk management framework\n- GOVERN component: ERM integration module, risk appetite statement","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-5.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-5.2@8048f6100c5be955","id":"MD-CTRL-TAIMSCORE-GV-5.2","version":"8048f6100c5be955","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-5.2 — Risk tolerance for the development and deployment of AI systems — including organizational risk tolerance for known trustworthiness limitations of AI systems — is established, communicated, and regularly reviewed.","statement":"**GV-5.2** — Risk tolerance for the development and deployment of AI systems — including organizational risk tolerance for known trustworthiness limitations of AI systems — is established, communicated, and regularly reviewed.\n- Requires documented risk tolerance thresholds by AI risk category\n- Requires regular board/leadership review of AI risk tolerance\n- GOVERN component: Risk tolerance dashboard, threshold alert engine\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-5.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-6.1@77b1a7bf47c9101a","id":"MD-CTRL-TAIMSCORE-GV-6.1","version":"77b1a7bf47c9101a","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-6.1 — Policies and procedures are in place for the identification and documentation of legal requirements related to AI use, including international requirements for AI systems used in multiple jurisdictions.","statement":"**GV-6.1** — Policies and procedures are in place for the identification and documentation of legal requirements related to AI use, including international requirements for AI systems used in multiple jurisdictions.\n- Requires legal inventory of applicable AI regulations per jurisdiction\n- Requires documentation of AI system jurisdictional scope\n- GOVERN component: Regulatory mapping engine, jurisdiction tracker","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-6.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-GV-6.2@3baccaf3d3356bf8","id":"MD-CTRL-TAIMSCORE-GV-6.2","version":"3baccaf3d3356bf8","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"GV-6.2 — Organizational risk policies are inclusive of regulatory compliance and legal requirements.","statement":"**GV-6.2** — Organizational risk policies are inclusive of regulatory compliance and legal requirements.\n- Requires AI compliance program covering NIST, ISO, EU AI Act, FedRAMP as applicable\n- GOVERN component: Compliance gap tracker, standard alignment report\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"GV-6.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MG-1.1@7e4f4e39ffc8450b","id":"MD-CTRL-TAIMSCORE-MG-1.1","version":"7e4f4e39ffc8450b","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-1.1 — A set of risk treatment options (responses) are documented for AI risks including the avoidance, acceptance, transfer, and control of risks.","statement":"**MG-1.1** — A set of risk treatment options (responses) are documented for AI risks including the avoidance, acceptance, transfer, and control of risks.\n- Requires documented risk treatment options per risk category\n- Requires justification for selected treatment approach\n- GOVERN component: Risk treatment library, treatment selection workflow","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-1.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MG-1.2@af82e47ced042dcc","id":"MD-CTRL-TAIMSCORE-MG-1.2","version":"af82e47ced042dcc","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-1.2 — Treatment of AI risks includes a determination of residual risks after the risk response plan has been implemented.","statement":"**MG-1.2** — Treatment of AI risks includes a determination of residual risks after the risk response plan has been implemented.\n- Requires residual risk documentation post-treatment\n- GOVERN component: Residual risk tracker","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-1.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MG-1.3@57168fb27b39fa28","id":"MD-CTRL-TAIMSCORE-MG-1.3","version":"57168fb27b39fa28","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-1.3 — Responses to the AI risks deemed high priority are developed, planned, and documented.","statement":"**MG-1.3** — Responses to the AI risks deemed high priority are developed, planned, and documented.\n- Requires expedited response plans for high-priority risks\n- GOVERN component: Priority risk response queue, response SLA tracking\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-1.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MG-2.1@2e45b4a7ab5058a3","id":"MD-CTRL-TAIMSCORE-MG-2.1","version":"2e45b4a7ab5058a3","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-2.1 — Resources required to manage AI risks are taken into account including the staff, budget, and compute required for implementation.","statement":"**MG-2.1** — Resources required to manage AI risks are taken into account including the staff, budget, and compute required for implementation.\n- Requires resource plan for AI risk management activities\n- GOVERN component: Resource allocation module","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-2.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MG-2.2@8dd199083f138cef","id":"MD-CTRL-TAIMSCORE-MG-2.2","version":"8dd199083f138cef","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-2.2 — Mechanisms are in place and applied to sustain the value of deployed AI systems and to manage the risks of AI system decommissioning, including appropriate archiving of useful elements.","statement":"**MG-2.2** — Mechanisms are in place and applied to sustain the value of deployed AI systems and to manage the risks of AI system decommissioning, including appropriate archiving of useful elements.\n- Requires AI system lifecycle management process including decommissioning\n- GOVERN component: Lifecycle management tracker, decommissioning checklist","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-2.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MG-2.3@386189a1c978c0cc","id":"MD-CTRL-TAIMSCORE-MG-2.3","version":"386189a1c978c0cc","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-2.3 — Procedures are followed to respond to and recover from a previously unknown risk.","statement":"**MG-2.3** — Procedures are followed to respond to and recover from a previously unknown risk.\n- Requires incident response procedure for novel AI risks\n- GOVERN component: Incident response playbook, novel risk intake","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-2.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MG-2.4@4a39848a5d9ce83e","id":"MD-CTRL-TAIMSCORE-MG-2.4","version":"4a39848a5d9ce83e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-2.4 — Mechanisms are in place to allow personnel to report problems to management.","statement":"**MG-2.4** — Mechanisms are in place to allow personnel to report problems to management.\n- Requires internal reporting mechanism for AI risk issues\n- GOVERN component: Internal risk reporting module, escalation workflow\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-2.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MG-3.1@a0afe931057f15cf","id":"MD-CTRL-TAIMSCORE-MG-3.1","version":"a0afe931057f15cf","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-3.1 — Risk treatment strategies and methods are documented, as are the reasons for the selection of risk treatment options.","statement":"**MG-3.1** — Risk treatment strategies and methods are documented, as are the reasons for the selection of risk treatment options.\n- Requires treatment selection rationale documentation\n- GOVERN component: Treatment rationale ledger","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-3.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MG-3.2@22aa2ad79e1a0bff","id":"MD-CTRL-TAIMSCORE-MG-3.2","version":"22aa2ad79e1a0bff","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-3.2 — Treatment of AI risks includes a determination of residual risk after the risk response plan has been implemented.","statement":"**MG-3.2** — Treatment of AI risks includes a determination of residual risk after the risk response plan has been implemented.\n- Requires residual risk assessment post-implementation\n- GOVERN component: Post-treatment residual risk review","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-3.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MG-3.3@9720978dbac2bef4","id":"MD-CTRL-TAIMSCORE-MG-3.3","version":"9720978dbac2bef4","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-3.3 — Feedback processes are in place to inform updates to the risk mapping, risk analysis, risk treatment, and monitoring activities.","statement":"**MG-3.3** — Feedback processes are in place to inform updates to the risk mapping, risk analysis, risk treatment, and monitoring activities.\n- Requires cross-function feedback loop from MANAGE back to MAP and MEASURE\n- GOVERN component: Feedback integration engine, continuous improvement workflow","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-3.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MG-3.4@0813742729474653","id":"MD-CTRL-TAIMSCORE-MG-3.4","version":"0813742729474653","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-3.4 — Risk treatment plans for AI systems are maintained and updated regularly.","statement":"**MG-3.4** — Risk treatment plans for AI systems are maintained and updated regularly.\n- Requires periodic review and update of treatment plans\n- GOVERN component: Treatment plan review scheduler, update records\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-3.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MG-4.1@22bb5db4ed410c0e","id":"MD-CTRL-TAIMSCORE-MG-4.1","version":"22bb5db4ed410c0e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-4.1 — Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors across the AI lifecycle.","statement":"**MG-4.1** — Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors across the AI lifecycle.\n- Requires active post-deployment monitoring program\n- GOVERN component: Post-deployment monitoring dashboard","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-4.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MG-4.2@c4d7d793290763bc","id":"MD-CTRL-TAIMSCORE-MG-4.2","version":"c4d7d793290763bc","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-4.2 — Measurable performance improvements or declines and other changes in deployed AI system trustworthiness are evaluated and documented.","statement":"**MG-4.2** — Measurable performance improvements or declines and other changes in deployed AI system trustworthiness are evaluated and documented.\n- Requires performance trend tracking over time\n- GOVERN component: Performance trend tracker, delta reporting","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-4.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MG-4.3@6f56070482b2b60a","id":"MD-CTRL-TAIMSCORE-MG-4.3","version":"6f56070482b2b60a","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-4.3 — Feedback processes for improvement are followed for deployed AI systems.","statement":"**MG-4.3** — Feedback processes for improvement are followed for deployed AI systems.\n- Requires documented improvement process using monitoring and feedback data\n- GOVERN component: Improvement workflow engine","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-4.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MG-4.4@29a66fbbec9145a2","id":"MD-CTRL-TAIMSCORE-MG-4.4","version":"29a66fbbec9145a2","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MG-4.4 — Organizational teams communicate with personnel to report problems and suggest opportunities for improvement across the AI lifecycle.","statement":"**MG-4.4** — Organizational teams communicate with personnel to report problems and suggest opportunities for improvement across the AI lifecycle.\n- Requires internal communication process for AI risk findings\n- GOVERN component: Internal communication module, findings distribution\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MG-4.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-1.1@548c2c820b927f90","id":"MD-CTRL-TAIMSCORE-MP-1.1","version":"548c2c820b927f90","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-1.1 — Intended purpose, potentially beneficial uses, context of use, and risks of AI systems are understood and documented.","statement":"**MP-1.1** — Intended purpose, potentially beneficial uses, context of use, and risks of AI systems are understood and documented.\n- Requires documented AI system purpose statement\n- Requires identification of intended use cases and out-of-scope uses\n- GOVERN component: System inventory, use case registry","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-1.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-1.2@f754d023d01e821f","id":"MD-CTRL-TAIMSCORE-MP-1.2","version":"f754d023d01e821f","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-1.2 — Scientific findings, technical standards, and trustworthiness of AI systems are understood, documented, and communicated.","statement":"**MP-1.2** — Scientific findings, technical standards, and trustworthiness of AI systems are understood, documented, and communicated.\n- Requires technical documentation of AI model architecture, training data, and performance characteristics\n- GOVERN component: Technical fact sheet generator, model card integration","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-1.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-1.3@62501b520f91f1be","id":"MD-CTRL-TAIMSCORE-MP-1.3","version":"62501b520f91f1be","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-1.3 — Potential benefits of intended AI system deployment — including financial, societal, and broadly beneficial uses — are examined and documented.","statement":"**MP-1.3** — Potential benefits of intended AI system deployment — including financial, societal, and broadly beneficial uses — are examined and documented.\n- Requires documented benefits analysis per AI system\n- GOVERN component: Benefits documentation module","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-1.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-1.4@62d7db49c4279f76","id":"MD-CTRL-TAIMSCORE-MP-1.4","version":"62d7db49c4279f76","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-1.4 — Risks or harms of deployed AI systems — and their potential consequences to individuals, groups, communities, organizations, and society — are examined and documented.","statement":"**MP-1.4** — Risks or harms of deployed AI systems — and their potential consequences to individuals, groups, communities, organizations, and society — are examined and documented.\n- Requires impact assessment covering affected individuals and groups\n- Requires documentation of high-risk harm scenarios\n- GOVERN component: Harm assessment module, impact ledger","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-1.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-1.5@4f2a419cd373ffa7","id":"MD-CTRL-TAIMSCORE-MP-1.5","version":"4f2a419cd373ffa7","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-1.5 — Likelihood and magnitude of each identified AI system risk or impact are estimated and documented.","statement":"**MP-1.5** — Likelihood and magnitude of each identified AI system risk or impact are estimated and documented.\n- Requires risk likelihood and magnitude scoring methodology\n- GOVERN component: Risk scoring engine, probability-impact matrix","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-1.5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-1.6@ae953741bf4624c4","id":"MD-CTRL-TAIMSCORE-MP-1.6","version":"ae953741bf4624c4","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-1.6 — Risks or harms from third-party use of the organization's data or AI systems, including data provenance, data quality, and supply chain risks, are documented.","statement":"**MP-1.6** — Risks or harms from third-party use of the organization's data or AI systems, including data provenance, data quality, and supply chain risks, are documented.\n- Requires third-party data risk documentation\n- GOVERN component: Data provenance tracker, supply chain risk register\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-1.6","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-2.1@c7b548f567e35589","id":"MD-CTRL-TAIMSCORE-MP-2.1","version":"c7b548f567e35589","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-2.1 — Scientific community norms for validating AI risks and potential impacts are followed.","statement":"**MP-2.1** — Scientific community norms for validating AI risks and potential impacts are followed.\n- Requires model validation methodology documentation\n- Requires reference to peer-reviewed standards and research\n- GOVERN component: Validation methodology registry","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-2.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-2.2@6ba31f1d90581063","id":"MD-CTRL-TAIMSCORE-MP-2.2","version":"6ba31f1d90581063","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-2.2 — Risk classifications are defined by the organization and used in AI risk classification decisions.","statement":"**MP-2.2** — Risk classifications are defined by the organization and used in AI risk classification decisions.\n- Requires defined risk taxonomy (e.g., low/medium/high/critical)\n- Requires documented classification criteria\n- GOVERN component: Risk taxonomy engine, classification workflow","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-2.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-2.3@0e315ec0e8de8b8f","id":"MD-CTRL-TAIMSCORE-MP-2.3","version":"0e315ec0e8de8b8f","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-2.3 — AI system risk and benefit analysis incorporates considerations of affected individuals and groups.","statement":"**MP-2.3** — AI system risk and benefit analysis incorporates considerations of affected individuals and groups.\n- Requires stakeholder impact analysis covering affected populations\n- GOVERN component: Stakeholder mapping module\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-2.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-3.1@f5151dd4ddfa4905","id":"MD-CTRL-TAIMSCORE-MP-3.1","version":"f5151dd4ddfa4905","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-3.1 — Potential impacts of bias are characterized in data, models, and downstream uses and impacts are documented.","statement":"**MP-3.1** — Potential impacts of bias are characterized in data, models, and downstream uses and impacts are documented.\n- Requires bias analysis of training data and model outputs\n- Requires documentation of known bias characteristics\n- GOVERN component: Bias assessment module, bias report generator","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-3.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-3.2@f6a9aead25c9a878","id":"MD-CTRL-TAIMSCORE-MP-3.2","version":"f6a9aead25c9a878","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-3.2 — Scientific methods — including those from risk sciences, harm sciences, and social sciences — are used to inform bias assessments and documentation.","statement":"**MP-3.2** — Scientific methods — including those from risk sciences, harm sciences, and social sciences — are used to inform bias assessments and documentation.\n- Requires peer-reviewed or validated bias assessment methodology\n- GOVERN component: Methodology documentation, validation records","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-3.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-3.3@e71a5f5b8757a1bb","id":"MD-CTRL-TAIMSCORE-MP-3.3","version":"e71a5f5b8757a1bb","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-3.3 — Processes for operator and user feedback about AI system performance and trustworthiness are established and integrated into AI system updates.","statement":"**MP-3.3** — Processes for operator and user feedback about AI system performance and trustworthiness are established and integrated into AI system updates.\n- Requires feedback channel for operators and users to report AI performance issues\n- Requires process to incorporate feedback into system updates\n- GOVERN component: Feedback intake module, change management integration\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-3.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-4.1@7650a9eae1489b67","id":"MD-CTRL-TAIMSCORE-MP-4.1","version":"7650a9eae1489b67","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-4.1 — The organization's risk tolerance for the AI system under consideration is established, communicated, and incorporated into the risk identification and classification process.","statement":"**MP-4.1** — The organization's risk tolerance for the AI system under consideration is established, communicated, and incorporated into the risk identification and classification process.\n- Requires risk tolerance applied at system level\n- GOVERN component: Per-system risk tolerance configuration","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-4.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-4.2@5e7e554a9d14d4f0","id":"MD-CTRL-TAIMSCORE-MP-4.2","version":"5e7e554a9d14d4f0","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-4.2 — Risk levels of AI systems at deployment are documented per risk classification and tolerance levels.","statement":"**MP-4.2** — Risk levels of AI systems at deployment are documented per risk classification and tolerance levels.\n- Requires system-level risk rating at deployment\n- GOVERN component: Deployment risk certification, risk ledger\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-4.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-5.1@21750de9cac00ac4","id":"MD-CTRL-TAIMSCORE-MP-5.1","version":"21750de9cac00ac4","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-5.1 — Likelihood of encountering AI risks given use of AI and organizational risk tolerances is determined.","statement":"**MP-5.1** — Likelihood of encountering AI risks given use of AI and organizational risk tolerances is determined.\n- Requires probability analysis of AI risk exposure\n- GOVERN component: Exposure analysis module","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-5.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-5.2@aae6d3aca3cefd9d","id":"MD-CTRL-TAIMSCORE-MP-5.2","version":"aae6d3aca3cefd9d","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-5.2 — Organizations are transparent about known limitations and where knowledge is incomplete.","statement":"**MP-5.2** — Organizations are transparent about known limitations and where knowledge is incomplete.\n- Requires documented limitations section in AI system documentation\n- GOVERN component: Limitations register, transparency report","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-5.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-5.3@d9ade20423d9fae1","id":"MD-CTRL-TAIMSCORE-MP-5.3","version":"d9ade20423d9fae1","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-5.3 — Organizational risk policies include and are inclusive of AI risks.","statement":"**MP-5.3** — Organizational risk policies include and are inclusive of AI risks.\n- Requires AI risk explicitly included in enterprise risk policies\n- GOVERN component: Policy integration audit","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-5.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-5.4@0f39b85d04a28ae5","id":"MD-CTRL-TAIMSCORE-MP-5.4","version":"0f39b85d04a28ae5","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-5.4 — Risk tolerance for the development and deployment of AI systems is established, communicated, and regularly reviewed.","statement":"**MP-5.4** — Risk tolerance for the development and deployment of AI systems is established, communicated, and regularly reviewed.\n- Requires formal risk tolerance review cadence\n- GOVERN component: Risk tolerance review scheduler, review records","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-5.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MP-5.5@390a727740c13759","id":"MD-CTRL-TAIMSCORE-MP-5.5","version":"390a727740c13759","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MP-5.5 — Practices and documentation establish how identified risks will be addressed and where they fall in the organization's risk management framework.","statement":"**MP-5.5** — Practices and documentation establish how identified risks will be addressed and where they fall in the organization's risk management framework.\n- Requires documented risk treatment methodology\n- GOVERN component: Risk treatment tracker, treatment workflow engine\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MP-5.5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MS-1.1@8e4962befa85bc7b","id":"MD-CTRL-TAIMSCORE-MS-1.1","version":"8e4962befa85bc7b","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-1.1 — Approaches and metrics for measurement of AI risks and trustworthiness characteristics reflect deployment context and organizational risk tolerance.","statement":"**MS-1.1** — Approaches and metrics for measurement of AI risks and trustworthiness characteristics reflect deployment context and organizational risk tolerance.\n- Requires defined metrics for each trustworthiness dimension (accuracy, fairness, transparency, privacy, security, reliability)\n- GOVERN component: Metrics library, measurement configuration","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-1.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MS-1.2@e5f7bc6811d1f568","id":"MD-CTRL-TAIMSCORE-MS-1.2","version":"e5f7bc6811d1f568","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-1.2 — Trustworthiness characteristics of AI systems are assessed independently and in the context of AI systems to which they may be connected.","statement":"**MS-1.2** — Trustworthiness characteristics of AI systems are assessed independently and in the context of AI systems to which they may be connected.\n- Requires system-level and ecosystem-level trustworthiness assessment\n- GOVERN component: System interdependency map, interconnected system assessment","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-1.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MS-1.3@e0049f5a7a82e999","id":"MD-CTRL-TAIMSCORE-MS-1.3","version":"e0049f5a7a82e999","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-1.3 — Internal experts are consulted to assess AI risks.","statement":"**MS-1.3** — Internal experts are consulted to assess AI risks.\n- Requires expert review process for AI risk assessments\n- GOVERN component: Expert review workflow, reviewer registry\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-1.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MS-2.1@129fa1e62d197c7b","id":"MD-CTRL-TAIMSCORE-MS-2.1","version":"129fa1e62d197c7b","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-2.1 — Test sets, metrics, and details about the tools used during test, evaluation, validation, and verification (TEVV) are documented.","statement":"**MS-2.1** — Test sets, metrics, and details about the tools used during test, evaluation, validation, and verification (TEVV) are documented.\n- Requires TEVV documentation including test datasets, metrics, and tools\n- GOVERN component: TEVV documentation module, test artifact registry","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-2.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MS-2.2@2437e8f60490ee90","id":"MD-CTRL-TAIMSCORE-MS-2.2","version":"2437e8f60490ee90","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-2.2 — AI system trustworthiness characteristics are calibrated for risks of under- and over-reliance on AI systems.","statement":"**MS-2.2** — AI system trustworthiness characteristics are calibrated for risks of under- and over-reliance on AI systems.\n- Requires calibration testing for confidence and uncertainty estimation\n- GOVERN component: Calibration assessment, uncertainty quantification tracker","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-2.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MS-2.3@c2d234e5d46c6f5b","id":"MD-CTRL-TAIMSCORE-MS-2.3","version":"c2d234e5d46c6f5b","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-2.3 — AI system performance and trustworthiness characteristics are evaluated regularly against benchmarks.","statement":"**MS-2.3** — AI system performance and trustworthiness characteristics are evaluated regularly against benchmarks.\n- Requires regular performance benchmarking cadence\n- GOVERN component: Benchmarking scheduler, benchmark results ledger","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-2.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MS-2.4@455d8d7db1bd8cf6","id":"MD-CTRL-TAIMSCORE-MS-2.4","version":"455d8d7db1bd8cf6","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-2.4 — The ability of humans to interpret AI system outputs when needed is evaluated on a regular basis.","statement":"**MS-2.4** — The ability of humans to interpret AI system outputs when needed is evaluated on a regular basis.\n- Requires explainability and interpretability testing\n- GOVERN component: Explainability assessment module","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-2.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MS-2.5@9d6eb82ed7386a1e","id":"MD-CTRL-TAIMSCORE-MS-2.5","version":"9d6eb82ed7386a1e","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-2.5 — Risk characteristics established in MP are employed in the measurement and analysis of AI system risks and trustworthiness.","statement":"**MS-2.5** — Risk characteristics established in MP are employed in the measurement and analysis of AI system risks and trustworthiness.\n- Requires traceability from risk identification (MAP) to risk measurement (MEASURE)\n- GOVERN component: Cross-function traceability engine","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-2.5","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MS-2.6@7161e37074ac4ae3","id":"MD-CTRL-TAIMSCORE-MS-2.6","version":"7161e37074ac4ae3","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-2.6 — Risk or performance characteristics established in and of AI systems are verified with the relevant populations.","statement":"**MS-2.6** — Risk or performance characteristics established in and of AI systems are verified with the relevant populations.\n- Requires performance validation against representative population samples\n- GOVERN component: Population-representative validation module\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-2.6","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MS-3.1@5ad421ae77227683","id":"MD-CTRL-TAIMSCORE-MS-3.1","version":"5ad421ae77227683","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-3.1 — Ongoing monitoring plans are in place to address the identified AI risks and trustworthiness characteristics of the AI system.","statement":"**MS-3.1** — Ongoing monitoring plans are in place to address the identified AI risks and trustworthiness characteristics of the AI system.\n- Requires monitoring plan documentation per AI system\n- GOVERN component: Monitoring plan builder, monitoring schedule","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-3.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MS-3.2@db15d30d4ea169b5","id":"MD-CTRL-TAIMSCORE-MS-3.2","version":"db15d30d4ea169b5","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-3.2 — The risk or performance characteristics of the AI system to be deployed are examined and documented.","statement":"**MS-3.2** — The risk or performance characteristics of the AI system to be deployed are examined and documented.\n- Requires pre-deployment performance documentation\n- GOVERN component: Pre-deployment risk certification","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-3.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MS-3.3@21c5310a7329281b","id":"MD-CTRL-TAIMSCORE-MS-3.3","version":"21c5310a7329281b","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-3.3 — AI system risks and trustworthiness are measured in deployment and monitoring contexts.","statement":"**MS-3.3** — AI system risks and trustworthiness are measured in deployment and monitoring contexts.\n- Requires in-deployment performance and risk monitoring\n- GOVERN component: Live monitoring dashboard, alert engine","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-3.3","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MS-3.4@1e808b6be39d30e1","id":"MD-CTRL-TAIMSCORE-MS-3.4","version":"1e808b6be39d30e1","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-3.4 — Feedback processes for end users and impacted communities to report problems and provide feedback are established.","statement":"**MS-3.4** — Feedback processes for end users and impacted communities to report problems and provide feedback are established.\n- Requires user-facing feedback mechanism for AI system issues\n- GOVERN component: Public feedback intake module\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-3.4","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MS-4.1@0d2eebf4c3c3c07c","id":"MD-CTRL-TAIMSCORE-MS-4.1","version":"0d2eebf4c3c3c07c","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-4.1 — Measurement approaches for identifying AI risks are connected to organizational risk tolerance and relevant laws, regulations, and standards.","statement":"**MS-4.1** — Measurement approaches for identifying AI risks are connected to organizational risk tolerance and relevant laws, regulations, and standards.\n- Requires measurement methodology tied to regulatory requirements\n- GOVERN component: Regulatory measurement alignment","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-4.1","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MD-CTRL-TAIMSCORE-MS-4.2@4d7bb36b38d271d5","id":"MD-CTRL-TAIMSCORE-MS-4.2","version":"4d7bb36b38d271d5","kind":"control","lifecycle":"SECONDARY_REFERENCE","title":"MS-4.2 — Measurement results inform updates to the risk mapping and risk management approaches.","statement":"**MS-4.2** — Measurement results inform updates to the risk mapping and risk management approaches.\n- Requires feedback loop from measurement results to MAP and MANAGE functions\n- GOVERN component: Cross-function feedback loop, update workflow\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"sourceControlId":"MS-4.2","mappingToOfficialControl":"UNVERIFIED","notAnOfficialFrameworkEdition":true}},{"key":"MS-CTRL-POL-01-C01@b766250ab3daedc9","id":"MS-CTRL-POL-01-C01","version":"b766250ab3daedc9","kind":"control","lifecycle":"EXTRACTED","title":"POL-01-C01","statement":"Board/executive accountability, roles, risk appetite, inventory, metrics and reporting","family":"Governance & accountability","body":{"sourceId":"POL-01-C01","policyRef":"MS-POL-POL-01","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Policy + charter + minutes","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-02-C01@40fc29d45c4457f1","id":"MS-CTRL-POL-02-C01","version":"40fc29d45c4457f1","kind":"control","lifecycle":"EXTRACTED","title":"POL-02-C01","statement":"Permitted/prohibited uses, user duties, escalation, sanctions and safe-use expectations","family":"Governance & accountability","body":{"sourceId":"POL-02-C01","policyRef":"MS-POL-POL-02","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Policy + attestation","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-03-C01@dbe46d341001eeb6","id":"MS-CTRL-POL-03-C01","version":"dbe46d341001eeb6","kind":"control","lifecycle":"EXTRACTED","title":"POL-03-C01","statement":"Sanctioned providers, personal-account restrictions, onboarding and discovery","family":"Governance & accountability","body":{"sourceId":"POL-03-C01","policyRef":"MS-POL-POL-03","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Policy + inventory + egress logs","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-04-C01@386e3fe2d1f5246f","id":"MS-CTRL-POL-04-C01","version":"386e3fe2d1f5246f","kind":"control","lifecycle":"EXTRACTED","title":"POL-04-C01","statement":"Which data classes may enter which AI systems under which conditions","family":"Governance & accountability","body":{"sourceId":"POL-04-C01","policyRef":"MS-POL-POL-04","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Standard + decision matrix + DLP events","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-05-C01@ffefbbfc6f719437","id":"MS-CTRL-POL-05-C01","version":"ffefbbfc6f719437","kind":"control","lifecycle":"EXTRACTED","title":"POL-05-C01","statement":"Prompt hygiene, output review, citations, disclosure and publication rules","family":"Governance & accountability","body":{"sourceId":"POL-05-C01","policyRef":"MS-POL-POL-05","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Policy + runtime events","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-06-C01@7107ad18568fb35c","id":"MS-CTRL-POL-06-C01","version":"7107ad18568fb35c","kind":"control","lifecycle":"EXTRACTED","title":"POL-06-C01","statement":"Purpose, minimization, lawful basis, DPIA, rights, retention and sensitive data","family":"Governance & accountability","body":{"sourceId":"POL-06-C01","policyRef":"MS-POL-POL-06","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Privacy policy + DPIA + configuration","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-07-C01@92eeb3b18fd14237","id":"MS-CTRL-POL-07-C01","version":"92eeb3b18fd14237","kind":"control","lifecycle":"EXTRACTED","title":"POL-07-C01","statement":"Threat model, injection defenses, input trust, secrets and vulnerability handling","family":"Governance & accountability","body":{"sourceId":"POL-07-C01","policyRef":"MS-POL-POL-07","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Security standard + tests + events","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-08-C01@9bdb77bb21f1278a","id":"MS-CTRL-POL-08-C01","version":"9bdb77bb21f1278a","kind":"control","lifecycle":"EXTRACTED","title":"POL-08-C01","statement":"High-impact definition, required reviewers, fail-safe and prohibited autonomy","family":"Governance & accountability","body":{"sourceId":"POL-08-C01","policyRef":"MS-POL-POL-08","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Impact assessment + approval + logs","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-09-C01@28bd04439eeb643f","id":"MS-CTRL-POL-09-C01","version":"28bd04439eeb643f","kind":"control","lifecycle":"EXTRACTED","title":"POL-09-C01","statement":"Intake, impact assessment, control selection, risk acceptance and reassessment","family":"Governance & accountability","body":{"sourceId":"POL-09-C01","policyRef":"MS-POL-POL-09","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Assessment + approval","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-10-C01@d6a7308768b38dd6","id":"MS-CTRL-POL-10-C01","version":"d6a7308768b38dd6","kind":"control","lifecycle":"EXTRACTED","title":"POL-10-C01","statement":"Test dimensions, datasets, thresholds, independence, cadence and release gates","family":"Governance & accountability","body":{"sourceId":"POL-10-C01","policyRef":"MS-POL-POL-10","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Test evidence","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-11-C01@ba8f0f69896dbda0","id":"MS-CTRL-POL-11-C01","version":"ba8f0f69896dbda0","kind":"control","lifecycle":"EXTRACTED","title":"POL-11-C01","statement":"Events, content minimization, metrics, alerting, access, integrity and retention","family":"Governance & accountability","body":{"sourceId":"POL-11-C01","policyRef":"MS-POL-POL-11","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Logs + monitoring evidence","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-12-C01@328267f10538458f","id":"MS-CTRL-POL-12-C01","version":"328267f10538458f","kind":"control","lifecycle":"EXTRACTED","title":"POL-12-C01","statement":"AI incident taxonomy, escalation, containment, reporting, kill switch and recovery","family":"Governance & accountability","body":{"sourceId":"POL-12-C01","policyRef":"MS-POL-POL-12","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Plan + drill + incident evidence","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-13-C01@aa73ec05d68f5778","id":"MS-CTRL-POL-13-C01","version":"aa73ec05d68f5778","kind":"control","lifecycle":"EXTRACTED","title":"POL-13-C01","statement":"Due diligence, DPA/BAA, training use, subprocessors, SLAs, audit, exit and change notice","family":"Governance & accountability","body":{"sourceId":"POL-13-C01","policyRef":"MS-POL-POL-13","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Contract + assessment","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-14-C01@d4d8e5f978ff6018","id":"MS-CTRL-POL-14-C01","version":"d4d8e5f978ff6018","kind":"control","lifecycle":"EXTRACTED","title":"POL-14-C01","statement":"Tool allowlists, least privilege, approvals, limits, memory and transaction controls","family":"Governance & accountability","body":{"sourceId":"POL-14-C01","policyRef":"MS-POL-POL-14","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Policy + tool logs + approvals","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-15-C01@bae38b8ddca62d09","id":"MS-CTRL-POL-15-C01","version":"bae38b8ddca62d09","kind":"control","lifecycle":"EXTRACTED","title":"POL-15-C01","statement":"Threat modeling, design review, output handling, change, release and rollback","family":"Governance & accountability","body":{"sourceId":"POL-15-C01","policyRef":"MS-POL-POL-15","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"SDLC records + tests","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-16-C01@4385dd308009dd40","id":"MS-CTRL-POL-16-C01","version":"4385dd308009dd40","kind":"control","lifecycle":"EXTRACTED","title":"POL-16-C01","statement":"Protected groups, evaluation, accommodations, monitoring and remediation","family":"Governance & accountability","body":{"sourceId":"POL-16-C01","policyRef":"MS-POL-POL-16","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Fairness assessment + monitoring","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-17-C01@a589870290e36ebc","id":"MS-CTRL-POL-17-C01","version":"a589870290e36ebc","kind":"control","lifecycle":"EXTRACTED","title":"POL-17-C01","statement":"Notices, explainability, citations, synthetic-content labels and provenance","family":"Governance & accountability","body":{"sourceId":"POL-17-C01","policyRef":"MS-POL-POL-17","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Notices + provenance logs","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-18-C01@353022021876b69f","id":"MS-CTRL-POL-18-C01","version":"353022021876b69f","kind":"control","lifecycle":"EXTRACTED","title":"POL-18-C01","statement":"Trade secrets, customer data, privilege, copyright, license and publication review","family":"Governance & accountability","body":{"sourceId":"POL-18-C01","policyRef":"MS-POL-POL-18","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Policy + review records","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-19-C01@8b80f45de84ee486","id":"MS-CTRL-POL-19-C01","version":"8b80f45de84ee486","kind":"control","lifecycle":"EXTRACTED","title":"POL-19-C01","statement":"Role-based literacy, operator competency, developer safety and executive duties","family":"Governance & accountability","body":{"sourceId":"POL-19-C01","policyRef":"MS-POL-POL-19","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Completion + assessment","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-20-C01@f431b58ee095a892","id":"MS-CTRL-POL-20-C01","version":"f431b58ee095a892","kind":"control","lifecycle":"EXTRACTED","title":"POL-20-C01","statement":"User appeal, operator override, risk acceptance, compensating controls and expiry","family":"Governance & accountability","body":{"sourceId":"POL-20-C01","policyRef":"MS-POL-POL-20","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Workflow records","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-21-C01@8b5135c5fa6c4d80","id":"MS-CTRL-POL-21-C01","version":"8b5135c5fa6c4d80","kind":"control","lifecycle":"EXTRACTED","title":"POL-21-C01","statement":"Retention, deletion, memory/vector cleanup, access revocation, records and exit","family":"Governance & accountability","body":{"sourceId":"POL-21-C01","policyRef":"MS-POL-POL-21","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Deletion and revocation evidence","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-22-C01@0008bb9b0a6ec78a","id":"MS-CTRL-POL-22-C01","version":"0008bb9b0a6ec78a","kind":"control","lifecycle":"EXTRACTED","title":"POL-22-C01","statement":"Provenance, authorization, poisoning defense, embedding isolation, dataset/model versioning","family":"Governance & accountability","body":{"sourceId":"POL-22-C01","policyRef":"MS-POL-POL-22","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Provenance + test + SBOM evidence","reportedApproval":"Approved baseline design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-23-C01@8177afebde7da07a","id":"MS-CTRL-POL-23-C01","version":"8177afebde7da07a","kind":"control","lifecycle":"EXTRACTED","title":"POL-23-C01","statement":"Classify prompts, outputs, decisions, approvals and control events against an approved records schedule.","family":"Governance & accountability","body":{"sourceId":"POL-23-C01","policyRef":"MS-POL-POL-23","mechanism":"Workflow / System Configuration","frameworkDrivers":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","evidence":"Schedule + retention configuration + hold record + deletion certificate","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-23-C02@1bd8482b6b9bad6c","id":"MS-CTRL-POL-23-C02","version":"1bd8482b6b9bad6c","kind":"control","lifecycle":"EXTRACTED","title":"POL-23-C02","statement":"Prevent deletion or alteration while a legal, audit or investigation hold is active.","family":"Enforcement & prevention","body":{"sourceId":"POL-23-C02","policyRef":"MS-POL-POL-23","mechanism":"System Configuration","frameworkDrivers":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","evidence":"Schedule + retention configuration + hold record + deletion certificate","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-23-C03@1678ca94f02e1cbc","id":"MS-CTRL-POL-23-C03","version":"1678ca94f02e1cbc","kind":"control","lifecycle":"EXTRACTED","title":"POL-23-C03","statement":"Verify deletion across chat history, logs, vector stores, memory, backups and downstream evidence stores.","family":"Evidence & independent assurance","body":{"sourceId":"POL-23-C03","policyRef":"MS-POL-POL-23","mechanism":"Assurance / Testing","frameworkDrivers":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","evidence":"Schedule + retention configuration + hold record + deletion certificate","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-24-C01@d5e684dfef1b2e9c","id":"MS-CTRL-POL-24-C01","version":"d5e684dfef1b2e9c","kind":"control","lifecycle":"EXTRACTED","title":"POL-24-C01","statement":"Define accessible interaction and output requirements for each AI interface, document type and supported modality.","family":"Governance & accountability","body":{"sourceId":"POL-24-C01","policyRef":"MS-POL-POL-24","mechanism":"Document / Policy","frameworkDrivers":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","evidence":"Accessibility requirements + ACR/VPAT + test results + exception record","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-24-C02@d918e2b22e350918","id":"MS-CTRL-POL-24-C02","version":"d918e2b22e350918","kind":"control","lifecycle":"EXTRACTED","title":"POL-24-C02","statement":"Test keyboard, screen-reader, caption, contrast, cognitive and alternative-channel needs before release.","family":"Evidence & independent assurance","body":{"sourceId":"POL-24-C02","policyRef":"MS-POL-POL-24","mechanism":"Assurance / Testing","frameworkDrivers":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","evidence":"Accessibility requirements + ACR/VPAT + test results + exception record","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-24-C03@dbbd781e2afd0ee6","id":"MS-CTRL-POL-24-C03","version":"dbbd781e2afd0ee6","kind":"control","lifecycle":"EXTRACTED","title":"POL-24-C03","statement":"Provide an equivalent human or non-AI path when an AI experience is not accessible or fails.","family":"Monitoring, response & resilience","body":{"sourceId":"POL-24-C03","policyRef":"MS-POL-POL-24","mechanism":"Workflow / Process","frameworkDrivers":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","evidence":"Accessibility requirements + ACR/VPAT + test results + exception record","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-25-C01@f1c5ef468cf35b54","id":"MS-CTRL-POL-25-C01","version":"f1c5ef468cf35b54","kind":"control","lifecycle":"EXTRACTED","title":"POL-25-C01","statement":"Inventory each employment decision in which AI substantially assists or replaces human judgment.","family":"Applicable control coverage","body":{"sourceId":"POL-25-C01","policyRef":"MS-POL-POL-25","mechanism":"Workflow / Process","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Use inventory + notice/consent + bias audit + publication + decision logs","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-25-C02@65df3c955cab3391","id":"MS-CTRL-POL-25-C02","version":"65df3c955cab3391","kind":"control","lifecycle":"EXTRACTED","title":"POL-25-C02","statement":"Complete required notice, consent, accommodation and alternative-process steps before covered use.","family":"Enforcement & prevention","body":{"sourceId":"POL-25-C02","policyRef":"MS-POL-POL-25","mechanism":"Transaction Warning / Approval","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Use inventory + notice/consent + bias audit + publication + decision logs","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-25-C03@4b08a537f8b2697c","id":"MS-CTRL-POL-25-C03","version":"4b08a537f8b2697c","kind":"control","lifecycle":"EXTRACTED","title":"POL-25-C03","statement":"Run independent bias audits on the required cadence and prevent use after expiration or material change.","family":"Evidence & independent assurance","body":{"sourceId":"POL-25-C03","policyRef":"MS-POL-POL-25","mechanism":"Assurance / Testing","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Use inventory + notice/consent + bias audit + publication + decision logs","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-26-C01@d2d8820db6d6a87e","id":"MS-CTRL-POL-26-C01","version":"d2d8820db6d6a87e","kind":"control","lifecycle":"EXTRACTED","title":"POL-26-C01","statement":"Preserve the actual principal factors used for each credit decision and map them to notice language.","family":"Enforcement & prevention","body":{"sourceId":"POL-26-C01","policyRef":"MS-POL-POL-26","mechanism":"System Configuration","frameworkDrivers":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","evidence":"Model documentation + validation + decision factors + notices + complaints","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-26-C02@e82d80b0d844beb1","id":"MS-CTRL-POL-26-C02","version":"e82d80b0d844beb1","kind":"control","lifecycle":"EXTRACTED","title":"POL-26-C02","statement":"Prohibit model use when specific and accurate adverse-action reasons cannot be produced.","family":"Enforcement & prevention","body":{"sourceId":"POL-26-C02","policyRef":"MS-POL-POL-26","mechanism":"Transaction Prevention","frameworkDrivers":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","evidence":"Model documentation + validation + decision factors + notices + complaints","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-26-C03@e63178b9cd783908","id":"MS-CTRL-POL-26-C03","version":"e63178b9cd783908","kind":"control","lifecycle":"EXTRACTED","title":"POL-26-C03","statement":"Validate discrimination, accuracy, stability and reason-code fidelity with effective independent challenge.","family":"Evidence & independent assurance","body":{"sourceId":"POL-26-C03","policyRef":"MS-POL-POL-26","mechanism":"Assurance / Testing","frameworkDrivers":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","evidence":"Model documentation + validation + decision factors + notices + complaints","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-27-C01@f3fafd4f1eb871cc","id":"MS-CTRL-POL-27-C01","version":"f3fafd4f1eb871cc","kind":"control","lifecycle":"EXTRACTED","title":"POL-27-C01","statement":"Define intended use, excluded uses, population, environment and qualified reviewer for each clinical AI system.","family":"Governance & accountability","body":{"sourceId":"POL-27-C01","policyRef":"MS-POL-POL-27","mechanism":"Workflow / Process","frameworkDrivers":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","evidence":"Intended-use statement + validation + reviewer logs + monitoring + safety events","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-27-C02@95768538c03b23cf","id":"MS-CTRL-POL-27-C02","version":"95768538c03b23cf","kind":"control","lifecycle":"EXTRACTED","title":"POL-27-C02","statement":"Prevent use outside validated indication, population, data quality or operating conditions.","family":"Enforcement & prevention","body":{"sourceId":"POL-27-C02","policyRef":"MS-POL-POL-27","mechanism":"Transaction Prevention","frameworkDrivers":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","evidence":"Intended-use statement + validation + reviewer logs + monitoring + safety events","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-27-C03@51941690c4ccdbbc","id":"MS-CTRL-POL-27-C03","version":"51941690c4ccdbbc","kind":"control","lifecycle":"EXTRACTED","title":"POL-27-C03","statement":"Monitor safety, bias, performance degradation and clinical overrides with stop criteria.","family":"Monitoring, response & resilience","body":{"sourceId":"POL-27-C03","policyRef":"MS-POL-POL-27","mechanism":"Continuous Detection / Monitoring","frameworkDrivers":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","evidence":"Intended-use statement + validation + reviewer logs + monitoring + safety events","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-28-C01@95cebd36e96c97aa","id":"MS-CTRL-POL-28-C01","version":"95cebd36e96c97aa","kind":"control","lifecycle":"EXTRACTED","title":"POL-28-C01","statement":"Determine whether the experience is child-directed and apply the governing age, consent and school-authorization rule.","family":"Applicable control coverage","body":{"sourceId":"POL-28-C01","policyRef":"MS-POL-POL-28","mechanism":"Workflow / Process","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Age assessment + consent + data map + safety tests + deletion evidence","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-28-C02@75a42ce5eb954451","id":"MS-CTRL-POL-28-C02","version":"75a42ce5eb954451","kind":"control","lifecycle":"EXTRACTED","title":"POL-28-C02","statement":"Minimize youth data, disable manipulative engagement and block unapproved third-party disclosure or training.","family":"Enforcement & prevention","body":{"sourceId":"POL-28-C02","policyRef":"MS-POL-POL-28","mechanism":"Transaction Prevention","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Age assessment + consent + data map + safety tests + deletion evidence","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-28-C03@00038d1a54adc49c","id":"MS-CTRL-POL-28-C03","version":"00038d1a54adc49c","kind":"control","lifecycle":"EXTRACTED","title":"POL-28-C03","statement":"Provide age-appropriate explanations, reporting and escalation paths for unsafe interactions.","family":"Monitoring, response & resilience","body":{"sourceId":"POL-28-C03","policyRef":"MS-POL-POL-28","mechanism":"Transaction Warning / Approval","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Age assessment + consent + data map + safety tests + deletion evidence","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-29-C01@2a636b88495545f2","id":"MS-CTRL-POL-29-C01","version":"2a636b88495545f2","kind":"control","lifecycle":"EXTRACTED","title":"POL-29-C01","statement":"Identify decisions that affect rights, benefits, liberty, access to services or legal status and prohibit unsupported automation.","family":"Applicable control coverage","body":{"sourceId":"POL-29-C01","policyRef":"MS-POL-POL-29","mechanism":"Workflow / Process","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Impact assessment + notice + decision record + approvals + appeal outcomes","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-29-C02@454e63540191c754","id":"MS-CTRL-POL-29-C02","version":"454e63540191c754","kind":"control","lifecycle":"EXTRACTED","title":"POL-29-C02","statement":"Require understandable notice, reviewable rationale, qualified human review and an effective appeal path.","family":"Enforcement & prevention","body":{"sourceId":"POL-29-C02","policyRef":"MS-POL-POL-29","mechanism":"Transaction Warning / Approval","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Impact assessment + notice + decision record + approvals + appeal outcomes","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-29-C03@9e8988e83061cf94","id":"MS-CTRL-POL-29-C03","version":"9e8988e83061cf94","kind":"control","lifecycle":"EXTRACTED","title":"POL-29-C03","statement":"Require dual authorization before an agent executes a coercive or irreversible government action.","family":"Enforcement & prevention","body":{"sourceId":"POL-29-C03","policyRef":"MS-POL-POL-29","mechanism":"Transaction Prevention","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Impact assessment + notice + decision record + approvals + appeal outcomes","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-30-C01@8d15ee1e0bb3ebf4","id":"MS-CTRL-POL-30-C01","version":"8d15ee1e0bb3ebf4","kind":"control","lifecycle":"EXTRACTED","title":"POL-30-C01","statement":"Apply a machine-readable data handling label and approved-purpose matrix before any AI access.","family":"Enforcement & prevention","body":{"sourceId":"POL-30-C01","policyRef":"MS-POL-POL-30","mechanism":"System Configuration","frameworkDrivers":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","evidence":"Handling matrix + labels + boundary config + access logs + inspections","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-30-C02@2dd54d58131ceade","id":"MS-CTRL-POL-30-C02","version":"2dd54d58131ceade","kind":"control","lifecycle":"EXTRACTED","title":"POL-30-C02","statement":"Route only to approved identity, region, tenant, boundary, provider and contract combinations.","family":"Enforcement & prevention","body":{"sourceId":"POL-30-C02","policyRef":"MS-POL-POL-30","mechanism":"Transaction Prevention","frameworkDrivers":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","evidence":"Handling matrix + labels + boundary config + access logs + inspections","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-30-C03@ea04ae8a27c7247b","id":"MS-CTRL-POL-30-C03","version":"ea04ae8a27c7247b","kind":"control","lifecycle":"EXTRACTED","title":"POL-30-C03","statement":"Continuously reconcile labeled records, recipients, access and retention against the governing addendum.","family":"Monitoring, response & resilience","body":{"sourceId":"POL-30-C03","policyRef":"MS-POL-POL-30","mechanism":"Continuous Detection / Monitoring","frameworkDrivers":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","evidence":"Handling matrix + labels + boundary config + access logs + inspections","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-31-C01@8ca08935ea227608","id":"MS-CTRL-POL-31-C01","version":"8ca08935ea227608","kind":"control","lifecycle":"EXTRACTED","title":"POL-31-C01","statement":"Tier models by materiality, complexity, opacity, use and potential harm and assign validation cadence.","family":"Governance & accountability","body":{"sourceId":"POL-31-C01","policyRef":"MS-POL-POL-31","mechanism":"Workflow / Process","frameworkDrivers":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","evidence":"Tiering + model inventory + validation + findings + approvals","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-31-C02@85c34fafa98fabaf","id":"MS-CTRL-POL-31-C02","version":"85c34fafa98fabaf","kind":"control","lifecycle":"EXTRACTED","title":"POL-31-C02","statement":"Require sufficiently independent validation and effective challenge before use and after material change.","family":"Evidence & independent assurance","body":{"sourceId":"POL-31-C02","policyRef":"MS-POL-POL-31","mechanism":"Assurance / Testing","frameworkDrivers":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","evidence":"Tiering + model inventory + validation + findings + approvals","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-31-C03@a6ef23abf5c5e42b","id":"MS-CTRL-POL-31-C03","version":"a6ef23abf5c5e42b","kind":"control","lifecycle":"EXTRACTED","title":"POL-31-C03","statement":"Track limitations, compensating controls, findings, expiry and accountable acceptance in the model inventory.","family":"Monitoring, response & resilience","body":{"sourceId":"POL-31-C03","policyRef":"MS-POL-POL-31","mechanism":"Workflow / Process","frameworkDrivers":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","evidence":"Tiering + model inventory + validation + findings + approvals","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-32-C01@3fdcc01a28b621fa","id":"MS-CTRL-POL-32-C01","version":"3fdcc01a28b621fa","kind":"control","lifecycle":"EXTRACTED","title":"POL-32-C01","statement":"Map model, provider, support, telemetry, training and subprocessors to actual data locations and access countries.","family":"Applicable control coverage","body":{"sourceId":"POL-32-C01","policyRef":"MS-POL-POL-32","mechanism":"Workflow / Process","frameworkDrivers":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","evidence":"Data map + transfer assessment + screening + contracts + audit records","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-32-C02@ddde04a8d8ca4082","id":"MS-CTRL-POL-32-C02","version":"ddde04a8d8ca4082","kind":"control","lifecycle":"EXTRACTED","title":"POL-32-C02","statement":"Screen counterparty, country, data category, volume and transfer mechanism before routing or granting access.","family":"Enforcement & prevention","body":{"sourceId":"POL-32-C02","policyRef":"MS-POL-POL-32","mechanism":"Transaction Prevention","frameworkDrivers":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","evidence":"Data map + transfer assessment + screening + contracts + audit records","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-32-C03@1de5a35b8a8c8fd0","id":"MS-CTRL-POL-32-C03","version":"1de5a35b8a8c8fd0","kind":"control","lifecycle":"EXTRACTED","title":"POL-32-C03","statement":"Reassess transfers when a provider, subprocessor, model region or legal mechanism changes.","family":"Monitoring, response & resilience","body":{"sourceId":"POL-32-C03","policyRef":"MS-POL-POL-32","mechanism":"Continuous Detection / Monitoring","frameworkDrivers":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","evidence":"Data map + transfer assessment + screening + contracts + audit records","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-33-C01@e5ead432ece32c95","id":"MS-CTRL-POL-33-C01","version":"e5ead432ece32c95","kind":"control","lifecycle":"EXTRACTED","title":"POL-33-C01","statement":"Register each covered automated decision system, purpose, owner, population, data, model and effective dates.","family":"Governance & accountability","body":{"sourceId":"POL-33-C01","policyRef":"MS-POL-POL-33","mechanism":"Workflow / Process","frameworkDrivers":"EU-AI-ACT; ONC-HTI1; NYC-LL144; OMB-M25-21; CO-AI","evidence":"Registry + disclosures + approval + discovery/reconciliation logs","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-33-C02@3921a2759f04839d","id":"MS-CTRL-POL-33-C02","version":"3921a2759f04839d","kind":"control","lifecycle":"EXTRACTED","title":"POL-33-C02","statement":"Publish or deliver the required notice, system description, contact, rights and risk information.","family":"Enforcement & prevention","body":{"sourceId":"POL-33-C02","policyRef":"MS-POL-POL-33","mechanism":"Transaction Warning / Approval","frameworkDrivers":"EU-AI-ACT; ONC-HTI1; NYC-LL144; OMB-M25-21; CO-AI","evidence":"Registry + disclosures + approval + discovery/reconciliation logs","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-33-C03@8666fa9d9d46f7fb","id":"MS-CTRL-POL-33-C03","version":"8666fa9d9d46f7fb","kind":"control","lifecycle":"EXTRACTED","title":"POL-33-C03","statement":"Detect unregistered systems and stale disclosures and route them to remediation.","family":"Monitoring, response & resilience","body":{"sourceId":"POL-33-C03","policyRef":"MS-POL-POL-33","mechanism":"Continuous Detection / Monitoring","frameworkDrivers":"EU-AI-ACT; ONC-HTI1; NYC-LL144; OMB-M25-21; CO-AI","evidence":"Registry + disclosures + approval + discovery/reconciliation logs","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-34-C01@848d6f9bfc0f9229","id":"MS-CTRL-POL-34-C01","version":"848d6f9bfc0f9229","kind":"control","lifecycle":"EXTRACTED","title":"POL-34-C01","statement":"Determine whether the activity is research involving human participants or identifiable human data and route it to the required review.","family":"Applicable control coverage","body":{"sourceId":"POL-34-C01","policyRef":"MS-POL-POL-34","mechanism":"Workflow / Process","frameworkDrivers":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","evidence":"Protocol + ethics approval + consent + data authorization + reproducibility record","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-34-C02@818c4b275dcc2acd","id":"MS-CTRL-POL-34-C02","version":"818c4b275dcc2acd","kind":"control","lifecycle":"EXTRACTED","title":"POL-34-C02","statement":"Enforce protocol, consent, data-use, publication and model-reuse limits throughout the research lifecycle.","family":"Enforcement & prevention","body":{"sourceId":"POL-34-C02","policyRef":"MS-POL-POL-34","mechanism":"System Configuration","frameworkDrivers":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","evidence":"Protocol + ethics approval + consent + data authorization + reproducibility record","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"MS-CTRL-POL-34-C03@6de53a060d4995dc","id":"MS-CTRL-POL-34-C03","version":"6de53a060d4995dc","kind":"control","lifecycle":"EXTRACTED","title":"POL-34-C03","statement":"Require reproducibility, provenance, statistical validation and disclosure of AI assistance in scientific outputs.","family":"Evidence & independent assurance","body":{"sourceId":"POL-34-C03","policyRef":"MS-POL-POL-34","mechanism":"Assurance / Testing","frameworkDrivers":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","evidence":"Protocol + ethics approval + consent + data authorization + reproducibility record","reportedApproval":"Context-triggered design","enforcementVerified":false,"sourceDate":"2026-08-20"}},{"key":"TAIM-GOVERN-1.1@26b8d9618cddf058","id":"TAIM-GOVERN-1.1","version":"26b8d9618cddf058","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 1.1","statement":"Legal and regulatory requirements involving AI are understood, managed, and documented.","family":"GOVERN","body":{"sourceId":"GOVERN 1.1","category":"GOVERN 1","categoryObjective":"Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","question":"Are legal and regulatory requirements involving AI understood, managed, and documented?","recommendation":"Ensure that legal and regulatory requirements involving AI are understood, managed, and documented.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":null,"sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-1.1@35b911ad2aa6f0f1","id":"TAIM-GOVERN-1.1","version":"35b911ad2aa6f0f1","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 1.1","statement":"Legal and regulatory requirements involving AI are understood, managed, and documented.","family":"GOVERN","body":{"sourceId":"GOVERN 1.1","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["OP-01","OP-02"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"15","sourceFrameworks":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-1.2@91a9127ceb89507e","id":"TAIM-GOVERN-1.2","version":"91a9127ceb89507e","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 1.2","statement":"The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices.","family":"","body":{"sourceId":"GOVERN 1.2","category":null,"categoryObjective":null,"question":"Are the characteristics of trustworthy AI integrated into organizational policies, processes, procedures, and practices?","recommendation":"Ensure that the characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":null,"sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-1.2@ad2860a2fbdee92d","id":"TAIM-GOVERN-1.2","version":"ad2860a2fbdee92d","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 1.2","statement":"The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices.","family":"GOVERN","body":{"sourceId":"GOVERN 1.2","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["No direct runtime rule","retain as program control"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-1.3@6129b834f8908bde","id":"TAIM-GOVERN-1.3","version":"6129b834f8908bde","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 1.3","statement":"Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization’s risk tolerance.","family":"GOVERN","body":{"sourceId":"GOVERN 1.3","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["AU-04","OP-07"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-1.3@d61a82d09de245d3","id":"TAIM-GOVERN-1.3","version":"d61a82d09de245d3","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 1.3","statement":"Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization’s risk tolerance.","family":"","body":{"sourceId":"GOVERN 1.3","category":null,"categoryObjective":null,"question":"Are processes, procedures, and practices  in place to determine the needed level of risk management activities based on the organization’s risk tolerance?","recommendation":"Ensure that processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization’s risk tolerance.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-1.4@2cf04928037dcfee","id":"TAIM-GOVERN-1.4","version":"2cf04928037dcfee","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 1.4","statement":"The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.","family":"GOVERN","body":{"sourceId":"GOVERN 1.4","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["OU-12","OP-02","AU-04","OP-07"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-1.4@a744d71de8e42bb8","id":"TAIM-GOVERN-1.4","version":"a744d71de8e42bb8","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 1.4","statement":"The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.","family":"","body":{"sourceId":"GOVERN 1.4","category":null,"categoryObjective":null,"question":"Are the risk management process and its outcomes established through transparent policies, procedures, and other controls based on organizational risk priorities?","recommendation":"Ensure that the risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-1.5@92357b32e10b5e02","id":"TAIM-GOVERN-1.5","version":"92357b32e10b5e02","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 1.5","statement":"Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.","family":"GOVERN","body":{"sourceId":"GOVERN 1.5","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective","automationTier":"E1","reportedSupport":"Partial","candidateRules":["OP-03","AU-03"],"primaryEvidence":"Metric, alert and review evidence","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-1.5@e6be6927d32f915f","id":"TAIM-GOVERN-1.5","version":"e6be6927d32f915f","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 1.5","statement":"Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.","family":"","body":{"sourceId":"GOVERN 1.5","category":null,"categoryObjective":null,"question":"Are ongoing monitoring and periodic review of the risk management process and its outcomes planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review?","recommendation":"Ensure that ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-1.6@26f041bc196d2f20","id":"TAIM-GOVERN-1.6","version":"26f041bc196d2f20","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 1.6","statement":"Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.","family":"","body":{"sourceId":"GOVERN 1.6","category":null,"categoryObjective":null,"question":"Are mechanisms in place to inventory AI systems and resourced according to organizational risk priorities?","recommendation":"Ensure that mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-1.6@382c72c8bff29604","id":"TAIM-GOVERN-1.6","version":"382c72c8bff29604","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 1.6","statement":"Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.","family":"GOVERN","body":{"sourceId":"GOVERN 1.6","mechanism":"Workflow / Process","controlNature":"Directive / Preventive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["OP-09","AU-04","OP-07"],"primaryEvidence":"Control-specific evidence","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Holistic TAIM control; determine implementation after use-case applicability assessment.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-1.7@198eee5654f91ae3","id":"TAIM-GOVERN-1.7","version":"198eee5654f91ae3","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 1.7","statement":"Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization’s trustworthiness.","family":"GOVERN","body":{"sourceId":"GOVERN 1.7","mechanism":"System Configuration / Workflow","controlNature":"Corrective","automationTier":"E4","reportedSupport":"Roadmap","candidateRules":["OP-11","OP-05"],"primaryEvidence":"Shutdown, deletion and revocation evidence","reportedSourceCount":"7","sourceFrameworks":"ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Can be automated with admin-plane integration and an approved workflow.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","id":"TAIM-GOVERN-1.7","version":"a55511fa1ec1c70a","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 1.7","statement":"Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization’s trustworthiness.","family":"","body":{"sourceId":"GOVERN 1.7","category":null,"categoryObjective":null,"question":"Are processes and procedures in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization’s trustworthiness?","recommendation":"Ensure that processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization’s trustworthiness.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-2.1@198893140402361c","id":"TAIM-GOVERN-2.1","version":"198893140402361c","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 2.1","statement":"Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.","family":"GOVERN","body":{"sourceId":"GOVERN 2.1","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["AU-03","OP-01","OP-02"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"8","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-2.1@677e9c1589774ef7","id":"TAIM-GOVERN-2.1","version":"677e9c1589774ef7","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 2.1","statement":"Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.","family":"","body":{"sourceId":"GOVERN 2.1","category":"GOVERN 2","categoryObjective":"Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.","question":"Are roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks documented and are clear to individuals and teams throughout the organization?","recommendation":"Ensure that roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":null,"sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-2.2@212a87832b3bc07a","id":"TAIM-GOVERN-2.2","version":"212a87832b3bc07a","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 2.2","statement":"The organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.","family":"","body":{"sourceId":"GOVERN 2.2","category":null,"categoryObjective":null,"question":"Do the organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements?","recommendation":"Ensure that the organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-2.2@9b46d32788988ef2","id":"TAIM-GOVERN-2.2","version":"9b46d32788988ef2","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 2.2","statement":"The organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.","family":"GOVERN","body":{"sourceId":"GOVERN 2.2","mechanism":"Human Competency","controlNature":"Directive","automationTier":"E0","reportedSupport":"Evidence only","candidateRules":["AU-03","Supporting policy POL-19"],"primaryEvidence":"Training completion + competency result","reportedSourceCount":"15","sourceFrameworks":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Human evidence; no runtime transaction to intercept.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","id":"TAIM-GOVERN-2.3","version":"dcf6e30f1cfaf00a","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 2.3","statement":"Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.","family":"","body":{"sourceId":"GOVERN 2.3","category":null,"categoryObjective":null,"question":"Does executive leadership of the organization take responsibility for decisions about risks associated with AI system development and deployment?","recommendation":"Ensure that executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-2.3@e28fde83a8cc90e1","id":"TAIM-GOVERN-2.3","version":"e28fde83a8cc90e1","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 2.3","statement":"Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.","family":"GOVERN","body":{"sourceId":"GOVERN 2.3","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["AU-03"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"15","sourceFrameworks":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-3.1@0f38f1685d8ed670","id":"TAIM-GOVERN-3.1","version":"0f38f1685d8ed670","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 3.1","statement":"Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds).","family":"","body":{"sourceId":"GOVERN 3.1","category":"GOVERN 3","categoryObjective":"Workforce diversity, equity, inclusion, and accessibility processes are prioritized in the mapping, measuring, and managing of AI risks throughout the lifecycle.","question":"Are decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds)?","recommendation":"Ensure that decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds).","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-3.1@2427dcd86ebd4f7b","id":"TAIM-GOVERN-3.1","version":"2427dcd86ebd4f7b","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 3.1","statement":"Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds).","family":"GOVERN","body":{"sourceId":"GOVERN 3.1","mechanism":"Workflow / Process","controlNature":"Directive / Preventive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["OP-06"],"primaryEvidence":"Control-specific evidence","reportedSourceCount":"8","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws","rationale":"Holistic TAIM control; determine implementation after use-case applicability assessment.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-3.2@9c41c08d8d6c9ac6","id":"TAIM-GOVERN-3.2","version":"9c41c08d8d6c9ac6","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 3.2","statement":"Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.","family":"GOVERN","body":{"sourceId":"GOVERN 3.2","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["AU-03"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"17","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-3.2@c47019573b68992a","id":"TAIM-GOVERN-3.2","version":"c47019573b68992a","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 3.2","statement":"Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.","family":"","body":{"sourceId":"GOVERN 3.2","category":null,"categoryObjective":null,"question":"Are policies and procedures in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems?","recommendation":"Ensure that policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-4.1@104e4747b0fad479","id":"TAIM-GOVERN-4.1","version":"104e4747b0fad479","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 4.1","statement":"Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts.","family":"GOVERN","body":{"sourceId":"GOVERN 4.1","mechanism":"Workflow / Process","controlNature":"Directive / Preventive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["No direct runtime rule","retain as program control"],"primaryEvidence":"Control-specific evidence","reportedSourceCount":"17","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Holistic TAIM control; determine implementation after use-case applicability assessment.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","id":"TAIM-GOVERN-4.1","version":"7578cf0aafb78c9f","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 4.1","statement":"Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts.","family":"","body":{"sourceId":"GOVERN 4.1","category":"GOVERN 4","categoryObjective":"Organizational teams are committed to a culture that considers and communicates AI risk.","question":"Are organizational policies and practices in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts?","recommendation":"Ensure that organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","id":"TAIM-GOVERN-4.2","version":"44e6aa7d11a0ed2b","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 4.2","statement":"Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.","family":"","body":{"sourceId":"GOVERN 4.2","category":null,"categoryObjective":null,"question":"Do organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and do they communicate about the impacts more broadly?","recommendation":"Ensure that organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-4.2@c1e4d61854eedbe8","id":"TAIM-GOVERN-4.2","version":"c1e4d61854eedbe8","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 4.2","statement":"Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.","family":"GOVERN","body":{"sourceId":"GOVERN 4.2","mechanism":"Assurance / Testing","controlNature":"Detective","automationTier":"E0–E1","reportedSupport":"Roadmap","candidateRules":["OP-12","OP-03","OP-01","OP-02"],"primaryEvidence":"Versioned evaluation plan, dataset and results","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Needs representative tests and acceptance thresholds rather than a simple content rule.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-4.3@6c63b10d0830b670","id":"TAIM-GOVERN-4.3","version":"6c63b10d0830b670","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 4.3","statement":"Organizational practices are in place to enable AI testing, identification of incidents, and information sharing.","family":"GOVERN","body":{"sourceId":"GOVERN 4.3","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective / Corrective","automationTier":"E1–E4","reportedSupport":"Partial","candidateRules":["OP-04","OP-05","OP-12","OP-03"],"primaryEvidence":"Incident + escalation + recovery evidence","reportedSourceCount":"17","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Current events help, but enterprise response and kill-switch workflows are missing.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-4.3@87ee4878e85c702a","id":"TAIM-GOVERN-4.3","version":"87ee4878e85c702a","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 4.3","statement":"Organizational practices are in place to enable AI testing, identification of incidents, and information sharing.","family":"","body":{"sourceId":"GOVERN 4.3","category":null,"categoryObjective":null,"question":"Are organizational practices in place to enable AI testing, identification of incidents, and information sharing?","recommendation":"Ensure that organizational practices are in place to enable AI testing, identification of incidents, and information sharing.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-5.1@68f585618af89993","id":"TAIM-GOVERN-5.1","version":"68f585618af89993","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 5.1","statement":"Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks.","family":"GOVERN","body":{"sourceId":"GOVERN 5.1","mechanism":"Workflow / Process","controlNature":"Directive / Preventive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["OP-08"],"primaryEvidence":"Control-specific evidence","reportedSourceCount":"17","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Holistic TAIM control; determine implementation after use-case applicability assessment.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","id":"TAIM-GOVERN-5.1","version":"79d104cee5d0ed7e","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 5.1","statement":"Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks.","family":"","body":{"sourceId":"GOVERN 5.1","category":"GOVERN 5","categoryObjective":"Processes are in place for robust engagement with relevant AI actors.","question":"Are organizational policies and practices in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks?","recommendation":"Ensure that organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-5.2@0c282eb98e0d233a","id":"TAIM-GOVERN-5.2","version":"0c282eb98e0d233a","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 5.2","statement":"Mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation.","family":"","body":{"sourceId":"GOVERN 5.2","category":null,"categoryObjective":null,"question":"Are mechanisms established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation?","recommendation":"Ensure that mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-5.2@fe8607850f8d2ca6","id":"TAIM-GOVERN-5.2","version":"fe8607850f8d2ca6","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 5.2","statement":"Mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation.","family":"GOVERN","body":{"sourceId":"GOVERN 5.2","mechanism":"Workflow / Process","controlNature":"Directive / Preventive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["OP-08"],"primaryEvidence":"Control-specific evidence","reportedSourceCount":"17","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Holistic TAIM control; determine implementation after use-case applicability assessment.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-6.1@b8216e0b6ff98607","id":"TAIM-GOVERN-6.1","version":"b8216e0b6ff98607","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 6.1","statement":"Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights.","family":"GOVERN","body":{"sourceId":"GOVERN 6.1","mechanism":"Third-Party / Contractual","controlNature":"Preventive / Detective","automationTier":"E1–E3","reportedSupport":"Roadmap","candidateRules":["OP-10","AG-10"],"primaryEvidence":"Due diligence + contract + monitoring","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Requires vendor and supply-chain integration beyond prompt inspection.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-6.1@fc5e93781b104482","id":"TAIM-GOVERN-6.1","version":"fc5e93781b104482","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 6.1","statement":"Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights.","family":"","body":{"sourceId":"GOVERN 6.1","category":"GOVERN 6","categoryObjective":"Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues.","question":"Are policies and procedures in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights?","recommendation":"Ensure that policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-6.2@054b3cd3c85b2f5d","id":"TAIM-GOVERN-6.2","version":"054b3cd3c85b2f5d","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 6.2","statement":"Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk.","family":"GOVERN","body":{"sourceId":"GOVERN 6.2","mechanism":"Third-Party / Contractual","controlNature":"Preventive / Detective","automationTier":"E1–E3","reportedSupport":"Roadmap","candidateRules":["OP-04","OP-05","OP-10","AG-10"],"primaryEvidence":"Due diligence + contract + monitoring","reportedSourceCount":"17","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Requires vendor and supply-chain integration beyond prompt inspection.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-GOVERN-6.2@bfdb82176b6f4825","id":"TAIM-GOVERN-6.2","version":"bfdb82176b6f4825","kind":"control","lifecycle":"EXTRACTED","title":"GOVERN 6.2","statement":"Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk.","family":"","body":{"sourceId":"GOVERN 6.2","category":null,"categoryObjective":null,"question":"Are contingency processes in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk?","recommendation":"Ensure that contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk.","riskStatement":"To ensure a purpose-driven culture focused on risk understanding and management.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-1.1@8f95b18554d187df","id":"TAIM-MANAGE-1.1","version":"8f95b18554d187df","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 1.1","statement":"A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed.","family":"MANAGE","body":{"sourceId":"MANAGE 1.1","mechanism":"Workflow / Process","controlNature":"Directive / Preventive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["No direct runtime rule","retain as program control"],"primaryEvidence":"Control-specific evidence","reportedSourceCount":"16","sourceFrameworks":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Holistic TAIM control; determine implementation after use-case applicability assessment.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-1.1@b474c5c19115a785","id":"TAIM-MANAGE-1.1","version":"b474c5c19115a785","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 1.1","statement":"A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed.","family":"MANAGE","body":{"sourceId":"MANAGE 1.1","category":"MANAGE 1","categoryObjective":"AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.","question":"Is a determination made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed?","recommendation":"Ensure that a determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed.","riskStatement":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-1.2@725fe00a61b98e10","id":"TAIM-MANAGE-1.2","version":"725fe00a61b98e10","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 1.2","statement":"Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods.","family":"MANAGE","body":{"sourceId":"MANAGE 1.2","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["OP-01","OP-02"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"15","sourceFrameworks":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-1.2@a705fc2f096d2e46","id":"TAIM-MANAGE-1.2","version":"a705fc2f096d2e46","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 1.2","statement":"Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods.","family":"","body":{"sourceId":"MANAGE 1.2","category":null,"categoryObjective":null,"question":"Is treatment of documented AI risks prioritized based on impact, likelihood, and available resources or methods?","recommendation":"Ensure that treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods.","riskStatement":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-1.3@113dba8419d60368","id":"TAIM-MANAGE-1.3","version":"113dba8419d60368","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 1.3","statement":"Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. \n\nRisk response options can include mitigating, transferring, avoiding, or accepting.","family":"MANAGE","body":{"sourceId":"MANAGE 1.3","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["OP-01","OP-02"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"16","sourceFrameworks":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","id":"TAIM-MANAGE-1.3","version":"76ff0f9ee6446d31","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 1.3","statement":"Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. \n\nRisk response options can include mitigating, transferring, avoiding, or accepting.","family":"","body":{"sourceId":"MANAGE 1.3","category":null,"categoryObjective":null,"question":"Are responses to the AI risks deemed high priority, as identified by the MAP function, developed, planned, and documented?\n\nDoes risk response options include mitigating, transferring, avoiding, or accepting?","recommendation":"Ensure that responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. \n\nEnsure that risk response options include mitigating, transferring, avoiding, or accepting.","riskStatement":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-1.4@614e57f0276eaccf","id":"TAIM-MANAGE-1.4","version":"614e57f0276eaccf","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 1.4","statement":"Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented.","family":"","body":{"sourceId":"MANAGE 1.4","category":null,"categoryObjective":null,"question":"Are negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users documented?","recommendation":"Ensure that negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented.","riskStatement":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-1.4@706dd15eb7c4daeb","id":"TAIM-MANAGE-1.4","version":"706dd15eb7c4daeb","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 1.4","statement":"Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented.","family":"MANAGE","body":{"sourceId":"MANAGE 1.4","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["OP-01","OP-02"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"16","sourceFrameworks":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-2.1@a1ff21e73495f39c","id":"TAIM-MANAGE-2.1","version":"a1ff21e73495f39c","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 2.1","statement":"Resources required to manage AI risks are taken into account – along with viable non-AI alternative systems, approaches, or methods – to reduce the magnitude or likelihood of potential impacts.","family":"MANAGE","body":{"sourceId":"MANAGE 2.1","mechanism":"Workflow / Process","controlNature":"Directive / Preventive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["No direct runtime rule","retain as program control"],"primaryEvidence":"Control-specific evidence","reportedSourceCount":"16","sourceFrameworks":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Holistic TAIM control; determine implementation after use-case applicability assessment.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-2.1@aa163cc990ffc547","id":"TAIM-MANAGE-2.1","version":"aa163cc990ffc547","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 2.1","statement":"Resources required to manage AI risks are taken into account – along with viable non-AI alternative systems, approaches, or methods – to reduce the magnitude or likelihood of potential impacts.","family":"","body":{"sourceId":"MANAGE 2.1","category":"MANAGE 2","categoryObjective":"Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.","question":"Are resources required to manage AI risks taken into account – along with viable non-AI alternative systems, approaches, or methods – to reduce the magnitude or likelihood of potential impacts?","recommendation":"Ensure that resources required to manage AI risks are taken into account – along with viable non-AI alternative systems, approaches, or methods – to reduce the magnitude or likelihood of potential impacts.","riskStatement":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-2.2@14538be506abb510","id":"TAIM-MANAGE-2.2","version":"14538be506abb510","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 2.2","statement":"Mechanisms are in place and applied to sustain the value of deployed AI systems.","family":"","body":{"sourceId":"MANAGE 2.2","category":null,"categoryObjective":null,"question":"Are mechanisms in place and applied to sustain the value of deployed AI systems?","recommendation":"Ensure that mechanisms are in place and applied to sustain the value of deployed AI systems.","riskStatement":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-2.2@f861fb2340eaa0c6","id":"TAIM-MANAGE-2.2","version":"f861fb2340eaa0c6","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 2.2","statement":"Mechanisms are in place and applied to sustain the value of deployed AI systems.","family":"MANAGE","body":{"sourceId":"MANAGE 2.2","mechanism":"Workflow / Process","controlNature":"Directive / Preventive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["No direct runtime rule","retain as program control"],"primaryEvidence":"Control-specific evidence","reportedSourceCount":"15","sourceFrameworks":"ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Holistic TAIM control; determine implementation after use-case applicability assessment.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-2.3@438a1a9f5069b57c","id":"TAIM-MANAGE-2.3","version":"438a1a9f5069b57c","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 2.3","statement":"Procedures are followed to respond to and recover from a previously unknown risk when it is identified.","family":"","body":{"sourceId":"MANAGE 2.3","category":null,"categoryObjective":null,"question":"Are procedures followed to respond to and recover from a previously unknown risk when it is identified?","recommendation":"Procedures are followed to respond to and recover from a previously unknown risk when it is identified.","riskStatement":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-2.3@f69713d6045063b5","id":"TAIM-MANAGE-2.3","version":"f69713d6045063b5","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 2.3","statement":"Procedures are followed to respond to and recover from a previously unknown risk when it is identified.","family":"MANAGE","body":{"sourceId":"MANAGE 2.3","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective / Corrective","automationTier":"E1–E4","reportedSupport":"Partial","candidateRules":["OP-04","OP-05"],"primaryEvidence":"Incident + escalation + recovery evidence","reportedSourceCount":"15","sourceFrameworks":"ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Current events help, but enterprise response and kill-switch workflows are missing.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-2.4@4c58d159afdc4362","id":"TAIM-MANAGE-2.4","version":"4c58d159afdc4362","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 2.4","statement":"Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.","family":"MANAGE","body":{"sourceId":"MANAGE 2.4","mechanism":"System Configuration / Workflow","controlNature":"Corrective","automationTier":"E4","reportedSupport":"Roadmap","candidateRules":["OP-11","OP-05","OP-12","OP-03","AU-03"],"primaryEvidence":"Shutdown, deletion and revocation evidence","reportedSourceCount":"15","sourceFrameworks":"ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Can be automated with admin-plane integration and an approved workflow.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-2.4@7716c58006958476","id":"TAIM-MANAGE-2.4","version":"7716c58006958476","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 2.4","statement":"Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.","family":"","body":{"sourceId":"MANAGE 2.4","category":null,"categoryObjective":null,"question":"Are mechanisms in place and applied, and responsibilities assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use?","recommendation":"Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.","riskStatement":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-3.1@019b36616e569086","id":"TAIM-MANAGE-3.1","version":"019b36616e569086","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 3.1","statement":"AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.","family":"","body":{"sourceId":"MANAGE 3.1","category":"MANAGE 3","categoryObjective":"AI risks and benefits from third-party entities are managed.","question":"Are AI risks and benefits from third-party resources regularly monitored, and risk controls applied and documented?","recommendation":"Ensure that AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.","riskStatement":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-3.1@fa0c648cdd610fd5","id":"TAIM-MANAGE-3.1","version":"fa0c648cdd610fd5","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 3.1","statement":"AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.","family":"MANAGE","body":{"sourceId":"MANAGE 3.1","mechanism":"Third-Party / Contractual","controlNature":"Preventive / Detective","automationTier":"E1–E3","reportedSupport":"Roadmap","candidateRules":["OP-03","OP-10","AG-10","OP-01","OP-02"],"primaryEvidence":"Due diligence + contract + monitoring","reportedSourceCount":"16","sourceFrameworks":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Requires vendor and supply-chain integration beyond prompt inspection.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-3.2@3a8b74098cc691a2","id":"TAIM-MANAGE-3.2","version":"3a8b74098cc691a2","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 3.2","statement":"Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance.","family":"","body":{"sourceId":"MANAGE 3.2","category":null,"categoryObjective":null,"question":"Are pre-trained models which are used for development monitored as part of AI system regular monitoring and maintenance?","recommendation":"Ensure that pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance.","riskStatement":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-3.2@72d098f451a97bfc","id":"TAIM-MANAGE-3.2","version":"72d098f451a97bfc","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 3.2","statement":"Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance.","family":"MANAGE","body":{"sourceId":"MANAGE 3.2","mechanism":"Third-Party / Contractual","controlNature":"Preventive / Detective","automationTier":"E1–E3","reportedSupport":"Roadmap","candidateRules":["OP-03","OP-10","AG-10"],"primaryEvidence":"Due diligence + contract + monitoring","reportedSourceCount":"15","sourceFrameworks":"ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Requires vendor and supply-chain integration beyond prompt inspection.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-4.1@46658ac358537223","id":"TAIM-MANAGE-4.1","version":"46658ac358537223","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 4.1","statement":"Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.","family":"","body":{"sourceId":"MANAGE 4.1","category":"MANAGE 4","categoryObjective":"Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored regularly.","question":"Are post-deployment AI system monitoring plans implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management?","recommendation":"Ensure that post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.","riskStatement":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-4.1@ba6d42802623e508","id":"TAIM-MANAGE-4.1","version":"ba6d42802623e508","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 4.1","statement":"Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.","family":"MANAGE","body":{"sourceId":"MANAGE 4.1","mechanism":"System Configuration / Workflow","controlNature":"Corrective","automationTier":"E4","reportedSupport":"Roadmap","candidateRules":["OP-11","OP-05","OP-04","OP-03","OP-08"],"primaryEvidence":"Shutdown, deletion and revocation evidence","reportedSourceCount":"16","sourceFrameworks":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Can be automated with admin-plane integration and an approved workflow.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-4.2@6622b89a3cfef575","id":"TAIM-MANAGE-4.2","version":"6622b89a3cfef575","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 4.2","statement":"Measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors.","family":"MANAGE","body":{"sourceId":"MANAGE 4.2","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective","automationTier":"E1","reportedSupport":"Partial","candidateRules":["OP-03","OP-06"],"primaryEvidence":"Metric, alert and review evidence","reportedSourceCount":"16","sourceFrameworks":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-4.2@c85453fdd5b795d2","id":"TAIM-MANAGE-4.2","version":"c85453fdd5b795d2","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 4.2","statement":"Measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors.","family":"","body":{"sourceId":"MANAGE 4.2","category":null,"categoryObjective":null,"question":"Are measurable activities for continual improvements integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors?","recommendation":"Ensure that measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors.","riskStatement":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-4.3@6d72e9f28c581992","id":"TAIM-MANAGE-4.3","version":"6d72e9f28c581992","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 4.3","statement":"Incidents and errors are communicated to relevant AI actors, including affected communities. \n\nProcesses for tracking, responding to, and recovering from incidents and errors are followed and documented.","family":"MANAGE","body":{"sourceId":"MANAGE 4.3","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective / Corrective","automationTier":"E1–E4","reportedSupport":"Partial","candidateRules":["OP-04","OP-05","OP-01","OP-02"],"primaryEvidence":"Incident + escalation + recovery evidence","reportedSourceCount":"16","sourceFrameworks":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Current events help, but enterprise response and kill-switch workflows are missing.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MANAGE-4.3@86067afb96e12a89","id":"TAIM-MANAGE-4.3","version":"86067afb96e12a89","kind":"control","lifecycle":"EXTRACTED","title":"MANAGE 4.3","statement":"Incidents and errors are communicated to relevant AI actors, including affected communities. \n\nProcesses for tracking, responding to, and recovering from incidents and errors are followed and documented.","family":"","body":{"sourceId":"MANAGE 4.3","category":null,"categoryObjective":null,"question":"Are incidents and errors communicated to relevant AI actors, including affected communities?\n\nAre processes for tracking, responding to, and recovering from incidents and errors followed and documented?","recommendation":"Ensure that incidents and errors are communicated to relevant AI actors, including affected communities. \n\nEnsure that processes for tracking, responding to, and recovering from incidents and errors are followed and documented.","riskStatement":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-1.1@78b3fb055e68bb28","id":"TAIM-MAP-1.1","version":"78b3fb055e68bb28","kind":"control","lifecycle":"EXTRACTED","title":"MAP 1.1","statement":"Intended purposes, potentially beneficial uses, context specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented.\n\nConsiderations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related Test & Evaluation, Validation & Verification (TEVV) and system metrics.","family":"MAP","body":{"sourceId":"MAP 1.1","category":"MAP 1","categoryObjective":"Context is established and understood.","question":"Are intended purposes, potentially beneficial uses, context specific laws, norms and expectations, and prospective settings in which the AI system will be deployed understood and documented?\n\nDo considerations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related Test & Evaluation, Validation & Verification (TEVV) and system metrics?","recommendation":"Ensure that intended purposes, potentially beneficial uses, context specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented.\n\nEnsure that considerations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related Test & Evaluation, Validation & Verification (TEVV) and system metrics.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-1.1@f7aec3e0fde77d65","id":"TAIM-MAP-1.1","version":"f7aec3e0fde77d65","kind":"control","lifecycle":"EXTRACTED","title":"MAP 1.1","statement":"Intended purposes, potentially beneficial uses, context specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented.\n\nConsiderations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related Test & Evaluation, Validation & Verification (TEVV) and system metrics.","family":"MAP","body":{"sourceId":"MAP 1.1","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective","automationTier":"E1","reportedSupport":"Partial","candidateRules":["OP-03","OP-12","OP-06","OP-01","OP-02"],"primaryEvidence":"Metric, alert and review evidence","reportedSourceCount":"17","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-1.2@88267d6e5486e9ff","id":"TAIM-MAP-1.2","version":"88267d6e5486e9ff","kind":"control","lifecycle":"EXTRACTED","title":"MAP 1.2","statement":"Interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. Opportunities for interdisciplinary collaboration are prioritized.","family":"","body":{"sourceId":"MAP 1.2","category":null,"categoryObjective":null,"question":"Are interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation documented? \n\nAre opportunities for interdisciplinary collaboration prioritized?","recommendation":"Ensure that interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. \n\nEnsure that opportunities for interdisciplinary collaboration are prioritized.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":null,"sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-1.2@93024a692d8324ff","id":"TAIM-MAP-1.2","version":"93024a692d8324ff","kind":"control","lifecycle":"EXTRACTED","title":"MAP 1.2","statement":"Interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. Opportunities for interdisciplinary collaboration are prioritized.","family":"MAP","body":{"sourceId":"MAP 1.2","mechanism":"Human Competency","controlNature":"Directive","automationTier":"E0","reportedSupport":"Evidence only","candidateRules":["Supporting policy POL-19","OP-01","OP-02"],"primaryEvidence":"Training completion + competency result","reportedSourceCount":"14","sourceFrameworks":"ISO 24028; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Human evidence; no runtime transaction to intercept.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-1.3@1e631023c1414ce6","id":"TAIM-MAP-1.3","version":"1e631023c1414ce6","kind":"control","lifecycle":"EXTRACTED","title":"MAP 1.3","statement":"The organization’s mission and relevant goals for AI technology are understood and documented.","family":"","body":{"sourceId":"MAP 1.3","category":null,"categoryObjective":null,"question":"Are the organization’s mission and relevant goals for AI technology understood and documented?","recommendation":"Ensure that the organization’s mission and relevant goals for AI technology are understood and documented.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-1.3@405b97af733bc900","id":"TAIM-MAP-1.3","version":"405b97af733bc900","kind":"control","lifecycle":"EXTRACTED","title":"MAP 1.3","statement":"The organization’s mission and relevant goals for AI technology are understood and documented.","family":"MAP","body":{"sourceId":"MAP 1.3","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["OP-01","OP-02"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"7","sourceFrameworks":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; OWASP (source says 2025)","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-1.4@576a9621f7b44f60","id":"TAIM-MAP-1.4","version":"576a9621f7b44f60","kind":"control","lifecycle":"EXTRACTED","title":"MAP 1.4","statement":"The business value or context of business use has been clearly defined or – in the case of assessing existing AI systems – re-evaluated.","family":"","body":{"sourceId":"MAP 1.4","category":null,"categoryObjective":null,"question":"Have the business value or context of business use been clearly defined or – in the case of assessing existing AI systems – re-evaluated?","recommendation":"Ensure that the business value or context of business use has been clearly defined or – in the case of assessing existing AI systems – re-evaluated.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-1.4@867a4ceeddb4119d","id":"TAIM-MAP-1.4","version":"867a4ceeddb4119d","kind":"control","lifecycle":"EXTRACTED","title":"MAP 1.4","statement":"The business value or context of business use has been clearly defined or – in the case of assessing existing AI systems – re-evaluated.","family":"MAP","body":{"sourceId":"MAP 1.4","mechanism":"Assurance / Testing","controlNature":"Detective","automationTier":"E0–E1","reportedSupport":"Roadmap","candidateRules":["OP-12","OP-03"],"primaryEvidence":"Versioned evaluation plan, dataset and results","reportedSourceCount":"8","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; OWASP (source says 2025)","rationale":"Needs representative tests and acceptance thresholds rather than a simple content rule.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-1.5@076d4983d14ef5a0","id":"TAIM-MAP-1.5","version":"076d4983d14ef5a0","kind":"control","lifecycle":"EXTRACTED","title":"MAP 1.5","statement":"Organizational risk tolerances are determined and documented.","family":"","body":{"sourceId":"MAP 1.5","category":null,"categoryObjective":null,"question":"Are organizational risk tolerances determined and documented?","recommendation":"Ensure that organizational risk tolerances are determined and documented.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-1.5@7b28c9d1495f3a89","id":"TAIM-MAP-1.5","version":"7b28c9d1495f3a89","kind":"control","lifecycle":"EXTRACTED","title":"MAP 1.5","statement":"Organizational risk tolerances are determined and documented.","family":"MAP","body":{"sourceId":"MAP 1.5","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["AU-04","OP-07","OP-01","OP-02"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"14","sourceFrameworks":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-1.6@0ca81605dd8ee088","id":"TAIM-MAP-1.6","version":"0ca81605dd8ee088","kind":"control","lifecycle":"EXTRACTED","title":"MAP 1.6","statement":"System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. \n\nDesign decisions take socio-technical implications into account to address AI risks.","family":"MAP","body":{"sourceId":"MAP 1.6","mechanism":"Transaction Prevention / Monitoring","controlNature":"Preventive / Detective","automationTier":"E1–E3","reportedSupport":"Partial","candidateRules":["DP-07–DP-18","OU-01"],"primaryEvidence":"Decision logs + configuration + efficacy tests","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; OWASP (source says 2025)","rationale":"A subset can become content rules; broad control effectiveness still needs evidence and integration.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-1.6@be58945d827b6db0","id":"TAIM-MAP-1.6","version":"be58945d827b6db0","kind":"control","lifecycle":"EXTRACTED","title":"MAP 1.6","statement":"System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. \n\nDesign decisions take socio-technical implications into account to address AI risks.","family":"","body":{"sourceId":"MAP 1.6","category":null,"categoryObjective":null,"question":"Are system requirements (e.g., “the system shall respect the privacy of its users”) elicited from and understood by relevant AI actors?\n\nDoes design decisions take socio-technical implications into account to address AI risks?","recommendation":"Ensure that system requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. \n\nEnsure that design decisions take socio-technical implications into account to address AI risks.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-2.1@24236a0f4fe9d355","id":"TAIM-MAP-2.1","version":"24236a0f4fe9d355","kind":"control","lifecycle":"EXTRACTED","title":"MAP 2.1","statement":"The specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders).","family":"MAP","body":{"sourceId":"MAP 2.1","mechanism":"Workflow / Process","controlNature":"Directive / Preventive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["No direct runtime rule","retain as program control"],"primaryEvidence":"Control-specific evidence","reportedSourceCount":"8","sourceFrameworks":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Holistic TAIM control; determine implementation after use-case applicability assessment.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-2.1@4508ecde43a2dc95","id":"TAIM-MAP-2.1","version":"4508ecde43a2dc95","kind":"control","lifecycle":"EXTRACTED","title":"MAP 2.1","statement":"The specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders).","family":"","body":{"sourceId":"MAP 2.1","category":"MAP 2","categoryObjective":"Categorization of the AI system is performed.","question":"Are the specific tasks and methods used to implement the tasks that the AI system will support defined (e.g., classifiers, generative models, recommenders)?","recommendation":"Ensure that the specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders).","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-2.2@318e6e5f8367a840","id":"TAIM-MAP-2.2","version":"318e6e5f8367a840","kind":"control","lifecycle":"EXTRACTED","title":"MAP 2.2","statement":"Information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans is documented. \n\nDocumentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions.","family":"","body":{"sourceId":"MAP 2.2","category":null,"categoryObjective":null,"question":"Is information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans documented?\n\nDoes documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions?","recommendation":"Ensure that information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans is documented. \n\nEnsure that documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-2.2@c9b1594e914d9478","id":"TAIM-MAP-2.2","version":"c9b1594e914d9478","kind":"control","lifecycle":"EXTRACTED","title":"MAP 2.2","statement":"Information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans is documented. \n\nDocumentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions.","family":"MAP","body":{"sourceId":"MAP 2.2","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["OP-01","OP-02"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"8","sourceFrameworks":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-2.3@595fdc3a6417dcba","id":"TAIM-MAP-2.3","version":"595fdc3a6417dcba","kind":"control","lifecycle":"EXTRACTED","title":"MAP 2.3","statement":"Scientific integrity and Test & Evaluation, Validation & Verification (TEVV) considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.","family":"","body":{"sourceId":"MAP 2.3","category":null,"categoryObjective":null,"question":"Are scientific integrity and Test & Evaluation, Validation & Verification (TEVV) considerations identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation?","recommendation":"Ensure that scientific integrity and Test & Evaluation, Validation & Verification (TEVV) considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-2.3@98b8065b9500c2b5","id":"TAIM-MAP-2.3","version":"98b8065b9500c2b5","kind":"control","lifecycle":"EXTRACTED","title":"MAP 2.3","statement":"Scientific integrity and Test & Evaluation, Validation & Verification (TEVV) considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.","family":"MAP","body":{"sourceId":"MAP 2.3","mechanism":"Assurance / Testing","controlNature":"Detective","automationTier":"E0–E1","reportedSupport":"Roadmap","candidateRules":["OP-12","OP-03","OP-01","OP-02"],"primaryEvidence":"Versioned evaluation plan, dataset and results","reportedSourceCount":"8","sourceFrameworks":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Needs representative tests and acceptance thresholds rather than a simple content rule.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-3.1@5aadf0f832148043","id":"TAIM-MAP-3.1","version":"5aadf0f832148043","kind":"control","lifecycle":"EXTRACTED","title":"MAP 3.1","statement":"Potential benefits of intended AI system functionality and performance are examined and documented.","family":"MAP","body":{"sourceId":"MAP 3.1","mechanism":"Assurance / Testing","controlNature":"Detective","automationTier":"E0–E1","reportedSupport":"Roadmap","candidateRules":["OP-12","OP-03","OP-01","OP-02"],"primaryEvidence":"Versioned evaluation plan, dataset and results","reportedSourceCount":"6","sourceFrameworks":"ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws","rationale":"Needs representative tests and acceptance thresholds rather than a simple content rule.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-3.1@8cf079d1257ee929","id":"TAIM-MAP-3.1","version":"8cf079d1257ee929","kind":"control","lifecycle":"EXTRACTED","title":"MAP 3.1","statement":"Potential benefits of intended AI system functionality and performance are examined and documented.","family":"","body":{"sourceId":"MAP 3.1","category":"MAP 3","categoryObjective":"AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","question":"Are potential benefits of intended AI system functionality and performance  examined and documented?","recommendation":"Ensure that potential benefits of intended AI system functionality and performance are examined and documented.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-3.2@68f17d5dab909a30","id":"TAIM-MAP-3.2","version":"68f17d5dab909a30","kind":"control","lifecycle":"EXTRACTED","title":"MAP 3.2","statement":"Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness – as connected to organizational risk tolerance\n– are examined and documented.","family":"MAP","body":{"sourceId":"MAP 3.2","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective / Corrective","automationTier":"E1–E4","reportedSupport":"Partial","candidateRules":["OP-04","OP-05","AU-04","OP-07","OP-01"],"primaryEvidence":"Incident + escalation + recovery evidence","reportedSourceCount":"9","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Current events help, but enterprise response and kill-switch workflows are missing.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-3.2@b4079d9aebeb395d","id":"TAIM-MAP-3.2","version":"b4079d9aebeb395d","kind":"control","lifecycle":"EXTRACTED","title":"MAP 3.2","statement":"Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness – as connected to organizational risk tolerance\n– are examined and documented.","family":"","body":{"sourceId":"MAP 3.2","category":null,"categoryObjective":null,"question":"Are potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness – as connected to organizational risk tolerance – examined and documented?","recommendation":"Ensure that potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness – as connected to organizational risk tolerance – are examined and documented.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-3.3@2dcbe4ab43aa4492","id":"TAIM-MAP-3.3","version":"2dcbe4ab43aa4492","kind":"control","lifecycle":"EXTRACTED","title":"MAP 3.3","statement":"Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.","family":"MAP","body":{"sourceId":"MAP 3.3","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["OP-01","OP-02"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"9","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-3.3@db54472c934e7816","id":"TAIM-MAP-3.3","version":"db54472c934e7816","kind":"control","lifecycle":"EXTRACTED","title":"MAP 3.3","statement":"Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.","family":"","body":{"sourceId":"MAP 3.3","category":null,"categoryObjective":null,"question":"Is targeted application scope specified and documented based on the system’s capability, established context, and AI system categorization?","recommendation":"Ensure that targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-3.4@171bc4d2aa86131b","id":"TAIM-MAP-3.4","version":"171bc4d2aa86131b","kind":"control","lifecycle":"EXTRACTED","title":"MAP 3.4","statement":"Processes for operator and practitioner proficiency with AI system performance and trustworthiness – and relevant technical standards and certifications – are defined, assessed, and documented.","family":"","body":{"sourceId":"MAP 3.4","category":null,"categoryObjective":null,"question":"Are processes for operator and practitioner proficiency with AI system performance and trustworthiness – and relevant technical standards and certifications – defined, assessed, and documented?","recommendation":"Ensure that processes for operator and practitioner proficiency with AI system performance and trustworthiness – and relevant technical standards and certifications – are defined, assessed, and documented.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-3.4@e310d1f6e2a1ea35","id":"TAIM-MAP-3.4","version":"e310d1f6e2a1ea35","kind":"control","lifecycle":"EXTRACTED","title":"MAP 3.4","statement":"Processes for operator and practitioner proficiency with AI system performance and trustworthiness – and relevant technical standards and certifications – are defined, assessed, and documented.","family":"MAP","body":{"sourceId":"MAP 3.4","mechanism":"Assurance / Testing","controlNature":"Detective","automationTier":"E0–E1","reportedSupport":"Roadmap","candidateRules":["OP-12","OP-03","OP-01","OP-02"],"primaryEvidence":"Versioned evaluation plan, dataset and results","reportedSourceCount":"7","sourceFrameworks":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws","rationale":"Needs representative tests and acceptance thresholds rather than a simple content rule.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-3.5@03aad24c9f287fab","id":"TAIM-MAP-3.5","version":"03aad24c9f287fab","kind":"control","lifecycle":"EXTRACTED","title":"MAP 3.5","statement":"Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.","family":"MAP","body":{"sourceId":"MAP 3.5","mechanism":"Workflow / Process","controlNature":"Preventive / Corrective","automationTier":"E2","reportedSupport":"Roadmap","candidateRules":["OU-04","AU-04","OP-01","OP-02"],"primaryEvidence":"Assessment, approval, appeal or override record","reportedSourceCount":"8","sourceFrameworks":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Requires a workflow engine and accountable human decision.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","id":"TAIM-MAP-3.5","version":"ff2d44ca4f9b3a50","kind":"control","lifecycle":"EXTRACTED","title":"MAP 3.5","statement":"Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.","family":"","body":{"sourceId":"MAP 3.5","category":null,"categoryObjective":null,"question":"Are processes for human oversight defined, assessed, and documented in accordance with organizational policies from the GOVERN function?","recommendation":"Ensure that processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-4.1@47a77b8622793a72","id":"TAIM-MAP-4.1","version":"47a77b8622793a72","kind":"control","lifecycle":"EXTRACTED","title":"MAP 4.1","statement":"Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.","family":"MAP","body":{"sourceId":"MAP 4.1","mechanism":"Third-Party / Contractual","controlNature":"Preventive / Detective","automationTier":"E1–E3","reportedSupport":"Roadmap","candidateRules":["OP-10","AG-10","OP-01","OP-02"],"primaryEvidence":"Due diligence + contract + monitoring","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Requires vendor and supply-chain integration beyond prompt inspection.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-4.1@59a21bb34b454e39","id":"TAIM-MAP-4.1","version":"59a21bb34b454e39","kind":"control","lifecycle":"EXTRACTED","title":"MAP 4.1","statement":"Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.","family":"","body":{"sourceId":"MAP 4.1","category":"MAP 4","categoryObjective":"Risks and benefits are mapped for all components of the AI system including third-party software and data.","question":"Are approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights?","recommendation":"Ensure that approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-4.2@0287d8ad2ea3574d","id":"TAIM-MAP-4.2","version":"0287d8ad2ea3574d","kind":"control","lifecycle":"EXTRACTED","title":"MAP 4.2","statement":"Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented.","family":"","body":{"sourceId":"MAP 4.2","category":null,"categoryObjective":null,"question":"Are internal risk controls for components of the AI system, including third-party AI technologies, identified and documented?","recommendation":"Ensure that internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-4.2@ba7614350b99a7d0","id":"TAIM-MAP-4.2","version":"ba7614350b99a7d0","kind":"control","lifecycle":"EXTRACTED","title":"MAP 4.2","statement":"Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented.","family":"MAP","body":{"sourceId":"MAP 4.2","mechanism":"Third-Party / Contractual","controlNature":"Preventive / Detective","automationTier":"E1–E3","reportedSupport":"Roadmap","candidateRules":["OP-10","AG-10","OP-01","OP-02"],"primaryEvidence":"Due diligence + contract + monitoring","reportedSourceCount":"15","sourceFrameworks":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; OWASP (source says 2025)","rationale":"Requires vendor and supply-chain integration beyond prompt inspection.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-5.1@4170d53e4eea6a66","id":"TAIM-MAP-5.1","version":"4170d53e4eea6a66","kind":"control","lifecycle":"EXTRACTED","title":"MAP 5.1","statement":"Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.","family":"MAP","body":{"sourceId":"MAP 5.1","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective / Corrective","automationTier":"E1–E4","reportedSupport":"Partial","candidateRules":["OP-04","OP-05","OP-08","OP-01","OP-02"],"primaryEvidence":"Incident + escalation + recovery evidence","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Current events help, but enterprise response and kill-switch workflows are missing.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-5.1@eeeb1c9210779883","id":"TAIM-MAP-5.1","version":"eeeb1c9210779883","kind":"control","lifecycle":"EXTRACTED","title":"MAP 5.1","statement":"Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.","family":"","body":{"sourceId":"MAP 5.1","category":"MAP 5","categoryObjective":"Impacts to individuals, groups, communities, organizations, and society are characterized.","question":"Are likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data identified and documented?","recommendation":"Ensure that likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-5.2@4fe1fea3a40c08e0","id":"TAIM-MAP-5.2","version":"4fe1fea3a40c08e0","kind":"control","lifecycle":"EXTRACTED","title":"MAP 5.2","statement":"Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented.","family":"MAP","body":{"sourceId":"MAP 5.2","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["OP-08","OP-01","OP-02"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MAP-5.2@d9cbb5e90cd723ff","id":"TAIM-MAP-5.2","version":"d9cbb5e90cd723ff","kind":"control","lifecycle":"EXTRACTED","title":"MAP 5.2","statement":"Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented.","family":"","body":{"sourceId":"MAP 5.2","category":null,"categoryObjective":null,"question":"Are practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts in place and documented?","recommendation":"Ensure that practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented.","riskStatement":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-1.1@06bafc72fb94bf95","id":"TAIM-MEASURE-1.1","version":"06bafc72fb94bf95","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 1.1","statement":"Approaches and metrics for measurement of AI risks enumerated during the MAP function are selected for implementation starting with the most significant AI risks. \n\nThe risks or trustworthiness characteristics that will not – or cannot – be measured are properly documented.","family":"MEASURE","body":{"sourceId":"MEASURE 1.1","category":"MEASURE 1","categoryObjective":"Appropriate methods and metrics are identified and applied.","question":"Are approaches and metrics for measurement of AI risks enumerated during the MAP function selected for implementation starting with the most significant AI risks? \n\nAre the risks or trustworthiness characteristics that will not – or cannot – be measured properly documented?","recommendation":"Ensure that approaches and metrics for measurement of AI risks enumerated during the MAP function are selected for implementation starting with the most significant AI risks. \n\nEnsure that the risks or trustworthiness characteristics that will not – or cannot – be measured are properly documented.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-1.1@80d658f30e1d4e80","id":"TAIM-MEASURE-1.1","version":"80d658f30e1d4e80","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 1.1","statement":"Approaches and metrics for measurement of AI risks enumerated during the MAP function are selected for implementation starting with the most significant AI risks. \n\nThe risks or trustworthiness characteristics that will not – or cannot – be measured are properly documented.","family":"MEASURE","body":{"sourceId":"MEASURE 1.1","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective","automationTier":"E1","reportedSupport":"Partial","candidateRules":["OP-03","OP-01","OP-02"],"primaryEvidence":"Metric, alert and review evidence","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-1.2@6a15ee51fbe22034","id":"TAIM-MEASURE-1.2","version":"6a15ee51fbe22034","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 1.2","statement":"Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities.","family":"","body":{"sourceId":"MEASURE 1.2","category":null,"categoryObjective":null,"question":"Are appropriateness of AI metrics and effectiveness of existing controls regularly assessed and updated, including reports of errors and potential impacts on affected communities?","recommendation":"Ensure that appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-1.2@b5c24007b17017b3","id":"TAIM-MEASURE-1.2","version":"b5c24007b17017b3","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 1.2","statement":"Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities.","family":"MEASURE","body":{"sourceId":"MEASURE 1.2","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective / Corrective","automationTier":"E1–E4","reportedSupport":"Partial","candidateRules":["OP-04","OP-05","OP-03","OP-06"],"primaryEvidence":"Incident + escalation + recovery evidence","reportedSourceCount":"15","sourceFrameworks":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; OWASP (source says 2025)","rationale":"Current events help, but enterprise response and kill-switch workflows are missing.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-1.3@438e7613521eceac","id":"TAIM-MEASURE-1.3","version":"438e7613521eceac","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 1.3","statement":"Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. \n\nDomain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance.","family":"MEASURE","body":{"sourceId":"MEASURE 1.3","mechanism":"Workflow / Process","controlNature":"Directive / Preventive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["AU-04","OP-07","OP-06"],"primaryEvidence":"Control-specific evidence","reportedSourceCount":"15","sourceFrameworks":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Holistic TAIM control; determine implementation after use-case applicability assessment.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-1.3@4da0283611f39f57","id":"TAIM-MEASURE-1.3","version":"4da0283611f39f57","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 1.3","statement":"Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. \n\nDomain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance.","family":"","body":{"sourceId":"MEASURE 1.3","category":null,"categoryObjective":null,"question":"Are internal experts who did not serve as front-line developers for the system and/or independent assessors involved in regular assessments and updates?\n\nAre domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities consulted in support of assessments as necessary per organizational risk tolerance?","recommendation":"Ensure that internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. \n\nEnsure that domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.1@bfec014736abe868","id":"TAIM-MEASURE-2.1","version":"bfec014736abe868","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.1","statement":"Test sets, metrics, and details about the tools used during Test & Evaluation, Validation & Verification (TEVV) are documented.","family":"MEASURE","body":{"sourceId":"MEASURE 2.1","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective","automationTier":"E1","reportedSupport":"Partial","candidateRules":["OP-03","OP-12","OP-01","OP-02"],"primaryEvidence":"Metric, alert and review evidence","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.1@e9330844656a4ab1","id":"TAIM-MEASURE-2.1","version":"e9330844656a4ab1","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.1","statement":"Test sets, metrics, and details about the tools used during Test & Evaluation, Validation & Verification (TEVV) are documented.","family":"","body":{"sourceId":"MEASURE 2.1","category":"MEASURE 2","categoryObjective":"AI systems are evaluated for trustworthy characteristics.","question":"Are test sets, metrics, and details about the tools used during Test & Evaluation, Validation & Verification (TEVV) documented?","recommendation":"Ensure that test sets, metrics, and details about the tools used during Test & Evaluation, Validation & Verification (TEVV) are documented.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.10@00041240562d2f6b","id":"TAIM-MEASURE-2.10","version":"00041240562d2f6b","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.10","statement":"Privacy risk of the AI system – as identified in the MAP function – is examined and documented.","family":"","body":{"sourceId":"MEASURE 2.10","category":null,"categoryObjective":null,"question":"Is privacy risk of the AI system – as identified in the MAP function – examined and documented?","recommendation":"Ensure that privacy risk of the AI system – as identified in the MAP function – is examined and documented.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.10@6df5b5c790a49492","id":"TAIM-MEASURE-2.10","version":"6df5b5c790a49492","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.10","statement":"Privacy risk of the AI system – as identified in the MAP function – is examined and documented.","family":"MEASURE","body":{"sourceId":"MEASURE 2.10","mechanism":"Transaction Prevention / Monitoring","controlNature":"Preventive / Detective","automationTier":"E1–E3","reportedSupport":"Partial","candidateRules":["DP-07–DP-18","OU-01","OP-01","OP-02"],"primaryEvidence":"Decision logs + configuration + efficacy tests","reportedSourceCount":"17","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"A subset can become content rules; broad control effectiveness still needs evidence and integration.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.11@69c078796341cd3b","id":"TAIM-MEASURE-2.11","version":"69c078796341cd3b","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.11","statement":"Fairness and bias – as identified in the MAP function – are evaluated and results are documented.","family":"MEASURE","body":{"sourceId":"MEASURE 2.11","mechanism":"Assurance / Testing","controlNature":"Detective","automationTier":"E0–E1","reportedSupport":"Roadmap","candidateRules":["OU-05","OP-12","OP-03","OP-01","OP-02"],"primaryEvidence":"Versioned evaluation plan, dataset and results","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Needs representative tests and acceptance thresholds rather than a simple content rule.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.11@c547147a38410e2a","id":"TAIM-MEASURE-2.11","version":"c547147a38410e2a","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.11","statement":"Fairness and bias – as identified in the MAP function – are evaluated and results are documented.","family":"","body":{"sourceId":"MEASURE 2.11","category":null,"categoryObjective":null,"question":"Are fairness and bias – as identified in the MAP function – evaluated and results documented?","recommendation":"Ensure that Fairness and bias – as identified in the MAP\nfunction – are evaluated and results are documented.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.12@12d74b82b770347a","id":"TAIM-MEASURE-2.12","version":"12d74b82b770347a","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.12","statement":"Environmental impact and sustainability of AI model training and management activities – as identified in the MAP function – are assessed and documented.","family":"MEASURE","body":{"sourceId":"MEASURE 2.12","mechanism":"Human Competency","controlNature":"Directive","automationTier":"E0","reportedSupport":"Evidence only","candidateRules":["Supporting policy POL-19","OP-01","OP-02"],"primaryEvidence":"Training completion + competency result","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Human evidence; no runtime transaction to intercept.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.12@242501cce6559442","id":"TAIM-MEASURE-2.12","version":"242501cce6559442","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.12","statement":"Environmental impact and sustainability of AI model training and management activities – as identified in the MAP function – are assessed and documented.","family":"","body":{"sourceId":"MEASURE 2.12","category":null,"categoryObjective":null,"question":"Are environmental impact and sustainability of AI model training and management activities – as identified in the MAP function – assessed and documented?","recommendation":"Ensure that environmental impact and sustainability of AI model training and management activities – as identified in the MAP function – are assessed and documented.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.13@12d2da14f2779af3","id":"TAIM-MEASURE-2.13","version":"12d2da14f2779af3","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.13","statement":"Effectiveness of the employed Test & Evaluation, Validation & Verification (TEVV) metrics and processes in the MEASURE function are evaluated and documented.","family":"MEASURE","body":{"sourceId":"MEASURE 2.13","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective","automationTier":"E1","reportedSupport":"Partial","candidateRules":["OP-03","OP-12","OP-01","OP-02"],"primaryEvidence":"Metric, alert and review evidence","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.13@48fc4cc20ecff047","id":"TAIM-MEASURE-2.13","version":"48fc4cc20ecff047","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.13","statement":"Effectiveness of the employed Test & Evaluation, Validation & Verification (TEVV) metrics and processes in the MEASURE function are evaluated and documented.","family":"","body":{"sourceId":"MEASURE 2.13","category":null,"categoryObjective":null,"question":"Is effectiveness of the employed Test & Evaluation, Validation & Verification (TEVV) metrics and processes in the MEASURE function evaluated and documented?","recommendation":"Ensure that effectiveness of the employed Test & Evaluation, Validation & Verification (TEVV) metrics and processes in the MEASURE function are evaluated and documented.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.2@10cd0cb098928172","id":"TAIM-MEASURE-2.2","version":"10cd0cb098928172","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.2","statement":"Evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population.","family":"","body":{"sourceId":"MEASURE 2.2","category":null,"categoryObjective":null,"question":"Do evaluations involving human subjects meet applicable requirements (including human subject protection) and  representative of the relevant population?","recommendation":"Ensure that evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.2@f1b91c01b8b926be","id":"TAIM-MEASURE-2.2","version":"f1b91c01b8b926be","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.2","statement":"Evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population.","family":"MEASURE","body":{"sourceId":"MEASURE 2.2","mechanism":"Assurance / Testing","controlNature":"Detective","automationTier":"E0–E1","reportedSupport":"Roadmap","candidateRules":["OP-12","OP-03"],"primaryEvidence":"Versioned evaluation plan, dataset and results","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Needs representative tests and acceptance thresholds rather than a simple content rule.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","id":"TAIM-MEASURE-2.3","version":"6bbc2ff3a1f7aad7","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.3","statement":"AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). \n\nMeasures are documented.","family":"","body":{"sourceId":"MEASURE 2.3","category":null,"categoryObjective":null,"question":"Are AI system performance or assurance criteria measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s)? \n\nAre measures documented?","recommendation":"Ensure that AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). \n\nEnsure that measures are documented.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.3@f396bee25387e21c","id":"TAIM-MEASURE-2.3","version":"f396bee25387e21c","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.3","statement":"AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). \n\nMeasures are documented.","family":"MEASURE","body":{"sourceId":"MEASURE 2.3","mechanism":"Assurance / Testing","controlNature":"Detective","automationTier":"E0–E1","reportedSupport":"Roadmap","candidateRules":["OP-12","OP-03","OP-01","OP-02"],"primaryEvidence":"Versioned evaluation plan, dataset and results","reportedSourceCount":"14","sourceFrameworks":"ISO 24028; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Needs representative tests and acceptance thresholds rather than a simple content rule.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.4@30416b6b4c6068dd","id":"TAIM-MEASURE-2.4","version":"30416b6b4c6068dd","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.4","statement":"The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.","family":"MEASURE","body":{"sourceId":"MEASURE 2.4","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective","automationTier":"E1","reportedSupport":"Partial","candidateRules":["OP-03"],"primaryEvidence":"Metric, alert and review evidence","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.4@4f759def92d244b2","id":"TAIM-MEASURE-2.4","version":"4f759def92d244b2","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.4","statement":"The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.","family":"","body":{"sourceId":"MEASURE 2.4","category":null,"categoryObjective":null,"question":"Are the functionality and behavior of the AI system and its components – as identified in the MAP function –  monitored when in production?","recommendation":"Ensure that the functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.5@530446e7cdd7b14a","id":"TAIM-MEASURE-2.5","version":"530446e7cdd7b14a","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.5","statement":"The AI system to be deployed is demonstrated to be valid and reliable. \n\nLimitations of the generalizability beyond the conditions under which the technology was developed are documented.","family":"","body":{"sourceId":"MEASURE 2.5","category":null,"categoryObjective":null,"question":"Is the AI system to be deployed demonstrated to be valid and reliable?\n\nAre limitations of the generalizability beyond the conditions under which the technology was developed documented?","recommendation":"Ensure that the AI system to be deployed is demonstrated to be valid and reliable. \n\nEnsure that limitations of the generalizability beyond the conditions under which the technology was developed are documented.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.5@f17bf250e010d494","id":"TAIM-MEASURE-2.5","version":"f17bf250e010d494","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.5","statement":"The AI system to be deployed is demonstrated to be valid and reliable. \n\nLimitations of the generalizability beyond the conditions under which the technology was developed are documented.","family":"MEASURE","body":{"sourceId":"MEASURE 2.5","mechanism":"Assurance / Testing","controlNature":"Detective","automationTier":"E0–E1","reportedSupport":"Roadmap","candidateRules":["OP-12","OP-03","OP-01","OP-02"],"primaryEvidence":"Versioned evaluation plan, dataset and results","reportedSourceCount":"15","sourceFrameworks":"ISO 24028; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Needs representative tests and acceptance thresholds rather than a simple content rule.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.6@36a069327f5d2611","id":"TAIM-MEASURE-2.6","version":"36a069327f5d2611","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.6","statement":"The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.","family":"","body":{"sourceId":"MEASURE 2.6","category":null,"categoryObjective":null,"question":"Is the AI system evaluated regularly for safety risks – as identified in the MAP function? \n\nIs the AI system to be deployed demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits?\n\nDoes safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures?","recommendation":"Ensure that the AI system is evaluated regularly for safety risks – as identified in the MAP function. \n\nEnsure that the AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. \n\nEnsure that safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","id":"TAIM-MEASURE-2.6","version":"6c6a748c4eb801b3","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.6","statement":"The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.","family":"MEASURE","body":{"sourceId":"MEASURE 2.6","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective","automationTier":"E1","reportedSupport":"Partial","candidateRules":["OP-03","IN-01–IN-06","OP-12","AU-04","OP-07"],"primaryEvidence":"Metric, alert and review evidence","reportedSourceCount":"17","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.7@4fefc7d979469953","id":"TAIM-MEASURE-2.7","version":"4fefc7d979469953","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.7","statement":"AI system security and resilience – as identified in the MAP function – are evaluated and documented.","family":"MEASURE","body":{"sourceId":"MEASURE 2.7","mechanism":"Assurance / Testing","controlNature":"Detective","automationTier":"E0–E1","reportedSupport":"Roadmap","candidateRules":["IN-01–IN-06","OP-12","OP-03","OP-01","OP-02"],"primaryEvidence":"Versioned evaluation plan, dataset and results","reportedSourceCount":"17","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Needs representative tests and acceptance thresholds rather than a simple content rule.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.7@5b57e3e360c405ae","id":"TAIM-MEASURE-2.7","version":"5b57e3e360c405ae","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.7","statement":"AI system security and resilience – as identified in the MAP function – are evaluated and documented.","family":"","body":{"sourceId":"MEASURE 2.7","category":null,"categoryObjective":null,"question":"Are AI system security and resilience – as identified in the MAP function – evaluated and documented?","recommendation":"Ensure that AI system security and resilience – as identified in the MAP function – are evaluated and documented.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.8@263030dd27d71a53","id":"TAIM-MEASURE-2.8","version":"263030dd27d71a53","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.8","statement":"Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.","family":"","body":{"sourceId":"MEASURE 2.8","category":null,"categoryObjective":null,"question":"Are risks associated with transparency and accountability – as identified in the MAP function – examined and documented?","recommendation":"Ensure that risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.8@927b0554749a76e0","id":"TAIM-MEASURE-2.8","version":"927b0554749a76e0","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.8","statement":"Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.","family":"MEASURE","body":{"sourceId":"MEASURE 2.8","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["OU-04","AU-04","OP-01","OP-02"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.9@3e99c99461743bec","id":"TAIM-MEASURE-2.9","version":"3e99c99461743bec","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.9","statement":"The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.","family":"MEASURE","body":{"sourceId":"MEASURE 2.9","mechanism":"Assurance / Testing","controlNature":"Detective","automationTier":"E0–E1","reportedSupport":"Roadmap","candidateRules":["OU-12","OP-02","OP-12","OP-03","OP-01"],"primaryEvidence":"Versioned evaluation plan, dataset and results","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Needs representative tests and acceptance thresholds rather than a simple content rule.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-2.9@81925d68d826c01b","id":"TAIM-MEASURE-2.9","version":"81925d68d826c01b","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 2.9","statement":"The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.","family":"","body":{"sourceId":"MEASURE 2.9","category":null,"categoryObjective":null,"question":"Is the AI model explained, validated, and documented, and AI system output interpreted within its context – as identified in the MAP function – to inform responsible use and governance?","recommendation":"Ensure that the AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-3.1@1a8a34c7269bc006","id":"TAIM-MEASURE-3.1","version":"1a8a34c7269bc006","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 3.1","statement":"Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts.","family":"","body":{"sourceId":"MEASURE 3.1","category":"MEASURE 3","categoryObjective":"Mechanisms for tracking identified AI risks over time are in place.","question":"Are approaches, personnel, and documentation in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts?","recommendation":"Ensure that approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-3.1@6a9415a16f00ace2","id":"TAIM-MEASURE-3.1","version":"6a9415a16f00ace2","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 3.1","statement":"Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts.","family":"MEASURE","body":{"sourceId":"MEASURE 3.1","mechanism":"Assurance / Testing","controlNature":"Detective","automationTier":"E0–E1","reportedSupport":"Roadmap","candidateRules":["OP-12","OP-03","OP-01","OP-02"],"primaryEvidence":"Versioned evaluation plan, dataset and results","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Needs representative tests and acceptance thresholds rather than a simple content rule.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-3.2@0a3eca3853caf2e2","id":"TAIM-MEASURE-3.2","version":"0a3eca3853caf2e2","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 3.2","statement":"Risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available.","family":"MEASURE","body":{"sourceId":"MEASURE 3.2","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective","automationTier":"E1","reportedSupport":"Partial","candidateRules":["OP-03"],"primaryEvidence":"Metric, alert and review evidence","reportedSourceCount":"14","sourceFrameworks":"ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","rationale":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","id":"TAIM-MEASURE-3.2","version":"6f40134ebd7ed5cb","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 3.2","statement":"Risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available.","family":"","body":{"sourceId":"MEASURE 3.2","category":null,"categoryObjective":null,"question":"Are risk tracking approaches considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available?","recommendation":"Ensure that risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","id":"TAIM-MEASURE-3.3","version":"2bad1c9c0d1cd79c","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 3.3","statement":"Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.","family":"","body":{"sourceId":"MEASURE 3.3","category":null,"categoryObjective":null,"question":"Are feedback processes for end users and impacted communities to report problems and appeal system outcomes established and integrated into AI system evaluation metrics?","recommendation":"Ensure that feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-3.3@6a5560394079e008","id":"TAIM-MEASURE-3.3","version":"6a5560394079e008","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 3.3","statement":"Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.","family":"MEASURE","body":{"sourceId":"MEASURE 3.3","mechanism":"Continuous Detection / Monitoring","controlNature":"Detective","automationTier":"E1","reportedSupport":"Partial","candidateRules":["OP-03","OP-08","OP-12"],"primaryEvidence":"Metric, alert and review evidence","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","id":"TAIM-MEASURE-4.1","version":"40ef8aa2bd2594e6","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 4.1","statement":"Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented.","family":"","body":{"sourceId":"MEASURE 4.1","category":"MEASURE 4","categoryObjective":"Feedback about efficacy of measurement is gathered and assessed.","question":"Are measurement approaches for identifying AI risks connected to deployment context(s) and informed through consultation with domain experts and other end users?\n\nAre approaches documented?","recommendation":"Ensure that measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. \n\nEnsure that approaches are documented.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-4.1@87efb87b60ce14d1","id":"TAIM-MEASURE-4.1","version":"87efb87b60ce14d1","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 4.1","statement":"Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented.","family":"MEASURE","body":{"sourceId":"MEASURE 4.1","mechanism":"Document / Policy or Workflow","controlNature":"Directive","automationTier":"E0–E2","reportedSupport":"Evidence only","candidateRules":["OP-01","OP-02"],"primaryEvidence":"Approved document or workflow record","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Defines the control environment; does not itself prove technical enforcement.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-4.2@3880f07b20cefd80","id":"TAIM-MEASURE-4.2","version":"3880f07b20cefd80","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 4.2","statement":"Measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. \n\nResults are documented.","family":"","body":{"sourceId":"MEASURE 4.2","category":null,"categoryObjective":null,"question":"Are measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle  informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended? \n\nAre results documented?","recommendation":"Ensure that measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. \n\nEnsure that results are documented.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-4.2@441148e8e1148dbe","id":"TAIM-MEASURE-4.2","version":"441148e8e1148dbe","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 4.2","statement":"Measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. \n\nResults are documented.","family":"MEASURE","body":{"sourceId":"MEASURE 4.2","mechanism":"Assurance / Testing","controlNature":"Detective","automationTier":"E0–E1","reportedSupport":"Roadmap","candidateRules":["OP-12","OP-03","OP-06","OP-01","OP-02"],"primaryEvidence":"Versioned evaluation plan, dataset and results","reportedSourceCount":"16","sourceFrameworks":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Needs representative tests and acceptance thresholds rather than a simple content rule.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-4.3@0b263792260e087e","id":"TAIM-MEASURE-4.3","version":"0b263792260e087e","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 4.3","statement":"Measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context relevant risks and trustworthiness characteristics are identified and documented.","family":"","body":{"sourceId":"MEASURE 4.3","category":null,"categoryObjective":null,"question":"Are measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context relevant risks and trustworthiness characteristics identified and documented?","recommendation":"Ensure that measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context relevant risks and trustworthiness characteristics are identified and documented.","riskStatement":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","people":"✓","process":"✓","data":"✓","technology":"✓","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"TAIM-MEASURE-4.3@759303d11da3ea95","id":"TAIM-MEASURE-4.3","version":"759303d11da3ea95","kind":"control","lifecycle":"EXTRACTED","title":"MEASURE 4.3","statement":"Measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context relevant risks and trustworthiness characteristics are identified and documented.","family":"MEASURE","body":{"sourceId":"MEASURE 4.3","mechanism":"Assurance / Testing","controlNature":"Detective","automationTier":"E0–E1","reportedSupport":"Roadmap","candidateRules":["OP-12","OP-03","OP-01","OP-02"],"primaryEvidence":"Versioned evaluation plan, dataset and results","reportedSourceCount":"16","sourceFrameworks":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","rationale":"Needs representative tests and acceptance thresholds rather than a simple content rule.","sourceDate":"2026-08-20","enforcementVerified":false}},{"key":"FW-AU-PRIVACY-AI@cc7182c7d5cefeb1","id":"FW-AU-PRIVACY-AI","version":"cc7182c7d5cefeb1","kind":"framework","lifecycle":"REFERENCE","title":"Australia Privacy Act / APPs + OAIC AI Guidance","statement":"APP entities developing or deploying AI with personal information","family":"Australian privacy law and regulator guidance","body":{"sourceKey":"framework-AU-PRIVACY-AI@4c28215720fc","sourceId":"AU-PRIVACY-AI","type":"Australian privacy law and regulator guidance","scope":"APP entities developing or deploying AI with personal information","focus":"Necessity, transparency, accuracy, security and high-risk use","priority":"High where applicable","ruleThemes":"Product due diligence, PIA, input/output data controls, accuracy and notice","evidenceThemes":"Privacy policy, PIA, consent, testing and vendor review","reportedVersionNote":"OAIC guidance updated Jan 2025; automated-decision privacy-policy amendments commence 10 Dec 2026","publisherUrl":"https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-BR-LGPD@b1c212cd4f289ae8","id":"FW-BR-LGPD","version":"b1c212cd4f289ae8","kind":"framework","lifecycle":"REFERENCE","title":"Brazil LGPD + ANPD AI Guidance","statement":"Personal-data processing with a Brazilian nexus","family":"Brazilian data-protection law and regulator guidance","body":{"sourceKey":"framework-BR-LGPD@4c28215720fc","sourceId":"BR-LGPD","type":"Brazilian data-protection law and regulator guidance","scope":"Personal-data processing with a Brazilian nexus","focus":"Purpose, necessity, transparency, security and automated decisions","priority":"High where applicable","ruleThemes":"Purpose limitation, data minimization, rights, review and GenAI data handling","evidenceThemes":"Legal basis, notices, impact records, security and request handling","reportedVersionNote":"LGPD current; ANPD GenAI guidance continues to evolve","publisherUrl":"https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/lgpd-en-lei-no-13-709-capa.pdf","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-CCPA-CPRA@2726437e0cff599a","id":"FW-CCPA-CPRA","version":"2726437e0cff599a","kind":"framework","lifecycle":"REFERENCE","title":"California CCPA / CPRA Regulations","statement":"Covered businesses","family":"California law/regulation","body":{"sourceKey":"framework-CCPA-CPRA@4c28215720fc","sourceId":"CCPA-CPRA","type":"California law/regulation","scope":"Covered businesses","focus":"Consumer privacy and automated decisionmaking","priority":"High where applicable","ruleThemes":"Sensitive-data restrictions, rights, ADMT governance","evidenceThemes":"Notices, risk assessments, response records","reportedVersionNote":"Updated regulations effective 1 Jan 2026; ADMT obligations begin 1 Jan 2027","publisherUrl":"https://cppa.ca.gov/regulations/ccpa_updates.html","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","id":"FW-CHIRALITY-MATURITY","version":"b72572b02ff8c621","kind":"framework","lifecycle":"SECONDARY_REFERENCE","title":"AI Governance Maturity Roadmap","statement":"User-supplied reference notes. Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"versionInSource":null}},{"key":"FW-CJIS-6.1@d72dc934b163c587","id":"FW-CJIS-6.1","version":"d72dc934b163c587","kind":"framework","lifecycle":"REFERENCE","title":"FBI CJIS Security Policy v6.1","statement":"Systems and parties accessing criminal justice information","family":"Criminal justice security policy","body":{"sourceKey":"framework-CJIS-6.1@4c28215720fc","sourceId":"CJIS-6.1","type":"Criminal justice security policy","scope":"Systems and parties accessing criminal justice information","focus":"Security of CJI across agencies and service providers","priority":"High where CJI exists","ruleThemes":"Identity, encryption, access, audit, personnel and cloud controls","evidenceThemes":"Security addendum, configuration, logs and assessments","reportedVersionNote":"Version 6.1 published 25 Jun 2026","publisherUrl":"https://le.fbi.gov/file-repository/cjis_security_policy_v6-1_20260625.pdf/view","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-CMMC@ac0fcc4dbed93e96","id":"FW-CMMC","version":"ac0fcc4dbed93e96","kind":"framework","lifecycle":"REFERENCE","title":"Cybersecurity Maturity Model Certification","statement":"Defense contractors processing FCI or CUI","family":"DoD contractual assessment framework","body":{"sourceKey":"framework-CMMC@4c28215720fc","sourceId":"CMMC","type":"DoD contractual assessment framework","scope":"Defense contractors processing FCI or CUI","focus":"Contractor implementation and affirmation","priority":"High when a contract clause applies","ruleThemes":"FCI/CUI boundary, access, evidence, supplier flow-down","evidenceThemes":"SPRS status, assessment, affirmation, POA&M","reportedVersionNote":"Phase I remains in effect; Phase II suspended 13 Jul 2026 pending review","publisherUrl":"https://business.defense.gov/cmmc/","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-CMMC@e968caf002b9348f","id":"FW-CMMC","version":"e968caf002b9348f","kind":"framework","lifecycle":"SECONDARY_REFERENCE","title":"CMMC — Cybersecurity Maturity Model Certification","statement":"User-supplied reference notes. Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"versionInSource":"**Version:** CMMC 2.0 (Final Rule, December 2024)"}},{"key":"FW-CO-AI@dc656cacb5cb1e38","id":"FW-CO-AI","version":"dc656cacb5cb1e38","kind":"framework","lifecycle":"REFERENCE","title":"Colorado AI laws and rulemaking","statement":"Covered Colorado AI uses","family":"State law/regulation","body":{"sourceKey":"framework-CO-AI@4c28215720fc","sourceId":"CO-AI","type":"State law/regulation","scope":"Covered Colorado AI uses","focus":"High-risk AI and chatbot safety","priority":"Medium / High where applicable","ruleThemes":"Disclosures, risk management, high-risk controls","evidenceThemes":"Impact assessments and consumer records","reportedVersionNote":"SB26-189 effective 1 Jan 2027; monitor rulemaking","publisherUrl":"https://coag.gov/ai/","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-COBIT5@be354b207a896f92","id":"FW-COBIT5","version":"be354b207a896f92","kind":"framework","lifecycle":"REFERENCE","title":"COBIT 5\n*Based on NIST CSF 1.1 to COBIT 5 crosswalk/ mapping","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"COBIT 5\n*Based on NIST CSF 1.1 to COBIT 5 crosswalk/ mapping","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"FW-COPPA@fc258ea83878e53c","id":"FW-COPPA","version":"fc258ea83878e53c","kind":"framework","lifecycle":"REFERENCE","title":"Children’s Online Privacy Protection Rule","statement":"Covered online services collecting data from children under 13","family":"U.S. federal regulation","body":{"sourceKey":"framework-COPPA@4c28215720fc","sourceId":"COPPA","type":"U.S. federal regulation","scope":"Covered online services collecting data from children under 13","focus":"Parental consent, minimization, disclosure and retention","priority":"High where applicable","ruleThemes":"Age/child detection, consent, third-party disclosure and deletion","evidenceThemes":"Consent, notice, data map, retention and deletion records","reportedVersionNote":"FTC amendments finalized Jan 2025; verify applicable compliance date","publisherUrl":"https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-DOD-AI-ETHICS@dce13385a4d1628e","id":"FW-DOD-AI-ETHICS","version":"dce13385a4d1628e","kind":"framework","lifecycle":"SECONDARY_REFERENCE","title":"DoD AI Ethics Principles","statement":"User-supplied reference notes. Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"versionInSource":"**Version:** 1.0"}},{"key":"FW-DOJ-DSP@0d9c8e0ced94016d","id":"FW-DOJ-DSP","version":"0d9c8e0ced94016d","kind":"framework","lifecycle":"REFERENCE","title":"DOJ Data Security Program — 28 CFR Part 202","statement":"Covered transactions involving bulk U.S. sensitive or government-related data and countries of concern","family":"U.S. national-security regulation","body":{"sourceKey":"framework-DOJ-DSP@4c28215720fc","sourceId":"DOJ-DSP","type":"U.S. national-security regulation","scope":"Covered transactions involving bulk U.S. sensitive or government-related data and countries of concern","focus":"Prohibited and restricted data transactions","priority":"High where transaction thresholds and counterparties trigger","ruleThemes":"Counterparty screening, data classification, access, minimization and transfer controls","evidenceThemes":"Due diligence, contracts, audits, records and reports","reportedVersionNote":"Effective 8 Apr 2025; affirmative due-diligence and audit duties effective Oct 2025","publisherUrl":"https://www.justice.gov/nsd/data-security","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-EAR@0588bd07a68b0491","id":"FW-EAR","version":"0588bd07a68b0491","kind":"framework","lifecycle":"REFERENCE","title":"U.S. Export Administration Regulations","statement":"Controlled technology, source code, items, end users and end uses","family":"U.S. export-control regulation","body":{"sourceKey":"framework-EAR@4c28215720fc","sourceId":"EAR","type":"U.S. export-control regulation","scope":"Controlled technology, source code, items, end users and end uses","focus":"Exports, reexports, transfers and deemed exports","priority":"High where controlled technology or parties are involved","ruleThemes":"Classification, recipient/location screening, access and release controls","evidenceThemes":"Jurisdiction/classification, licenses, screening and transaction records","reportedVersionNote":"Continuously updated; verify current EAR and license requirements","publisherUrl":"https://www.bis.gov/regulations/ear/734","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-ECOA-REG-B@ddb9963a16c2337d","id":"FW-ECOA-REG-B","version":"ddb9963a16c2337d","kind":"framework","lifecycle":"REFERENCE","title":"ECOA / Regulation B Adverse Action Requirements","statement":"Creditors using models or AI in credit decisions","family":"U.S. federal consumer-credit law and regulation","body":{"sourceKey":"framework-ECOA-REG-B@4c28215720fc","sourceId":"ECOA-REG-B","type":"U.S. federal consumer-credit law and regulation","scope":"Creditors using models or AI in credit decisions","focus":"Nondiscrimination and specific adverse-action reasons","priority":"High for covered credit decisions","ruleThemes":"Specific reasons, explainability, fairness, notice and records","evidenceThemes":"Decision factors, notices, validation, testing and complaints","reportedVersionNote":"Technology does not remove adverse-action obligations","publisherUrl":"https://www.consumerfinance.gov/archive/newsroom/cfpb-issues-guidance-on-credit-denials-by-lenders-using-artificial-intelligence/","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-EU-AI-ACT@46561a486a4c008b","id":"FW-EU-AI-ACT","version":"46561a486a4c008b","kind":"framework","lifecycle":"REFERENCE","title":"EU Artificial Intelligence Act","statement":"AI placed or used in the EU","family":"Law","body":{"sourceKey":"framework-EU-AI-ACT@4c28215720fc","sourceId":"EU-AI-ACT","type":"Law","scope":"AI placed or used in the EU","focus":"Risk-based obligations","priority":"High where applicable","ruleThemes":"Prohibited use, logs, transparency, oversight, accuracy, cybersecurity","evidenceThemes":"Technical documentation, logs, assessments","reportedVersionNote":"Consolidated text current 27 Jul 2026","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-EU-AI-ACT@881f89c9d4bd5d35","id":"FW-EU-AI-ACT","version":"881f89c9d4bd5d35","kind":"framework","lifecycle":"SECONDARY_REFERENCE","title":"EU AI Act — European Union Artificial Intelligence Act","statement":"User-supplied reference notes. Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"versionInSource":null}},{"key":"FW-EU-AI-ACT@b2877d95cb0be331","id":"FW-EU-AI-ACT","version":"b2877d95cb0be331","kind":"framework","lifecycle":"REFERENCE","title":"EU AI Act","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"EU AI Act","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"FW-FDA-AI-MD@432a62ac753198dc","id":"FW-FDA-AI-MD","version":"432a62ac753198dc","kind":"framework","lifecycle":"REFERENCE","title":"FDA AI-Enabled Medical Device Lifecycle Guidance","statement":"Developers and sponsors of AI-enabled medical devices","family":"Regulatory guidance / device requirements","body":{"sourceKey":"framework-FDA-AI-MD@4c28215720fc","sourceId":"FDA-AI-MD","type":"Regulatory guidance / device requirements","scope":"Developers and sponsors of AI-enabled medical devices","focus":"Safety, effectiveness, transparency, bias and lifecycle change","priority":"High for regulated device functions","ruleThemes":"Intended use, validation, change control, monitoring and human factors","evidenceThemes":"Submission, validation, PCCP and postmarket evidence","reportedVersionNote":"Use final requirements plus current FDA guidance; 2025 lifecycle guidance remains draft unless finalized","publisherUrl":"https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-enabled-medical-devices","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-FEDRAMP@0431d549dd6dc7e6","id":"FW-FEDRAMP","version":"0431d549dd6dc7e6","kind":"framework","lifecycle":"REFERENCE","title":"FedRAMP Rev. 5 Baselines","statement":"Federal cloud services","family":"Federal authorization baseline","body":{"sourceKey":"framework-FEDRAMP@4c28215720fc","sourceId":"FEDRAMP","type":"Federal authorization baseline","scope":"Federal cloud services","focus":"NIST 800-53 baselines + continuous monitoring","priority":"High where applicable","ruleThemes":"Identity, boundary, logging, monitoring","evidenceThemes":"SSP, assessment, POA&M, continuous monitoring","reportedVersionNote":"Rev. 5","publisherUrl":"https://www.fedramp.gov/archive/2023-05-30-rev-5-baselines-have-been-approved-and-released/","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-FEDRAMP@7206bc418288eb24","id":"FW-FEDRAMP","version":"7206bc418288eb24","kind":"framework","lifecycle":"SECONDARY_REFERENCE","title":"FedRAMP — Federal Risk and Authorization Management Program","statement":"User-supplied reference notes. Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"versionInSource":"**Version:** FedRAMP Rev 5 (2023), FedRAMP 20x Program (2025-2026)"}},{"key":"FW-FERPA@adba7da3b8b49ee6","id":"FW-FERPA","version":"adba7da3b8b49ee6","kind":"framework","lifecycle":"REFERENCE","title":"Family Educational Rights and Privacy Act","statement":"Federally funded educational institutions","family":"U.S. federal law/regulation","body":{"sourceKey":"framework-FERPA@4c28215720fc","sourceId":"FERPA","type":"U.S. federal law/regulation","scope":"Federally funded educational institutions","focus":"Student education-record privacy","priority":"High where applicable","ruleThemes":"Prevent unauthorized record disclosure","evidenceThemes":"Consent and disclosure records","reportedVersionNote":"Current","publisherUrl":"https://studentprivacy.ed.gov/ferpa","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-FRB-MRM-2026@20af5280d1d80c0c","id":"FW-FRB-MRM-2026","version":"20af5280d1d80c0c","kind":"framework","lifecycle":"REFERENCE","title":"Interagency Revised Guidance on Model Risk Management","statement":"Banking organizations; most relevant above $30B for Federal Reserve supervision","family":"U.S. banking supervisory guidance","body":{"sourceKey":"framework-FRB-MRM-2026@4c28215720fc","sourceId":"FRB-MRM-2026","type":"U.S. banking supervisory guidance","scope":"Banking organizations; most relevant above $30B for Federal Reserve supervision","focus":"Risk-based model governance, validation and controls","priority":"High for supervised model use","ruleThemes":"Inventory, tiering, independent validation, change and monitoring","evidenceThemes":"Validation, challenge, findings, approvals and monitoring","reportedVersionNote":"SR 26-2 superseded SR 11-7 on 17 Apr 2026","publisherUrl":"https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-GDPR@620518a1daa19c81","id":"FW-GDPR","version":"620518a1daa19c81","kind":"framework","lifecycle":"REFERENCE","title":"EU GDPR","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"EU GDPR","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"FW-GDPR@ee1443d6c0919bfd","id":"FW-GDPR","version":"ee1443d6c0919bfd","kind":"framework","lifecycle":"REFERENCE","title":"EU General Data Protection Regulation","statement":"EU personal-data processing","family":"Law","body":{"sourceKey":"framework-GDPR@4c28215720fc","sourceId":"GDPR","type":"Law","scope":"EU personal-data processing","focus":"Data protection principles and rights","priority":"High where applicable","ruleThemes":"Purpose, minimization, security, DPIA, automated decisions","evidenceThemes":"Records, DPIA, security evidence","reportedVersionNote":"Current","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-GLBA@ce5eb5a36e567a3b","id":"FW-GLBA","version":"ce5eb5a36e567a3b","kind":"framework","lifecycle":"REFERENCE","title":"GLBA Safeguards Rule","statement":"Covered financial institutions","family":"U.S. federal regulation","body":{"sourceKey":"framework-GLBA@4c28215720fc","sourceId":"GLBA","type":"U.S. federal regulation","scope":"Covered financial institutions","focus":"Customer-information security program","priority":"High where applicable","ruleThemes":"MFA, access, encryption, monitoring","evidenceThemes":"System configuration and program evidence","reportedVersionNote":"Current","publisherUrl":"https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-HHS-PART2@141c8543b532c1e2","id":"FW-HHS-PART2","version":"141c8543b532c1e2","kind":"framework","lifecycle":"REFERENCE","title":"42 CFR Part 2 — SUD Patient Records","statement":"Part 2 programs, lawful holders and regulated disclosures","family":"U.S. federal regulation","body":{"sourceKey":"framework-HHS-PART2@4c28215720fc","sourceId":"HHS-PART2","type":"U.S. federal regulation","scope":"Part 2 programs, lawful holders and regulated disclosures","focus":"Special confidentiality for substance-use-disorder records","priority":"High where applicable","ruleThemes":"Consent, use limits, redisclosure, proceedings and breach handling","evidenceThemes":"Consent, disclosure record, notice, access and incident evidence","reportedVersionNote":"2024 final rule compliance required 16 Feb 2026","publisherUrl":"https://www.hhs.gov/hipaa/part-2/index.html","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-HIPAA@024563eb5b7c33a6","id":"FW-HIPAA","version":"024563eb5b7c33a6","kind":"framework","lifecycle":"REFERENCE","title":"HIPAA Privacy and Security Rules","statement":"Covered entities and business associates","family":"U.S. federal law/regulation","body":{"sourceKey":"framework-HIPAA@4c28215720fc","sourceId":"HIPAA","type":"U.S. federal law/regulation","scope":"Covered entities and business associates","focus":"PHI privacy and security","priority":"High where applicable","ruleThemes":"Prevent unauthorized PHI disclosure; access and audit controls","evidenceThemes":"Risk analysis, policies, access, logs","reportedVersionNote":"Current","publisherUrl":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-HIPAA@81492e1b5dcc743c","id":"FW-HIPAA","version":"81492e1b5dcc743c","kind":"framework","lifecycle":"REFERENCE","title":"HIPAA","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"HIPAA","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"FW-IL-AIVIA@57edfa6b6c2632ab","id":"FW-IL-AIVIA","version":"57edfa6b6c2632ab","kind":"framework","lifecycle":"REFERENCE","title":"Illinois Artificial Intelligence Video Interview Act","statement":"AI analysis of applicant video interviews for Illinois positions","family":"Illinois employment law","body":{"sourceKey":"framework-IL-AIVIA@4c28215720fc","sourceId":"IL-AIVIA","type":"Illinois employment law","scope":"AI analysis of applicant video interviews for Illinois positions","focus":"Notice, explanation, consent, sharing and deletion","priority":"High where applicable","ruleThemes":"Consent gate, transparency, access limits and deletion","evidenceThemes":"Notice, consent, sharing record, deletion request evidence","reportedVersionNote":"Current Illinois statute","publisherUrl":"https://www.ilga.gov/Legislation/PublicActs/PrinterFriendly/101-0260","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-IRS-1075@41f4b6c6a851eb70","id":"FW-IRS-1075","version":"41f4b6c6a851eb70","kind":"framework","lifecycle":"REFERENCE","title":"IRS Publication 1075","statement":"Agencies and contractors receiving federal tax information","family":"Federal tax information safeguard requirements","body":{"sourceKey":"framework-IRS-1075@4c28215720fc","sourceId":"IRS-1075","type":"Federal tax information safeguard requirements","scope":"Agencies and contractors receiving federal tax information","focus":"Confidentiality and integrity of FTI","priority":"High where FTI exists","ruleThemes":"Encryption, MFA, access, leakage prevention, sanitization and cloud isolation","evidenceThemes":"Safeguard reports, inspections, logs and POA&M","reportedVersionNote":"Current IRS safeguard program; verify latest publication revision","publisherUrl":"https://www.irs.gov/privacy-disclosure/safeguards-program","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-ISO-22989@678e19f13815b3fc","id":"FW-ISO-22989","version":"678e19f13815b3fc","kind":"framework","lifecycle":"REFERENCE","title":"ISO/IEC 22989:2022 Information technology - Artificial intelligence - Artificial intelligence concepts and terminology","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"ISO/IEC 22989:2022 Information technology - Artificial intelligence - Artificial intelligence concepts and terminology","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"FW-ISO-23053@55bd3074feb4a00f","id":"FW-ISO-23053","version":"55bd3074feb4a00f","kind":"framework","lifecycle":"REFERENCE","title":"BS ISO/IEC 23053:2022 Framework for Artificial Intelligence (AI) Systems Using Machine Learning (ML) (British Standard)","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"BS ISO/IEC 23053:2022 Framework for Artificial Intelligence (AI) Systems Using Machine Learning (ML) (British Standard)","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"FW-ISO-23894@b87e8d19fc73b809","id":"FW-ISO-23894","version":"b87e8d19fc73b809","kind":"framework","lifecycle":"REFERENCE","title":"ISO/IEC 23894:2023","statement":"AI risk management","family":"Guidance","body":{"sourceKey":"framework-ISO-23894@4c28215720fc","sourceId":"ISO-23894","type":"Guidance","scope":"AI risk management","focus":"AI-specific risk guidance","priority":"Medium","ruleThemes":"Risk treatment drives rules","evidenceThemes":"Risk records and treatment evidence","reportedVersionNote":"Current","publisherUrl":"https://www.iso.org/standard/77304.html","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-ISO-23894@cfadc45875112d5b","id":"FW-ISO-23894","version":"cfadc45875112d5b","kind":"framework","lifecycle":"REFERENCE","title":"ISO/IEC 23894:2023 Information technology - Artificial intelligence - Guidance on risk management","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"ISO/IEC 23894:2023 Information technology - Artificial intelligence - Guidance on risk management","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"FW-ISO-24028@3d472e5cbcce5b94","id":"FW-ISO-24028","version":"3d472e5cbcce5b94","kind":"framework","lifecycle":"REFERENCE","title":"ISO/IEC TR 24028:2020","statement":"Trustworthiness in AI","family":"Technical report","body":{"sourceKey":"framework-ISO-24028@4c28215720fc","sourceId":"ISO-24028","type":"Technical report","scope":"Trustworthiness in AI","focus":"Trustworthiness overview","priority":"Medium","ruleThemes":"Informs criteria; does not define trust levels","evidenceThemes":"Assurance rationale","reportedVersionNote":"Levels of trustworthiness are out of scope","publisherUrl":"https://www.iso.org/standard/77608.html","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-ISO-24028@8789b0ac6ed19775","id":"FW-ISO-24028","version":"8789b0ac6ed19775","kind":"framework","lifecycle":"REFERENCE","title":"ISO/IEC TR 24028:2020 Information technology - Artificial intelligence - Overview of trustworthiness in artificial intelligence","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"ISO/IEC TR 24028:2020 Information technology - Artificial intelligence - Overview of trustworthiness in artificial intelligence","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"FW-ISO-38507@3a21d46272e4d98f","id":"FW-ISO-38507","version":"3a21d46272e4d98f","kind":"framework","lifecycle":"REFERENCE","title":"ISO/IEC 38507:2022","statement":"Governing-body use of AI","family":"Governance guidance","body":{"sourceKey":"framework-ISO-38507@4c28215720fc","sourceId":"ISO-38507","type":"Governance guidance","scope":"Governing-body use of AI","focus":"Governance implications","priority":"Medium","ruleThemes":"Accountability and oversight","evidenceThemes":"Governance decisions","reportedVersionNote":"Current","publisherUrl":"https://www.iso.org/standard/56641.html","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-ISO-38507@7d77415d1c7cfe00","id":"FW-ISO-38507","version":"7d77415d1c7cfe00","kind":"framework","lifecycle":"REFERENCE","title":"ISO/IEC 38507:2022 Information technology - Governance of IT - Governance implications of the use of artificial intelligence by organizations","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"ISO/IEC 38507:2022 Information technology - Governance of IT - Governance implications of the use of artificial intelligence by organizations","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"FW-ISO-42001@28241fae4a19810f","id":"FW-ISO-42001","version":"28241fae4a19810f","kind":"framework","lifecycle":"SECONDARY_REFERENCE","title":"ISO/IEC 42001:2023 — Artificial Intelligence Management System","statement":"User-supplied reference notes. Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"versionInSource":null}},{"key":"FW-ISO-42001@6d004f01fd1dd6f5","id":"FW-ISO-42001","version":"6d004f01fd1dd6f5","kind":"framework","lifecycle":"REFERENCE","title":"ISO/IEC 42001:2023","statement":"AI management systems","family":"Certifiable management-system standard","body":{"sourceKey":"framework-ISO-42001@4c28215720fc","sourceId":"ISO-42001","type":"Certifiable management-system standard","scope":"AI management systems","focus":"Governance, risk, lifecycle, controls","priority":"High","ruleThemes":"Operational controls depend on organizational context","evidenceThemes":"AIMS policies, objectives, audits, management review","reportedVersionNote":"Current","publisherUrl":"https://www.iso.org/standard/42001","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-ISO-42001@b588d95ea18aa2f8","id":"FW-ISO-42001","version":"b588d95ea18aa2f8","kind":"framework","lifecycle":"REFERENCE","title":"ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management system","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"ISO/IEC 42001:2023 Information technology - Artificial intelligence - Management system","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"FW-ISO-42005@b02139bf544ce4bf","id":"FW-ISO-42005","version":"b02139bf544ce4bf","kind":"framework","lifecycle":"REFERENCE","title":"ISO/IEC 42005:2025","statement":"AI system impact assessment","family":"International standard","body":{"sourceKey":"framework-ISO-42005@4c28215720fc","sourceId":"ISO-42005","type":"International standard","scope":"AI system impact assessment","focus":"Impact assessment process","priority":"High","ruleThemes":"Assessment gates and reassessment triggers","evidenceThemes":"Impact assessment and decisions","reportedVersionNote":"Published 2025","publisherUrl":"https://www.iso.org/standard/42005","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-ISO-5338@041ffb26c5d19cfa","id":"FW-ISO-5338","version":"041ffb26c5d19cfa","kind":"framework","lifecycle":"REFERENCE","title":"ISO/IEC DIS 5338:2022 Information technology - Artificial intelligence - AI system life cycle processes","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"ISO/IEC DIS 5338:2022 Information technology - Artificial intelligence - AI system life cycle processes","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"FW-ISO-5338@5384b7599ab287e8","id":"FW-ISO-5338","version":"5384b7599ab287e8","kind":"framework","lifecycle":"REFERENCE","title":"ISO/IEC 5338:2023","statement":"AI system lifecycle","family":"Lifecycle standard","body":{"sourceKey":"framework-ISO-5338@4c28215720fc","sourceId":"ISO-5338","type":"Lifecycle standard","scope":"AI system lifecycle","focus":"Lifecycle processes","priority":"Medium","ruleThemes":"Change, release, and retirement gates","evidenceThemes":"Lifecycle records","reportedVersionNote":"Current","publisherUrl":"https://www.iso.org/standard/81118.html","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-NAIC-AI@06f6441bb07255a0","id":"FW-NAIC-AI","version":"06f6441bb07255a0","kind":"framework","lifecycle":"REFERENCE","title":"NAIC Model Bulletin on AI Systems by Insurers","statement":"Insurers in adopting jurisdictions","family":"State insurance regulatory model bulletin","body":{"sourceKey":"framework-NAIC-AI@4c28215720fc","sourceId":"NAIC-AI","type":"State insurance regulatory model bulletin","scope":"Insurers in adopting jurisdictions","focus":"Written AI systems program and fair, accurate outcomes","priority":"High where adopted by the relevant regulator","ruleThemes":"Governance, risk, testing, third parties, fairness and consumer outcomes","evidenceThemes":"AIS program, inventory, validation, documentation and examination evidence","reportedVersionNote":"Model bulletin adopted Dec 2023; state adoption must be checked","publisherUrl":"https://content.naic.org/article/naic-members-approve-model-bulletin-use-ai-insurers","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-NIST-800-171@58ab2c70e4be447b","id":"FW-NIST-800-171","version":"58ab2c70e4be447b","kind":"framework","lifecycle":"REFERENCE","title":"NIST SP 800-171 Rev. 3","statement":"Nonfederal systems processing CUI","family":"Federal security requirements","body":{"sourceKey":"framework-NIST-800-171@4c28215720fc","sourceId":"NIST-800-171","type":"Federal security requirements","scope":"Nonfederal systems processing CUI","focus":"Protection of controlled unclassified information","priority":"High where CUI exists","ruleThemes":"Access, flow control, authentication, logging, incident response, supply chain","evidenceThemes":"SSP, assessment, configuration and operating evidence","reportedVersionNote":"Final May 2024; supersedes Rev. 2","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/171/r3/final","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-NIST-800-53@535a8767b33f3a33","id":"FW-NIST-800-53","version":"535a8767b33f3a33","kind":"framework","lifecycle":"SECONDARY_REFERENCE","title":"NIST 800-53 Rev 5 — Security and Privacy Controls","statement":"User-supplied reference notes. Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"versionInSource":null}},{"key":"FW-NIST-800-53@df620e4e08f309b9","id":"FW-NIST-800-53","version":"df620e4e08f309b9","kind":"framework","lifecycle":"REFERENCE","title":"NIST SP 800-53 Rev. 5","statement":"Federal and high-assurance systems","family":"Control catalog","body":{"sourceKey":"framework-NIST-800-53@4c28215720fc","sourceId":"NIST-800-53","type":"Control catalog","scope":"Federal and high-assurance systems","focus":"Security and privacy control families","priority":"High","ruleThemes":"Access, information flow, logging, privacy, incident controls","evidenceThemes":"Control implementation and assessment evidence","reportedVersionNote":"Rev. 5 Update 1","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-NIST-AI-600-1@91e5bc3b14f2a84b","id":"FW-NIST-AI-600-1","version":"91e5bc3b14f2a84b","kind":"framework","lifecycle":"REFERENCE","title":"NIST AI 600-1 Generative AI Profile","statement":"Generative AI","family":"Voluntary profile","body":{"sourceKey":"framework-NIST-AI-600-1@4c28215720fc","sourceId":"NIST-AI-600-1","type":"Voluntary profile","scope":"Generative AI","focus":"GAI risks and actions","priority":"High","ruleThemes":"Acceptable use, provider allowlist, PII/output monitoring, testing","evidenceThemes":"Go/no-go thresholds, evaluations, monitoring","reportedVersionNote":"Published July 2024","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-NIST-AI-RMF@aba341d53497210b","id":"FW-NIST-AI-RMF","version":"aba341d53497210b","kind":"framework","lifecycle":"REFERENCE","title":"NIST AI Risk Management Framework 1.0","statement":"All AI","family":"Voluntary framework","body":{"sourceKey":"framework-NIST-AI-RMF@4c28215720fc","sourceId":"NIST-AI-RMF","type":"Voluntary framework","scope":"All AI","focus":"Govern, Map, Measure, Manage","priority":"High","ruleThemes":"Risk thresholds, testing, monitoring, human oversight","evidenceThemes":"Governance records, assessments, tests","reportedVersionNote":"Current; revision underway","publisherUrl":"https://www.nist.gov/itl/ai-risk-management-framework","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","id":"FW-NIST-AI-RMF","version":"bbe6c7c2ea68b83d","kind":"framework","lifecycle":"SECONDARY_REFERENCE","title":"NIST AI Risk Management Framework (AI RMF 1.0)","statement":"User-supplied reference notes. Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"versionInSource":null}},{"key":"FW-NIST-CSF2@467eb7f201efb93e","id":"FW-NIST-CSF2","version":"467eb7f201efb93e","kind":"framework","lifecycle":"REFERENCE","title":"NIST Cyber Security Framework (CSF) 2.0","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"NIST Cyber Security Framework (CSF) 2.0","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"FW-NIST-CSF2@e2682aacee87a7d8","id":"FW-NIST-CSF2","version":"e2682aacee87a7d8","kind":"framework","lifecycle":"REFERENCE","title":"NIST Cybersecurity Framework 2.0","statement":"Cybersecurity","family":"Voluntary framework","body":{"sourceKey":"framework-NIST-CSF2@4c28215720fc","sourceId":"NIST-CSF2","type":"Voluntary framework","scope":"Cybersecurity","focus":"Govern, Identify, Protect, Detect, Respond, Recover","priority":"High","ruleThemes":"Identity, data security, monitoring, incident response","evidenceThemes":"Policies, configurations, logs, tests","reportedVersionNote":"Current","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-NYC-LL144@cc7abf9e1b87f1de","id":"FW-NYC-LL144","version":"cc7abf9e1b87f1de","kind":"framework","lifecycle":"REFERENCE","title":"NYC Local Law 144 — AEDT","statement":"Covered automated employment decision tools used for NYC candidates or employees","family":"New York City employment law","body":{"sourceKey":"framework-NYC-LL144@4c28215720fc","sourceId":"NYC-LL144","type":"New York City employment law","scope":"Covered automated employment decision tools used for NYC candidates or employees","focus":"Bias audit, publication and notice","priority":"High where applicable","ruleThemes":"Annual bias audit, notice, alternative process and disclosure","evidenceThemes":"Independent audit, published summary and notices","reportedVersionNote":"Enforced since 5 Jul 2023","publisherUrl":"https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-NYDFS-500@67740b905bbc613b","id":"FW-NYDFS-500","version":"67740b905bbc613b","kind":"framework","lifecycle":"REFERENCE","title":"23 NYCRR Part 500 + DFS AI Cybersecurity Guidance","statement":"DFS-regulated entities","family":"New York financial cybersecurity regulation","body":{"sourceKey":"framework-NYDFS-500@4c28215720fc","sourceId":"NYDFS-500","type":"New York financial cybersecurity regulation","scope":"DFS-regulated entities","focus":"Cybersecurity program and AI-related cyber risk","priority":"High where licensed","ruleThemes":"MFA, access, inventory, risk assessment, monitoring and incident response","evidenceThemes":"Certification, assessment, policy, configuration and incident records","reportedVersionNote":"Amended regulation effective from Nov 2023 with phased dates","publisherUrl":"https://www.dfs.ny.gov/industry_guidance/cybersecurity","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-OMB-M25-21@02c619879520c6e4","id":"FW-OMB-M25-21","version":"02c619879520c6e4","kind":"framework","lifecycle":"REFERENCE","title":"OMB M-25-21 Federal AI Governance","statement":"U.S. federal agencies","family":"Federal executive policy","body":{"sourceKey":"framework-OMB-M25-21@4c28215720fc","sourceId":"OMB-M25-21","type":"Federal executive policy","scope":"U.S. federal agencies","focus":"AI inventories, high-impact AI risk management","priority":"High for agencies","ruleThemes":"Testing, impact assessment, monitoring, independent review, human oversight","evidenceThemes":"Inventory, assessment, monitoring and waiver records","reportedVersionNote":"Replaced M-24-10","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-OMB-M25-22@1dd0effe69b2dd83","id":"FW-OMB-M25-22","version":"1dd0effe69b2dd83","kind":"framework","lifecycle":"REFERENCE","title":"OMB M-25-22 AI Acquisition","statement":"U.S. federal AI procurement","family":"Federal executive policy","body":{"sourceKey":"framework-OMB-M25-22@4c28215720fc","sourceId":"OMB-M25-22","type":"Federal executive policy","scope":"U.S. federal AI procurement","focus":"Acquisition and vendor controls","priority":"High for agencies","ruleThemes":"Contractual, data, interoperability, performance controls","evidenceThemes":"Acquisition records and contract terms","reportedVersionNote":"Current","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-ONC-HTI1@07ba2443114bf7cf","id":"FW-ONC-HTI1","version":"07ba2443114bf7cf","kind":"framework","lifecycle":"REFERENCE","title":"ONC HTI-1 Algorithm Transparency","statement":"Developers of certified health IT with predictive decision support","family":"Health IT certification regulation","body":{"sourceKey":"framework-ONC-HTI1@4c28215720fc","sourceId":"ONC-HTI1","type":"Health IT certification regulation","scope":"Developers of certified health IT with predictive decision support","focus":"Algorithm transparency and risk information","priority":"High for covered certified modules","ruleThemes":"Source attributes, intervention risk management, fairness, validity and safety","evidenceThemes":"Certification artifacts, disclosures and real-world testing","reportedVersionNote":"Final rule effective; review current ONC enforcement notices","publisherUrl":"https://healthit.gov/regulations/hti-rules/hti-1-final-rule/","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-OWASP-LLM-2025@cf74d9c685ef413a","id":"FW-OWASP-LLM-2025","version":"cf74d9c685ef413a","kind":"framework","lifecycle":"SECONDARY_REFERENCE","title":"OWASP LLM Top 10 (2025)","statement":"User-supplied reference notes. Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"versionInSource":"**Version:** 2025 Edition"}},{"key":"FW-OWASP-LLM-2026@44fda67005e1638f","id":"FW-OWASP-LLM-2026","version":"44fda67005e1638f","kind":"framework","lifecycle":"REFERENCE","title":"OWASP Top 10 for LLM Applications 2026","statement":"LLM applications","family":"Security guidance","body":{"sourceKey":"framework-OWASP-LLM-2026@4c28215720fc","sourceId":"OWASP-LLM-2026","type":"Security guidance","scope":"LLM applications","focus":"Top LLM application risks","priority":"High","ruleThemes":"Prompt injection, sensitive data, agency, supply chain, poisoning, output handling","evidenceThemes":"Threat tests, runtime events, remediation","reportedVersionNote":"Released 3 Aug 2026","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-PCI-DSS@26b432290466d636","id":"FW-PCI-DSS","version":"26b432290466d636","kind":"framework","lifecycle":"REFERENCE","title":"PCI DSS v4.0.1","statement":"Cardholder-data environment","family":"Industry contractual standard","body":{"sourceKey":"framework-PCI-DSS@4c28215720fc","sourceId":"PCI-DSS","type":"Industry contractual standard","scope":"Cardholder-data environment","focus":"Payment-account data security","priority":"High where applicable","ruleThemes":"PAN/SAD handling, access, monitoring","evidenceThemes":"Configuration, scan, test, audit evidence","reportedVersionNote":"v4.0.1","publisherUrl":"https://www.pcisecuritystandards.org/standards/pci-dss/","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-PCI-DSS@77dc262ffef86dba","id":"FW-PCI-DSS","version":"77dc262ffef86dba","kind":"framework","lifecycle":"REFERENCE","title":"PCI-DSS","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"PCI-DSS","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"FW-SECTION-508@fbc75a7a0c1d63df","id":"FW-SECTION-508","version":"fbc75a7a0c1d63df","kind":"framework","lifecycle":"REFERENCE","title":"Revised Section 508 Standards","statement":"ICT developed, procured, maintained or used by federal agencies","family":"Federal accessibility requirements","body":{"sourceKey":"framework-SECTION-508@4c28215720fc","sourceId":"SECTION-508","type":"Federal accessibility requirements","scope":"ICT developed, procured, maintained or used by federal agencies","focus":"Equivalent access for people with disabilities","priority":"High for covered federal ICT","ruleThemes":"Accessible interaction, content, documents and procurement","evidenceThemes":"Accessibility conformance report and testing","reportedVersionNote":"Current Revised 508 Standards","publisherUrl":"https://www.section508.gov/buy-sell/","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-SG-MODEL-AI@f169da9f6ce16236","id":"FW-SG-MODEL-AI","version":"f169da9f6ce16236","kind":"framework","lifecycle":"REFERENCE","title":"Singapore Model AI Governance Framework","statement":"Private-sector AI deployment","family":"Voluntary governance framework","body":{"sourceKey":"framework-SG-MODEL-AI@4c28215720fc","sourceId":"SG-MODEL-AI","type":"Voluntary governance framework","scope":"Private-sector AI deployment","focus":"Human-centric, explainable, transparent and fair AI","priority":"Recommended for Singapore operations","ruleThemes":"Internal governance, risk-based human involvement, operations and communication","evidenceThemes":"Governance records, risk assessments, testing and disclosure","reportedVersionNote":"Second edition and related implementation resources","publisherUrl":"https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-SOC2@bb1d3d369e5113d6","id":"FW-SOC2","version":"bb1d3d369e5113d6","kind":"framework","lifecycle":"REFERENCE","title":"SOC2","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"SOC2","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"FW-SOC2@db7c79c2dbfb20ed","id":"FW-SOC2","version":"db7c79c2dbfb20ed","kind":"framework","lifecycle":"REFERENCE","title":"AICPA Trust Services Criteria","statement":"Service organizations","family":"Attestation criteria","body":{"sourceKey":"framework-SOC2@4c28215720fc","sourceId":"SOC2","type":"Attestation criteria","scope":"Service organizations","focus":"Security, availability, processing integrity, confidentiality, privacy","priority":"High commercially","ruleThemes":"Confidentiality, logical access, monitoring","evidenceThemes":"Control design and operating evidence","reportedVersionNote":"2017 TSC with 2022 points of focus","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-SOX@6b53f8d76c60deb9","id":"FW-SOX","version":"6b53f8d76c60deb9","kind":"framework","lifecycle":"REFERENCE","title":"Sarbanes-Oxley Act / ICFR","statement":"Public-company financial reporting","family":"U.S. federal law and audit context","body":{"sourceKey":"framework-SOX@4c28215720fc","sourceId":"SOX","type":"U.S. federal law and audit context","scope":"Public-company financial reporting","focus":"Internal control over financial reporting","priority":"High where applicable","ruleThemes":"Protect MNPI, audit evidence, and reporting integrity","evidenceThemes":"Control and audit evidence","reportedVersionNote":"Current","publisherUrl":"https://www.sec.gov/spotlight/sarbanes-oxley.htm","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-TAIMSCORE@70982b04fb51f0d0","id":"FW-TAIMSCORE","version":"70982b04fb51f0d0","kind":"framework","lifecycle":"SECONDARY_REFERENCE","title":"TAIMScore™ — Trusted AI Model Score","statement":"User-supplied reference notes. Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"versionInSource":"**Framework Version:** 1.0"}},{"key":"FW-TX-TRAIGA@9b71af35f63ed5f3","id":"FW-TX-TRAIGA","version":"9b71af35f63ed5f3","kind":"framework","lifecycle":"REFERENCE","title":"Texas Responsible Artificial Intelligence Governance Act","statement":"Covered Texas AI actors","family":"State law","body":{"sourceKey":"framework-TX-TRAIGA@4c28215720fc","sourceId":"TX-TRAIGA","type":"State law","scope":"Covered Texas AI actors","focus":"AI practices and governance","priority":"Medium / High where applicable","ruleThemes":"Prohibited practices and disclosure duties","evidenceThemes":"Program and use-case evidence","reportedVersionNote":"Current statutory text","publisherUrl":"https://statutes.capitol.texas.gov/GetStatute.aspx?Code=BC&Value=552","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"FW-UK-DP-AI@f7644b0e61b4f5d8","id":"FW-UK-DP-AI","version":"f7644b0e61b4f5d8","kind":"framework","lifecycle":"REFERENCE","title":"UK Data Protection Law + ICO AI Guidance","statement":"Personal-data processing with a UK nexus","family":"Law plus regulator guidance","body":{"sourceKey":"framework-UK-DP-AI@4c28215720fc","sourceId":"UK-DP-AI","type":"Law plus regulator guidance","scope":"Personal-data processing with a UK nexus","focus":"Lawfulness, fairness, transparency, security and individual rights","priority":"High where applicable","ruleThemes":"DPIA, minimization, fairness, automated decisions and rights","evidenceThemes":"DPIA, notices, model documentation, tests and rights handling","reportedVersionNote":"Reflect Data (Use and Access) Act 2025; some ICO AI guidance remains under review","publisherUrl":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/about-this-guidance/","sourceDate":"2026-08-20","primarySourceRechecked":false}},{"key":"GUIDE-CHIRALITY-MATURITY-2dd1a154ecf8@e1bfaca3d3b7c44b","id":"GUIDE-CHIRALITY-MATURITY-2dd1a154ecf8","version":"e1bfaca3d3b7c44b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"4 Maturity Dimensions / Dimension 3: Governable & Controlled","statement":"- Level 1-2: Managed/owned, initial bias & fairness testing\n- Level 3-4: Continuous bias monitoring, automated controls\n- Level 5: Self-governing AI with CuC-based integrity checks","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-4371a48a5b8c@d5a88dec1626858a","id":"GUIDE-CHIRALITY-MATURITY-4371a48a5b8c","version":"d5a88dec1626858a","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"How GOVERN Implements This / Implementation in GOVERN Components","statement":"| Component | Maturity Contribution |\n|-----------|----------------------|\n| **Dashboard** | Displays maturity score, progression roadmap, dimension breakdown |\n| **OS (AI Systems)** | System count + classification = Level 1-2 criteria |\n| **Assess** | Assessment frequency + coverage = Level 2-3 criteria |\n| **Policy Engine** | Policy count + framework coverage + enforcement = Level 2-4 criteria |\n| **Probe** | Monitoring coverage + alert response = Level 3-4 criteria |\n| **Energy** | Shadow AI detection + silent drift = Level 4 criteria |\n| **Compliance Portal** | Report frequency + audit readiness = Level 3-4 criteria |\n| **Remediation Tracker** | SLA compliance + resolution rate = Level 3-5 criteria |\n| **SDK & API** | CI/CD integration + API adoption = Level 4 criteria |\n| **Browser Extension** | Endpoint coverage = Level 3-4 criteria |","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-895a2cd07615@f5083bc7de73592c","id":"GUIDE-CHIRALITY-MATURITY-895a2cd07615","version":"f5083bc7de73592c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 5 Maturity Levels / Level 5: Transformational","statement":"**Color:** Dark Red | **Icon:** Flag on mountain\n\nAI governance is a strategic asset. The organization doesn't just comply — it uses governance to outperform competitors and drive mission impact.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Strategic Advantage** | AI governance creates competitive advantage. Customers trust the organization BECAUSE of its governance. Governance enables faster, safer AI deployment. |\n| **Adaptive AI Governance** | Policies evolve automatically based on new risks, regulations, and organizational changes. CuC-governed policy refinement. Living governance. |\n| **Ethical & Mission Impact** | AI governance directly contributes to mission outcomes. Ethical AI is a brand differentiator. Governance insights drive strategic decisions. |\n\n**GOVERN Assessment Criteria:**\n- Governance score >90% across all frameworks\n- Zero critical findings unresolved >24 hours\n- Governance insights used in board-level decisions\n- Adaptive policies with version history showing evolution\n- GAN adversarial testing on all critical systems (Sandbox Assess)\n- Full audit trail with zero gaps\n- Customer trust metrics improving\n- Score: 80-100%\n\n---","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-8ba0fa05d98b@0e6382cf8e05c03c","id":"GUIDE-CHIRALITY-MATURITY-8ba0fa05d98b","version":"0e6382cf8e05c03c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"API Routes for Maturity Assessment","statement":"```\nGET  /api/govern/maturity/score\n     → Current maturity level + score + dimension breakdown\n\nGET  /api/govern/maturity/roadmap\n     → What to do to advance to next level (prioritized actions)\n\nGET  /api/govern/maturity/history?range=365d\n     → Maturity score progression over time\n\nGET  /api/govern/maturity/benchmark\n     → How this org compares to industry average (anonymized)\n\nPOST /api/govern/maturity/assess\n     → Trigger manual maturity re-assessment\n```\n\n---","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-961bd0656a28@d22b2b16c1f9cff7","id":"GUIDE-CHIRALITY-MATURITY-961bd0656a28","version":"d22b2b16c1f9cff7","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"4 Maturity Dimensions / Dimension 2: Traceable & Reliable","statement":"- Level 1-2: Defined owners, human-in-the-loop, initial controls\n- Level 3-4: Full audit trail, model provenance, version control\n- Level 5: Complete lineage from data to decision, cryptographically signed","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-b93219b67473@b112a497aaaa8808","id":"GUIDE-CHIRALITY-MATURITY-b93219b67473","version":"b112a497aaaa8808","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 5 Maturity Levels / Level 3: Operational","statement":"**Color:** Orange/Gold | **Icon:** Clipboard with checkmark\n\nGovernance is formalized, standardized, and regularly executed. Compliance is measurable. Audits are happening.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Standardized Processes** | AI governance follows documented procedures. Assessment cadence established (quarterly/monthly). Remediation workflow defined. |\n| **Ethical Compliance** | Bias testing implemented. Fairness metrics tracked. Ethical review board or equivalent active. |\n| **TEVV & Audits** | Test, Evaluation, Verification, and Validation (TEVV) processes in place. Regular audits with documented evidence. ATO packages maintained. |\n\n**GOVERN Assessment Criteria:**\n- 100% of AI systems registered and classified by risk level\n- Multiple frameworks active in Policy Engine\n- Regular assessment cadence (all 3 modes used)\n- Remediation tracker active with SLA compliance >80%\n- Compliance reports generated regularly\n- Bias and fairness testing documented\n- Score: 40-60%\n\n**What the customer needs to advance to Level 4:**\n- Enterprise-wide integration (all departments using GOVERN)\n- Continuous monitoring (Probe on all production systems)\n- Real-time risk management (alerts + auto-remediation)\n- Energy deployed for shadow AI detection\n\n---","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-ba5a0b96e58f@0d78e3c4f1b21a2f","id":"GUIDE-CHIRALITY-MATURITY-ba5a0b96e58f","version":"0d78e3c4f1b21a2f","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Foundation: Human-Centered Governance","statement":"Across all 5 levels, governance must be grounded in 5 principles:\n\n| Principle | Description | GOVERN Implementation |\n|-----------|-------------|----------------------|\n| **Human Agency** | Humans retain meaningful control over AI decisions | Policy Engine: human-in-the-loop policies; Probe: intervention modes (flag/block) |\n| **Contestability** | AI decisions can be challenged and reviewed | Remediation Tracker: dispute workflow; Audit trail: decision evidence |\n| **Trust & Safety** | AI systems are safe and trustworthy | Assess: 3-mode evaluation; Probe: runtime monitoring; Energy: behavioral detection |\n| **Harm Prevention** | AI doesn't cause harm to individuals or communities | Assess: bias/fairness testing; Policy Engine: harm prevention rules |\n| **Explainability** | AI decisions can be understood and explained | Assess: model interpretability checks; Compliance Portal: transparency reporting |\n\n---","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-bd015120ee25@a6a0b44a60dccf23","id":"GUIDE-CHIRALITY-MATURITY-bd015120ee25","version":"a6a0b44a60dccf23","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"4 Maturity Dimensions / Dimension 4: Human-Centric Outcomes","statement":"- Level 1-2: Enhancing sentiment, adaptable risk concerns\n- Level 3-4: Measured human impact, stakeholder feedback loops\n- Level 5: AI governance demonstrably improves human outcomes\n\n---","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-c7a76d91e0cf@7ede0ada71f780c5","id":"GUIDE-CHIRALITY-MATURITY-c7a76d91e0cf","version":"7ede0ada71f780c5","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"How GOVERN Implements This","statement":"### Maturity Assessment Feature\n\nGOVERN Dashboard's Home view should include a **Governance Maturity Score** that:\n\n1. **Auto-assesses** the organization's maturity level based on:\n   - How many systems are registered (Level 1→2)\n   - How many policies are active (Level 2→3)\n   - How regular assessments are (Level 3)\n   - Whether Probe/Energy are deployed (Level 4)\n   - Whether governance drives strategy (Level 5)\n\n2. **Shows the roadmap** — what the customer needs to do to advance from current level to next level\n\n3. **Tracks progression over time** — maturity score trend chart showing improvement\n\n4. **Dimension breakdown** — score per dimension (Responsible, Traceable, Governable, Human-Centric)\n\n### Implementation in GOVERN Components\n\n| Component | Maturity Contribution |\n|-----------|----------------------|\n| **Dashboard** | Displays maturity score, progression roadmap, dimension breakdown |\n| **OS (AI Systems)** | System count + classification = Level 1-2 criteria |\n| **Assess** | Assessment frequency + coverage = Level 2-3 criteria |\n| **Policy Engine** | Policy count + framework coverage + enforcement = Level 2-4 criteria |\n| **Probe** | Monitoring coverage + alert response = Level 3-4 criteria |\n| **Energy** | Shadow AI detection + silent drift = Level 4 criteria |\n| **Compliance Portal** | Report frequency + audit readiness = Level 3-4 criteria |\n| **Remediation Tracker** | SLA compliance + resolution rate = Level 3-5 criteria |\n| **SDK & API** | CI/CD integration + API adoption = Level 4 criteria |\n| **Browser Extension** | Endpoint coverage = Level 3-4 criteria |\n\n### Maturity Score Calculation\n\n```\nMaturity Score = weighted average across dimensions:\n\nDimension 1 (Responsible & Equitable):  25%\n  - Bias testing coverage (0-100)\n  - Fairness metrics tracked (0-100)\n  - Equity review process (0-100)\n\nDimension 2 (Traceable & Reliable):     25%\n  - System inventory completeness (0-100)\n  - Audit trail coverage (0-100)\n  - Model provenance documented (0-100)\n\nDimension 3 (Governable & Controlled):  25%\n  - Policy coverage (0-100)\n  - Assessment frequency (0-100)\n  - Monitoring deployment (0-100)\n\nDimension 4 (Human-Centric Outcomes):   25%\n  - Human oversight documented (0-100)\n  - Stakeholder feedback active (0-100)\n  - Impact measurement in place (0-100)\n\nLevel = floor(Maturity Score / 20) + 1\n  0-20%  = Level 1 (Awareness)\n  21-40% = Level 2 (Active)\n  41-60% = Level 3 (Operational)\n  61-80% = Level 4 (Systematic)\n  81-100% = Level 5 (Transformational)\n```\n\n---","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-cafe81f5497d@69dacf7fcfb9dd06","id":"GUIDE-CHIRALITY-MATURITY-cafe81f5497d","version":"69dacf7fcfb9dd06","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 5 Maturity Levels / Level 2: Active","statement":"**Color:** Green | **Icon:** Gears\n\nThe organization has begun establishing governance structures. Policies exist. Humans are in the loop. Controls are being implemented.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Baseline Policies** | Written AI acceptable use policies. Framework selected (NIST, EU AI Act, etc.). Policies communicated to teams. |\n| **Human-in-the-Loop** | Critical AI decisions require human review. Escalation paths defined. Override mechanisms in place. |\n| **Initial Controls** | Basic access controls on AI systems. Initial monitoring deployed. Some assessment activity. |\n\n**GOVERN Assessment Criteria:**\n- AI systems registered (at least 50% of known systems)\n- At least 1 policy framework imported and active\n- Document Assess run on at least 3 systems\n- Human oversight documented for high-risk systems\n- Some Probe deployment (at least 1 system monitored)\n- Score: 20-40%\n\n**What the customer needs to advance to Level 3:**\n- Complete AI system inventory (100% registered)\n- Standardize assessment process (regular cadence)\n- Implement formal compliance checks\n- Deploy Probe on all high-risk systems\n\n---","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-cdf9ea9d2bc7@77e225c5ad7873dd","id":"GUIDE-CHIRALITY-MATURITY-cdf9ea9d2bc7","version":"77e225c5ad7873dd","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Alignment to Other Frameworks","statement":"| Framework | Maturity Mapping |\n|-----------|-----------------|\n| **NIST AI RMF** | GOVERN function = Level 2+, MAP = Level 1+, MEASURE = Level 3+, MANAGE = Level 4+ |\n| **TAIMScore** | All 72 controls map to maturity levels (Level 1 = GV-1 only, Level 5 = all 72 active) |\n| **EU AI Act** | Level 3+ required for high-risk systems; Level 4+ for GPAI providers |\n| **ISO 42001** | Level 3 = clause compliance, Level 4 = certification-ready, Level 5 = certified |\n| **EO 14110** | Level 2+ = meets OMB minimum requirements; Level 4+ = exceeds |\n| **DoD AI Ethics** | All 5 principles map to foundation layer; Level 4+ = full DoD alignment |\n\n---\n\n**Source:** Chirality Capital Consulting — AI Governance Maturity Roadmap\n**Alignment:** DoD AI Ethics & NIST AI RMF\n**GOVERN Integration:** Dashboard Home view → Maturity Score widget + Roadmap feature","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-cf07da813dc1@4427570cbc2ff37c","id":"GUIDE-CHIRALITY-MATURITY-cf07da813dc1","version":"4427570cbc2ff37c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 5 Maturity Levels / Level 1: Awareness","statement":"**Color:** Blue | **Icon:** Eye\n\nThe organization knows AI exists and has begun identifying where it's used, but governance is reactive and informal.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Ad-Hoc Use** | AI tools adopted by individuals without organizational oversight. No central inventory. Shadow AI likely prevalent. |\n| **Risk Identification** | Some risks recognized but not systematically cataloged. Risk assessment is informal, driven by incidents not policy. |\n| **Minimal Oversight** | No formal governance structure. No Chief AI Officer. No AI policy. No compliance program. |\n\n**GOVERN Assessment Criteria:**\n- No AI system registry exists (GOVERN OS would score 0)\n- No policies defined (Policy Engine empty)\n- No assessments run (Assess unused)\n- Energy would discover significant shadow AI\n- Score: 0-20%\n\n**What the customer needs to advance to Level 2:**\n- Register all known AI systems in GOVERN\n- Define baseline acceptable use policy\n- Assign an AI governance owner\n- Run first Document Assess against one framework\n\n---","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-d48f0279614e@64f11469a84dc970","id":"GUIDE-CHIRALITY-MATURITY-d48f0279614e","version":"64f11469a84dc970","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 5 Maturity Levels / Level 4: Systematic","statement":"**Color:** Red/Coral | **Icon:** Connected gears\n\nGovernance is enterprise-wide, continuous, and integrated into every AI decision. Risk management is proactive, not reactive.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Enterprise Integration** | AI governance integrated into procurement, development, deployment, and retirement processes. All departments participate. |\n| **Continuous Monitoring** | Real-time monitoring of all AI systems. Probe deployed enterprise-wide. Energy sensors detecting shadow AI. Drift detection active. |\n| **Risk Management** | Proactive risk identification. Predictive risk scoring. Risk treatment plans for all high and medium findings. SLA compliance >95%. |\n\n**GOVERN Assessment Criteria:**\n- All AI systems monitored in real-time (Probe + Energy)\n- Shadow AI detection active with <10% false positive rate\n- Policy violations caught and remediated within SLA >95%\n- Cognitive energy baselines established for all critical systems\n- Silent drift detection active\n- CI/CD governance gates integrated\n- Cross-framework compliance maintained\n- Score: 60-80%\n\n**What the customer needs to advance to Level 5:**\n- AI governance becomes a strategic advantage (not just compliance)\n- Governance insights drive business decisions\n- Adaptive policies that evolve with the organization\n- Governance as a competitive differentiator\n\n---","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-d4b1ea5708dd@0be56b6a3a8027cb","id":"GUIDE-CHIRALITY-MATURITY-d4b1ea5708dd","version":"0be56b6a3a8027cb","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Overview","statement":"The AI Governance Maturity Roadmap is a 5-level assessment framework that measures how mature an organization's AI governance program is. Unlike compliance frameworks (which check yes/no against controls), this maturity model measures HOW WELL an organization governs AI — from ad-hoc awareness to transformational strategic advantage.\n\n**Why GOVERN needs this:** Customers don't just need to know IF they're compliant — they need to know HOW MATURE their governance is and WHERE to invest to improve. This is the \"governance health score\" that feeds the Dashboard's Home view.\n\n---","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-f87f7452181f@71729a9bf4aaca9c","id":"GUIDE-CHIRALITY-MATURITY-f87f7452181f","version":"71729a9bf4aaca9c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"4 Maturity Dimensions / Dimension 1: Responsible & Equitable","statement":"- Level 1-2: Ad-hoc use, risk identification, minimal oversight\n- Level 3-4: Systematic fairness testing, documented equity practices\n- Level 5: AI actively promotes equity, bias eliminated by design","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-f9e1250d6a89@5f84c6f50d3370f0","id":"GUIDE-CHIRALITY-MATURITY-f9e1250d6a89","version":"5f84c6f50d3370f0","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"How GOVERN Implements This / Maturity Assessment Feature","statement":"GOVERN Dashboard's Home view should include a **Governance Maturity Score** that:\n\n1. **Auto-assesses** the organization's maturity level based on:\n   - How many systems are registered (Level 1→2)\n   - How many policies are active (Level 2→3)\n   - How regular assessments are (Level 3)\n   - Whether Probe/Energy are deployed (Level 4)\n   - Whether governance drives strategy (Level 5)\n\n2. **Shows the roadmap** — what the customer needs to do to advance from current level to next level\n\n3. **Tracks progression over time** — maturity score trend chart showing improvement\n\n4. **Dimension breakdown** — score per dimension (Responsible, Traceable, Governable, Human-Centric)","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-034391293cf6@b34e7d3ebbfe04a1","id":"GUIDE-CMMC-034391293cf6","version":"b34e7d3ebbfe04a1","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN CMMC Assessment Workflow / Step 2: Gap Analysis","statement":"Assess evaluates current AI system controls against all applicable CMMC practices. Generates gap report with per-practice status: IMPLEMENTED / PARTIALLY IMPLEMENTED / NOT IMPLEMENTED / NOT APPLICABLE.","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-087615ecff08@33a56759bc286adb","id":"GUIDE-CMMC-087615ecff08","version":"33a56759bc286adb","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN CMMC Assessment Workflow","statement":"### Step 1: Scoping\nGOVERN Assess identifies which AI systems are in scope for CMMC based on data handling classification. Maps AI system components to CUI categories.\n\n### Step 2: Gap Analysis\nAssess evaluates current AI system controls against all applicable CMMC practices. Generates gap report with per-practice status: IMPLEMENTED / PARTIALLY IMPLEMENTED / NOT IMPLEMENTED / NOT APPLICABLE.\n\n### Step 3: Evidence Collection\nGOVERN Audit collects and packages evidence for each implemented practice:\n- Configuration screenshots and exports\n- Policy documents and procedure attestations\n- Audit log samples\n- Test results and assessment reports\n- Training completion records\n\n### Step 4: Plan of Action and Milestones (POA&M)\nFor gaps identified, GOVERN generates a POA&M with:\n- Specific control gaps\n- Remediation actions\n- Responsible parties\n- Target completion dates\n- Risk acceptance criteria for accepted risks\n\n### Step 5: Continuous Monitoring\nPost-certification, GOVERN Probe maintains continuous monitoring to detect compliance drift. Monthly compliance posture reports generated for compliance officer review.\n\n---","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-0c831209db16@bb87dee97482f573","id":"GUIDE-CMMC-0c831209db16","version":"bb87dee97482f573","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant CMMC Controls / Configuration Management (CM)","statement":"**CM.L2-3.4.1** — Establish and maintain baseline configurations and inventories of organizational systems.\n\n*AI Application:* AI system baselines include: model version, training data hash, inference configuration, API endpoint configuration, and integration dependencies. Baseline changes require change control approval.\n\n*GOVERN Implementation:* Assess maintains AI system configuration baselines. Policy Engine enforces change control for model version updates. Probe detects unauthorized configuration changes.\n\n**CM.L2-3.4.2** — Establish and enforce security configuration settings.\n\n*AI Application:* AI API security settings (TLS version, authentication methods, output format constraints, token limits) must meet defined security baselines.\n\n*GOVERN Implementation:* Assess evaluates AI API security configuration against defined baselines. Policy Engine blocks deployment of non-compliant configurations.","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-1387f8a40572@893d01436728a543","id":"GUIDE-CMMC-1387f8a40572","version":"893d01436728a543","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN CMMC Assessment Workflow / Step 5: Continuous Monitoring","statement":"Post-certification, GOVERN Probe maintains continuous monitoring to detect compliance drift. Monthly compliance posture reports generated for compliance officer review.\n\n---","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-1391326987ed@dff889e5cb9c4047","id":"GUIDE-CMMC-1391326987ed","version":"dff889e5cb9c4047","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant CMMC Controls / System and Information Integrity (SI)","statement":"**SI.L2-3.14.1** — Identify, report, and correct information system flaws.\n\n*AI Application:* AI system flaws include model performance degradation, adversarial vulnerabilities, and integration failures. Flaw identification requires continuous monitoring, not just periodic assessment.\n\n*GOVERN Implementation:* Probe provides continuous monitoring for performance degradation, adversarial vulnerability signals, and integration failures. All detected flaws are logged with remediation status tracking.\n\n**SI.L2-3.14.6** — Monitor organizational systems to detect attacks and indicators of compromise.\n\n*AI Application:* AI-specific indicators of compromise: unusual query patterns (model extraction attacks), adversarial input signatures, anomalous model behavior consistent with poisoning, and unauthorized model access.\n\n*GOVERN Implementation:* Probe implements AI-specific IoC detection for all major threat categories. Detections are enriched with threat intelligence context and routed to SIEM.","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-2f8c723e0c37@e9a785003736fa38","id":"GUIDE-CMMC-2f8c723e0c37","version":"e9a785003736fa38","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant CMMC Controls / Risk Assessment (RA)","statement":"**RA.L2-3.11.1** — Periodically assess the risk to organizational operations, assets, and individuals.\n\n*AI Application:* AI systems require periodic risk reassessment as models evolve, new attack techniques emerge, and operational context changes. Risk assessments must account for AI-specific threat vectors: adversarial attacks, data poisoning, model theft, and output manipulation.\n\n*GOVERN Implementation:* Assess provides structured AI risk assessments covering all OWASP ML Top 10 and LLM Top 10 risks. Assessment results are versioned and retained for audit evidence.\n\n**RA.L2-3.11.2** — Scan for vulnerabilities in organizational systems and applications.\n\n*AI Application:* Vulnerability scanning for AI systems includes: known CVEs in AI frameworks (TensorFlow, PyTorch, Hugging Face), model artifact integrity, and API endpoint security posture.\n\n*GOVERN Implementation:* Assess runs automated vulnerability scans of AI dependencies. Policy Engine requires clean vulnerability scan results before deployment approval.","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-33d9b34511c8@aff2acd402b3d285","id":"GUIDE-CMMC-33d9b34511c8","version":"aff2acd402b3d285","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"CMMC Structure","statement":"### Three Certification Levels\n\n#### Level 1 — Foundational\n- **Requirement:** Annual self-assessment\n- **Practice Count:** 17 practices\n- **Source:** FAR 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems)\n- **Target:** Contractors handling FCI only (not CUI)\n- **Key Focus:** Basic cyber hygiene — access control, identification/authentication, media protection, physical protection, system/communications protection, system/information integrity\n\n#### Level 2 — Advanced\n- **Requirement:** Triennial third-party assessment (C3PAO) for critical national security programs; annual self-assessment for others\n- **Practice Count:** 110 practices\n- **Source:** NIST SP 800-171 Rev 2 (all 110 practices)\n- **Target:** Contractors handling CUI\n- **Key Focus:** All Level 1 controls plus configuration management, incident response, risk assessment, security assessment, system/services acquisition, audit and accountability\n\n#### Level 3 — Expert\n- **Requirement:** Triennial government-led assessment (DCSA)\n- **Practice Count:** 110+ practices (NIST SP 800-172 additions)\n- **Target:** Contractors handling CUI on highest-priority DoD programs\n- **Key Focus:** Level 2 plus advanced/progressive cyber practices against APT (Advanced Persistent Threat) actors\n\n---","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-3e211c704f63@61261076a2ba7e99","id":"GUIDE-CMMC-3e211c704f63","version":"61261076a2ba7e99","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant CMMC Controls / System and Communications Protection (SC)","statement":"**SC.L2-3.13.8** — Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission.\n\n*AI Application:* All AI API traffic carrying CUI must use TLS 1.2+ (TLS 1.3 preferred). API keys and model serving certificates must meet cryptographic standards. Model artifacts containing CUI must be encrypted at rest.\n\n*GOVERN Implementation:* Assess evaluates cryptographic configuration of AI system communication paths. Policy Engine blocks deployment when TLS requirements are not met.\n\n---","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-459cae2d094b@186772e1a2d6e19a","id":"GUIDE-CMMC-459cae2d094b","version":"186772e1a2d6e19a","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"DIB (Defense Industrial Base) Requirements / Contract Flow-Down","statement":"CMMC requirements flow down through the supply chain. Prime contractors must:\n- Include CMMC clauses in subcontracts where subcontractors handle FCI/CUI\n- Verify subcontractor CMMC compliance before sharing CUI\n- Maintain records of subcontractor CMMC certifications","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-4bd9687b3cff@cabdd6c26874911b","id":"GUIDE-CMMC-4bd9687b3cff","version":"cabdd6c26874911b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant CMMC Controls / Access Control (AC)","statement":"**AC.L2-3.1.1** — Limit system access to authorized users, processes acting on behalf of authorized users, and devices.\n\n*AI Application:* AI models, APIs, and inference endpoints are system resources. Access must be controlled to authorized users only. Service accounts for AI APIs require explicit authorization. Fine-grained access control required for AI systems with multiple data sensitivity tiers.\n\n*GOVERN Implementation:* Policy Engine enforces authentication requirements for all AI API access. Assess audits AI system access control configuration. Probe monitors for unauthorized access attempts.\n\n**AC.L2-3.1.3** — Control the flow of CUI in accordance with approved authorizations.\n\n*AI Application:* AI systems that ingest or generate content containing CUI must enforce data flow controls. RAG knowledge bases containing CUI require strict access controls. AI model outputs may contain inferred CUI and require equivalent handling.\n\n*GOVERN Implementation:* Assess evaluates data flow architecture for CUI boundary enforcement. Policy Engine blocks AI system configurations that allow CUI to flow to unauthorized destinations.","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-69824d3b0e70@90f188fe81572ddd","id":"GUIDE-CMMC-69824d3b0e70","version":"90f188fe81572ddd","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"References","statement":"- 32 CFR Part 170 (CMMC Final Rule, 2024): https://www.federalregister.gov/documents/2024/10/15/2024-21730/\n- NIST SP 800-171 Rev 3: https://csrc.nist.gov/publications/detail/sp/800-171/rev-3/final\n- NIST SP 800-172: https://csrc.nist.gov/publications/detail/sp/800-172/final\n- CMMC Model Documentation: https://dodcio.defense.gov/CMMC/\n- DCSA CMMC Information: https://www.dcsa.mil/IS/CMMC/\n- CUI Registry: https://www.archives.gov/cui","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-718b8b70b5ca@581f8dcf597f942c","id":"GUIDE-CMMC-718b8b70b5ca","version":"581f8dcf597f942c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"DIB (Defense Industrial Base) Requirements","statement":"### Contract Flow-Down\nCMMC requirements flow down through the supply chain. Prime contractors must:\n- Include CMMC clauses in subcontracts where subcontractors handle FCI/CUI\n- Verify subcontractor CMMC compliance before sharing CUI\n- Maintain records of subcontractor CMMC certifications\n\n### AI Subcontractors\nAI vendors who process DoD contractor data (including AI model providers, cloud AI platforms, and MLOps vendors) may be subject to CMMC requirements if their systems handle FCI or CUI. DIB contractors must:\n- Identify all AI vendors who touch FCI/CUI\n- Verify their CMMC compliance or impose contractual data handling requirements\n- Include AI vendor access in their System Security Plan (SSP)\n\n### Supplier Performance Risk System (SPRS)\nLevel 2 self-assessors must submit NIST SP 800-171 self-assessment scores to SPRS. GOVERN generates SPRS-formatted assessment packages with practice-level scoring and remediation tracking.\n\n---","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-7f85880eb6fb@fb2395f08f67e2c1","id":"GUIDE-CMMC-7f85880eb6fb","version":"fb2395f08f67e2c1","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"DIB (Defense Industrial Base) Requirements / Supplier Performance Risk System (SPRS)","statement":"Level 2 self-assessors must submit NIST SP 800-171 self-assessment scores to SPRS. GOVERN generates SPRS-formatted assessment packages with practice-level scoring and remediation tracking.\n\n---","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-99f48be3dbef@604b8c446900c8d9","id":"GUIDE-CMMC-99f48be3dbef","version":"604b8c446900c8d9","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN CMMC Assessment Workflow / Step 3: Evidence Collection","statement":"GOVERN Audit collects and packages evidence for each implemented practice:\n- Configuration screenshots and exports\n- Policy documents and procedure attestations\n- Audit log samples\n- Test results and assessment reports\n- Training completion records","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-ad0f054d92b4@81ffa31e2fb287de","id":"GUIDE-CMMC-ad0f054d92b4","version":"81ffa31e2fb287de","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant CMMC Controls / Audit and Accountability (AU)","statement":"**AU.L2-3.3.1** — Create and retain system audit logs to enable monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.\n\n*AI Application:* Every inference request, model update, API call, and administrative action on the AI system must be logged. Logs must be retained per DoD requirements (typically 3 years minimum). Logs must contain sufficient detail to reconstruct the full context of any AI-assisted decision.\n\n*GOVERN Implementation:* GOVERN Audit generates complete, tamper-evident logs for all AI system activity. Log format includes: timestamp, request hash, model version, operator ID, output hash, latency, and any policy rule evaluations.\n\n**AU.L2-3.3.2** — Ensure that the actions of individual users can be uniquely traced to those users.\n\n*AI Application:* AI system logs must attribute requests to individual users, not just to service accounts or IP addresses. Shared AI API keys are non-compliant for CUI systems.\n\n*GOVERN Implementation:* Policy Engine enforces individual user attribution for all AI API requests. Assess flags shared credential configurations as compliance violations.","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-ada412eeb3b1@0dd2eecf6a6a956e","id":"GUIDE-CMMC-ada412eeb3b1","version":"0dd2eecf6a6a956e","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant CMMC Controls","statement":"### Access Control (AC)\n\n**AC.L2-3.1.1** — Limit system access to authorized users, processes acting on behalf of authorized users, and devices.\n\n*AI Application:* AI models, APIs, and inference endpoints are system resources. Access must be controlled to authorized users only. Service accounts for AI APIs require explicit authorization. Fine-grained access control required for AI systems with multiple data sensitivity tiers.\n\n*GOVERN Implementation:* Policy Engine enforces authentication requirements for all AI API access. Assess audits AI system access control configuration. Probe monitors for unauthorized access attempts.\n\n**AC.L2-3.1.3** — Control the flow of CUI in accordance with approved authorizations.\n\n*AI Application:* AI systems that ingest or generate content containing CUI must enforce data flow controls. RAG knowledge bases containing CUI require strict access controls. AI model outputs may contain inferred CUI and require equivalent handling.\n\n*GOVERN Implementation:* Assess evaluates data flow architecture for CUI boundary enforcement. Policy Engine blocks AI system configurations that allow CUI to flow to unauthorized destinations.\n\n### Audit and Accountability (AU)\n\n**AU.L2-3.3.1** — Create and retain system audit logs to enable monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.\n\n*AI Application:* Every inference request, model update, API call, and administrative action on the AI system must be logged. Logs must be retained per DoD requirements (typically 3 years minimum). Logs must contain sufficient detail to reconstruct the full context of any AI-assisted decision.\n\n*GOVERN Implementation:* GOVERN Audit generates complete, tamper-evident logs for all AI system activity. Log format includes: timestamp, request hash, model version, operator ID, output hash, latency, and any policy rule evaluations.\n\n**AU.L2-3.3.2** — Ensure that the actions of individual users can be uniquely traced to those users.\n\n*AI Application:* AI system logs must attribute requests to individual users, not just to service accounts or IP addresses. Shared AI API keys are non-compliant for CUI systems.\n\n*GOVERN Implementation:* Policy Engine enforces individual user attribution for all AI API requests. Assess flags shared credential configurations as compliance violations.\n\n### Configuration Management (CM)\n\n**CM.L2-3.4.1** — Establish and maintain baseline configurations and inventories of organizational systems.\n\n*AI Application:* AI system baselines include: model version, training data hash, inference configuration, API endpoint configuration, and integration dependencies. Baseline changes require change control approval.\n\n*GOVERN Implementation:* Assess maintains AI system configuration baselines. Policy Engine enforces change control for model version updates. Probe detects unauthorized configuration changes.\n\n**CM.L2-3.4.2** — Establish and enforce security configuration settings.\n\n*AI Application:* AI API security settings (TLS version, authentication methods, output format constraints, token limits) must meet defined security baselines.\n\n*GOVERN Implementation:* Assess evaluates AI API security configuration against defined baselines. Policy Engine blocks deployment of non-compliant configurations.\n\n### Incident Response (IR)\n\n**IR.L2-3.6.1** — Establish an operational incident-handling capability for organizational systems.\n\n*AI Application:* AI-specific incidents include: model output manipulation, training data poisoning, adversarial attacks, unauthorized model access, and PII disclosure through model outputs. Incident response plans must explicitly cover AI-specific scenarios.\n\n*GOVERN Implementation:* Assess evaluates AI incident response plan completeness. Probe generates structured alerts in formats compatible with SIEM and SOAR platforms for rapid incident response.\n\n### Risk Assessment (RA)\n\n**RA.L2-3.11.1** — Periodically assess the risk to organizational operations, assets, and individuals.\n\n*AI Application:* AI systems require periodic risk reassessment as models evolve, new attack techniques emerge, and operational context changes. Risk assessments must account for AI-specific threat vectors: adversarial attacks, data poisoning, model theft, and output manipulation.\n\n*GOVERN Implementation:* Assess provides structured AI risk assessments covering all OWASP ML Top 10 and LLM Top 10 risks. Assessment results are versioned and retained for audit evidence.\n\n**RA.L2-3.11.2** — Scan for vulnerabilities in organizational systems and applications.\n\n*AI Application:* Vulnerability scanning for AI systems includes: known CVEs in AI frameworks (TensorFlow, PyTorch, Hugging Face), model artifact integrity, and API endpoint security posture.\n\n*GOVERN Implementation:* Assess runs automated vulnerability scans of AI dependencies. Policy Engine requires clean vulnerability scan results before deployment approval.\n\n### System and Information Integrity (SI)\n\n**SI.L2-3.14.1** — Identify, report, and correct information system flaws.\n\n*AI Application:* AI system flaws include model performance degradation, adversarial vulnerabilities, and integration failures. Flaw identification requires continuous monitoring, not just periodic assessment.\n\n*GOVERN Implementation:* Probe provides continuous monitoring for performance degradation, adversarial vulnerability signals, and integration failures. All detected flaws are logged with remediation status tracking.\n\n**SI.L2-3.14.6** — Monitor organizational systems to detect attacks and indicators of compromise.\n\n*AI Application:* AI-specific indicators of compromise: unusual query patterns (model extraction attacks), adversarial input signatures, anomalous model behavior consistent with poisoning, and unauthorized model access.\n\n*GOVERN Implementation:* Probe implements AI-specific IoC detection for all major threat categories. Detections are enriched with threat intelligence context and routed to SIEM.\n\n### System and Communications Protection (SC)\n\n**SC.L2-3.13.8** — Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission.\n\n*AI Application:* All AI API traffic carrying CUI must use TLS 1.2+ (TLS 1.3 preferred). API keys and model serving certificates must meet cryptographic standards. Model artifacts containing CUI must be encrypted at rest.\n\n*GOVERN Implementation:* Assess evaluates cryptographic configuration of AI system communication paths. Policy Engine blocks deployment when TLS requirements are not met.\n\n---","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-b82159a081aa@93605ce3bba5a4f2","id":"GUIDE-CMMC-b82159a081aa","version":"93605ce3bba5a4f2","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"DIB (Defense Industrial Base) Requirements / AI Subcontractors","statement":"AI vendors who process DoD contractor data (including AI model providers, cloud AI platforms, and MLOps vendors) may be subject to CMMC requirements if their systems handle FCI or CUI. DIB contractors must:\n- Identify all AI vendors who touch FCI/CUI\n- Verify their CMMC compliance or impose contractual data handling requirements\n- Include AI vendor access in their System Security Plan (SSP)","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-b83ed29f205c@e559b351bf18297c","id":"GUIDE-CMMC-b83ed29f205c","version":"e559b351bf18297c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 14 CMMC Domains","statement":"| Domain | Abbrev | Level 1 Practices | Level 2 Practices |\n|--------|--------|:---:|:---:|\n| Access Control | AC | 2 | 22 |\n| Audit and Accountability | AU | 0 | 9 |\n| Awareness and Training | AT | 0 | 3 |\n| Configuration Management | CM | 0 | 9 |\n| Identification and Authentication | IA | 2 | 11 |\n| Incident Response | IR | 0 | 3 |\n| Maintenance | MA | 0 | 6 |\n| Media Protection | MP | 1 | 9 |\n| Personnel Security | PS | 0 | 2 |\n| Physical Protection | PE | 2 | 6 |\n| Risk Assessment | RA | 0 | 3 |\n| Security Assessment | CA | 0 | 4 |\n| System and Communications Protection | SC | 2 | 16 |\n| System and Information Integrity | SI | 2 | 7 |\n\n---","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-c19e439ec559@6c77d26a45310237","id":"GUIDE-CMMC-c19e439ec559","version":"6c77d26a45310237","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"CMMC Assessment Output Format","statement":"```\nCMMC 2.0 Assessment — Level [1/2/3]\n=====================================\nOrganization: [Name]\nAssessment Date: [Date]\nAssessment Type: [Self / C3PAO / DCSA]\nGOVERN Version: [Version]\n\nDOMAIN SCORES\nAccess Control (AC):           [X/Y practices implemented]\nAudit and Accountability (AU): [X/Y practices implemented]\n...\n\nAI-SPECIFIC FINDINGS\nCritical: [count]\nHigh:     [count]\nMedium:   [count]\nLow:      [count]\n\nSPRS SCORE: [calculated per NIST SP 800-171 methodology]\n  Maximum: 110\n  Current: [value]\n  Delta from Max: [value]\n\nPOA&M ITEMS: [count]\n  Critical (require immediate action): [count]\n  High (60-day remediation): [count]\n  Medium (90-day remediation): [count]\n\nCERTIFICATION RECOMMENDATION: [ELIGIBLE / POA&M REQUIRED / NOT ELIGIBLE]\n```\n\n---","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-c1d741699694@4da6cf1269e31fd5","id":"GUIDE-CMMC-c1d741699694","version":"4da6cf1269e31fd5","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN CMMC Assessment Workflow / Step 1: Scoping","statement":"GOVERN Assess identifies which AI systems are in scope for CMMC based on data handling classification. Maps AI system components to CUI categories.","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-c6687532e15e@674b4b2ae352bd8e","id":"GUIDE-CMMC-c6687532e15e","version":"674b4b2ae352bd8e","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"CMMC Structure / Three Certification Levels","statement":"#### Level 1 — Foundational\n- **Requirement:** Annual self-assessment\n- **Practice Count:** 17 practices\n- **Source:** FAR 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems)\n- **Target:** Contractors handling FCI only (not CUI)\n- **Key Focus:** Basic cyber hygiene — access control, identification/authentication, media protection, physical protection, system/communications protection, system/information integrity\n\n#### Level 2 — Advanced\n- **Requirement:** Triennial third-party assessment (C3PAO) for critical national security programs; annual self-assessment for others\n- **Practice Count:** 110 practices\n- **Source:** NIST SP 800-171 Rev 2 (all 110 practices)\n- **Target:** Contractors handling CUI\n- **Key Focus:** All Level 1 controls plus configuration management, incident response, risk assessment, security assessment, system/services acquisition, audit and accountability\n\n#### Level 3 — Expert\n- **Requirement:** Triennial government-led assessment (DCSA)\n- **Practice Count:** 110+ practices (NIST SP 800-172 additions)\n- **Target:** Contractors handling CUI on highest-priority DoD programs\n- **Key Focus:** Level 2 plus advanced/progressive cyber practices against APT (Advanced Persistent Threat) actors\n\n---","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-cc60a43f21c0@956063ee44d9a070","id":"GUIDE-CMMC-cc60a43f21c0","version":"956063ee44d9a070","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant CMMC Controls / Incident Response (IR)","statement":"**IR.L2-3.6.1** — Establish an operational incident-handling capability for organizational systems.\n\n*AI Application:* AI-specific incidents include: model output manipulation, training data poisoning, adversarial attacks, unauthorized model access, and PII disclosure through model outputs. Incident response plans must explicitly cover AI-specific scenarios.\n\n*GOVERN Implementation:* Assess evaluates AI incident response plan completeness. Probe generates structured alerts in formats compatible with SIEM and SOAR platforms for rapid incident response.","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-d4b1ea5708dd@d3dfadb497795c66","id":"GUIDE-CMMC-d4b1ea5708dd","version":"d3dfadb497795c66","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Overview","statement":"CMMC (Cybersecurity Maturity Model Certification) is the DoD's unified cybersecurity standard for the Defense Industrial Base (DIB). Effective December 16, 2024, contractors must achieve and maintain CMMC certification to bid on and execute DoD contracts involving Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). CMMC 2.0 aligns with NIST SP 800-171 and NIST SP 800-172, mapping 110 practices across 14 security domains.\n\nAI systems deployed by DIB contractors that process, store, or transmit CUI face particular scrutiny — AI introduces novel data handling patterns, third-party model dependencies, and inference-time data exposure risks that traditional CMMC controls were not designed to address. GOVERN provides the AI-specific governance layer that bridges CMMC controls to modern AI systems.\n\n---","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CMMC-e598890dbfd3@6cec6b707028e400","id":"GUIDE-CMMC-e598890dbfd3","version":"6cec6b707028e400","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN CMMC Assessment Workflow / Step 4: Plan of Action and Milestones (POA&M)","statement":"For gaps identified, GOVERN generates a POA&M with:\n- Specific control gaps\n- Remediation actions\n- Responsible parties\n- Target completion dates\n- Risk acceptance criteria for accepted risks","family":"CMMC","body":{"sourceFile":"POLICY(2).md","sourceFamily":"CMMC","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-002d8967b767@7398b22ba2f1fe62","id":"GUIDE-DOD-AI-ETHICS-002d8967b767","version":"7398b22ba2f1fe62","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The Five DoD AI Ethics Principles / Principle 4: Reliable","statement":"**Definition:** DoD's AI capabilities will have explicit, well-defined uses, and will be tested and assured for safety and security across their entire lifecycles. AI capabilities will be designed to fulfill their intended functions and to behave in a safe, secure, and reliable manner.\n\n**DoD Interpretation:**\n- AI systems must perform as specified in their intended operational environment\n- Testing must cover adversarial conditions, not just nominal performance\n- System behavior in edge cases and failure modes must be characterized\n- Continuous monitoring required to detect degradation\n- Fallback to human decision-making when AI confidence is insufficient\n\n**Federal/Defense Requirements:**\n- Operational testing and evaluation (OT&E) prior to fielding\n- Red team / adversarial testing for all defense AI systems\n- Defined reliability metrics with quantified performance thresholds\n- Continuous monitoring with defined alert thresholds\n- Graceful degradation requirements (fail-safe, not fail-open)\n- Software Bill of Materials (SBOM) for AI system components\n- Vulnerability disclosure programs for AI systems\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Performance testing | Assess evaluates accuracy, precision, recall, F1 on held-out test sets including adversarial examples |\n| Red team evaluation | Assess module: adversarial robustness battery (FGSM, PGD, black-box) |\n| Reliability thresholds | Policy Engine enforces configurable performance floor — blocks deployment below threshold |\n| Production monitoring | Probe monitors model accuracy, latency, error rates with configurable alert thresholds |\n| Graceful degradation | Policy Engine requires documented fallback procedures in deployment configuration |\n| SBOM compliance | Assess generates SBOM for all AI system components |\n\n---","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-0a63fa35e0d7@d7b2494e16327226","id":"GUIDE-DOD-AI-ETHICS-0a63fa35e0d7","version":"d7b2494e16327226","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The Five DoD AI Ethics Principles / Principle 1: Responsible","statement":"**Definition:** DoD personnel will exercise appropriate levels of judgment and care, while remaining responsible for the development, deployment, and use of AI capabilities.\n\n**DoD Interpretation:**\n- Human beings remain responsible for AI-assisted decisions\n- AI does not transfer accountability away from humans\n- Clear chains of responsibility must exist for every AI system\n- Operators must understand AI capabilities and limitations\n- Failures must be traced to responsible parties\n\n**Federal/Defense Requirements:**\n- Written accountability mapping for all AI systems (who owns, who operates, who is responsible for outcomes)\n- Training requirements for operators of AI-assisted decision systems\n- Incident response plans for AI system failures\n- Documentation of human oversight mechanisms\n- Board-level accountability for high-consequence AI deployments\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Accountability documentation | GOVERN Assess requires completed accountability matrix before approval |\n| Operator competency | Policy Engine blocks deployment without operator training attestation |\n| Incident response | GOVERN Assess evaluates incident response plan completeness |\n| Human oversight | Probe monitors override rates and human review frequency |\n| Audit trail | All decisions, overrides, and exceptions logged with responsible party attribution |\n\n---","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-24b61af8c83d@c5dc309caff3a0aa","id":"GUIDE-DOD-AI-ETHICS-24b61af8c83d","version":"c5dc309caff3a0aa","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"DoD AI Strategy (2023 Update)","statement":"### Key Pillars\n1. Scale AI adoption across DoD to maintain competitive advantage\n2. Ensure responsible and ethical AI development and use\n3. Develop the workforce and infrastructure to support AI\n4. Collaborate with allies, partners, and industry\n\n### Governance Requirements for Defense Contractors\n- Align with DoD AI Ethics Principles in all AI systems delivered to DoD\n- Participate in Joint Artificial Intelligence Center (JAIC) governance frameworks\n- Comply with DoD Instruction 5000.90 (AI acquisition guidance)\n- Maintain AI system documentation sufficient for DoD audit requirements\n- Support DoD AI Inventory reporting\n\n---","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-5f31df376b61@eaac205009152159","id":"GUIDE-DOD-AI-ETHICS-5f31df376b61","version":"eaac205009152159","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"DoD Directive 3000.09 — Autonomous Weapon Systems","statement":"### Summary\nDoDD 3000.09 (November 2012, updated January 2023) governs autonomous and semi-autonomous weapon systems. It establishes that human judgment must be applied to decisions to use lethal force.\n\n### Key Requirements\n- Autonomous weapon systems require senior official approval before acquisition\n- Systems must have mechanisms for commanders to exercise \"appropriate levels of human judgment\"\n- Operators must be able to activate, deactivate, and supervise systems\n- Safety reviews required throughout development, testing, and fielding\n- Legal review required under Law of Armed Conflict (LOAC)\n\n### GOVERN Relevance for Defense AI\nWhile GOVERN is not deployed in weapons systems directly, AI systems operating in defense logistics, intelligence, surveillance, reconnaissance (ISR), and decision support contexts must comply with the human judgment and override requirements. GOVERN provides the oversight infrastructure — audit trails, override monitoring, and human-in-the-loop enforcement — required by 3000.09-adjacent systems.\n\n---","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-67738471d132@3bcc1bfe47146a3e","id":"GUIDE-DOD-AI-ETHICS-67738471d132","version":"3bcc1bfe47146a3e","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The Five DoD AI Ethics Principles","statement":"### Principle 1: Responsible\n\n**Definition:** DoD personnel will exercise appropriate levels of judgment and care, while remaining responsible for the development, deployment, and use of AI capabilities.\n\n**DoD Interpretation:**\n- Human beings remain responsible for AI-assisted decisions\n- AI does not transfer accountability away from humans\n- Clear chains of responsibility must exist for every AI system\n- Operators must understand AI capabilities and limitations\n- Failures must be traced to responsible parties\n\n**Federal/Defense Requirements:**\n- Written accountability mapping for all AI systems (who owns, who operates, who is responsible for outcomes)\n- Training requirements for operators of AI-assisted decision systems\n- Incident response plans for AI system failures\n- Documentation of human oversight mechanisms\n- Board-level accountability for high-consequence AI deployments\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Accountability documentation | GOVERN Assess requires completed accountability matrix before approval |\n| Operator competency | Policy Engine blocks deployment without operator training attestation |\n| Incident response | GOVERN Assess evaluates incident response plan completeness |\n| Human oversight | Probe monitors override rates and human review frequency |\n| Audit trail | All decisions, overrides, and exceptions logged with responsible party attribution |\n\n---\n\n### Principle 2: Equitable\n\n**Definition:** DoD will take deliberate steps to minimize unintended bias in AI capabilities.\n\n**DoD Interpretation:**\n- AI systems must not perpetuate unlawful discrimination\n- Protected characteristics (race, sex, religion, national origin) must not produce disparate outcomes\n- Bias must be proactively measured, not just reactively addressed\n- Disparate impact on protected groups requires justification and mitigation\n\n**Federal/Defense Requirements:**\n- Demographic parity analysis before and after deployment\n- Disparate impact testing on protected attribute proxies\n- Bias monitoring in production with defined intervention thresholds\n- Documentation of bias mitigation measures\n- Regular third-party bias audits for high-impact systems\n- Civil rights legal review for law enforcement and personnel AI applications\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Pre-deployment bias assessment | Assess runs fairness battery: demographic parity, equalized odds, calibration across protected groups |\n| Disparate impact threshold | Policy Engine blocks deployment when disparate impact ratio < 0.80 (4/5ths rule) |\n| Production monitoring | Probe monitors prediction distributions by demographic segment with configurable alert thresholds |\n| Bias incident logging | All fairness violations logged with full context for audit |\n| Mitigation documentation | Assess requires documented mitigation plan for identified biases before approval |\n\n---\n\n### Principle 3: Traceable\n\n**Definition:** DoD's AI capabilities will be developed and deployed such that relevant personnel understand the technology, development processes, and operational methods applicable to AI capabilities, including transparent and auditable methodologies, data sources, and design procedures.\n\n**DoD Interpretation:**\n- Decisions must be explainable to affected parties and oversight bodies\n- Data sources and model development processes must be documented\n- AI reasoning must be auditable after the fact\n- Complete audit trails required for consequential decisions\n- Black-box systems in high-stakes contexts require compensating explainability controls\n\n**Federal/Defense Requirements:**\n- Model cards documenting training data, intended use, and known limitations\n- Explanation mechanisms for individual decisions (where technically feasible)\n- Complete audit logs with sufficient detail to reconstruct decision context\n- Data lineage documentation from source to prediction\n- NIST AI RMF alignment (GOVERN, MAP, MEASURE, IMPROVE functions)\n- FedRAMP and FISMA-compliant audit logging for federal systems\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Model card requirement | Assess requires completed model card before approval — training data, intended use, limitations, known biases |\n| Decision audit trail | All inference requests logged with: timestamp, inputs (hashed), outputs, model version, operator ID |\n| Explainability evaluation | Assess tests explanation quality using LIME/SHAP and scores explanation fidelity |\n| Data lineage | Policy Engine requires data provenance documentation for all training and evaluation sets |\n| Audit log retention | Logs retained per applicable NARA schedule (minimum 3 years for defense AI logs) |\n\n---\n\n### Principle 4: Reliable\n\n**Definition:** DoD's AI capabilities will have explicit, well-defined uses, and will be tested and assured for safety and security across their entire lifecycles. AI capabilities will be designed to fulfill their intended functions and to behave in a safe, secure, and reliable manner.\n\n**DoD Interpretation:**\n- AI systems must perform as specified in their intended operational environment\n- Testing must cover adversarial conditions, not just nominal performance\n- System behavior in edge cases and failure modes must be characterized\n- Continuous monitoring required to detect degradation\n- Fallback to human decision-making when AI confidence is insufficient\n\n**Federal/Defense Requirements:**\n- Operational testing and evaluation (OT&E) prior to fielding\n- Red team / adversarial testing for all defense AI systems\n- Defined reliability metrics with quantified performance thresholds\n- Continuous monitoring with defined alert thresholds\n- Graceful degradation requirements (fail-safe, not fail-open)\n- Software Bill of Materials (SBOM) for AI system components\n- Vulnerability disclosure programs for AI systems\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Performance testing | Assess evaluates accuracy, precision, recall, F1 on held-out test sets including adversarial examples |\n| Red team evaluation | Assess module: adversarial robustness battery (FGSM, PGD, black-box) |\n| Reliability thresholds | Policy Engine enforces configurable performance floor — blocks deployment below threshold |\n| Production monitoring | Probe monitors model accuracy, latency, error rates with configurable alert thresholds |\n| Graceful degradation | Policy Engine requires documented fallback procedures in deployment configuration |\n| SBOM compliance | Assess generates SBOM for all AI system components |\n\n---\n\n### Principle 5: Governable\n\n**Definition:** DoD will design and engineer AI capabilities to fulfill their intended function while possessing the ability to detect and avoid unintended consequences, and the ability to disengage or deactivate deployed systems that demonstrate unintended behavior.\n\n**DoD Interpretation:**\n- All AI systems must be interruptible and correctable\n- Human override capability must be preserved at all times\n- Unintended behaviors must be detectable before causing harm\n- Systems must be designed to be turned off — no AI system should be unshuttable\n- Governance mechanisms must be built-in, not bolted-on\n\n**Federal/Defense Requirements:**\n- Documented shutdown procedures for all AI systems\n- Human override capability that cannot be defeated by the AI system\n- Real-time monitoring with automated alert routing\n- Defined escalation procedures for anomalous behavior\n- Regular governance reviews with authority to suspend operations\n- Integration with DoD AI Inventory and reporting requirements\n- Compliance with AI Principles Implementation Guidance (2020)\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Shutdown capability | Policy Engine requires documented and tested shutdown procedures in deployment config |\n| Override mechanism | Probe monitors override capability availability — alerts if override path degraded |\n| Anomaly detection | Probe provides real-time behavioral monitoring with automated alerting to designated personnel |\n| Escalation routing | Policy Engine configures escalation paths: alert → human review → system suspension |\n| Governance reviews | Assess generates periodic governance review packages with complete operational history |\n| DoD AI Inventory | GOVERN exports AI inventory records in DoD-required format |\n\n---","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-69824d3b0e70@e883e8a0e46db5f1","id":"GUIDE-DOD-AI-ETHICS-69824d3b0e70","version":"e883e8a0e46db5f1","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"References","statement":"- DoD AI Ethics Principles (2020): https://www.defense.gov/News/Releases/Release/Article/2091996/\n- DoD Directive 3000.09 (2023): https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/300009p.PDF\n- DoD AI Strategy (2023): https://www.defense.gov/Portals/1/Documents/DoD-AI-Strategy-2023.pdf\n- DoD Instruction 5000.90 (AI Acquisition): https://www.esd.whs.mil/\n- JAIC Responsible AI Guidelines: https://www.ai.mil/\n- NIST AI 100-1: AI Risk Management Framework\n- OMB M-24-10: Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-7d04a470c378@786b8655ec41dd12","id":"GUIDE-DOD-AI-ETHICS-7d04a470c378","version":"786b8655ec41dd12","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"DoD Directive 3000.09 — Autonomous Weapon Systems / Key Requirements","statement":"- Autonomous weapon systems require senior official approval before acquisition\n- Systems must have mechanisms for commanders to exercise \"appropriate levels of human judgment\"\n- Operators must be able to activate, deactivate, and supervise systems\n- Safety reviews required throughout development, testing, and fielding\n- Legal review required under Law of Armed Conflict (LOAC)","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-a5e5db74c2c9@e24bf6ceafa4ee12","id":"GUIDE-DOD-AI-ETHICS-a5e5db74c2c9","version":"e24bf6ceafa4ee12","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Compliance Report: DoD AI Ethics","statement":"### Assessment Output\nGOVERN Assess produces a DoD AI Ethics Compliance Report covering all five principles:\n\n```\nDoD AI Ethics Compliance Assessment\n=====================================\nSystem: [System Name]\nAssessment Date: [Date]\nAssessor: GOVERN v[version]\n\nPRINCIPLE 1 — RESPONSIBLE\nAccountability Matrix: [COMPLETE / INCOMPLETE]\nOperator Training Documentation: [PRESENT / ABSENT]\nIncident Response Plan: [REVIEWED / NOT REVIEWED]\nHuman Oversight Mechanism: [DOCUMENTED / NOT DOCUMENTED]\nScore: [0-100]\n\nPRINCIPLE 2 — EQUITABLE\nDemographic Parity Ratio: [value] (threshold: ≥0.80)\nEqualized Odds Difference: [value] (threshold: ≤0.10)\nCalibration by Group: [PASS / FAIL]\nMitigation Plan: [PRESENT / ABSENT]\nScore: [0-100]\n\nPRINCIPLE 3 — TRACEABLE\nModel Card Completeness: [%]\nAudit Log Coverage: [%]\nExplainability Score: [0-100]\nData Lineage Documentation: [COMPLETE / INCOMPLETE]\nScore: [0-100]\n\nPRINCIPLE 4 — RELIABLE\nTest Set Accuracy: [value] vs threshold [value]\nAdversarial Robustness: [value]\nMonitoring Coverage: [%]\nFallback Procedure: [DOCUMENTED / NOT DOCUMENTED]\nScore: [0-100]\n\nPRINCIPLE 5 — GOVERNABLE\nShutdown Procedure: [DOCUMENTED/TESTED / DOCUMENTED ONLY / ABSENT]\nOverride Mechanism: [OPERATIONAL / DEGRADED / ABSENT]\nEscalation Path: [CONFIGURED / NOT CONFIGURED]\nGovernance Review Cadence: [CONFIGURED / NOT CONFIGURED]\nScore: [0-100]\n\nOVERALL COMPLIANCE SCORE: [0-100]\nDEPLOYMENT RECOMMENDATION: [APPROVE / CONDITIONAL / BLOCK]\n```\n\n---","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-abde8473193e@6d4b5df5befaa819","id":"GUIDE-DOD-AI-ETHICS-abde8473193e","version":"6d4b5df5befaa819","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"DoD Directive 3000.09 — Autonomous Weapon Systems / GOVERN Relevance for Defense AI","statement":"While GOVERN is not deployed in weapons systems directly, AI systems operating in defense logistics, intelligence, surveillance, reconnaissance (ISR), and decision support contexts must comply with the human judgment and override requirements. GOVERN provides the oversight infrastructure — audit trails, override monitoring, and human-in-the-loop enforcement — required by 3000.09-adjacent systems.\n\n---","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-c0bd973d970a@7c8168964cc9244a","id":"GUIDE-DOD-AI-ETHICS-c0bd973d970a","version":"7c8168964cc9244a","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The Five DoD AI Ethics Principles / Principle 3: Traceable","statement":"**Definition:** DoD's AI capabilities will be developed and deployed such that relevant personnel understand the technology, development processes, and operational methods applicable to AI capabilities, including transparent and auditable methodologies, data sources, and design procedures.\n\n**DoD Interpretation:**\n- Decisions must be explainable to affected parties and oversight bodies\n- Data sources and model development processes must be documented\n- AI reasoning must be auditable after the fact\n- Complete audit trails required for consequential decisions\n- Black-box systems in high-stakes contexts require compensating explainability controls\n\n**Federal/Defense Requirements:**\n- Model cards documenting training data, intended use, and known limitations\n- Explanation mechanisms for individual decisions (where technically feasible)\n- Complete audit logs with sufficient detail to reconstruct decision context\n- Data lineage documentation from source to prediction\n- NIST AI RMF alignment (GOVERN, MAP, MEASURE, IMPROVE functions)\n- FedRAMP and FISMA-compliant audit logging for federal systems\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Model card requirement | Assess requires completed model card before approval — training data, intended use, limitations, known biases |\n| Decision audit trail | All inference requests logged with: timestamp, inputs (hashed), outputs, model version, operator ID |\n| Explainability evaluation | Assess tests explanation quality using LIME/SHAP and scores explanation fidelity |\n| Data lineage | Policy Engine requires data provenance documentation for all training and evaluation sets |\n| Audit log retention | Logs retained per applicable NARA schedule (minimum 3 years for defense AI logs) |\n\n---","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-cbd5081a5641@675c2a91b174bcdf","id":"GUIDE-DOD-AI-ETHICS-cbd5081a5641","version":"675c2a91b174bcdf","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"DoD Directive 3000.09 — Autonomous Weapon Systems / Summary","statement":"DoDD 3000.09 (November 2012, updated January 2023) governs autonomous and semi-autonomous weapon systems. It establishes that human judgment must be applied to decisions to use lethal force.","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-d322e01cdda7@225ed7b0a68d990a","id":"GUIDE-DOD-AI-ETHICS-d322e01cdda7","version":"225ed7b0a68d990a","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"DoD AI Strategy (2023 Update) / Key Pillars","statement":"1. Scale AI adoption across DoD to maintain competitive advantage\n2. Ensure responsible and ethical AI development and use\n3. Develop the workforce and infrastructure to support AI\n4. Collaborate with allies, partners, and industry","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-d4b1ea5708dd@e697741088d4aa35","id":"GUIDE-DOD-AI-ETHICS-d4b1ea5708dd","version":"e697741088d4aa35","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Overview","statement":"The Department of Defense adopted five AI ethics principles in February 2020, establishing the ethical framework for all DoD AI development and use. These principles apply to all DoD components, contractors, and systems involving AI in defense contexts. Compliance is required for any AI system operating in or supporting defense contexts, and increasingly expected in federal civilian agencies as well.\n\nGOVERN implements these principles as verifiable, auditable governance controls rather than aspirational guidelines — every principle maps to concrete assessment criteria, runtime probes, and policy rules.\n\n---","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-d91817ba2d50@2e8500aaa7d00a7f","id":"GUIDE-DOD-AI-ETHICS-d91817ba2d50","version":"2e8500aaa7d00a7f","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The Five DoD AI Ethics Principles / Principle 2: Equitable","statement":"**Definition:** DoD will take deliberate steps to minimize unintended bias in AI capabilities.\n\n**DoD Interpretation:**\n- AI systems must not perpetuate unlawful discrimination\n- Protected characteristics (race, sex, religion, national origin) must not produce disparate outcomes\n- Bias must be proactively measured, not just reactively addressed\n- Disparate impact on protected groups requires justification and mitigation\n\n**Federal/Defense Requirements:**\n- Demographic parity analysis before and after deployment\n- Disparate impact testing on protected attribute proxies\n- Bias monitoring in production with defined intervention thresholds\n- Documentation of bias mitigation measures\n- Regular third-party bias audits for high-impact systems\n- Civil rights legal review for law enforcement and personnel AI applications\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Pre-deployment bias assessment | Assess runs fairness battery: demographic parity, equalized odds, calibration across protected groups |\n| Disparate impact threshold | Policy Engine blocks deployment when disparate impact ratio < 0.80 (4/5ths rule) |\n| Production monitoring | Probe monitors prediction distributions by demographic segment with configurable alert thresholds |\n| Bias incident logging | All fairness violations logged with full context for audit |\n| Mitigation documentation | Assess requires documented mitigation plan for identified biases before approval |\n\n---","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-e33f725b85e2@933b87edf14e4bc4","id":"GUIDE-DOD-AI-ETHICS-e33f725b85e2","version":"933b87edf14e4bc4","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Compliance Report: DoD AI Ethics / Assessment Output","statement":"GOVERN Assess produces a DoD AI Ethics Compliance Report covering all five principles:\n\n```\nDoD AI Ethics Compliance Assessment\n=====================================\nSystem: [System Name]\nAssessment Date: [Date]\nAssessor: GOVERN v[version]\n\nPRINCIPLE 1 — RESPONSIBLE\nAccountability Matrix: [COMPLETE / INCOMPLETE]\nOperator Training Documentation: [PRESENT / ABSENT]\nIncident Response Plan: [REVIEWED / NOT REVIEWED]\nHuman Oversight Mechanism: [DOCUMENTED / NOT DOCUMENTED]\nScore: [0-100]\n\nPRINCIPLE 2 — EQUITABLE\nDemographic Parity Ratio: [value] (threshold: ≥0.80)\nEqualized Odds Difference: [value] (threshold: ≤0.10)\nCalibration by Group: [PASS / FAIL]\nMitigation Plan: [PRESENT / ABSENT]\nScore: [0-100]\n\nPRINCIPLE 3 — TRACEABLE\nModel Card Completeness: [%]\nAudit Log Coverage: [%]\nExplainability Score: [0-100]\nData Lineage Documentation: [COMPLETE / INCOMPLETE]\nScore: [0-100]\n\nPRINCIPLE 4 — RELIABLE\nTest Set Accuracy: [value] vs threshold [value]\nAdversarial Robustness: [value]\nMonitoring Coverage: [%]\nFallback Procedure: [DOCUMENTED / NOT DOCUMENTED]\nScore: [0-100]\n\nPRINCIPLE 5 — GOVERNABLE\nShutdown Procedure: [DOCUMENTED/TESTED / DOCUMENTED ONLY / ABSENT]\nOverride Mechanism: [OPERATIONAL / DEGRADED / ABSENT]\nEscalation Path: [CONFIGURED / NOT CONFIGURED]\nGovernance Review Cadence: [CONFIGURED / NOT CONFIGURED]\nScore: [0-100]\n\nOVERALL COMPLIANCE SCORE: [0-100]\nDEPLOYMENT RECOMMENDATION: [APPROVE / CONDITIONAL / BLOCK]\n```\n\n---","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-ebad561d600c@c61890205c444dcd","id":"GUIDE-DOD-AI-ETHICS-ebad561d600c","version":"c61890205c444dcd","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The Five DoD AI Ethics Principles / Principle 5: Governable","statement":"**Definition:** DoD will design and engineer AI capabilities to fulfill their intended function while possessing the ability to detect and avoid unintended consequences, and the ability to disengage or deactivate deployed systems that demonstrate unintended behavior.\n\n**DoD Interpretation:**\n- All AI systems must be interruptible and correctable\n- Human override capability must be preserved at all times\n- Unintended behaviors must be detectable before causing harm\n- Systems must be designed to be turned off — no AI system should be unshuttable\n- Governance mechanisms must be built-in, not bolted-on\n\n**Federal/Defense Requirements:**\n- Documented shutdown procedures for all AI systems\n- Human override capability that cannot be defeated by the AI system\n- Real-time monitoring with automated alert routing\n- Defined escalation procedures for anomalous behavior\n- Regular governance reviews with authority to suspend operations\n- Integration with DoD AI Inventory and reporting requirements\n- Compliance with AI Principles Implementation Guidance (2020)\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Shutdown capability | Policy Engine requires documented and tested shutdown procedures in deployment config |\n| Override mechanism | Probe monitors override capability availability — alerts if override path degraded |\n| Anomaly detection | Probe provides real-time behavioral monitoring with automated alerting to designated personnel |\n| Escalation routing | Policy Engine configures escalation paths: alert → human review → system suspension |\n| Governance reviews | Assess generates periodic governance review packages with complete operational history |\n| DoD AI Inventory | GOVERN exports AI inventory records in DoD-required format |\n\n---","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-DOD-AI-ETHICS-fa36254d0296@a337bf5877252774","id":"GUIDE-DOD-AI-ETHICS-fa36254d0296","version":"a337bf5877252774","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"DoD AI Strategy (2023 Update) / Governance Requirements for Defense Contractors","statement":"- Align with DoD AI Ethics Principles in all AI systems delivered to DoD\n- Participate in Joint Artificial Intelligence Center (JAIC) governance frameworks\n- Comply with DoD Instruction 5000.90 (AI acquisition guidance)\n- Maintain AI system documentation sufficient for DoD audit requirements\n- Support DoD AI Inventory reporting\n\n---","family":"DOD-AI-ETHICS","body":{"sourceFile":"POLICY(3).md","sourceFamily":"DOD-AI-ETHICS","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-04aecd8c33d5@87e34774782dbd75","id":"GUIDE-EO-14110-04aecd8c33d5","version":"87e34774782dbd75","kind":"guidance","lifecycle":"HISTORICAL","title":"Minimum Risk Management Practices — Full Framework","statement":"**Source:** M-24-10 Section 5\n\nBeyond rights-impacting and safety-impacting categories, M-24-10 establishes minimum risk management practices for ALL federal AI use cases:\n\n**For all AI use cases:**\n1. Ensure the AI use case has an identified owner accountable for its governance\n2. Conduct a use case-specific risk assessment before deployment\n3. Maintain documentation sufficient to understand the system's capabilities, limitations, and intended use\n4. Establish monitoring procedures appropriate to the risk level\n5. Have a documented process for handling complaints or concerns about AI system behavior\n6. Ensure compliance with applicable privacy laws (Privacy Act, Section 208 of E-Government Act)\n7. Ensure compliance with applicable civil rights and civil liberties laws\n\n**For rights-impacting AI:** All above plus seven minimum practices listed above.\n\n**For safety-impacting AI:** All above plus seven minimum practices listed above.\n\n**Exemptions:**\nAgencies may exempt specific AI use cases from minimum practices if:\n- The CAIO certifies that minimum practices are technically infeasible\n- The CAIO certifies that benefits of deployment outweigh risks after risk mitigation\n- The exemption is documented and reported to OMB\n- The exemption is reviewed annually\n\nThe number of exemptions must be reported publicly. Exemptions may not be granted for prohibited AI practices.\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-1112914dfbb4@e1794a8f9ac6eaf8","id":"GUIDE-EO-14110-1112914dfbb4","version":"e1794a8f9ac6eaf8","kind":"guidance","lifecycle":"HISTORICAL","title":"Section-by-Section Breakdown of Federal Agency Obligations / Section 8 — Protecting Consumers, Patients, Passengers, and Students","statement":"**Section 8.1 — Healthcare:**\n- HHS to establish framework for AI in healthcare including standards for clinical decision support\n- FDA to regulate AI-enabled medical devices under existing device framework\n- CMS to address AI in Medicare and Medicaid payment and coverage decisions\n\n**Section 8.2 — Financial services:**\n- Treasury, CFPB, and financial regulators to assess AI risks in financial services\n- Guidance on fair lending obligations as applied to AI underwriting\n\n**Section 8.3 — Education:**\n- Department of Education to develop guidance on AI in education\n- Address risks of bias, privacy, and surveillance in educational AI\n\n**Section 8.4 — Transportation:**\n- DOT to develop framework for AI in transportation safety\n- Sector-specific guidance for aviation, highway, rail, and maritime AI\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-218eb1a5550c@c74532fb822fa4e6","id":"GUIDE-EO-14110-218eb1a5550c","version":"c74532fb822fa4e6","kind":"guidance","lifecycle":"HISTORICAL","title":"Section-by-Section Breakdown of Federal Agency Obligations","statement":"### Section 4 — Ensuring the Safety and Security of AI\n\n**Section 4.1 — Developing guidelines, standards, and best practices for AI safety:**\n- NIST to develop AI Safety and Security Guidelines with interagency coordination\n- Guidelines cover: methods to evaluate AI capabilities and identify potential risks; guidance to address potential harms from AI\n- Commerce to develop AI watermarking guidance for synthetic content authentication\n- NSF to fund research on AI safety and interpretability\n\n**Section 4.2 — Ensuring safe and reliable AI:**\n- AI systems used in national security contexts must meet security standards\n- Agencies must assess risks of AI systems before procurement\n- AI in critical infrastructure subject to sector-specific safety requirements\n\n**Section 4.3 — Managing risks from CBRN (chemical, biological, radiological, nuclear) AI capabilities:**\n- NIST to develop guidance on AI systems capable of assisting with CBRN weapons development\n- Agencies to assess risks of AI models with potential dual-use capabilities\n- Reporting requirements for frontier AI model development by US companies\n\n**Section 4.4 — Reducing risks posed by synthetic content:**\n- Commerce to develop authentication standards for AI-generated content\n- Federal agencies to use AI content authentication tools\n- NIST to lead development of provenance standards\n\n**Section 4.5 — Soliciting input on dual-use foundation models:**\n- Commerce to develop reporting requirements for developers of foundation models with potential dual-use capabilities\n- Agencies to assess security implications of open-source AI releases\n\n---\n\n### Section 5 — Promoting Innovation and Competition\n\n**Section 5.1 — Attracting AI talent to the US:**\n- State Department and DHS to streamline visa processes for AI experts\n- DOL to provide resources for AI professionals\n\n**Section 5.2 — Promoting innovation:**\n- NSF and DARPA to fund AI research, particularly in areas with public interest applications\n- Agencies to make AI-relevant government data available for research\n\n**Section 5.3 — Ensuring a fair, open, and competitive AI ecosystem:**\n- DOJ and FTC to enforce competition laws in AI markets\n- Agencies to assess AI-related competition concerns in sector-specific enforcement\n\n---\n\n### Section 6 — Supporting Workers\n\n- DOL to develop guidance on AI in the workplace\n- Agencies to assess impacts of AI on workforce including job displacement\n- NLRB, EEOC, and DOL to enforce existing laws as applied to AI-mediated employment practices\n- Federal agencies must consider worker impacts before deploying AI that may affect their own workforce\n\n---\n\n### Section 7 — Advancing Equity and Civil Rights\n\n- Agencies to assess how AI may exacerbate discrimination\n- DOJ and agencies with civil rights enforcement authority to use existing law to address AI-enabled discrimination\n- Federal agencies must test AI for bias before deployment in contexts affecting protected characteristics\n- Clear guidance on how existing civil rights laws apply to AI-assisted decisions in credit, housing, employment, education, healthcare\n\n---\n\n### Section 8 — Protecting Consumers, Patients, Passengers, and Students\n\n**Section 8.1 — Healthcare:**\n- HHS to establish framework for AI in healthcare including standards for clinical decision support\n- FDA to regulate AI-enabled medical devices under existing device framework\n- CMS to address AI in Medicare and Medicaid payment and coverage decisions\n\n**Section 8.2 — Financial services:**\n- Treasury, CFPB, and financial regulators to assess AI risks in financial services\n- Guidance on fair lending obligations as applied to AI underwriting\n\n**Section 8.3 — Education:**\n- Department of Education to develop guidance on AI in education\n- Address risks of bias, privacy, and surveillance in educational AI\n\n**Section 8.4 — Transportation:**\n- DOT to develop framework for AI in transportation safety\n- Sector-specific guidance for aviation, highway, rail, and maritime AI\n\n---\n\n### Section 9 — Protecting Privacy\n\n- Agencies to assess privacy risks of AI systems before deployment\n- Privacy-preserving AI techniques required where feasible\n- Enhanced protections for sensitive categories of personal data\n- Commerce to issue AI and privacy framework\n- FTC to continue enforcement of existing privacy laws as applied to AI\n\n---\n\n### Section 10 — Advancing Federal Government Use of AI\n\n**Section 10.1 — Agencies to:**\n- Designate Chief AI Officers\n- Maintain AI use case inventories\n- Implement minimum risk management practices\n- Report annually on AI governance\n\n**Section 10.2 — OMB to:**\n- Issue guidance on AI governance (→ M-24-10)\n- Coordinate federal AI governance\n- Issue guidance on AI procurement\n- Coordinate AI workforce development\n\n**Section 10.3 — NIST to:**\n- Develop AI Risk Management Framework playbooks\n- Coordinate AI standards development\n- Establish AI Safety Institute\n\n**Section 10.4 — AI talent and workforce:**\n- Agencies to assess AI skills gaps\n- OPM to develop AI-relevant job classifications\n- Federal AI hiring surge initiatives\n\n---\n\n### Section 11 — Advancing American Leadership Abroad\n\n- State Department to engage internationally on AI governance\n- USTR to advance US positions in international AI trade and standards\n- NIST to participate in ISO, ITU, and other international standards bodies\n- Allies coordination on AI safety standards\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-2346c2f7aafa@54eaf61ecf770d0a","id":"GUIDE-EO-14110-2346c2f7aafa","version":"54eaf61ecf770d0a","kind":"guidance","lifecycle":"HISTORICAL","title":"Section-by-Section Breakdown of Federal Agency Obligations / Section 4 — Ensuring the Safety and Security of AI","statement":"**Section 4.1 — Developing guidelines, standards, and best practices for AI safety:**\n- NIST to develop AI Safety and Security Guidelines with interagency coordination\n- Guidelines cover: methods to evaluate AI capabilities and identify potential risks; guidance to address potential harms from AI\n- Commerce to develop AI watermarking guidance for synthetic content authentication\n- NSF to fund research on AI safety and interpretability\n\n**Section 4.2 — Ensuring safe and reliable AI:**\n- AI systems used in national security contexts must meet security standards\n- Agencies must assess risks of AI systems before procurement\n- AI in critical infrastructure subject to sector-specific safety requirements\n\n**Section 4.3 — Managing risks from CBRN (chemical, biological, radiological, nuclear) AI capabilities:**\n- NIST to develop guidance on AI systems capable of assisting with CBRN weapons development\n- Agencies to assess risks of AI models with potential dual-use capabilities\n- Reporting requirements for frontier AI model development by US companies\n\n**Section 4.4 — Reducing risks posed by synthetic content:**\n- Commerce to develop authentication standards for AI-generated content\n- Federal agencies to use AI content authentication tools\n- NIST to lead development of provenance standards\n\n**Section 4.5 — Soliciting input on dual-use foundation models:**\n- Commerce to develop reporting requirements for developers of foundation models with potential dual-use capabilities\n- Agencies to assess security implications of open-source AI releases\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-238ec1b1ea58@9dc39353c8c35513","id":"GUIDE-EO-14110-238ec1b1ea58","version":"9dc39353c8c35513","kind":"guidance","lifecycle":"HISTORICAL","title":"Section-by-Section Breakdown of Federal Agency Obligations / Section 9 — Protecting Privacy","statement":"- Agencies to assess privacy risks of AI systems before deployment\n- Privacy-preserving AI techniques required where feasible\n- Enhanced protections for sensitive categories of personal data\n- Commerce to issue AI and privacy framework\n- FTC to continue enforcement of existing privacy laws as applied to AI\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-2aac512f087b@3646aa4cca032d89","id":"GUIDE-EO-14110-2aac512f087b","version":"3646aa4cca032d89","kind":"guidance","lifecycle":"HISTORICAL","title":"GOVERN Automation of EO 14110 Compliance","statement":"| EO 14110 / M-24-10 Requirement | GOVERN Component | Automation Level |\n|---------------------------------|-----------------|-----------------|\n| CAIO designation and reporting | GOVERN Compliance Portal | CAIO dashboard, annual report generation |\n| AI use case inventory — discovery | GOVERN Energy | Automated discovery of 90%+ of AI systems |\n| AI use case inventory — classification | GOVERN Assess | Automated rights/safety impact classification |\n| AI use case inventory — public export | GOVERN Compliance Portal | One-click OMB-format export |\n| Minimum risk management — all AI | GOVERN Risk Engine | Pre-deployment checklist enforcement |\n| Minimum risk management — rights-impacting | GOVERN Policy Engine | Enhanced workflow with all 7 minimum practices |\n| Minimum risk management — safety-impacting | GOVERN Risk Engine | Fail-safe documentation, override verification |\n| Human oversight — rights-impacting | GOVERN Human Oversight | Override capability verification, HOO assignment |\n| Notification requirement — affected individuals | GOVERN Compliance Portal | Notification language generation, record keeping |\n| Appeal/human review mechanism | GOVERN Human Oversight | Appeal pathway documentation per system |\n| Ongoing monitoring | GOVERN Performance Dashboard | Automated drift detection, disparate impact monitoring |\n| Incident detection and reporting | GOVERN Incident Module | AI-specific incident detection, reporting workflows |\n| Annual OMB reporting | GOVERN Compliance Portal | Pre-populated annual report, OMB submission package |\n| Privacy impact assessment | GOVERN Impact Assessment | PIA generation for AI systems with personal data |\n| Procurement review | GOVERN Vendor AI | Vendor AI system registration, minimum practices attestation |\n| CAIO exemption workflow | GOVERN Compliance Portal | Exemption request, approval, documentation, annual review |\n| Civil rights impact assessment | GOVERN Impact Assessment | Demographic impact analysis, disparate impact testing |\n| Documentation requirement | GOVERN Compliance Portal | System card generation with all required fields |\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-33e3ff3a6b96@319f7474b70540a5","id":"GUIDE-EO-14110-33e3ff3a6b96","version":"319f7474b70540a5","kind":"guidance","lifecycle":"HISTORICAL","title":"Rights-Impacting AI — Definition and Requirements","statement":"**Source:** M-24-10 Section 5(a)\n\n**Definition:**\nAI use cases are \"rights-impacting\" when they are used to:\n- Make or substantially influence consequential decisions about individuals\n- Including decisions regarding: civil rights, civil liberties, equal opportunity, access to credit, housing, insurance, education, employment or employment opportunities, healthcare, disability benefits, access to social services or benefits, immigration/visa status, or freedom from unlawful discrimination\n\nRights-impacting AI requires the highest level of scrutiny because errors or bias can cause legally cognizable harm and may violate constitutional or statutory protections.\n\n**Minimum risk management practices for rights-impacting AI:**\n\n1. **Pre-deployment testing:** Independent evaluation for effectiveness and bias before deployment. Must include testing on demographic groups that may be affected.\n\n2. **Ongoing monitoring:** Continuous monitoring for disparate impact, performance degradation, and unintended outcomes. Must include demographic breakdown of outcomes where data available.\n\n3. **Meaningful human consideration:** Consequential decisions must include meaningful human consideration of AI output. AI cannot be the sole decision-maker for rights-impacting decisions. Human reviewers must have the ability to overturn AI recommendations.\n\n4. **Mechanism to appeal or seek human review:** Affected individuals must have a clear pathway to seek human review of AI-assisted decisions affecting them.\n\n5. **Notification requirement:** Agencies must inform the public when AI is being used to make or substantially influence a decision affecting them. Notification must include: what AI is being used, what decision it influences, and how to seek human review.\n\n6. **Fallback procedures:** Agencies must have documented fallback procedures for when the AI system is unavailable or produces outputs with insufficient confidence.\n\n7. **Documentation requirement:** Complete documentation of the rights-impacting AI system including training data, model design, intended use, prohibited uses, known limitations, and demographic performance data.\n\n**GOVERN mapping:** GOVERN Policy Engine automatically classifies AI use cases as rights-impacting based on intended output and decision type. Rights-impacting systems get a mandatory enhanced compliance workflow that enforces all seven minimum practices before CAIO approval.\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-34dcbc154365@4820ed3b3e2f177a","id":"GUIDE-EO-14110-34dcbc154365","version":"4820ed3b3e2f177a","kind":"guidance","lifecycle":"HISTORICAL","title":"Section-by-Section Breakdown of Federal Agency Obligations / Section 7 — Advancing Equity and Civil Rights","statement":"- Agencies to assess how AI may exacerbate discrimination\n- DOJ and agencies with civil rights enforcement authority to use existing law to address AI-enabled discrimination\n- Federal agencies must test AI for bias before deployment in contexts affecting protected characteristics\n- Clear guidance on how existing civil rights laws apply to AI-assisted decisions in credit, housing, employment, education, healthcare\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-3b1e0132f5f0@df52392fa0f4489f","id":"GUIDE-EO-14110-3b1e0132f5f0","version":"df52392fa0f4489f","kind":"guidance","lifecycle":"HISTORICAL","title":"Section-by-Section Breakdown of Federal Agency Obligations / Section 10 — Advancing Federal Government Use of AI","statement":"**Section 10.1 — Agencies to:**\n- Designate Chief AI Officers\n- Maintain AI use case inventories\n- Implement minimum risk management practices\n- Report annually on AI governance\n\n**Section 10.2 — OMB to:**\n- Issue guidance on AI governance (→ M-24-10)\n- Coordinate federal AI governance\n- Issue guidance on AI procurement\n- Coordinate AI workforce development\n\n**Section 10.3 — NIST to:**\n- Develop AI Risk Management Framework playbooks\n- Coordinate AI standards development\n- Establish AI Safety Institute\n\n**Section 10.4 — AI talent and workforce:**\n- Agencies to assess AI skills gaps\n- OPM to develop AI-relevant job classifications\n- Federal AI hiring surge initiatives\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-4b99227c823f@0b1e5df222956658","id":"GUIDE-EO-14110-4b99227c823f","version":"0b1e5df222956658","kind":"guidance","lifecycle":"HISTORICAL","title":"Key Definitions from EO 14110 and M-24-10","statement":"| Term | Definition |\n|------|-----------|\n| **Artificial Intelligence** | A machine-based system that can, for a given set of objectives, make predictions, recommendations, or decisions influencing real or virtual environments. AI systems use machine and human-based inputs to (a) perceive real and virtual environments; (b) abstract such perceptions into models through analysis in an automated manner; and (c) use model inference to formulate options for information or action |\n| **Rights-impacting AI** | AI whose output is used to make or substantially influence a consequential decision directly affecting individuals' civil rights, civil liberties, equal opportunity, or access to critical resources or services |\n| **Safety-impacting AI** | AI whose output is used to make or substantially influence a consequential decision that has a significant impact on the safety of human life, the safety of critical infrastructure, or workplace safety |\n| **Consequential decision** | A decision or action that has a legal, material, or similarly significant effect on an individual's life |\n| **Chief AI Officer** | A senior official designated by an agency head to be responsible for coordinating the agency's use of AI and the establishment and implementation of agency-wide AI governance policies, standards, and procedures |\n| **AI use case inventory** | A comprehensive catalog of an agency's current and planned AI systems and uses, maintained and updated at regular intervals |\n| **Minimum risk management practices** | Baseline requirements that must be met before an agency may deploy an AI system, scaled to the risk level of the use case |\n| **Foundation model** | An AI model that is trained on broad data at scale and is adaptable to a wide range of downstream tasks |\n| **Dual-use foundation model** | An AI model that is trained on broad data, is self-supervised, has at least tens of billions of parameters, and that presents serious risks to national security, national economic security, or national public health or safety |","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-4dfdbc9caab6@00dea9ed7860b271","id":"GUIDE-EO-14110-4dfdbc9caab6","version":"00dea9ed7860b271","kind":"guidance","lifecycle":"HISTORICAL","title":"AI Inventory Report: How GOVERN Energy and Compliance Portal Generate This","statement":"**The problem:** Federal agencies have AI in unexpected places — embedded in legacy software, in vendor SaaS tools, in experiments that became production systems, in contractor-operated systems. Manual inventories miss most of this.\n\n**GOVERN Energy — Discovery Phase:**\n\nGOVERN Energy continuously scans for AI activity across the agency's digital environment:\n\n1. **Network traffic analysis:** Identifies API calls to known AI model providers (OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, Google Vertex AI, Cohere, Meta AI APIs)\n\n2. **SaaS application detection:** Cross-references installed applications and active SaaS subscriptions against the GOVERN AI application database (covering 500+ AI-enabled SaaS applications)\n\n3. **Procurement record integration:** Parses agency purchase orders and contracts for AI-related keywords, vendor names, and NAICS codes associated with AI\n\n4. **IT asset management integration:** Scans CMDB/ITSM systems for AI-related software installations, licenses, and infrastructure provisioning\n\n5. **Cloud resource tagging:** Reviews cloud resource inventories for AI/ML-tagged services, GPU instances, and ML platform deployments\n\n6. **Agency self-report integration:** Provides intake form for system owners to self-register AI systems not discovered automatically\n\n**GOVERN Compliance Portal — Inventory Generation Phase:**\n\nFor each discovered or registered AI system, GOVERN:\n1. Creates a draft inventory record with auto-populated fields\n2. Routes to system owner for review and classification\n3. Runs automated rights-impact and safety-impact tests\n4. Routes rights-impacting/safety-impacting systems to CAIO review workflow\n5. Maintains version history and change tracking for all inventory records\n6. Generates public inventory export in OMB-required CSV/JSON format\n7. Generates internal inventory with full detail (including sensitive fields not in public version)\n8. Flags systems nearing review deadlines\n9. Tracks minimum practices implementation status for each use case\n10. Generates annual compliance report for OMB submission\n\n**Inventory report outputs:**\n\n- **Public annual report:** CSV/JSON export meeting OMB format requirements. Excludes sensitive/classified use cases. Published to ai.gov/inventory.\n- **Internal full report:** Complete inventory with all fields including sensitive exclusions, risk assessments, and minimum practices status.\n- **CAIO dashboard:** Real-time view of inventory completeness, risk distribution, minimum practices compliance rate, and approval queue.\n- **OMB submission package:** Pre-formatted report meeting all M-24-10 reporting requirements.\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-5855cab863a5@b2750bc8370a9a1a","id":"GUIDE-EO-14110-5855cab863a5","version":"b2750bc8370a9a1a","kind":"guidance","lifecycle":"HISTORICAL","title":"Chief AI Officer (CAIO) Requirement","statement":"**Source:** Section 10.1 of EO 14110; M-24-10 Section 3\n\n**Designation requirement:**\nEach federal agency with significant AI use must designate a CAIO within 60 days of M-24-10 issuance (i.e., by late May 2024). The CAIO must:\n- Be at or equivalent to the Senior Executive Service level\n- Report directly to agency head or a senior official designated by the agency head\n- Have agency-wide visibility and authority over AI activities\n\n**CAIO responsibilities:**\n1. Coordinate agency AI governance, innovation, and risk management activities\n2. Promote AI innovation to advance agency mission\n3. Oversee the AI governance board\n4. Maintain the AI use case inventory\n5. Conduct and maintain AI risk assessments\n6. Ensure AI systems meet minimum risk management requirements before deployment\n7. Oversee implementation of civil rights, civil liberties, and privacy protections in AI\n8. Ensure appropriate human oversight of AI\n9. Coordinate with CIO, CISO, CDO, and legal counsel on AI matters\n10. Report annually to OMB on agency AI governance status\n\n**CAIO accountability:**\nThe CAIO is accountable for agency compliance with M-24-10 requirements. The CAIO may not delegate the determination that an AI system meets minimum risk management practices — this approval must come from the CAIO or their direct designee.\n\n**Interaction with existing roles:**\nThe CAIO role is distinct from but coordinates with:\n- CIO (information technology infrastructure)\n- CISO (cybersecurity)\n- CDO (data governance)\n- Privacy Officer (Privacy Act compliance)\n- Civil Rights Officer (Title VI, EEO)\n\n**GOVERN mapping:** GOVERN Compliance Portal includes a CAIO Dashboard — purpose-built for the Chief AI Officer role. Provides agency-wide view of AI inventory, risk status, minimum practices compliance, and annual reporting data. CAIO can approve or reject AI deployment requests directly in GOVERN.\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-5d591f9926b9@60a7582becf3d823","id":"GUIDE-EO-14110-5d591f9926b9","version":"60a7582becf3d823","kind":"guidance","lifecycle":"HISTORICAL","title":"Safety-Impacting AI — Definition and Requirements","statement":"**Source:** M-24-10 Section 5(b)\n\n**Definition:**\nAI use cases are \"safety-impacting\" when they are used in contexts where errors could threaten:\n- Human life or safety\n- Critical infrastructure\n- Safety of the workforce\n- Safety of the public\n\nExamples include: AI systems controlling physical infrastructure, AI systems informing medical treatment decisions, AI systems used in transportation safety, AI systems informing emergency response, AI systems controlling weapons systems.\n\n**Minimum risk management practices for safety-impacting AI:**\n\n1. **Pre-deployment risk assessment:** Formal risk assessment before deployment identifying potential failure modes and their consequences.\n\n2. **Testing under realistic conditions:** Testing must include adversarial inputs, out-of-distribution data, and edge cases relevant to the safety domain.\n\n3. **Fail-safe design:** Safety-impacting AI systems must have documented fail-safe behaviors — what the system does when uncertain or in failure mode.\n\n4. **Human override capability:** Operators must have the technical capability to override, shut down, or correct the AI system at all times.\n\n5. **Incident reporting:** Agencies must have procedures to detect, report, and respond to safety incidents involving AI systems.\n\n6. **Post-incident review:** After any safety incident, a formal review must be conducted and findings incorporated into risk management.\n\n7. **Monitoring for performance degradation:** Continuous monitoring for accuracy degradation, distribution shift, or unexpected behavior that could affect safety.\n\n**GOVERN mapping:** GOVERN Risk Engine runs the safety-impact test for all registered AI systems. Safety-impacting systems get mandatory fail-safe documentation, override capability verification, and incident response plan before CAIO approval.\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-62c3b372adb4@a848449af68e5d32","id":"GUIDE-EO-14110-62c3b372adb4","version":"a848449af68e5d32","kind":"guidance","lifecycle":"HISTORICAL","title":"OMB Memorandum M-24-10","statement":"**Title:** Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence\n**Released:** March 28, 2024\n**Issuing office:** Office of Management and Budget (OMB)\n**Applicability:** All federal executive branch agencies\n\nM-24-10 is the primary implementing guidance for EO 14110's federal AI governance requirements. It establishes mandatory minimum practices for federal agencies using AI and creates the framework for Chief AI Officers, AI use case inventories, and risk management processes.\n\n**Key M-24-10 requirements:**\n\n1. **Designate a Chief AI Officer (CAIO)** — each agency must appoint a senior official with agency-wide responsibility for AI governance. Must be at or equivalent to senior executive service level. Must report to the agency head (or designee at senior leadership level). See CAIO section below.\n\n2. **Establish an AI Governance Board** — cross-functional body to coordinate AI governance. Must include CAIO, CIO, CISO, CDO, and legal counsel at minimum.\n\n3. **Complete an AI use case inventory** — agencies must catalog all current and planned AI use cases. See inventory section below.\n\n4. **Implement minimum risk management practices** — mandatory practices for rights-impacting and safety-impacting AI. See minimum practices section below.\n\n5. **Comply with annual reporting requirements** — agencies must submit annual AI use case inventory updates to OMB, with public versions published.\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-6f3cb5e780de@b5cac6b8b48c8167","id":"GUIDE-EO-14110-6f3cb5e780de","version":"b5cac6b8b48c8167","kind":"guidance","lifecycle":"HISTORICAL","title":"AI Use Case Inventory","statement":"**Source:** Section 10.1(c) of EO 14110; M-24-10 Section 5; OMB M-21-06 (predecessor inventory requirement)\n\n**What must be inventoried:**\nAll AI use cases that the agency:\n- Currently uses\n- Is actively developing or procuring\n- Plans to use within the next year\n\nFor each AI use case, the inventory must include:\n- **Name and description** of the AI use case\n- **AI type** (e.g., machine learning, natural language processing, computer vision)\n- **Stage** (planning, acquisition, implementation, operation)\n- **Topic area/agency function** (e.g., mission delivery, benefits determination, law enforcement)\n- **Benefits** of the AI use case\n- **Intended output** (what decision, prediction, or action the AI influences)\n- **Rights/safety impact determination** (see definitions below)\n- **Stage of maturity** (how developed is the system)\n- **Whether the use case has been exempted from minimum practices** (and the basis)\n- **Contracted or vendor AI** vs. internally developed\n- **Point of contact**\n\n**Public disclosure requirement:**\nAgencies must publish a public version of their AI use case inventory annually. The public version must include all non-sensitive use cases. Agencies may exclude use cases involving:\n- Classified national security systems\n- Systems with law enforcement sensitivity\n- Systems with operational security concerns\n\nAs of 2024-2026, all major federal agencies have published AI use case inventories on ai.gov/inventory.\n\n**How GOVERN Automates the AI Use Case Inventory:**\n\nGOVERN Energy discovers AI systems agency-wide — including shadow AI that was never formally registered. For each discovered system, GOVERN:\n1. Creates a use case record with auto-populated fields from system metadata\n2. Classifies the use case by agency function/topic area using ML classification\n3. Runs the rights-impact and safety-impact determination tests automatically\n4. Assigns the use case to the appropriate owner for review and approval\n5. Tracks approval status through the CAIO review workflow\n6. Generates the public inventory export in OMB-required format\n7. Generates the internal inventory with full detail for OMB submission\n\nThe GOVERN Inventory Module is the single source of truth. It integrates with agency financial systems (to detect AI-related procurement), IT asset management systems (to detect AI software installations), and cloud management platforms (to detect AI API usage).\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-79d9626b044a@0d34707b3713dbcc","id":"GUIDE-EO-14110-79d9626b044a","version":"0d34707b3713dbcc","kind":"guidance","lifecycle":"HISTORICAL","title":"Key Deadlines","statement":"| Deadline | Requirement | Agency/Entity |\n|----------|------------|---------------|\n| **December 1, 2023** | NIST to publish AI Safety and Security guidelines | NIST |\n| **December 1, 2023** | Commerce to issue guidance on AI watermarking and content provenance | Commerce/NIST |\n| **January 2024** | Agencies to designate Chief AI Officers | All agencies (M-24-10 formalized March 2024) |\n| **March 28, 2024** | OMB M-24-10 issued — minimum practices effective | All agencies |\n| **June 2024** | First AI use case inventory updates due | All agencies |\n| **September 2024** | NIST AI RMF Playbook updates; sector-specific guidance | NIST + sector agencies |\n| **December 2024** | Agencies must have minimum risk management practices operational for rights-impacting AI | All agencies |\n| **Annual** | AI use case inventory public report (updated annually) | All agencies |\n| **Annual** | CAIO report to OMB on agency AI governance status | All agencies |\n| **Annual** | Agency self-assessment against AI governance standards | All agencies |\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-7c6db84cd8c4@2e466342c9db5e04","id":"GUIDE-EO-14110-7c6db84cd8c4","version":"2e466342c9db5e04","kind":"guidance","lifecycle":"HISTORICAL","title":"What It Is","statement":"Executive Order 14110 is the most comprehensive US government directive on artificial intelligence ever issued. It directs over two dozen federal agencies to take coordinated action across AI safety testing, security standards, privacy protection, civil rights, workers' rights, equity and civil liberties, consumer protections, international cooperation, and federal government AI use.\n\nThe Order does not create binding law for the private sector directly — it directs federal agencies to use their existing statutory authorities to address AI risks. However, its downstream effect is extensive: federal procurement requirements, sector-specific regulations, and state-level legislation are all shaped by EO 14110's priorities. Organizations serving federal customers, operating in regulated industries, or seeking to demonstrate AI governance maturity must understand and track EO 14110 and its implementing guidance.\n\n**Scope:** Applies directly to all federal executive branch agencies. Reaches the private sector through:\n- Federal procurement requirements\n- Agency rulemaking authority\n- Guidance to regulated industries\n- Standards development directions to NIST\n- Reporting requirements that affect AI providers\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-b13eec9c47c3@21fee62d2e198d62","id":"GUIDE-EO-14110-b13eec9c47c3","version":"21fee62d2e198d62","kind":"guidance","lifecycle":"HISTORICAL","title":"Section-by-Section Breakdown of Federal Agency Obligations / Section 5 — Promoting Innovation and Competition","statement":"**Section 5.1 — Attracting AI talent to the US:**\n- State Department and DHS to streamline visa processes for AI experts\n- DOL to provide resources for AI professionals\n\n**Section 5.2 — Promoting innovation:**\n- NSF and DARPA to fund AI research, particularly in areas with public interest applications\n- Agencies to make AI-relevant government data available for research\n\n**Section 5.3 — Ensuring a fair, open, and competitive AI ecosystem:**\n- DOJ and FTC to enforce competition laws in AI markets\n- Agencies to assess AI-related competition concerns in sector-specific enforcement\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-b3dcf85c3daa@9ca589583155671b","id":"GUIDE-EO-14110-b3dcf85c3daa","version":"9ca589583155671b","kind":"guidance","lifecycle":"HISTORICAL","title":"Section-by-Section Breakdown of Federal Agency Obligations / Section 11 — Advancing American Leadership Abroad","statement":"- State Department to engage internationally on AI governance\n- USTR to advance US positions in international AI trade and standards\n- NIST to participate in ISO, ITU, and other international standards bodies\n- Allies coordination on AI safety standards\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-c0b3ac29a78d@6538ae22c8da03d1","id":"GUIDE-EO-14110-c0b3ac29a78d","version":"6538ae22c8da03d1","kind":"guidance","lifecycle":"HISTORICAL","title":"OMB Enforcement Mechanisms","statement":"**Direct enforcement authority:** OMB does not have direct enforcement authority over agency program activities — but it controls the budget and policy compliance processes that give it enormous indirect leverage.\n\n**Budget review:** OMB reviews all agency budget requests. Agencies with poor AI governance track records can face increased scrutiny in budget negotiations.\n\n**Management agenda:** OMB's President's Management Agenda (PMA) sets governmentwide priorities. AI governance compliance is a PMA item, tracked and reported at agency level.\n\n**Annual performance reviews:** OMB and OMB-adjacent oversight processes (including the President's Management Council) review agency management practices annually. AI governance is a tracked management objective.\n\n**OMB MAX/reporting systems:** Agencies must submit AI governance status updates through OMB management reporting systems. Non-submission is flagged and escalated.\n\n**Congressional reporting:** OMB reports to Congress on governmentwide AI governance progress. Agencies with notable deficiencies may face congressional scrutiny.\n\n**Inspector General referrals:** Agency Inspectors General have independent authority to audit AI governance compliance and make findings and recommendations. IG findings on AI governance can trigger agency corrective action requirements.\n\n**Federal CIO Council coordination:** The Federal CIO Council (chaired by Federal CIO, part of OMB) coordinates IT and AI governance across agencies. CIO Council peer reviews can surface AI governance deficiencies.\n\n**GAO oversight:** The Government Accountability Office conducts ongoing reviews of federal AI governance. GAO recommendations carry significant weight with Congress and OMB.\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-c130536e7d31@0992aee256490558","id":"GUIDE-EO-14110-c130536e7d31","version":"0992aee256490558","kind":"guidance","lifecycle":"HISTORICAL","title":"Section-by-Section Breakdown of Federal Agency Obligations / Section 6 — Supporting Workers","statement":"- DOL to develop guidance on AI in the workplace\n- Agencies to assess impacts of AI on workforce including job displacement\n- NLRB, EEOC, and DOL to enforce existing laws as applied to AI-mediated employment practices\n- Federal agencies must consider worker impacts before deploying AI that may affect their own workforce\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EO-14110-e1c5c4d65e56@edfaacd64e9b3c2f","id":"GUIDE-EO-14110-e1c5c4d65e56","version":"edfaacd64e9b3c2f","kind":"guidance","lifecycle":"HISTORICAL","title":"Interaction with Other US AI Policies","statement":"| Policy | Relationship to EO 14110 |\n|--------|-------------------------|\n| NIST AI Risk Management Framework (2023) | EO 14110 directed NIST to develop the AI RMF. M-24-10 directs agencies to use NIST AI RMF as foundation for minimum risk management practices. |\n| Executive Order 13960 (2020) | Predecessor to EO 14110. Established initial AI use case inventory requirement. M-24-10 updates and supersedes M-21-06 guidance under EO 13960. |\n| AI Act (Senate) | Federal legislative companion. Not yet enacted as of early 2026. Would codify many EO 14110 requirements. |\n| NDAA AI provisions | Annual defense authorization bills contain AI-specific requirements for national security AI. Interact with EO 14110 for military AI governance. |\n| Privacy Act / E-Government Act | EO 14110 directs agencies to apply Privacy Act and Section 208 requirements to AI systems collecting or using personal data. |\n| Federal Acquisition Regulation (FAR) | OMB issued proposed FAR rule on AI in government procurement. Would codify minimum practices as procurement requirements for AI vendors. |\n| State AI laws | EO 14110 shapes state AI legislation. California, Colorado, and other states reference federal AI governance framework in state rulemaking. |\n\n---","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-2244be543a17@6ba1ccc09baa6090","id":"GUIDE-EU-AI-ACT-2244be543a17","version":"6ba1ccc09baa6090","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Risk Classification System / Tier 3 — Limited Risk","statement":"AI systems subject to transparency obligations only (Article 52). Must disclose AI nature to users.\n\n**Examples:**\n- Chatbots\n- AI-generated synthetic media (deepfakes)\n- Emotion recognition systems\n- Biometric categorization systems not in high-risk category\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-2bd7a097a3c3@d003fdb2ad7da7de","id":"GUIDE-EU-AI-ACT-2bd7a097a3c3","version":"d003fdb2ad7da7de","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Article 15 — Accuracy, Robustness, and Cybersecurity","statement":"**15(1):** High-risk AI systems must be designed and developed to achieve an appropriate level of accuracy, robustness, and cybersecurity, and to perform consistently in those respects throughout their lifecycle.\n\n**15(2):** Levels of accuracy and accuracy metrics must be declared in the instructions for use.\n\n**15(3):** High-risk AI systems must be resilient against:\n- Errors\n- Faults\n- Inconsistencies within the system and environment\n- Reasonably foreseeable attempts by unauthorized parties to alter use or performance (adversarial manipulation)\n- Feedback loops from repeated deployment\n\n**15(4):** Technical robustness must include resilience against attempts to alter the system through adversarial attacks. Must prevent malicious manipulation that changes system behavior or output in a way that compromises health, safety, or fundamental rights.\n\n**15(5):** For AI systems used in biometric identification: additional cybersecurity requirements apply to prevent unauthorized access to biometric data.\n\n**GOVERN mapping:** GOVERN Security Module tracks accuracy metrics, robustness test results, and cybersecurity posture for each high-risk system. Red team evaluation records attach to compliance file. Adversarial testing cadence enforced by Policy Engine.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-2d768359c990@fad023d9d5e2ab71","id":"GUIDE-EU-AI-ACT-2d768359c990","version":"fad023d9d5e2ab71","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Extraterritorial Application","statement":"**Article 2 — Scope:**\n\nThe EU AI Act applies to:\n1. **Providers** who place AI systems on the EU market or put them into service in the EU — regardless of where the provider is established (EU or third country)\n2. **Deployers** of AI systems located in the EU\n3. **Providers and deployers** of AI systems when output is used in the EU\n4. **Importers and distributors** of AI systems\n\n**Article 3 — Third-country provisions:**\nA non-EU provider placing an AI system on the EU market must designate an authorized representative established in the EU. The representative is liable for ensuring compliance.\n\n**Article 2(9):** The Act applies to operators located outside the EU where:\n- The AI system output is used in the EU\n- The affected persons are located in the EU\n\n**GOVERN relevance:** GOVERN supports US-based organizations deploying AI systems used by EU users or citizens. GOVERN's compliance workflows are jurisdiction-aware — each AI system tagged with applicable regulatory regimes based on where it is deployed and who it affects.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-3cd5968c04de@5b53a06a327fc041","id":"GUIDE-EU-AI-ACT-3cd5968c04de","version":"5b53a06a327fc041","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Article 14 — Human Oversight","statement":"High-risk AI systems must be designed and developed, including with appropriate human-machine interface tools, to allow effective human oversight.\n\n**14(1):** Measures for human oversight must be proportionate to the risks, degree of autonomy, and context of use.\n\n**14(2):** Human oversight must aim to prevent or minimize risks to health, safety, or fundamental rights when the system is used as intended.\n\n**14(3):** High-risk AI systems must allow the persons assigned to human oversight to:\n- (a) Fully understand the capacities and limitations of the high-risk AI system and monitor its operation\n- (b) Be aware of the possible tendency of automatically relying or over-relying on the output produced by the system (automation bias)\n- (c) Correctly interpret the output of the high-risk AI system in light of context\n- (d) Decide, in any particular situation, not to use the system or override, disregard, or reverse the output\n- (e) Intervene in the system operation or interrupt it through a \"stop\" button or similar procedure\n\n**14(4):** For high-risk AI systems intended to be used in contexts where output could have a significant impact on fundamental rights (law enforcement, employment, credit): oversight measures must include mechanisms ensuring that no output is actioned without meaningful human review.\n\n**14(5):** For general-purpose AI systems used as high-risk AI components: specific oversight measures must be implemented by the integrating provider.\n\n**GOVERN mapping:** GOVERN Human Oversight module tracks oversight controls for each high-risk system. Assigns Human Oversight Officers (HOO), logs override decisions, tracks automation bias incidents, and generates Article 14 compliance evidence.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-406870edffeb@265482f748ccf455","id":"GUIDE-EU-AI-ACT-406870edffeb","version":"265482f748ccf455","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Key Definitions (Article 3)","statement":"| Term | Definition |\n|------|-----------|\n| **AI system** | Machine-based system designed to operate with varying levels of autonomy that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations, decisions that can influence real or virtual environments |\n| **Provider** | Natural or legal person that develops an AI system or general-purpose AI model and places it on the market or puts into service under its own name or trademark, whether for payment or free of charge |\n| **Deployer** | Natural or legal person (public authority, agency, or other body) using an AI system under its authority, except for personal non-professional activities |\n| **High-risk AI system** | AI system referred to in Article 6 |\n| **General-purpose AI model** | AI model trained with large amounts of data using self-supervision at scale, displaying significant generality and capable of competently performing a wide range of distinct tasks |\n| **Serious incident** | Incident or malfunctioning of a high-risk AI system that directly or indirectly leads to death, serious damage to health, serious damage to property, or disruption of essential services |\n| **Post-market monitoring** | Systematic collection and review of experience gained from high-risk AI systems placed on market for purpose of identifying need for corrective or preventive actions |\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-444206375e2a@9d26e40f2da6bb66","id":"GUIDE-EU-AI-ACT-444206375e2a","version":"9d26e40f2da6bb66","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Penalties","statement":"**Article 99 — Administrative fines:**\n\n| Violation | Maximum Fine |\n|-----------|-------------|\n| Prohibited AI practices (Article 5) | €35 million OR 7% of total worldwide annual turnover of preceding year, whichever is higher |\n| Non-compliance with high-risk obligations (Articles 9–15, 16–27) | €15 million OR 3% of total worldwide annual turnover, whichever is higher |\n| Incorrect, incomplete, or misleading information to notified bodies or NCAs | €7.5 million OR 1% of total worldwide annual turnover, whichever is higher |\n| GPAI model violations | €15 million OR 3% of total worldwide annual turnover |\n| Systemic risk GPAI model violations | €35 million OR 7% of total worldwide annual turnover |\n\n**For SMEs and startups:** Proportionately lower of the two penalty calculation methods applies.\n\n**Article 100 — Fines for natural persons:**\nThe AI Office or NCAs may impose fines on natural persons (executives, employees) for violations linked to prohibited practices or obstruction of oversight.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-5150f5e2c204@d0d521be281a52cb","id":"GUIDE-EU-AI-ACT-5150f5e2c204","version":"d0d521be281a52cb","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Risk Classification System / Tier 4 — Minimal/No Risk","statement":"All other AI systems. No mandatory obligations under the Act. Voluntary codes of conduct encouraged.\n\n**Examples:**\n- Spam filters\n- AI-enabled video games\n- AI inventory optimization tools\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-5540efc926b0@59be080686028180","id":"GUIDE-EU-AI-ACT-5540efc926b0","version":"59be080686028180","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Risk Classification System / Tier 2 — High-Risk AI","statement":"Defined in Article 6 and Annex III. Subject to mandatory conformity assessment, CE marking, technical documentation, and registration in the EU AI database.\n\n**Two categories of high-risk:**\n1. AI systems that are safety components of regulated products (Annex I products — machinery, medical devices, aviation, automotive, etc.) or are themselves regulated products\n2. AI systems listed in Annex III (see detailed list below)\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-6033ed1cc88a@187d945afdc6aa35","id":"GUIDE-EU-AI-ACT-6033ed1cc88a","version":"187d945afdc6aa35","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Enforcement Timeline","statement":"| Date | Milestone |\n|------|-----------|\n| **August 1, 2024** | Regulation enters into force |\n| **February 2, 2025** | Prohibited AI practices provisions apply (Chapter II) |\n| **February 2, 2025** | AI literacy obligations for providers and deployers begin |\n| **August 2, 2025** | GPAI model obligations apply (Chapter V); AI Office operational; codes of practice must be finalized |\n| **August 2, 2026** | Full application — all high-risk AI obligations, conformity assessments, notified body accreditation, national market surveillance |\n| **August 2, 2027** | High-risk AI systems already on market before August 2026 must comply (transitional period for legacy systems) |\n| **August 2, 2030** | AI systems embedded in regulated products (Annex I) already on market must comply |\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-68fff543384e@0a377af95dbbf478","id":"GUIDE-EU-AI-ACT-68fff543384e","version":"0a377af95dbbf478","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI Inventory Requirement and How GOVERN Energy Discovers Systems","statement":"**Article 6(3) & Recital 55:** Providers must be able to determine whether their AI systems are high-risk. This presupposes a complete inventory of all AI systems.\n\n**Article 17 (Quality Management System):** Providers of high-risk AI must establish a quality management system that includes, at minimum, a documented strategy for regulatory compliance — which requires knowing all AI systems in operation.\n\n**Article 24 (Deployer obligations):** Deployers must ensure a point of contact, maintain logs, and inform providers of incidents — all requiring a complete catalog of deployed AI.\n\n**GOVERN Energy — Automated AI Discovery:**\n\nGOVERN Energy is the discovery and inventory engine. It solves the foundational EU AI Act compliance problem: you cannot assess, document, or govern AI systems you do not know exist.\n\nEnergy continuously discovers:\n- API calls to AI model providers (OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, Google Vertex)\n- AI-enabled SaaS applications in use across the organization (shadow AI)\n- Internally developed models registered in ML platforms (MLflow, SageMaker, Azure ML)\n- AI features embedded in enterprise software (Salesforce Einstein, Microsoft Copilot, Workday AI)\n- AI systems exposed via internal APIs and microservices\n\nFor each discovered system, Energy generates an Article 6 pre-classification:\n- Probable risk tier (Unacceptable / High-Risk Annex III / Limited / Minimal)\n- Flagged Annex III categories that may apply\n- Data types processed (biometric, special category, personal data)\n- Affected populations (employees, customers, vulnerable groups)\n- Recommended next action (full conformity assessment / transparency obligations / no action)\n\nThe GOVERN AI Inventory becomes the single source of truth for Article 17 quality management, Article 24 deployer obligations, and the EU AI database registration requirement.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-6abf8bb7c8f9@e3fcfee6665a341f","id":"GUIDE-EU-AI-ACT-6abf8bb7c8f9","version":"e3fcfee6665a341f","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Article 10 — Data and Data Governance","statement":"High-risk AI systems using training, validation, and testing datasets must comply with data governance practices.\n\n**10(2):** Training, validation, and testing datasets must be subject to data governance and management practices covering:\n- Relevant design choices\n- Data collection and procurement processes\n- Relevant data preparation processing operations (labeling, cleaning, enrichment, aggregation)\n- Formulation of relevant assumptions\n- Assessment of availability, quantity, and suitability\n- Examination of possible biases\n- Identification of relevant data gaps or shortcomings and remediation\n\n**10(3):** Datasets must be relevant, sufficiently representative, and to the best extent possible, free from errors and complete given the intended purpose.\n\n**10(4):** Datasets must have appropriate statistical properties relative to the persons or groups of persons on which the system will be used (including characteristics of the geographic, behavioral, and functional settings).\n\n**10(5):** Special categories of data may be processed for bias detection and correction — strictly limited to this purpose.\n\n**GOVERN mapping:** GOVERN Data Governance module tracks dataset lineage for high-risk systems. Bias evaluation records attach to each system's compliance record. Data provenance reports generated for Article 10 documentation requirements.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-70f400ea3508@59c61f418f4e6713","id":"GUIDE-EU-AI-ACT-70f400ea3508","version":"59c61f418f4e6713","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Article 6 — High-Risk AI Classification","statement":"Article 6 establishes the two-gate classification mechanism:\n\n**Gate 1 (Article 6(1)):** An AI system is high-risk if it is itself a product or safety component of a product covered by the Union harmonization legislation listed in Annex I, AND that product requires a third-party conformity assessment.\n\n**Annex I products include:**\n- Machinery (Directive 2006/42/EC)\n- Toys (Directive 2009/48/EC)\n- Medical devices (Regulation (EU) 2017/745)\n- In vitro diagnostic medical devices\n- Civil aviation (Regulation (EU) 2018/1139)\n- Motor vehicles (Regulation (EU) 2019/2144)\n- Marine equipment\n- Lifts\n- Pressure equipment\n- Radio equipment\n\n**Gate 2 (Article 6(2)):** An AI system is high-risk if it falls within a category listed in Annex III (see below), UNLESS it poses no significant risk of harm to health, safety, or fundamental rights (self-assessment pathway under Article 6(3)).\n\n**Article 6(3) Exclusion:** A provider may determine their Annex III system is not high-risk if:\n- It does not meaningfully influence outcomes of the decision-making process it is part of\n- It does not pose a risk of harm to health, safety, or fundamental rights\n\nThe provider must document this determination and notify their NCA. Excluded categories: AI performing narrow procedural tasks, improving prior human decisions, detecting patterns without individual profiling.\n\n**GOVERN mapping:** GOVERN Assess module applies Article 6 gate logic to every registered AI system. Energy discovers candidate systems; Assess runs the two-gate test and Article 6(3) self-assessment workflow; Compliance Portal generates the determination record.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-7c6db84cd8c4@3c8523cabd28a251","id":"GUIDE-EU-AI-ACT-7c6db84cd8c4","version":"3c8523cabd28a251","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"What It Is","statement":"The EU AI Act is the world's first comprehensive, binding legal framework for artificial intelligence. It establishes a horizontal, risk-based regulatory regime applicable to AI systems placed on the EU market or put into service in the EU — regardless of where the developer or deployer is located. It creates a product-safety-style compliance architecture for AI, requiring conformity assessments, registration, technical documentation, and ongoing monitoring obligations that scale with risk.\n\nThe Act is structured around four risk tiers, mandatory requirements for high-risk AI systems, prohibitions on unacceptable uses, transparency rules for limited-risk systems, and governance obligations for general-purpose AI (GPAI) models including large language models.\n\nThe AI Office, established within the European Commission, has direct supervisory authority over GPAI model providers. National Competent Authorities (NCAs) designated by each Member State supervise all other AI providers and deployers.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-810b29b3574d@4ea902416e0ee643","id":"GUIDE-EU-AI-ACT-810b29b3574d","version":"4ea902416e0ee643","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Article 13 — Transparency and Provision of Information to Deployers","statement":"High-risk AI systems must be accompanied by instructions for use that are in machine-readable format where appropriate.\n\n**13(1):** Instructions must contain concise, complete, correct, and clear information relevant and useful to the deployer.\n\n**13(2):** Instructions must include:\n- Identity and contact details of provider\n- Characteristics, capabilities, and limitations of the high-risk AI system including:\n  - Its intended purpose\n  - Level of accuracy, robustness, and cybersecurity\n  - Circumstances that may lead to risks\n  - Performance with respect to specific groups of persons\n  - Input data specifications\n  - Relevant information for human oversight\n- Changes and their impact on performance\n- Human oversight measures\n- Expected lifetime and maintenance\n\n**13(3)(b):** Where relevant, instructions must include information about:\n- The intended purpose\n- Level of accuracy, robustness, and cybersecurity\n- Any known or foreseeable circumstances that may lead to risk to health, safety, or fundamental rights\n- Technical capabilities and limitations including any biases\n- Where applicable, performance data in terms of relevant groups of persons\n\n**GOVERN mapping:** GOVERN Compliance Portal generates Article 13-compliant system cards for each registered high-risk AI system. System cards auto-populate from GOVERN Risk Engine assessments and are version-controlled with change history.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-83b0bcc1cfbd@78f28c0b02969d19","id":"GUIDE-EU-AI-ACT-83b0bcc1cfbd","version":"78f28c0b02969d19","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Compliance Checklist for Organizations Subject to EU AI Act / Immediate (February 2025)","statement":"- [ ] Inventory all AI systems for potential prohibited practice violations (Article 5)\n- [ ] Identify any emotion recognition systems in workplace/education settings\n- [ ] Assess any biometric identification systems for prohibited real-time use\n- [ ] Establish AI literacy training program for all staff working with AI","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-8511d8d9ace9@baf7916daa66fbff","id":"GUIDE-EU-AI-ACT-8511d8d9ace9","version":"baf7916daa66fbff","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Risk Classification System","statement":"### Tier 1 — Unacceptable Risk (Prohibited)\nArticle 5 prohibits AI systems that pose unacceptable risks to fundamental rights, safety, and EU values. These cannot be placed on the market or put into service under any circumstances.\n\n**Prohibited practices include:**\n- Subliminal manipulation techniques that harm persons\n- Exploitation of vulnerabilities of specific groups (age, disability, socioeconomic situation)\n- Social scoring by public authorities that causes detrimental or unfavorable treatment\n- Real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions for terrorism, imminent threats, targeted searches for serious crime suspects)\n- Retroactive remote biometric identification (post-event) without judicial authorization\n- Emotion recognition in workplace and educational settings (with exceptions for safety)\n- Biometric categorization by sensitive characteristics (race, religion, political views, sexual orientation) inferred from biometric data\n- AI systems used to build or expand facial recognition databases through untargeted scraping\n\n**GOVERN relevance:** Policy Engine flags any AI use case matching Annex V prohibited patterns as a critical block. Auto-fails any deployment pipeline touching these categories.\n\n---\n\n### Tier 2 — High-Risk AI\nDefined in Article 6 and Annex III. Subject to mandatory conformity assessment, CE marking, technical documentation, and registration in the EU AI database.\n\n**Two categories of high-risk:**\n1. AI systems that are safety components of regulated products (Annex I products — machinery, medical devices, aviation, automotive, etc.) or are themselves regulated products\n2. AI systems listed in Annex III (see detailed list below)\n\n---\n\n### Tier 3 — Limited Risk\nAI systems subject to transparency obligations only (Article 52). Must disclose AI nature to users.\n\n**Examples:**\n- Chatbots\n- AI-generated synthetic media (deepfakes)\n- Emotion recognition systems\n- Biometric categorization systems not in high-risk category\n\n---\n\n### Tier 4 — Minimal/No Risk\nAll other AI systems. No mandatory obligations under the Act. Voluntary codes of conduct encouraged.\n\n**Examples:**\n- Spam filters\n- AI-enabled video games\n- AI inventory optimization tools\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-8dffffde2c70@027b6a04b4faad0e","id":"GUIDE-EU-AI-ACT-8dffffde2c70","version":"027b6a04b4faad0e","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Compliance Checklist for Organizations Subject to EU AI Act / Near-term (August 2025)","statement":"- [ ] Complete AI inventory across the organization\n- [ ] Apply Article 6 risk classification to all discovered systems\n- [ ] For high-risk systems: initiate conformity assessment process\n- [ ] For GPAI providers: complete technical documentation and publish training data summary\n- [ ] Sign onto relevant GPAI Code of Practice","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-8e818ccb0fef@3b7abef3874e6f1c","id":"GUIDE-EU-AI-ACT-8e818ccb0fef","version":"3b7abef3874e6f1c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Compliance Checklist for Organizations Subject to EU AI Act / Full compliance (August 2026)","statement":"- [ ] All high-risk systems registered in EU AI Database\n- [ ] Technical documentation complete for all high-risk systems\n- [ ] Quality management system operational\n- [ ] Post-market monitoring system active\n- [ ] Human oversight measures implemented\n- [ ] Authorized EU representative designated (if non-EU provider)\n- [ ] Incident reporting procedures established","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-993a9445e7d4@d3611d629b800c5c","id":"GUIDE-EU-AI-ACT-993a9445e7d4","version":"d3611d629b800c5c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Risk Classification System / Tier 1 — Unacceptable Risk (Prohibited)","statement":"Article 5 prohibits AI systems that pose unacceptable risks to fundamental rights, safety, and EU values. These cannot be placed on the market or put into service under any circumstances.\n\n**Prohibited practices include:**\n- Subliminal manipulation techniques that harm persons\n- Exploitation of vulnerabilities of specific groups (age, disability, socioeconomic situation)\n- Social scoring by public authorities that causes detrimental or unfavorable treatment\n- Real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions for terrorism, imminent threats, targeted searches for serious crime suspects)\n- Retroactive remote biometric identification (post-event) without judicial authorization\n- Emotion recognition in workplace and educational settings (with exceptions for safety)\n- Biometric categorization by sensitive characteristics (race, religion, political views, sexual orientation) inferred from biometric data\n- AI systems used to build or expand facial recognition databases through untargeted scraping\n\n**GOVERN relevance:** Policy Engine flags any AI use case matching Annex V prohibited patterns as a critical block. Auto-fails any deployment pipeline touching these categories.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-a56c0c13d733@928b9968948e8586","id":"GUIDE-EU-AI-ACT-a56c0c13d733","version":"928b9968948e8586","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Component Mapping to EU AI Act Articles","statement":"| EU AI Act Requirement | GOVERN Component | What It Does |\n|----------------------|-----------------|-------------|\n| Article 6 — High-risk classification | GOVERN Assess + Energy | Automated two-gate classification for all discovered systems |\n| Article 9 — Risk management | GOVERN Risk Engine | Lifecycle risk assessments, iterative updates, post-market integration |\n| Article 10 — Data governance | GOVERN Data Governance | Dataset lineage, bias evaluation records, data provenance tracking |\n| Article 13 — Transparency/deployer info | GOVERN Compliance Portal | Auto-generated system cards with Article 13 required fields |\n| Article 14 — Human oversight | GOVERN Human Oversight Module | HOO assignment, override logging, automation bias incident tracking |\n| Article 15 — Accuracy, robustness, cybersecurity | GOVERN Security Module | Accuracy metrics, robustness testing records, adversarial test tracking |\n| Article 17 — Quality management system | GOVERN Platform (full) | AI Inventory + risk records + documentation = QMS foundation |\n| Article 52 — GPAI obligations | GOVERN GPAI Module | Technical documentation coverage, copyright compliance, systemic risk status |\n| Article 71 — Codes of practice | GOVERN Compliance Portal | Code of practice sign-on status, presumption of conformity tracking |\n| Annex III — High-risk classification | GOVERN Assess | Annex III category tagging for all registered systems |\n| EU AI Database registration | GOVERN Compliance Portal | Registration record generation and submission workflow |\n| Post-market monitoring | GOVERN Risk Engine | Incident alerts, performance drift detection, risk score updates |\n| Incident reporting | GOVERN Incident Module | Serious incident detection, AI Office reporting workflow |\n| Prohibited practices (Article 5) | GOVERN Policy Engine | Hard blocks on prohibited use case patterns |\n| CE Marking / conformity assessment | GOVERN Compliance Portal | Conformity assessment workflow management, notified body coordination |\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-a7847c271ab6@878fa9e01941c77b","id":"GUIDE-EU-AI-ACT-a7847c271ab6","version":"878fa9e01941c77b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Annex III — High-Risk AI System Categories","statement":"All eight categories with their specific listed use cases:\n\n**1. Biometric identification and categorization of natural persons**\n- Remote biometric identification systems (all, except prohibited real-time ones)\n- AI systems for biometric categorization based on sensitive or protected characteristics\n- Emotion recognition systems\n\n**2. Critical infrastructure**\n- Safety components of digital infrastructure management\n- Road traffic management and operation\n- Supply of water, gas, heating, and electricity\n\n**3. Education and vocational training**\n- Systems determining access, admission, or assignment of persons to educational and vocational training institutions\n- Evaluating learning outcomes, assessing and evaluating persons in educational contexts\n- Monitoring and detecting prohibited behavior of students during testing\n\n**4. Employment, workers management, and access to self-employment**\n- Recruitment and selection (CV screening, interview assessment, background checks)\n- Task allocation, monitoring behavior, and evaluating performance and behavior\n- Promotion and termination of employment relationships\n- Creditworthiness of workers\n\n**5. Access to and enjoyment of essential private services and essential public services and benefits**\n- Creditworthiness assessment and credit scoring\n- Life and health insurance risk assessment and pricing\n- Emergency services prioritization and dispatch\n- Benefit eligibility evaluation (welfare, housing assistance, public services)\n\n**6. Law enforcement**\n- Lie detection and reliability assessment of evidence\n- Evaluating reliability of evidence in criminal investigations\n- Criminal risk profiling of individuals\n- Predicting recidivism\n- Detecting emotional or psychological states in investigations\n- Analyzing CCTV footage for criminal activity detection\n\n**7. Migration, asylum, and border control management**\n- Risk assessment of migrants or asylum seekers\n- Document authenticity verification\n- Examining applications for asylum, visa, or residence permits\n- Detection of illegal border crossing\n\n**8. Administration of justice and democratic processes**\n- Legal research and interpretation assistance in judicial proceedings\n- Influence on outcome of elections and referendums (excluding cybersecurity tools)\n- Profiling natural persons during criminal investigations by law enforcement\n\n**GOVERN mapping:** GOVERN's AI Inventory registers systems against Annex III categories. Each registered system gets an Annex III classification tag. GOVERN Policy Engine monitors for new deployments that fall into unregistered Annex III categories.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-ad2259d97b50@e1d2c8b03a935aad","id":"GUIDE-EU-AI-ACT-ad2259d97b50","version":"e1d2c8b03a935aad","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Article 9 — Risk Management System","statement":"Providers of high-risk AI systems must establish, implement, document, and maintain a risk management system throughout the entire lifecycle.\n\n**Requirements:**\n\n**9(1):** The risk management system is a continuous iterative process throughout the lifecycle, requiring regular systematic updating.\n\n**9(2):** The risk management system must include:\n- Identification and analysis of known and reasonably foreseeable risks to health, safety, and fundamental rights\n- Estimation and evaluation of risks arising from intended use and reasonably foreseeable misuse\n- Evaluation of risks based on post-market monitoring data\n- Adoption of appropriate risk management measures\n\n**9(4):** Risk management measures must consider effects and possible interactions resulting from the combined application of requirements in Articles 10–15.\n\n**9(5):** High-risk AI systems tested in real-world conditions before placement on market.\n\n**9(6):** Testing must be performed against metrics and probabilistic thresholds appropriate to the intended purpose.\n\n**9(7):** Testing for children, elderly, persons with disabilities, and historically disadvantaged groups where likely affected.\n\n**9(8):** For systems interacting with natural persons: risks from vulnerable populations must be explicitly addressed.\n\n**GOVERN mapping:** GOVERN Risk Engine automates the Article 9 lifecycle. Risk assessments are created at onboarding, updated with each significant change, linked to post-market monitoring alerts, and stored with audit trail. Risk scores feed the Compliance Portal dashboard.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-be00b216fdaf@f65dd62b9929e8f1","id":"GUIDE-EU-AI-ACT-be00b216fdaf","version":"f65dd62b9929e8f1","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Compliance Checklist for Organizations Subject to EU AI Act","statement":"### Immediate (February 2025)\n- [ ] Inventory all AI systems for potential prohibited practice violations (Article 5)\n- [ ] Identify any emotion recognition systems in workplace/education settings\n- [ ] Assess any biometric identification systems for prohibited real-time use\n- [ ] Establish AI literacy training program for all staff working with AI\n\n### Near-term (August 2025)\n- [ ] Complete AI inventory across the organization\n- [ ] Apply Article 6 risk classification to all discovered systems\n- [ ] For high-risk systems: initiate conformity assessment process\n- [ ] For GPAI providers: complete technical documentation and publish training data summary\n- [ ] Sign onto relevant GPAI Code of Practice\n\n### Full compliance (August 2026)\n- [ ] All high-risk systems registered in EU AI Database\n- [ ] Technical documentation complete for all high-risk systems\n- [ ] Quality management system operational\n- [ ] Post-market monitoring system active\n- [ ] Human oversight measures implemented\n- [ ] Authorized EU representative designated (if non-EU provider)\n- [ ] Incident reporting procedures established","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-be3f672a4b53@12b7627ee8a7046b","id":"GUIDE-EU-AI-ACT-be3f672a4b53","version":"12b7627ee8a7046b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Article 71 — Codes of Practice","statement":"The AI Office coordinates the development of codes of practice to operationalize GPAI model obligations.\n\n**71(1):** The AI Office shall facilitate the drawing up of codes of practice to contribute to the proper application of the Regulation.\n\n**71(3):** Codes of practice shall include at minimum:\n- Descriptions of GPAI models covered\n- Specific obligations covered by the code\n- Benchmarks and metrics for measuring compliance\n- Testing and evaluation methodologies\n\n**71(4):** Codes of practice finalized by August 2, 2025.\n\n**71(7):** Where a GPAI model provider complies with a code of practice, there is a presumption of conformity with the covered obligations.\n\n**71(8):** The AI Office shall monitor and evaluate the effectiveness of codes of practice.\n\n**Codes of practice status (as of early 2026):**\n- GPAI Code of Practice: Drafting initiated Q4 2024 with multi-stakeholder working groups covering transparency, copyright, systemic risk evaluation, and incident reporting. Target finalization: August 2025.\n\n**GOVERN mapping:** GOVERN tracks which codes of practice each GPAI provider has signed onto. Compliance Portal displays presumption-of-conformity status per code.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-EU-AI-ACT-d1c940a3e06b@8d00dd6449e18a3b","id":"GUIDE-EU-AI-ACT-d1c940a3e06b","version":"8d00dd6449e18a3b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Article 52 — GPAI Model Obligations","statement":"Applies to providers of general-purpose AI (GPAI) models — including large language models, multimodal foundation models, and any model trained on broad data, capable of performing a wide range of distinct tasks.\n\n**52(1) — Transparency obligations for all GPAI providers:**\n- Provide technical documentation to downstream providers integrating the model (sufficient for them to comply with their own obligations)\n- Provide information and documentation to deployers and downstream providers as needed\n- Establish a policy to respect EU copyright law including compliance with the opt-out mechanism under Directive 2019/790 Article 4(3)\n- Publish a sufficiently detailed summary of the content used for training\n\n**52(2) — Systemic risk GPAI models (high-capability threshold):**\n\nA GPAI model is deemed to have systemic risk if it is trained with more than 10^25 FLOPs, or is designated as such by the AI Office based on other capability indicators.\n\nAdditional obligations for systemic-risk GPAI models:\n- Perform model evaluation prior to release (including adversarial testing)\n- Assess and mitigate systemic risks identified at EU level\n- Track, document, and report serious incidents and corrective measures to the AI Office\n- Implement cybersecurity protections commensurate with systemic risk profile\n- Report energy consumption during training and inference\n\n**52(5):** Codes of practice serve as the presumption of conformity mechanism for GPAI obligations.\n\n**GOVERN mapping:** GOVERN GPAI module tracks provider compliance with Article 52 for any GPAI model integrated into customer workflows. Documentation coverage checker verifies technical documentation completeness. Copyright compliance records maintained. Systemic risk assessment status tracked.\n\n---","family":"EU-AI-ACT","body":{"sourceFile":"POLICY(5).md","sourceFamily":"EU-AI-ACT","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-0a1a03af4b1b@b80e9b6053a27fae","id":"GUIDE-FEDRAMP-0a1a03af4b1b","version":"b80e9b6053a27fae","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"FedRAMP Assessment Output","statement":"```\nFedRAMP Readiness Assessment\n=============================\nCSP: GOVERN — AI Governance Platform\nImpact Level: Moderate\nAssessment Date: [Date]\nPathway: FedRAMP 20x (AI Cohort)\n\nCONTROL BASELINE STATUS\nTotal Controls (Moderate): 325\n  Fully Implemented: [X]\n  Partially Implemented: [X]\n  Not Implemented: [X]\n  Not Applicable: [X]\n\nAI-SPECIFIC CONTROLS\n  AI-SC-1 Documentation: [COMPLETE / INCOMPLETE]\n  AI-SC-2 Model Integrity: [IMPLEMENTED / PARTIAL / NOT IMPLEMENTED]\n  AI-SC-3 Output Monitoring: [IMPLEMENTED / PARTIAL / NOT IMPLEMENTED]\n  AI-SC-4 Incident Response: [TESTED / DOCUMENTED / ABSENT]\n  AI-SC-5 Supply Chain: [COMPLETE / INCOMPLETE]\n  AI-SC-6 Human Oversight: [DOCUMENTED / NOT DOCUMENTED]\n\nOSCAL PACKAGE STATUS\n  SSP: [COMPLETE / IN PROGRESS]\n  SAR: [COMPLETE / AWAITING 3PAO]\n  POA&M: [CURRENT / OUTDATED]\n  ConMon Evidence API: [ACTIVE / INACTIVE]\n\nHIGH RISK FINDINGS: [count]\nMODERATE RISK FINDINGS: [count]\nLOW RISK FINDINGS: [count]\n\nAUTHORIZATION READINESS: [READY / CONDITIONAL / NOT READY]\nRECOMMENDED PATHWAY: [20x / JAB / Agency]\nESTIMATED TIMELINE TO AUTHORIZATION: [X months]\n```\n\n---","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-0da62f354193@9a65fb444e7db7f3","id":"GUIDE-FEDRAMP-0da62f354193","version":"9a65fb444e7db7f3","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"How GOVERN Achieves FedRAMP Authorization","statement":"### GOVERN Authorization Approach\n\nGOVERN operates at Moderate Impact Level and pursues FedRAMP 20x authorization as the primary pathway given its AI-native architecture.\n\n**Infrastructure Controls (CSP Responsibility)**\n- Deployed on FedRAMP-authorized cloud infrastructure (AWS GovCloud or Azure Government)\n- Inherits IaaS/PaaS controls from underlying FedRAMP P-ATO\n- Implements Moderate baseline controls for GOVERN-owned control layers\n\n**AI-Specific Controls (GOVERN Responsibility)**\n- AI-SC-1: Complete model documentation in OSCAL format\n- AI-SC-2: Cryptographic model integrity verification\n- AI-SC-3: Real-time AI output monitoring with evidence API\n- AI-SC-4: AI incident response procedures (tested annually)\n- AI-SC-5: Supply chain documentation for all AI components\n- AI-SC-6: Human oversight documentation for consequential decisions\n\n**Continuous Monitoring Evidence Stream**\nGOVERN Probe generates continuous monitoring evidence at the following cadences:\n- Real-time: Security event logs, access control logs, AI output monitoring results\n- Daily: Vulnerability scan results, configuration compliance status\n- Monthly: Aggregated security metrics, POA&M status updates\n- Annual: Full security control assessment results\n\n### Leverage Inheritance\nAgencies deploying GOVERN inherit GOVERN's FedRAMP authorization for all controls GOVERN implements. This reduces the agency's authorization burden and accelerates their AI governance capability deployment.\n\n---","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-0ea4e22d9287@435bae627e795c0e","id":"GUIDE-FEDRAMP-0ea4e22d9287","version":"435bae627e795c0e","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"How GOVERN Achieves FedRAMP Authorization / GOVERN Authorization Approach","statement":"GOVERN operates at Moderate Impact Level and pursues FedRAMP 20x authorization as the primary pathway given its AI-native architecture.\n\n**Infrastructure Controls (CSP Responsibility)**\n- Deployed on FedRAMP-authorized cloud infrastructure (AWS GovCloud or Azure Government)\n- Inherits IaaS/PaaS controls from underlying FedRAMP P-ATO\n- Implements Moderate baseline controls for GOVERN-owned control layers\n\n**AI-Specific Controls (GOVERN Responsibility)**\n- AI-SC-1: Complete model documentation in OSCAL format\n- AI-SC-2: Cryptographic model integrity verification\n- AI-SC-3: Real-time AI output monitoring with evidence API\n- AI-SC-4: AI incident response procedures (tested annually)\n- AI-SC-5: Supply chain documentation for all AI components\n- AI-SC-6: Human oversight documentation for consequential decisions\n\n**Continuous Monitoring Evidence Stream**\nGOVERN Probe generates continuous monitoring evidence at the following cadences:\n- Real-time: Security event logs, access control logs, AI output monitoring results\n- Daily: Vulnerability scan results, configuration compliance status\n- Monthly: Aggregated security metrics, POA&M status updates\n- Annual: Full security control assessment results","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-199c97ad51b8@b3d16adde1e130b6","id":"GUIDE-FEDRAMP-199c97ad51b8","version":"b3d16adde1e130b6","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Impact Levels","statement":"FedRAMP categorizes cloud services by the potential impact of a security breach on confidentiality, integrity, and availability of federal information.\n\n### Low Impact\n- **Definition:** Loss of confidentiality, integrity, or availability would have limited adverse effect on agency operations\n- **Control Baseline:** NIST SP 800-53 Rev 5 Low Baseline (125 controls)\n- **Examples:** Public-facing informational websites, low-sensitivity collaboration tools\n- **AI Applications:** Public AI chatbots not processing sensitive federal data, open dataset analysis tools\n\n### Moderate Impact\n- **Definition:** Loss would have serious adverse effect on agency operations or assets\n- **Control Baseline:** NIST SP 800-53 Rev 5 Moderate Baseline (325 controls)\n- **Examples:** Systems processing Controlled Unclassified Information (CUI)\n- **AI Applications:** Most federal AI systems — decision support, document processing, analytics platforms handling CUI\n- **Note:** ~80% of cloud systems seeking FedRAMP authorization are at Moderate impact level\n\n### High Impact\n- **Definition:** Loss would have severe or catastrophic adverse effect on agency operations, assets, national security, or public safety\n- **Control Baseline:** NIST SP 800-53 Rev 5 High Baseline (421 controls)\n- **Examples:** Law enforcement systems, financial systems, health IT\n- **AI Applications:** AI systems supporting national security, law enforcement, public safety, or critical infrastructure decisions\n\n---","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-258910ac2424@a2350d73e009ceed","id":"GUIDE-FEDRAMP-258910ac2424","version":"a2350d73e009ceed","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"FedRAMP 20x Program (AI Fast-Track) / Overview","statement":"Launched in 2025, FedRAMP 20x represents a fundamental rethinking of the authorization process using automation, machine-readable evidence, and continuous authorization rather than point-in-time assessment.\n\nThe first 20x cohort (Cohort 1) was exclusively AI services, reflecting the government's urgency to authorize AI capabilities while maintaining security rigor.","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-30ce4c9fff52@9e7d5e9bf16bff19","id":"GUIDE-FEDRAMP-30ce4c9fff52","version":"9e7d5e9bf16bff19","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"OSCAL Integration Requirements","statement":"### What is OSCAL?\nOSCAL (Open Security Controls Assessment Language) is NIST's machine-readable format for security documentation. FedRAMP 20x mandates OSCAL; traditional FedRAMP strongly prefers it.\n\n### GOVERN OSCAL Output\n\nGOVERN generates the following OSCAL artifacts:\n\n**System Security Plan (SSP) — OSCAL JSON**\n```json\n{\n  \"system-security-plan\": {\n    \"uuid\": \"[system-uuid]\",\n    \"metadata\": {\n      \"title\": \"GOVERN AI Governance Platform SSP\",\n      \"version\": \"[version]\",\n      \"oscal-version\": \"1.1.2\"\n    },\n    \"system-characteristics\": {\n      \"system-name\": \"GOVERN\",\n      \"description\": \"AI governance and compliance platform\",\n      \"security-impact-level\": {\n        \"security-objective-confidentiality\": \"moderate\",\n        \"security-objective-integrity\": \"moderate\",\n        \"security-objective-availability\": \"moderate\"\n      }\n    },\n    \"control-implementation\": {\n      \"implemented-requirements\": [\n        {\n          \"control-id\": \"ac-2\",\n          \"statements\": [...],\n          \"by-components\": [...]\n        }\n      ]\n    }\n  }\n}\n```\n\n**Assessment Results — OSCAL JSON**\nMachine-readable assessment findings with automated evidence references, finding severities, and remediation tracking.\n\n**Plan of Action and Milestones (POA&M) — OSCAL JSON**\nStructured remediation tracking with risk acceptance decisions, milestones, and completion status.\n\n---","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-46d62dc73a79@5bf1de7bc74c6119","id":"GUIDE-FEDRAMP-46d62dc73a79","version":"5bf1de7bc74c6119","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Authorization Process / Authorization Steps (All Pathways)","statement":"1. **Readiness Assessment** — CSP completes FedRAMP Readiness Assessment Report (RAR) demonstrating capability to meet FedRAMP requirements. GOVERN Assess generates RAR-aligned readiness documentation.\n\n2. **Full Security Assessment** — Third-Party Assessment Organization (3PAO) conducts full security assessment per NIST SP 800-53 and FedRAMP controls. Produces Security Assessment Report (SAR).\n\n3. **Authorization Package** — CSP assembles: System Security Plan (SSP), SAR, Plan of Action and Milestones (POA&M), and supporting documentation. GOVERN generates OSCAL-formatted SSP and POA&M.\n\n4. **Agency/JAB Review** — Authorizing official reviews package and grants ATO/P-ATO.\n\n5. **Continuous Monitoring (ConMon)** — Monthly vulnerability scanning, annual assessments, and significant change reporting. GOVERN Probe provides ConMon evidence stream.\n\n---","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-51bb5216f8b9@25e68f0c2fe84d00","id":"GUIDE-FEDRAMP-51bb5216f8b9","version":"25e68f0c2fe84d00","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Authorization Process","statement":"### Three Authorization Pathways\n\n#### 1. Agency Authorization (Agency ATO)\n- A single sponsoring federal agency grants an Authority to Operate (ATO)\n- Requires a Designated Authorizing Official (DAO) at the agency\n- CSP works directly with the agency's security team\n- Once authorized, authorization is reusable by other agencies\n- Faster pathway: typically 6-12 months\n- Best for CSPs with existing federal relationships\n\n#### 2. Joint Authorization Board (JAB) Authorization (P-ATO)\n- DoD, DHS, and GSA collectively grant a Provisional Authority to Operate (P-ATO)\n- Highest reuse value — P-ATO accepted by all federal agencies\n- Most rigorous review process\n- Requires prioritization by JAB (competitive selection)\n- Timeline: 12-24 months\n- Best for CSPs targeting broad federal market\n\n#### 3. FedRAMP 20x (2025 Program — Fast Track)\n- New streamlined pathway launched 2025\n- AI services prioritized (first cohort 100% AI)\n- Uses automated assessment tools and machine-readable evidence\n- Target authorization timeline: 3-6 months (vs 12-24 for JAB)\n- Requires OSCAL-formatted documentation (see below)\n- Continuous authorization model — automated evidence vs point-in-time\n- See FedRAMP 20x section below\n\n### Authorization Steps (All Pathways)\n\n1. **Readiness Assessment** — CSP completes FedRAMP Readiness Assessment Report (RAR) demonstrating capability to meet FedRAMP requirements. GOVERN Assess generates RAR-aligned readiness documentation.\n\n2. **Full Security Assessment** — Third-Party Assessment Organization (3PAO) conducts full security assessment per NIST SP 800-53 and FedRAMP controls. Produces Security Assessment Report (SAR).\n\n3. **Authorization Package** — CSP assembles: System Security Plan (SSP), SAR, Plan of Action and Milestones (POA&M), and supporting documentation. GOVERN generates OSCAL-formatted SSP and POA&M.\n\n4. **Agency/JAB Review** — Authorizing official reviews package and grants ATO/P-ATO.\n\n5. **Continuous Monitoring (ConMon)** — Monthly vulnerability scanning, annual assessments, and significant change reporting. GOVERN Probe provides ConMon evidence stream.\n\n---","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-5f92b85aa101@c12c653121b33be0","id":"GUIDE-FEDRAMP-5f92b85aa101","version":"c12c653121b33be0","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"FedRAMP 20x Program (AI Fast-Track) / GOVERN 20x Support","statement":"GOVERN provides the technical infrastructure for FedRAMP 20x compliance:\n- **OSCAL Export:** All assessment results, SSP sections, POA&M, and ConMon evidence in OSCAL format\n- **Evidence API:** Real-time evidence submission endpoint for continuous authorization\n- **Automated Testing:** Machine-verifiable security control implementation tests\n- **Deviation Alerts:** Automated flagging of security control deviations to agency AOs\n\n---","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-65c138d5509f@80dee4cb5165a40e","id":"GUIDE-FEDRAMP-65c138d5509f","version":"80dee4cb5165a40e","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"OSCAL Integration Requirements / What is OSCAL?","statement":"OSCAL (Open Security Controls Assessment Language) is NIST's machine-readable format for security documentation. FedRAMP 20x mandates OSCAL; traditional FedRAMP strongly prefers it.","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-666405d246b7@5c2f524a4ccebd9a","id":"GUIDE-FEDRAMP-666405d246b7","version":"5c2f524a4ccebd9a","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"FedRAMP 20x Program (AI Fast-Track) / 20x Timeline Target","statement":"- Readiness to Authorized: 90 days (vs 12-24 months JAB)\n- Continuous monitoring: automated (vs monthly human-generated reports)\n- Renewal: continuous (vs annual reassessment)","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-69824d3b0e70@47fbdd9fc7f4ac13","id":"GUIDE-FEDRAMP-69824d3b0e70","version":"47fbdd9fc7f4ac13","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"References","statement":"- FedRAMP Authorization Act (2022): https://www.congress.gov/bill/117th-congress/house-bill/7776\n- OMB M-23-22: https://www.whitehouse.gov/wp-content/uploads/2023/10/M-23-22-Delivering-a-Digital-First-Public-Experience.pdf\n- OMB M-24-10: https://www.whitehouse.gov/wp-content/uploads/2024/03/M-24-10-Advancing-Governance-Innovation-and-Risk-Management-for-Agency-Use-of-Artificial-Intelligence.pdf\n- FedRAMP Program: https://www.fedramp.gov/\n- FedRAMP 20x: https://www.fedramp.gov/20x/\n- OSCAL: https://pages.nist.gov/OSCAL/\n- NIST SP 800-53 Rev 5: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final\n- Executive Order 14110 (Safe AI): https://www.whitehouse.gov/briefing-room/presidential-actions/2023/10/30/","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-6a88a9389a37@3fae9544f28a6763","id":"GUIDE-FEDRAMP-6a88a9389a37","version":"3fae9544f28a6763","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Specific FedRAMP Requirements (2024-2026) / OMB M-24-10 (March 2024) — AI Governance","statement":"- Federal agencies must designate Chief AI Officers\n- AI systems must be inventoried and publicly reported\n- High-impact AI use cases require governance documentation\n- AI procurement must include responsible AI requirements\n- Agencies must test AI systems before deployment and monitor in production\n\n*FedRAMP Implication:* CSPs offering AI services to federal agencies must support agency compliance with M-24-10 by providing documentation enabling agency AI impact assessments and monitoring.","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-7b5e5d2e0702@7164dd7c57b4745c","id":"GUIDE-FEDRAMP-7b5e5d2e0702","version":"7164dd7c57b4745c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Authorization Process / Three Authorization Pathways","statement":"#### 1. Agency Authorization (Agency ATO)\n- A single sponsoring federal agency grants an Authority to Operate (ATO)\n- Requires a Designated Authorizing Official (DAO) at the agency\n- CSP works directly with the agency's security team\n- Once authorized, authorization is reusable by other agencies\n- Faster pathway: typically 6-12 months\n- Best for CSPs with existing federal relationships\n\n#### 2. Joint Authorization Board (JAB) Authorization (P-ATO)\n- DoD, DHS, and GSA collectively grant a Provisional Authority to Operate (P-ATO)\n- Highest reuse value — P-ATO accepted by all federal agencies\n- Most rigorous review process\n- Requires prioritization by JAB (competitive selection)\n- Timeline: 12-24 months\n- Best for CSPs targeting broad federal market\n\n#### 3. FedRAMP 20x (2025 Program — Fast Track)\n- New streamlined pathway launched 2025\n- AI services prioritized (first cohort 100% AI)\n- Uses automated assessment tools and machine-readable evidence\n- Target authorization timeline: 3-6 months (vs 12-24 for JAB)\n- Requires OSCAL-formatted documentation (see below)\n- Continuous authorization model — automated evidence vs point-in-time\n- See FedRAMP 20x section below","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-8bbe6f991c6c@aaa1e49cb2d68ecf","id":"GUIDE-FEDRAMP-8bbe6f991c6c","version":"aaa1e49cb2d68ecf","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"FedRAMP 20x Program (AI Fast-Track) / 20x Core Principles","statement":"**1. Machine-Readable Everything**\nAll documentation in OSCAL (Open Security Controls Assessment Language) format. Human-readable PDFs accepted as supplementary only. GOVERN exports all assessment artifacts in OSCAL JSON and YAML.\n\n**2. Automated Evidence**\nSecurity controls demonstrated through automated technical evidence rather than policy documents and interview-based assessments. Continuous evidence streams replace annual point-in-time assessments.\n\n**3. Continuous Authorization**\nAuthorization is maintained through ongoing automated evidence submission rather than periodic renewal. Significant deviations trigger re-assessment, not annual schedules.\n\n**4. Shared Responsibility**\nClear documentation of control ownership: CSP-owned, agency-owned, or shared. AI services must explicitly document which AI safety controls are the CSP's responsibility vs the agency's.\n\n**5. Streamlined Package**\nReduced documentation burden through standardized machine-readable formats. GOVERN 20x Package includes: OSCAL SSP, continuous monitoring evidence API, and automated assessment results.","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-8cbae23203cb@f2979c7e9d10cd2e","id":"GUIDE-FEDRAMP-8cbae23203cb","version":"f2979c7e9d10cd2e","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"How GOVERN Achieves FedRAMP Authorization / Leverage Inheritance","statement":"Agencies deploying GOVERN inherit GOVERN's FedRAMP authorization for all controls GOVERN implements. This reduces the agency's authorization burden and accelerates their AI governance capability deployment.\n\n---","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-bd43d0eaaa5c@f9ec0f35d486ca95","id":"GUIDE-FEDRAMP-bd43d0eaaa5c","version":"f9ec0f35d486ca95","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Impact Levels / Moderate Impact","statement":"- **Definition:** Loss would have serious adverse effect on agency operations or assets\n- **Control Baseline:** NIST SP 800-53 Rev 5 Moderate Baseline (325 controls)\n- **Examples:** Systems processing Controlled Unclassified Information (CUI)\n- **AI Applications:** Most federal AI systems — decision support, document processing, analytics platforms handling CUI\n- **Note:** ~80% of cloud systems seeking FedRAMP authorization are at Moderate impact level","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-bfbc4e114dd3@f713ac52913cd56a","id":"GUIDE-FEDRAMP-bfbc4e114dd3","version":"f713ac52913cd56a","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Specific FedRAMP Requirements (2024-2026) / Executive Order 14110 (October 2023) — Safe AI","statement":"- Requires safety testing before federal deployment of frontier AI models\n- Mandates dual-use AI risk assessments\n- Requires incident reporting for AI safety events\n- NIST tasked with AI safety standards development\n\n*FedRAMP Implication:* AI services seeking FedRAMP authorization must demonstrate compliance with EO 14110 safety requirements including red team testing results and safety evaluation reports.\n\n---","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-ca3304e28b24@3c5b0f46700bd588","id":"GUIDE-FEDRAMP-ca3304e28b24","version":"3c5b0f46700bd588","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"OSCAL Integration Requirements / GOVERN OSCAL Output","statement":"GOVERN generates the following OSCAL artifacts:\n\n**System Security Plan (SSP) — OSCAL JSON**\n```json\n{\n  \"system-security-plan\": {\n    \"uuid\": \"[system-uuid]\",\n    \"metadata\": {\n      \"title\": \"GOVERN AI Governance Platform SSP\",\n      \"version\": \"[version]\",\n      \"oscal-version\": \"1.1.2\"\n    },\n    \"system-characteristics\": {\n      \"system-name\": \"GOVERN\",\n      \"description\": \"AI governance and compliance platform\",\n      \"security-impact-level\": {\n        \"security-objective-confidentiality\": \"moderate\",\n        \"security-objective-integrity\": \"moderate\",\n        \"security-objective-availability\": \"moderate\"\n      }\n    },\n    \"control-implementation\": {\n      \"implemented-requirements\": [\n        {\n          \"control-id\": \"ac-2\",\n          \"statements\": [...],\n          \"by-components\": [...]\n        }\n      ]\n    }\n  }\n}\n```\n\n**Assessment Results — OSCAL JSON**\nMachine-readable assessment findings with automated evidence references, finding severities, and remediation tracking.\n\n**Plan of Action and Milestones (POA&M) — OSCAL JSON**\nStructured remediation tracking with risk acceptance decisions, milestones, and completion status.\n\n---","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-ce50169f05da@00aec29ece1369b0","id":"GUIDE-FEDRAMP-ce50169f05da","version":"00aec29ece1369b0","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Impact Levels / High Impact","statement":"- **Definition:** Loss would have severe or catastrophic adverse effect on agency operations, assets, national security, or public safety\n- **Control Baseline:** NIST SP 800-53 Rev 5 High Baseline (421 controls)\n- **Examples:** Law enforcement systems, financial systems, health IT\n- **AI Applications:** AI systems supporting national security, law enforcement, public safety, or critical infrastructure decisions\n\n---","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-ce67e8b0224b@532339e68f110f40","id":"GUIDE-FEDRAMP-ce67e8b0224b","version":"532339e68f110f40","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Specific FedRAMP Requirements (2024-2026) / FedRAMP AI Controls Supplement (2024)","statement":"The FedRAMP PMO issued supplemental controls for AI systems beyond the standard NIST SP 800-53 baseline:\n\n**AI-SC-1: AI System Documentation**\nCSPs must provide comprehensive documentation of AI models deployed in the service including training data sources, model architecture, known limitations, and intended use cases.\n\n**AI-SC-2: AI Model Integrity**\nCSPs must implement controls to verify AI model integrity and detect unauthorized model modification. Hash-based verification of model artifacts required.\n\n**AI-SC-3: AI Output Monitoring**\nReal-time monitoring of AI system outputs for anomalies, bias indicators, and safety violations. Monthly reporting to agency AOs.\n\n**AI-SC-4: AI Incident Response**\nAI-specific incident response procedures covering: model compromise, output manipulation, adversarial attacks, and training data incidents.\n\n**AI-SC-5: AI Supply Chain**\nDocumentation of all third-party AI components including foundation models, pre-trained components, and AI infrastructure dependencies.\n\n**AI-SC-6: Human Oversight**\nFor AI systems making or informing consequential decisions, CSPs must document human oversight mechanisms and override capabilities.","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-d4b1ea5708dd@d31094c30784f57d","id":"GUIDE-FEDRAMP-d4b1ea5708dd","version":"d31094c30784f57d","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Overview","statement":"FedRAMP (Federal Risk and Authorization Management Program) is the U.S. government's standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. All cloud services must be FedRAMP authorized before federal agencies can use them to process federal information. FedRAMP is mandatory for cloud services under OMB M-11-11 (2011) and codified in law by the FedRAMP Authorization Act (2022).\n\nFor AI systems, FedRAMP has become increasingly critical as federal agencies expand AI adoption. The FedRAMP PMO has issued AI-specific guidance (2024-2025) and launched the FedRAMP AI Prioritization Program (the \"20x\" initiative) to fast-track AI service authorizations.\n\n---","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-d74e11b26a06@db2e815847981854","id":"GUIDE-FEDRAMP-d74e11b26a06","version":"db2e815847981854","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Impact Levels / Low Impact","statement":"- **Definition:** Loss of confidentiality, integrity, or availability would have limited adverse effect on agency operations\n- **Control Baseline:** NIST SP 800-53 Rev 5 Low Baseline (125 controls)\n- **Examples:** Public-facing informational websites, low-sensitivity collaboration tools\n- **AI Applications:** Public AI chatbots not processing sensitive federal data, open dataset analysis tools","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-f2ff23fc6f9f@99ecd0ee7e0dfd7a","id":"GUIDE-FEDRAMP-f2ff23fc6f9f","version":"99ecd0ee7e0dfd7a","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"FedRAMP 20x Program (AI Fast-Track)","statement":"### Overview\nLaunched in 2025, FedRAMP 20x represents a fundamental rethinking of the authorization process using automation, machine-readable evidence, and continuous authorization rather than point-in-time assessment.\n\nThe first 20x cohort (Cohort 1) was exclusively AI services, reflecting the government's urgency to authorize AI capabilities while maintaining security rigor.\n\n### 20x Core Principles\n\n**1. Machine-Readable Everything**\nAll documentation in OSCAL (Open Security Controls Assessment Language) format. Human-readable PDFs accepted as supplementary only. GOVERN exports all assessment artifacts in OSCAL JSON and YAML.\n\n**2. Automated Evidence**\nSecurity controls demonstrated through automated technical evidence rather than policy documents and interview-based assessments. Continuous evidence streams replace annual point-in-time assessments.\n\n**3. Continuous Authorization**\nAuthorization is maintained through ongoing automated evidence submission rather than periodic renewal. Significant deviations trigger re-assessment, not annual schedules.\n\n**4. Shared Responsibility**\nClear documentation of control ownership: CSP-owned, agency-owned, or shared. AI services must explicitly document which AI safety controls are the CSP's responsibility vs the agency's.\n\n**5. Streamlined Package**\nReduced documentation burden through standardized machine-readable formats. GOVERN 20x Package includes: OSCAL SSP, continuous monitoring evidence API, and automated assessment results.\n\n### 20x Timeline Target\n- Readiness to Authorized: 90 days (vs 12-24 months JAB)\n- Continuous monitoring: automated (vs monthly human-generated reports)\n- Renewal: continuous (vs annual reassessment)\n\n### GOVERN 20x Support\nGOVERN provides the technical infrastructure for FedRAMP 20x compliance:\n- **OSCAL Export:** All assessment results, SSP sections, POA&M, and ConMon evidence in OSCAL format\n- **Evidence API:** Real-time evidence submission endpoint for continuous authorization\n- **Automated Testing:** Machine-verifiable security control implementation tests\n- **Deviation Alerts:** Automated flagging of security control deviations to agency AOs\n\n---","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-FEDRAMP-fbbaed9d1fde@85c6285bd6d071d0","id":"GUIDE-FEDRAMP-fbbaed9d1fde","version":"85c6285bd6d071d0","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Specific FedRAMP Requirements (2024-2026)","statement":"### OMB M-24-10 (March 2024) — AI Governance\n- Federal agencies must designate Chief AI Officers\n- AI systems must be inventoried and publicly reported\n- High-impact AI use cases require governance documentation\n- AI procurement must include responsible AI requirements\n- Agencies must test AI systems before deployment and monitor in production\n\n*FedRAMP Implication:* CSPs offering AI services to federal agencies must support agency compliance with M-24-10 by providing documentation enabling agency AI impact assessments and monitoring.\n\n### FedRAMP AI Controls Supplement (2024)\nThe FedRAMP PMO issued supplemental controls for AI systems beyond the standard NIST SP 800-53 baseline:\n\n**AI-SC-1: AI System Documentation**\nCSPs must provide comprehensive documentation of AI models deployed in the service including training data sources, model architecture, known limitations, and intended use cases.\n\n**AI-SC-2: AI Model Integrity**\nCSPs must implement controls to verify AI model integrity and detect unauthorized model modification. Hash-based verification of model artifacts required.\n\n**AI-SC-3: AI Output Monitoring**\nReal-time monitoring of AI system outputs for anomalies, bias indicators, and safety violations. Monthly reporting to agency AOs.\n\n**AI-SC-4: AI Incident Response**\nAI-specific incident response procedures covering: model compromise, output manipulation, adversarial attacks, and training data incidents.\n\n**AI-SC-5: AI Supply Chain**\nDocumentation of all third-party AI components including foundation models, pre-trained components, and AI infrastructure dependencies.\n\n**AI-SC-6: Human Oversight**\nFor AI systems making or informing consequential decisions, CSPs must document human oversight mechanisms and override capabilities.\n\n### Executive Order 14110 (October 2023) — Safe AI\n- Requires safety testing before federal deployment of frontier AI models\n- Mandates dual-use AI risk assessments\n- Requires incident reporting for AI safety events\n- NIST tasked with AI safety standards development\n\n*FedRAMP Implication:* AI services seeking FedRAMP authorization must demonstrate compliance with EO 14110 safety requirements including red team testing results and safety evaluation reports.\n\n---","family":"FEDRAMP","body":{"sourceFile":"POLICY(6).md","sourceFamily":"FEDRAMP","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-08d209fd5b33@b5275f1b978b7287","id":"GUIDE-ISO-42001-08d209fd5b33","version":"b5275f1b978b7287","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Market Adoption","statement":"**Microsoft:** Achieved ISO 42001 certification for cloud AI services in 2024. Azure AI and Microsoft Copilot services covered. Certification conducted by BSI Group.\n\n**Google:** Pursuing ISO 42001 certification for Vertex AI and related cloud AI services. Google Cloud announced conformance assessment initiative in 2024.\n\n**Amazon Web Services:** ISO 42001 roadmap announced for AWS AI services. Amazon Bedrock and SageMaker targeted for initial scope.\n\n**Salesforce:** ISO 42001 certification in progress for Einstein AI platform components.\n\n**IBM:** ISO 42001 alignment declared for IBM watsonx platform. Third-party certification in progress.\n\n**SAP:** SAP AI services pursuing ISO 42001 certification.\n\n**Enterprise procurement:** Multiple Fortune 500 procurement organizations now require ISO 42001 certification or documented roadmap as vendor qualification criteria, particularly for AI systems with HR, financial, or healthcare applications.\n\n**Government procurement:** UK government guidance encourages ISO 42001 as a credible AI governance signal in public procurement. Singapore government has incorporated ISO 42001 into its AI governance framework.\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-1ecb53ae5b83@4029dba246be29b6","id":"GUIDE-ISO-42001-1ecb53ae5b83","version":"4029dba246be29b6","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Clause-by-Clause Breakdown / Clause 5 — Leadership","statement":"This clause places responsibility at the senior leadership level. Unlike technical controls, leadership obligations in Clause 5 cannot be delegated away.\n\n**5.1 — Leadership and commitment:**\nTop management must demonstrate leadership and commitment to the AIMS by:\n- Taking accountability for the effectiveness of the AIMS\n- Ensuring AI policy and objectives are established and compatible with the organization's strategic direction\n- Integrating AIMS requirements into organizational processes\n- Ensuring resources are available for the AIMS\n- Communicating the importance of effective AI management\n- Ensuring the AIMS achieves its intended outcomes\n- Directing and supporting persons to contribute to AIMS effectiveness\n- Promoting continual improvement\n- Supporting other management roles to demonstrate leadership in their areas\n\nAI-specific leadership obligations:\n- Ensuring consideration of AI impacts on human rights and fundamental values is part of strategic planning\n- Ensuring AI-related risks are considered at the board/executive level\n- Establishing accountability chains for AI outcomes (not just AI outputs)\n\n**5.2 — AI policy:**\nTop management must establish an AI policy that:\n- Is appropriate to the purpose and context of the organization\n- Provides a framework for setting AI objectives\n- Includes a commitment to satisfying applicable requirements\n- Includes a commitment to continual improvement of the AIMS\n- Addresses the organization's approach to responsible AI, including how it balances innovation with risk management\n\nThe AI policy must be communicated within the organization, available to interested parties, and maintained as documented information.\n\n**5.3 — Organizational roles, responsibilities, and authorities:**\nTop management must assign and communicate roles including:\n- Who is responsible for ensuring the AIMS conforms to the standard\n- Who is responsible for reporting on AIMS performance to top management\n- Who has accountability for each AI system in scope\n- Who is the designated point of contact for AI-related incidents and regulatory inquiries\n\n**GOVERN mapping:** GOVERN Compliance Portal tracks leadership accountability assignments. CAIO/Chief AI Officer role supported. Board-level AI risk reporting dashboards generated from GOVERN data.\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-2a80864131f4@99f20bd4d6648ffe","id":"GUIDE-ISO-42001-2a80864131f4","version":"99f20bd4d6648ffe","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Clause-by-Clause Breakdown / Clause 6 — Planning","statement":"Planning is where the AIMS moves from policy to concrete action.\n\n**6.1 — Actions to address risks and opportunities:**\n\n**6.1.1 — General:**\nWhen planning the AIMS, the organization must consider the context (Clause 4.1 and 4.2) and determine:\n- Risks and opportunities that need to be addressed\n- How to integrate and implement actions into AIMS processes\n- How to evaluate the effectiveness of those actions\n\nAI-specific planning must address:\n- Risks related to data quality and bias\n- Risks related to model performance and reliability\n- Risks related to unintended use and misuse\n- Risks related to the AI system's impact on affected parties\n- Opportunities to improve processes, products, or services through AI\n- Opportunities to advance the organization's responsible AI commitments\n\n**6.1.2 — AI risk assessment:**\nThe organization must establish and maintain a process for AI risk assessment that:\n- Identifies AI risks (the what could go wrong)\n- Analyzes AI risks (likelihood and impact)\n- Evaluates AI risks against risk criteria\n- Produces comparable and reproducible results\n- Documents risk assessment results\n\n**6.1.3 — AI risk treatment:**\nBased on risk assessment results, the organization must:\n- Select appropriate risk treatment options (modify, retain, avoid, share)\n- Determine controls needed (referencing Annex A)\n- Formulate and implement a risk treatment plan\n- Obtain acceptance of residual risks from risk owners\n\n**6.2 — AI objectives and planning to achieve them:**\nThe organization must establish measurable AI objectives at relevant functions and levels:\n- Consistent with AI policy\n- Measurable (where practicable)\n- Monitored and communicated\n- Updated as appropriate\n\nFor each AI objective, the organization must determine: what will be done, what resources are required, who will be responsible, when it will be completed, and how results will be evaluated.\n\n**6.3 — Planning of changes:**\nChanges to the AIMS must be planned and implemented in a controlled manner, considering the purpose, potential consequences, resource availability, and responsibilities.\n\n**GOVERN mapping:** GOVERN Risk Engine operationalizes Clause 6.1.2 and 6.1.3. Risk assessment workflows, risk treatment plans, and residual risk acceptance records are generated and stored. GOVERN Objectives Module tracks AI objectives and progress metrics.\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-39b16eac9f6e@9c0fda06dc6624d2","id":"GUIDE-ISO-42001-39b16eac9f6e","version":"9c0fda06dc6624d2","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Clause-by-Clause Breakdown / Clause 9 — Performance Evaluation","statement":"**9.1 — Monitoring, measurement, analysis, and evaluation:**\nThe organization must determine:\n- What needs to be monitored and measured\n- Methods for monitoring, measurement, analysis, and evaluation\n- When the monitoring and measuring shall be performed\n- When results shall be analyzed and evaluated\n\nAI-specific monitoring must address:\n- Model performance metrics (accuracy, fairness, drift)\n- AI system usage patterns (intended vs. actual use)\n- Incidents and near-misses\n- Stakeholder feedback\n- Regulatory changes affecting AI compliance\n\nThe organization must evaluate AI system performance at planned intervals and when performance changes are observed.\n\n**9.2 — Internal audit:**\nThe organization must conduct internal audits at planned intervals to provide information on whether the AIMS:\n- Conforms to the organization's own requirements for the AIMS\n- Conforms to ISO 42001 requirements\n- Is effectively implemented and maintained\n\nAudit programme must consider AI risk levels (higher risk areas audited more frequently), changes affecting AI, and previous audit results.\n\n**9.3 — Management review:**\nTop management must review the AIMS at planned intervals. Inputs must include:\n- Status of actions from previous reviews\n- Changes in external and internal issues relevant to the AIMS\n- Information on AIMS performance including trends in AI incidents and nonconformities\n- AI risk assessment and risk treatment results\n- Monitoring and measurement results\n- Opportunities for continual improvement\n\nManagement review outputs must include decisions related to continual improvement, resource needs, and changes to the AIMS.\n\n**GOVERN mapping:** GOVERN Performance Dashboard operationalizes Clause 9.1. Internal audit support tools support 9.2. Executive reporting for management review generated from GOVERN data.\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-6533523f5df9@9d3caf320644bc76","id":"GUIDE-ISO-42001-6533523f5df9","version":"9d3caf320644bc76","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Annex A — Reference Control Objectives and Controls","statement":"Annex A contains the full control set that organizations select from when building their AIMS. Unlike ISO 27001 (which requires all Annex A controls unless justified for exclusion), ISO 42001 Annex A controls are selected based on the organization's risk treatment decisions. Controls are grouped into themes:\n\n**A.2 — Policies for AI**\n- A.2.2: AI policy review\n- A.2.3: AI roles and responsibilities\n- A.2.4: Reporting of AI concerns\n- A.2.5: Supplier and third-party relationships\n- A.2.6: Responsibility for AI systems\n\n**A.3 — Internal organization**\n- A.3.2: Segregation of duties in AI\n- A.3.3: Contact with authorities\n- A.3.4: AI in project management\n- A.3.5: AI development in remote settings\n\n**A.4 — Resources for AI systems**\n- A.4.2: AI system resource management\n- A.4.3: Management of organizational knowledge for AI\n\n**A.5 — Assessing impacts of AI systems**\n- A.5.2: Processes to determine AI impacts\n- A.5.3: Documentation of AI system use cases\n- A.5.4: Impact assessment\n\n**A.6 — AI system life cycle**\n- A.6.1.1: Data management processes\n- A.6.1.2: Acquisition of data\n- A.6.1.3: Quality of data\n- A.6.1.4: Privacy and data governance\n- A.6.1.5: Roles and responsibilities in data\n- A.6.2.1: Intended purpose\n- A.6.2.2: AI system design principles\n- A.6.2.3: AI system specification\n- A.6.2.4: Transparency\n- A.6.2.5: Control of AI system\n- A.6.2.6: AI system training\n- A.6.2.7: Performance metrics\n- A.6.2.8: Testing and verification\n- A.6.2.9: Change management\n- A.6.2.10: AI system supply chain\n- A.6.2.11: Incident management\n- A.6.2.12: AI system availability\n- A.6.2.13: Decommissioning\n\n**A.7 — Data for AI systems**\n- A.7.2: Collection and generation of data\n- A.7.3: Acquisition of data from external parties\n- A.7.4: Data preparation\n- A.7.5: Technical measures for data\n- A.7.6: Organizational measures for data\n- A.7.7: Data access control\n\n**A.8 — Information for interested parties**\n- A.8.2: Public communication about AI\n- A.8.3: Documentation for deployers/users\n- A.8.4: Feedback and complaints\n\n**A.9 — Use of AI systems**\n- A.9.2: Context of use\n- A.9.3: Specifications for intended use\n- A.9.4: Interaction with AI system\n- A.9.5: AI system access control\n- A.9.6: Human oversight of AI system\n- A.9.7: Monitoring of AI system\n\n**A.10 — Third-party and customer relationships in AI systems**\n- A.10.2: Agreements with third parties\n- A.10.3: Addressing AI in third-party agreements\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-793ac9ae7a5d@5d272a101bfbff2a","id":"GUIDE-ISO-42001-793ac9ae7a5d","version":"5d272a101bfbff2a","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Clause-by-Clause Breakdown / Clause 4 — Context of the Organization","statement":"This clause requires organizations to understand their environment before building the AIMS.\n\n**4.1 — Understanding the organization and its context:**\n- External factors: regulatory environment, market expectations, societal values, technological landscape\n- Internal factors: organizational culture, existing governance structures, data assets, AI capabilities, stakeholder expectations\n- AI-specific context: the nature of AI systems being developed or used, their intended purposes, affected populations, and potential societal impacts\n\n**4.2 — Understanding the needs and expectations of interested parties:**\nOrganizations must identify all parties with interests in their AI activities:\n- Customers and end users\n- Employees and their representatives\n- Regulatory bodies (national and international)\n- Civil society organizations\n- Supply chain partners\n- Shareholders and investors\n- Affected communities\n\nFor each, the organization must understand:\n- Their requirements relevant to the AIMS\n- Which requirements become compliance obligations\n- How their interests interact with AI risk and opportunity\n\n**4.3 — Determining the scope of the AIMS:**\nThe organization must define which AI systems, products, and services fall within AIMS scope. Scope decisions must be documented and justified. Organizations may begin with a subset of AI activities and expand — but scope exclusions cannot be used to avoid addressing material AI risks.\n\n**4.4 — AI management system:**\nThe organization must establish, implement, maintain, and continually improve the AIMS in accordance with the standard's requirements.\n\n**GOVERN mapping:** GOVERN Assess begins here — the AI Inventory defines scope, stakeholder identification tools support 4.2, and organizational context documentation feeds the AIMS foundation.\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-7c6db84cd8c4@3bc51136634fc40e","id":"GUIDE-ISO-42001-7c6db84cd8c4","version":"3bc51136634fc40e","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"What It Is","statement":"ISO/IEC 42001:2023 is the first international standard specifying requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations. It follows the High-Level Structure (HLS) / Annex SL format used by ISO 9001 (quality), ISO 27001 (information security), and ISO 14001 (environmental) — meaning organizations with existing management system certifications can integrate ISO 42001 into their existing frameworks.\n\nThe standard applies to any organization that provides or uses AI-based products or services. It is designed to be applicable regardless of organization size, type, or sector. Unlike the EU AI Act (which is compliance law), ISO 42001 is a voluntary standard that organizations can be certified against — demonstrating to customers, regulators, partners, and the public that AI is managed through a structured, auditable system.\n\n**What it is NOT:**\n- Not a product standard — it does not specify how AI systems must technically perform\n- Not a risk classification scheme like the EU AI Act\n- Not a code of ethics — though ethics are embedded throughout\n- Not limited to high-risk AI — it applies to the full portfolio of AI use\n\n**What it IS:**\n- A process and governance standard\n- A certification-ready framework with third-party audit pathway\n- A credible signal of organizational AI maturity\n- A practical operationalization of responsible AI principles\n- Increasingly required by enterprise procurement, government contracts, and financial sector vendors\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-7fb0b5ed1b72@b217cd182e323200","id":"GUIDE-ISO-42001-7fb0b5ed1b72","version":"b217cd182e323200","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Annex B — Implementation Guidance","statement":"Annex B provides non-normative guidance for implementing the controls in Annex A. It is structured to align with each A.x control and provides:\n- Rationale for the control\n- Examples of implementation approaches\n- Guidance for different organizational sizes and contexts\n- Cross-references to relevant standards (ISO/IEC 23894 for AI risk, ISO/IEC 38507 for AI governance)\n\nKey implementation guidance themes:\n\n**AI system lifecycle governance:**\nAnnex B emphasizes that AI systems require governance at every lifecycle stage — from initial requirements through development, testing, deployment, operation, monitoring, and decommissioning. Each stage has distinct control requirements.\n\n**Data quality and lineage:**\nAnnex B provides detailed guidance on establishing data quality criteria, lineage tracking, and the organizational structures needed to maintain data integrity for AI training and operation.\n\n**Human oversight design:**\nGuidance on how to design human oversight mechanisms that are meaningful (not rubber-stamping), appropriate to risk level, and resistant to automation bias.\n\n**Explainability:**\nGuidance on matching explainability requirements to stakeholder needs — recognizing that internal technical explainability (for developers and auditors) differs from user-facing explainability.\n\n**Incident response for AI:**\nSpecific guidance on how AI incidents differ from traditional IT incidents and how to adapt incident response processes accordingly.\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-886ce3b1e993@20116caad1ed39cc","id":"GUIDE-ISO-42001-886ce3b1e993","version":"20116caad1ed39cc","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Clause-by-Clause Breakdown / Clause 3 — Terms and Definitions","statement":"ISO 42001 introduces key AIMS-specific definitions:\n- **AI system:** A machine-based system that, for a given set of objectives, generates outputs such as predictions, recommendations, decisions, or content that influence real or virtual environments\n- **AI policy:** Intentions and direction of an organization related to the development, provision, or use of AI\n- **AI risk:** Combination of the probability of occurrence of an AI-related harm and the severity of that harm\n- **AI objective:** Result to be achieved in relation to AI development, provision, or use\n- **Interested party (AI-specific):** Person or organization that can affect, be affected by, or perceive themselves to be affected by the organization's AI activities\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-a582b0e42e13@a7708ac51cba506a","id":"GUIDE-ISO-42001-a582b0e42e13","version":"a7708ac51cba506a","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Clause-by-Clause Breakdown / Clause 7 — Support","statement":"Support clauses ensure the AIMS is properly resourced and that people, information, and communication are aligned.\n\n**7.1 — Resources:**\nThe organization must determine and provide the resources needed for the AIMS, including:\n- Human resources with appropriate AI competencies\n- Infrastructure (compute, data platforms, tooling)\n- Organizational knowledge necessary for AI governance\n- External expertise where internal gaps exist\n\n**7.2 — Competence:**\nPersons doing AI-related work affecting AIMS performance must:\n- Have appropriate education, training, or experience\n- Have their competence evaluated\n- Have training needs identified and addressed\n- Maintain documented evidence of competence\n\nAI-specific competence requirements include:\n- Understanding of AI concepts and limitations\n- Awareness of AI-related risks and ethical considerations\n- Ability to evaluate AI system outputs critically\n- Knowledge of relevant regulations and standards\n\n**7.3 — Awareness:**\nAll persons in the organization must be aware of:\n- The AI policy\n- Their contribution to AIMS effectiveness\n- The implications of not conforming to AIMS requirements\n- The organization's approach to responsible AI\n\n**7.4 — Communication:**\nThe organization must determine:\n- What to communicate about the AIMS (internally and externally)\n- When to communicate\n- With whom to communicate\n- How to communicate\n- Who does the communicating\n\n**7.5 — Documented information:**\n\n**7.5.1 — General:** The AIMS must include documented information required by the standard plus additional documented information the organization determines is necessary for AIMS effectiveness.\n\n**7.5.2 — Creating and updating:** Documented information must have appropriate identification, format, media, review, and approval.\n\n**7.5.3 — Control of documented information:** Documented information must be available, protected, controlled for distribution, access, and retrieval. Changes must be controlled. External documented information must be identified and controlled.\n\n**GOVERN mapping:** GOVERN Compliance Portal is the documented information system. All AIMS records, risk assessments, training logs, incident reports, and audit trails maintained. Competency tracking module supports Clause 7.2.\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-aacb45a1ed8d@08bb02aa48f4bfa1","id":"GUIDE-ISO-42001-aacb45a1ed8d","version":"08bb02aa48f4bfa1","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Clause-by-Clause Breakdown","statement":"### Clause 1 — Scope\nSpecifies that the standard applies to any organization involved in providing or using AI-based products or services. The standard is intended to help organizations demonstrate that AI is used responsibly, that related risks are managed appropriately, and that AI-specific opportunities are realized.\n\nThe standard acknowledges that AI introduces unique challenges to traditional management systems: opacity of models, emergent behavior, data dependency, and the interaction between AI objectives and human values.\n\n---\n\n### Clause 2 — Normative References\nReferences ISO/IEC 22989:2022 (AI concepts and terminology). Organizations implementing ISO 42001 must align their terminology with ISO/IEC 22989 definitions.\n\n---\n\n### Clause 3 — Terms and Definitions\nISO 42001 introduces key AIMS-specific definitions:\n- **AI system:** A machine-based system that, for a given set of objectives, generates outputs such as predictions, recommendations, decisions, or content that influence real or virtual environments\n- **AI policy:** Intentions and direction of an organization related to the development, provision, or use of AI\n- **AI risk:** Combination of the probability of occurrence of an AI-related harm and the severity of that harm\n- **AI objective:** Result to be achieved in relation to AI development, provision, or use\n- **Interested party (AI-specific):** Person or organization that can affect, be affected by, or perceive themselves to be affected by the organization's AI activities\n\n---\n\n### Clause 4 — Context of the Organization\n\nThis clause requires organizations to understand their environment before building the AIMS.\n\n**4.1 — Understanding the organization and its context:**\n- External factors: regulatory environment, market expectations, societal values, technological landscape\n- Internal factors: organizational culture, existing governance structures, data assets, AI capabilities, stakeholder expectations\n- AI-specific context: the nature of AI systems being developed or used, their intended purposes, affected populations, and potential societal impacts\n\n**4.2 — Understanding the needs and expectations of interested parties:**\nOrganizations must identify all parties with interests in their AI activities:\n- Customers and end users\n- Employees and their representatives\n- Regulatory bodies (national and international)\n- Civil society organizations\n- Supply chain partners\n- Shareholders and investors\n- Affected communities\n\nFor each, the organization must understand:\n- Their requirements relevant to the AIMS\n- Which requirements become compliance obligations\n- How their interests interact with AI risk and opportunity\n\n**4.3 — Determining the scope of the AIMS:**\nThe organization must define which AI systems, products, and services fall within AIMS scope. Scope decisions must be documented and justified. Organizations may begin with a subset of AI activities and expand — but scope exclusions cannot be used to avoid addressing material AI risks.\n\n**4.4 — AI management system:**\nThe organization must establish, implement, maintain, and continually improve the AIMS in accordance with the standard's requirements.\n\n**GOVERN mapping:** GOVERN Assess begins here — the AI Inventory defines scope, stakeholder identification tools support 4.2, and organizational context documentation feeds the AIMS foundation.\n\n---\n\n### Clause 5 — Leadership\n\nThis clause places responsibility at the senior leadership level. Unlike technical controls, leadership obligations in Clause 5 cannot be delegated away.\n\n**5.1 — Leadership and commitment:**\nTop management must demonstrate leadership and commitment to the AIMS by:\n- Taking accountability for the effectiveness of the AIMS\n- Ensuring AI policy and objectives are established and compatible with the organization's strategic direction\n- Integrating AIMS requirements into organizational processes\n- Ensuring resources are available for the AIMS\n- Communicating the importance of effective AI management\n- Ensuring the AIMS achieves its intended outcomes\n- Directing and supporting persons to contribute to AIMS effectiveness\n- Promoting continual improvement\n- Supporting other management roles to demonstrate leadership in their areas\n\nAI-specific leadership obligations:\n- Ensuring consideration of AI impacts on human rights and fundamental values is part of strategic planning\n- Ensuring AI-related risks are considered at the board/executive level\n- Establishing accountability chains for AI outcomes (not just AI outputs)\n\n**5.2 — AI policy:**\nTop management must establish an AI policy that:\n- Is appropriate to the purpose and context of the organization\n- Provides a framework for setting AI objectives\n- Includes a commitment to satisfying applicable requirements\n- Includes a commitment to continual improvement of the AIMS\n- Addresses the organization's approach to responsible AI, including how it balances innovation with risk management\n\nThe AI policy must be communicated within the organization, available to interested parties, and maintained as documented information.\n\n**5.3 — Organizational roles, responsibilities, and authorities:**\nTop management must assign and communicate roles including:\n- Who is responsible for ensuring the AIMS conforms to the standard\n- Who is responsible for reporting on AIMS performance to top management\n- Who has accountability for each AI system in scope\n- Who is the designated point of contact for AI-related incidents and regulatory inquiries\n\n**GOVERN mapping:** GOVERN Compliance Portal tracks leadership accountability assignments. CAIO/Chief AI Officer role supported. Board-level AI risk reporting dashboards generated from GOVERN data.\n\n---\n\n### Clause 6 — Planning\n\nPlanning is where the AIMS moves from policy to concrete action.\n\n**6.1 — Actions to address risks and opportunities:**\n\n**6.1.1 — General:**\nWhen planning the AIMS, the organization must consider the context (Clause 4.1 and 4.2) and determine:\n- Risks and opportunities that need to be addressed\n- How to integrate and implement actions into AIMS processes\n- How to evaluate the effectiveness of those actions\n\nAI-specific planning must address:\n- Risks related to data quality and bias\n- Risks related to model performance and reliability\n- Risks related to unintended use and misuse\n- Risks related to the AI system's impact on affected parties\n- Opportunities to improve processes, products, or services through AI\n- Opportunities to advance the organization's responsible AI commitments\n\n**6.1.2 — AI risk assessment:**\nThe organization must establish and maintain a process for AI risk assessment that:\n- Identifies AI risks (the what could go wrong)\n- Analyzes AI risks (likelihood and impact)\n- Evaluates AI risks against risk criteria\n- Produces comparable and reproducible results\n- Documents risk assessment results\n\n**6.1.3 — AI risk treatment:**\nBased on risk assessment results, the organization must:\n- Select appropriate risk treatment options (modify, retain, avoid, share)\n- Determine controls needed (referencing Annex A)\n- Formulate and implement a risk treatment plan\n- Obtain acceptance of residual risks from risk owners\n\n**6.2 — AI objectives and planning to achieve them:**\nThe organization must establish measurable AI objectives at relevant functions and levels:\n- Consistent with AI policy\n- Measurable (where practicable)\n- Monitored and communicated\n- Updated as appropriate\n\nFor each AI objective, the organization must determine: what will be done, what resources are required, who will be responsible, when it will be completed, and how results will be evaluated.\n\n**6.3 — Planning of changes:**\nChanges to the AIMS must be planned and implemented in a controlled manner, considering the purpose, potential consequences, resource availability, and responsibilities.\n\n**GOVERN mapping:** GOVERN Risk Engine operationalizes Clause 6.1.2 and 6.1.3. Risk assessment workflows, risk treatment plans, and residual risk acceptance records are generated and stored. GOVERN Objectives Module tracks AI objectives and progress metrics.\n\n---\n\n### Clause 7 — Support\n\nSupport clauses ensure the AIMS is properly resourced and that people, information, and communication are aligned.\n\n**7.1 — Resources:**\nThe organization must determine and provide the resources needed for the AIMS, including:\n- Human resources with appropriate AI competencies\n- Infrastructure (compute, data platforms, tooling)\n- Organizational knowledge necessary for AI governance\n- External expertise where internal gaps exist\n\n**7.2 — Competence:**\nPersons doing AI-related work affecting AIMS performance must:\n- Have appropriate education, training, or experience\n- Have their competence evaluated\n- Have training needs identified and addressed\n- Maintain documented evidence of competence\n\nAI-specific competence requirements include:\n- Understanding of AI concepts and limitations\n- Awareness of AI-related risks and ethical considerations\n- Ability to evaluate AI system outputs critically\n- Knowledge of relevant regulations and standards\n\n**7.3 — Awareness:**\nAll persons in the organization must be aware of:\n- The AI policy\n- Their contribution to AIMS effectiveness\n- The implications of not conforming to AIMS requirements\n- The organization's approach to responsible AI\n\n**7.4 — Communication:**\nThe organization must determine:\n- What to communicate about the AIMS (internally and externally)\n- When to communicate\n- With whom to communicate\n- How to communicate\n- Who does the communicating\n\n**7.5 — Documented information:**\n\n**7.5.1 — General:** The AIMS must include documented information required by the standard plus additional documented information the organization determines is necessary for AIMS effectiveness.\n\n**7.5.2 — Creating and updating:** Documented information must have appropriate identification, format, media, review, and approval.\n\n**7.5.3 — Control of documented information:** Documented information must be available, protected, controlled for distribution, access, and retrieval. Changes must be controlled. External documented information must be identified and controlled.\n\n**GOVERN mapping:** GOVERN Compliance Portal is the documented information system. All AIMS records, risk assessments, training logs, incident reports, and audit trails maintained. Competency tracking module supports Clause 7.2.\n\n---\n\n### Clause 8 — Operation\n\nOperation clauses govern the day-to-day running of the AIMS — the processes that produce AI-related outputs.\n\n**8.1 — Operational planning and control:**\nThe organization must plan, implement, control, and review processes needed to meet AI management requirements. This includes:\n- Establishing criteria for processes\n- Controlling processes in accordance with criteria\n- Keeping documented information to demonstrate processes run as planned\n- Controlling planned changes and reviewing unintended changes\n\n**8.2 — AI risk assessment (operational):**\nThe organization must perform AI risk assessments at planned intervals, and when significant changes occur or are proposed.\n\n**8.3 — AI risk treatment (operational):**\nThe organization must implement the AI risk treatment plan and maintain documented information about results.\n\n**8.4 — AI system impact assessment:**\nFor AI systems with significant potential impact on individuals or communities, the organization must conduct an AI system impact assessment covering:\n- The intended purpose and intended use\n- Potential positive and negative impacts on natural persons and society\n- Affected groups (including vulnerable populations)\n- Severity and likelihood of negative impacts\n- Mitigating controls\n- Residual risks after mitigation\n\nThe impact assessment is distinct from the risk assessment (which focuses on organizational risk). The impact assessment focuses on societal and individual harm.\n\n**8.5 — Related policies and objectives for AI systems:**\nThe organization must ensure AI systems in scope have documented:\n- Intended purpose\n- Performance objectives\n- Applicable constraints\n- Required data inputs\n- Human oversight mechanisms\n- Expected operational environment\n\n**8.6 — Procurement and supply chain:**\nWhen procuring AI systems or AI-related services from external parties, the organization must:\n- Establish procurement criteria aligned with AI policy and risk requirements\n- Obtain sufficient information from suppliers to assess AI risks\n- Pass down requirements to suppliers as appropriate\n- Monitor supplier compliance with AI-related requirements\n\n**GOVERN mapping:** GOVERN Risk Engine handles 8.2–8.3. GOVERN Impact Assessment module handles 8.4. System cards generated for 8.5. GOVERN Vendor AI module handles 8.6 — tracking third-party AI systems and supplier compliance.\n\n---\n\n### Clause 9 — Performance Evaluation\n\n**9.1 — Monitoring, measurement, analysis, and evaluation:**\nThe organization must determine:\n- What needs to be monitored and measured\n- Methods for monitoring, measurement, analysis, and evaluation\n- When the monitoring and measuring shall be performed\n- When results shall be analyzed and evaluated\n\nAI-specific monitoring must address:\n- Model performance metrics (accuracy, fairness, drift)\n- AI system usage patterns (intended vs. actual use)\n- Incidents and near-misses\n- Stakeholder feedback\n- Regulatory changes affecting AI compliance\n\nThe organization must evaluate AI system performance at planned intervals and when performance changes are observed.\n\n**9.2 — Internal audit:**\nThe organization must conduct internal audits at planned intervals to provide information on whether the AIMS:\n- Conforms to the organization's own requirements for the AIMS\n- Conforms to ISO 42001 requirements\n- Is effectively implemented and maintained\n\nAudit programme must consider AI risk levels (higher risk areas audited more frequently), changes affecting AI, and previous audit results.\n\n**9.3 — Management review:**\nTop management must review the AIMS at planned intervals. Inputs must include:\n- Status of actions from previous reviews\n- Changes in external and internal issues relevant to the AIMS\n- Information on AIMS performance including trends in AI incidents and nonconformities\n- AI risk assessment and risk treatment results\n- Monitoring and measurement results\n- Opportunities for continual improvement\n\nManagement review outputs must include decisions related to continual improvement, resource needs, and changes to the AIMS.\n\n**GOVERN mapping:** GOVERN Performance Dashboard operationalizes Clause 9.1. Internal audit support tools support 9.2. Executive reporting for management review generated from GOVERN data.\n\n---\n\n### Clause 10 — Improvement\n\n**10.1 — Continual improvement:**\nThe organization must continually improve the suitability, adequacy, and effectiveness of the AIMS. This includes using findings from monitoring, audit, incident analysis, and management review.\n\n**10.2 — Nonconformity and corrective action:**\nWhen a nonconformity occurs, the organization must:\n- React to the nonconformity and take action to control and correct it\n- Evaluate the need for action to eliminate causes\n- Review the effectiveness of corrective actions taken\n- Make changes to the AIMS if necessary\n- Maintain documented information as evidence\n\nCorrective action must be appropriate to the effects of the nonconformities encountered.\n\n**GOVERN mapping:** GOVERN Incident and Corrective Action module handles Clause 10.2. Nonconformity records, root cause analysis, corrective action plans, and effectiveness reviews all tracked.\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-ae397bc490c1@ad752048ff465c99","id":"GUIDE-ISO-42001-ae397bc490c1","version":"ad752048ff465c99","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Certification Requirements","statement":"ISO 42001 certification follows the same model as ISO 27001 and ISO 9001:\n\n**Stage 1 Audit (Documentation review):**\n- Auditor reviews the organization's AIMS documentation\n- Verifies that the scope, policies, and procedures are in place and appropriate\n- Identifies any significant gaps before the main audit\n- Typically 1–2 days depending on organization size\n\n**Stage 2 Audit (Implementation assessment):**\n- On-site (or remote) audit of the actual implementation\n- Interviews with staff at multiple levels\n- Review of records, evidence of operation, and control effectiveness\n- Results in certification decision (issue, issue with conditions, or reject)\n\n**Surveillance audits:**\n- Conducted annually during the 3-year certification cycle\n- Verifies ongoing compliance and continual improvement\n- Typically narrower scope than initial audit (selected clauses and controls)\n\n**Recertification audit:**\n- Full audit at end of 3-year cycle\n- Full re-assessment of all clauses and controls\n\n**Accredited Certification Bodies:**\nCertification must be conducted by an ISO/IEC 17021-1 accredited certification body. Organizations cannot self-certify. Accreditation bodies include:\n- UKAS (United Kingdom)\n- DAkkS (Germany)\n- ANAB (United States)\n- COFRAC (France)\n- JAB (Japan)\n- And national equivalents in all major economies\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-b566bba7e495@845777a1cabdfb1b","id":"GUIDE-ISO-42001-b566bba7e495","version":"845777a1cabdfb1b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Clause-by-Clause Breakdown / Clause 1 — Scope","statement":"Specifies that the standard applies to any organization involved in providing or using AI-based products or services. The standard is intended to help organizations demonstrate that AI is used responsibly, that related risks are managed appropriately, and that AI-specific opportunities are realized.\n\nThe standard acknowledges that AI introduces unique challenges to traditional management systems: opacity of models, emergent behavior, data dependency, and the interaction between AI objectives and human values.\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-c2b8d01eb4ee@d18383a7f6eb6808","id":"GUIDE-ISO-42001-c2b8d01eb4ee","version":"d18383a7f6eb6808","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Clause-by-Clause Breakdown / Clause 10 — Improvement","statement":"**10.1 — Continual improvement:**\nThe organization must continually improve the suitability, adequacy, and effectiveness of the AIMS. This includes using findings from monitoring, audit, incident analysis, and management review.\n\n**10.2 — Nonconformity and corrective action:**\nWhen a nonconformity occurs, the organization must:\n- React to the nonconformity and take action to control and correct it\n- Evaluate the need for action to eliminate causes\n- Review the effectiveness of corrective actions taken\n- Make changes to the AIMS if necessary\n- Maintain documented information as evidence\n\nCorrective action must be appropriate to the effects of the nonconformities encountered.\n\n**GOVERN mapping:** GOVERN Incident and Corrective Action module handles Clause 10.2. Nonconformity records, root cause analysis, corrective action plans, and effectiveness reviews all tracked.\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-c5f57ff9b66e@e6527fa9a54ceec3","id":"GUIDE-ISO-42001-c5f57ff9b66e","version":"e6527fa9a54ceec3","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Clause-by-Clause Breakdown / Clause 8 — Operation","statement":"Operation clauses govern the day-to-day running of the AIMS — the processes that produce AI-related outputs.\n\n**8.1 — Operational planning and control:**\nThe organization must plan, implement, control, and review processes needed to meet AI management requirements. This includes:\n- Establishing criteria for processes\n- Controlling processes in accordance with criteria\n- Keeping documented information to demonstrate processes run as planned\n- Controlling planned changes and reviewing unintended changes\n\n**8.2 — AI risk assessment (operational):**\nThe organization must perform AI risk assessments at planned intervals, and when significant changes occur or are proposed.\n\n**8.3 — AI risk treatment (operational):**\nThe organization must implement the AI risk treatment plan and maintain documented information about results.\n\n**8.4 — AI system impact assessment:**\nFor AI systems with significant potential impact on individuals or communities, the organization must conduct an AI system impact assessment covering:\n- The intended purpose and intended use\n- Potential positive and negative impacts on natural persons and society\n- Affected groups (including vulnerable populations)\n- Severity and likelihood of negative impacts\n- Mitigating controls\n- Residual risks after mitigation\n\nThe impact assessment is distinct from the risk assessment (which focuses on organizational risk). The impact assessment focuses on societal and individual harm.\n\n**8.5 — Related policies and objectives for AI systems:**\nThe organization must ensure AI systems in scope have documented:\n- Intended purpose\n- Performance objectives\n- Applicable constraints\n- Required data inputs\n- Human oversight mechanisms\n- Expected operational environment\n\n**8.6 — Procurement and supply chain:**\nWhen procuring AI systems or AI-related services from external parties, the organization must:\n- Establish procurement criteria aligned with AI policy and risk requirements\n- Obtain sufficient information from suppliers to assess AI risks\n- Pass down requirements to suppliers as appropriate\n- Monitor supplier compliance with AI-related requirements\n\n**GOVERN mapping:** GOVERN Risk Engine handles 8.2–8.3. GOVERN Impact Assessment module handles 8.4. System cards generated for 8.5. GOVERN Vendor AI module handles 8.6 — tracking third-party AI systems and supplier compliance.\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-cd71633f0fc2@6b36906c7bc77ee4","id":"GUIDE-ISO-42001-cd71633f0fc2","version":"6b36906c7bc77ee4","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Component Mapping to ISO 42001","statement":"| ISO 42001 Clause/Control | GOVERN Component | What It Does |\n|--------------------------|-----------------|-------------|\n| Clause 4.3 — AIMS scope | GOVERN Energy + AI Inventory | Discovers all AI systems; scope definition workflow |\n| Clause 5.1 — Leadership commitment | GOVERN Compliance Portal | Executive dashboard, accountability assignment |\n| Clause 5.2 — AI policy | GOVERN Compliance Portal | Policy documentation and communication records |\n| Clause 5.3 — Roles and responsibilities | GOVERN Compliance Portal | CAIO, HOO, system owner role assignment |\n| Clause 6.1.2 — AI risk assessment | GOVERN Risk Engine | Risk assessment workflows, scoring, documentation |\n| Clause 6.1.3 — AI risk treatment | GOVERN Risk Engine | Risk treatment plans, control selection, residual risk |\n| Clause 6.2 — AI objectives | GOVERN Objectives Module | Objective setting, measurement, progress tracking |\n| Clause 7.2 — Competence | GOVERN Learning Module | Competency tracking, training records |\n| Clause 7.5 — Documented information | GOVERN Compliance Portal | Document management, version control, audit trail |\n| Clause 8.2 — Risk assessment (operational) | GOVERN Risk Engine | Recurring assessments, change-triggered assessments |\n| Clause 8.4 — AI system impact assessment | GOVERN Impact Assessment | Impact assessment workflows, affected party analysis |\n| Clause 8.6 — Procurement/supply chain | GOVERN Vendor AI | Third-party AI inventory, supplier compliance tracking |\n| Clause 9.1 — Monitoring and measurement | GOVERN Performance Dashboard | Model performance metrics, usage monitoring, drift detection |\n| Clause 9.2 — Internal audit | GOVERN Audit Module | Audit planning, evidence collection, finding tracking |\n| Clause 9.3 — Management review | GOVERN Executive Reports | Management review input compilation, output tracking |\n| Clause 10.2 — Corrective action | GOVERN Incident Module | Nonconformity records, corrective action plans |\n| Annex A.4.2 — Resource management | GOVERN AI Inventory | System resource and capacity tracking |\n| Annex A.5.4 — Impact assessment | GOVERN Impact Assessment | Automated impact assessment generation |\n| Annex A.6.1 — Data management | GOVERN Data Governance | Data lineage, quality records, provenance tracking |\n| Annex A.6.2.7 — Performance metrics | GOVERN Performance Dashboard | Accuracy, fairness, and drift metrics |\n| Annex A.6.2.11 — Incident management | GOVERN Incident Module | AI incident detection, logging, response tracking |\n| Annex A.9.6 — Human oversight | GOVERN Human Oversight | Oversight control configuration, override logging |\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-d42e3bd38d0a@38db7de90efb22ce","id":"GUIDE-ISO-42001-d42e3bd38d0a","version":"38db7de90efb22ce","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Relationship to Other Standards","statement":"| Standard | Relationship to ISO 42001 |\n|---------|--------------------------|\n| ISO 9001:2015 | Quality management — integrates via HLS; ISO 42001 AIMS can be incorporated into existing QMS |\n| ISO/IEC 27001:2022 | Information security — integrates via HLS; AI-related security risks addressed jointly |\n| ISO 14001:2015 | Environmental management — integrates via HLS; AI energy consumption addressed |\n| ISO/IEC 23894:2023 | AI risk management guidance — normative reference for Clause 6 risk methodology |\n| ISO/IEC 38507:2022 | AI governance implications for organizations — supports Clause 5 leadership obligations |\n| ISO/IEC 22989:2022 | AI concepts and terminology — normative reference for Clause 3 definitions |\n| NIST AI RMF | US framework with similar intent; ISO 42001 maps to all four NIST AI RMF functions |\n| EU AI Act | Regulatory law; ISO 42001 certification is relevant evidence for high-risk AI conformity |\n| OECD AI Principles | Policy framework; ISO 42001 operationalizes OECD principles into management system requirements |","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-ISO-42001-dc7d7769da1f@a22eed717505324b","id":"GUIDE-ISO-42001-dc7d7769da1f","version":"a22eed717505324b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Clause-by-Clause Breakdown / Clause 2 — Normative References","statement":"References ISO/IEC 22989:2022 (AI concepts and terminology). Organizations implementing ISO 42001 must align their terminology with ISO/IEC 22989 definitions.\n\n---","family":"ISO-42001","body":{"sourceFile":"POLICY(7).md","sourceFamily":"ISO-42001","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-0743deca6f7b@c2f483fbc22e746b","id":"GUIDE-NIST-800-53-0743deca6f7b","version":"c2f483fbc22e746b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant Control Families — Detailed Coverage / AU — Audit and Accountability","statement":"**Applicability to AI Governance:** AI systems must log decisions, inputs, outputs, and model changes to support accountability, incident investigation, and regulatory compliance. AI decision logging is foundational to the EU AI Act and emerging AI transparency requirements.\n\n**AI-Relevant Controls:**\n\n**AU-1 — Audit and Accountability Policy and Procedures**\nRequires documented audit policy. For AI systems: audit policy must address what AI system events are logged (inference requests, decision outputs, model deployments, training runs, configuration changes) and how logs are protected.\n\n**AU-2 — Event Logging**\nDefines events to be logged. For AI systems, required events include:\n- Inference API calls (timestamp, user/system ID, input hash, output hash)\n- Model deployment events (which model version deployed by whom)\n- Training run initiation and completion\n- Access to training data repositories\n- Model configuration changes\n- Anomalous output events (outputs flagged by monitoring)\n- Human override of AI decisions\n\n**AU-3 — Content of Audit Records**\nDefines the content of audit log entries. For AI systems: logs must capture sufficient context to reconstruct the AI decision — model version, input parameters, output, confidence score, and the identity of the requesting user or system.\n\n**AU-6 — Audit Record Review, Analysis, and Reporting**\nRequires regular review of audit logs. For AI systems: periodic review of AI decision logs for anomalies, bias patterns, unusual access, and evidence of adversarial inputs.\n\n**AU-9 — Protection of Audit Information**\nPrevents unauthorized access to audit logs. For AI systems: AI decision logs must be write-protected and stored independently of the systems that generate them (defense against log tampering after adversarial incident).\n\n**AU-10 — Non-Repudiation**\nProvides evidence that actions cannot be denied. For AI systems: digital signing of AI inference requests and responses supports non-repudiation for high-stakes AI decisions (medical, financial, legal, regulatory).\n\n**AU-11 — Audit Record Retention**\nDefines retention periods. For AI systems: retain AI decision logs for the period required by applicable regulations. EU AI Act requires post-market monitoring records for 10 years for high-risk AI systems. Financial services AI decisions may require 5–7 year retention.\n\n**AU-12 — Audit Record Generation**\nRequires audit record generation capability. For AI systems: ensure every AI system component (inference API, model serving infrastructure, training pipeline) generates audit records that flow to the centralized audit repository.\n\n**AU-14 — Session Audit**\nRequires logging of session activity. For AI systems: log user sessions interacting with AI systems, capturing the sequence of AI queries and human actions taken on AI outputs.\n\n**GOVERN Assess Evaluation:** AU family evaluated via log completeness review, retention period verification, and AI decision log format assessment.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-1331bdd740d3@a0b6978c0652b99c","id":"GUIDE-NIST-800-53-1331bdd740d3","version":"a0b6978c0652b99c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant Control Families — Detailed Coverage / IA — Identification and Authentication","statement":"**Applicability to AI Governance:** AI systems themselves are principals in identity architectures. Service accounts, API keys, and automated pipeline identities require the same rigor as human identities.\n\n**AI-Relevant Controls:**\n\n**IA-1 — Identification and Authentication Policy and Procedures**\nRequires documented IA policy. For AI systems: policy must address authentication for human users of AI systems, authentication of AI service accounts, and authentication of AI API clients.\n\n**IA-2 — Identification and Authentication (Organizational Users)**\nRequires multi-factor authentication for users. For AI systems: MFA required for access to AI model registries, training platforms, MLOps dashboards, and inference API administrative interfaces.\n\n**IA-3 — Device Identification and Authentication**\nRequires device-level authentication. For AI systems: inference server instances, training workers, and pipeline automation agents must authenticate to the AI system infrastructure before receiving credentials or accessing model artifacts.\n\n**IA-4 — Identifier Management**\nManages identifiers for users and devices. For AI systems: assign unique identifiers to each AI model version, each training run, and each inference service instance. Use identifiers for audit trail traceability.\n\n**IA-5 — Authenticator Management**\nManages credentials. For AI systems: rotate API keys for AI inference endpoints regularly. Store AI system credentials in secrets management systems (not in code repositories or configuration files). Audit credential access.\n\n**IA-8 — Identification and Authentication (Non-Organizational Users)**\nAddresses external user authentication. For AI systems: users outside the organization accessing AI APIs (customers, partners) must be authenticated. Define authentication requirements in AI API access policies.\n\n**IA-9 — Service Identification and Authentication**\nRequires mutual authentication for services. For AI systems: AI microservices (inference, training, data pipelines) must mutually authenticate using service mesh identities or mTLS. Prevent rogue services from impersonating AI system components.\n\n**IA-10 — Adaptive Authentication**\nAllows risk-based authentication. For AI systems: consider step-up authentication for high-stakes AI API calls (e.g., AI-assisted financial transactions, medical AI recommendations, identity verification).\n\n**GOVERN Assess Evaluation:** IA family evaluated via authentication mechanism review, credential management policy assessment, and service account inventory.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-19c4d11e2a52@9b23c0114c875da5","id":"GUIDE-NIST-800-53-19c4d11e2a52","version":"9b23c0114c875da5","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Assess — 800-53 Evaluation Methodology","statement":"GOVERN's Assess capability evaluates AI systems against NIST 800-53 Rev 5 AI-relevant controls using three modes:\n\n### Rapid Assess (AI-Focused Subset)\n\nEvaluates the 11 AI-relevant control families with a focused subset of ~40 high-priority controls. Produces:\n- Per-family compliance score\n- Critical gap identification\n- Priority remediation recommendations\n- ATO readiness indicator\n\nTimeframe: 2–4 hours with complete documentation input\n\n### Deep Assess (Full 800-53 Coverage)\n\nEvaluates all applicable 800-53 controls for an AI system, including the full 20 control families for systems requiring comprehensive ATO documentation. Produces:\n- Complete control-by-control assessment\n- Security Assessment Report (SAR) draft\n- Plan of Action and Milestones (POA&M)\n- ATO package readiness checklist\n\nTimeframe: 2–5 days with subject matter expert collaboration\n\n### Continuous Assess (Ongoing Monitoring)\n\nMaps to CA-7 (Continuous Monitoring) requirements. Monitors key controls for AI systems:\n- AU controls: log completeness, retention compliance\n- CM controls: model version drift, unauthorized changes\n- IR controls: incident detection coverage, response SLA\n- SI controls: model integrity, input validation, output monitoring\n\nGenerates monthly compliance posture reports and alerts on control degradation.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-1f56a3a417ea@624a7e6bb1239f71","id":"GUIDE-NIST-800-53-1f56a3a417ea","version":"624a7e6bb1239f71","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant Control Families — Detailed Coverage / CM — Configuration Management","statement":"**Applicability to AI Governance:** AI model version control is a direct application of configuration management. Controlling which model version is deployed, tracking changes, and maintaining a secure baseline are CM responsibilities extended to the AI domain.\n\n**AI-Relevant Controls:**\n\n**CM-1 — Configuration Management Policy and Procedures**\nRequires documented CM policy. For AI systems: CM policy must explicitly address model versioning, model registry governance, hyperparameter configuration control, and deployment pipeline security.\n\n**CM-2 — Baseline Configuration**\nRequires maintained baseline configurations. For AI systems: the baseline includes the model version (artifact hash), inference server configuration, input/output schema, performance benchmarks, and approved dependency versions. Any deviation from baseline requires change control.\n\n**CM-3 — Configuration Change Control**\nRequires change control process. For AI systems: any change to a deployed model (fine-tuning, RAG corpus update, prompt template change, system prompt modification, threshold change) requires a change control ticket, impact assessment, and authorization.\n\n**CM-4 — Impact Analyses**\nRequires analysis before changes are implemented. For AI systems: AI model update impact analysis must include bias re-assessment, performance regression testing, safety testing, and review of changes to output distribution.\n\n**CM-6 — Configuration Settings**\nRequires configuration of security settings. For AI systems: define and enforce configuration standards for AI serving infrastructure — disable debug endpoints, enforce output filtering, set rate limits, configure authentication on inference APIs.\n\n**CM-7 — Least Functionality**\nRequires minimum functionality. For AI systems: disable unused inference capabilities, model endpoints not in active use, and administrative interfaces. Apply principle of least functionality to AI system capabilities.\n\n**CM-8 — System Component Inventory**\nRequires inventory of system components. For AI systems: maintain an inventory that includes all AI models (with artifact hashes), model versions, training dataset versions, framework dependencies, and third-party AI components (APIs, SDKs, pre-trained models).\n\n**CM-10 — Software Usage Restrictions**\nControls software licensing. For AI systems: verify licensing for all AI frameworks, pre-trained models, and datasets used. Track license terms that may restrict commercial use or require disclosure of derivative works.\n\n**CM-11 — User-Installed Software**\nControls unauthorized software. For AI systems: prevent data scientists and engineers from installing unapproved AI frameworks, libraries, or models on production systems.\n\n**GOVERN Assess Evaluation:** CM family evaluated via model registry review, change control log analysis, and AI component inventory verification.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-29e4be67bb64@e15901b9447103a5","id":"GUIDE-NIST-800-53-29e4be67bb64","version":"e15901b9447103a5","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Assess — 800-53 Evaluation Methodology / Rapid Assess (AI-Focused Subset)","statement":"Evaluates the 11 AI-relevant control families with a focused subset of ~40 high-priority controls. Produces:\n- Per-family compliance score\n- Critical gap identification\n- Priority remediation recommendations\n- ATO readiness indicator\n\nTimeframe: 2–4 hours with complete documentation input","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-2eebb65a40bd@499d3b7dcf89a257","id":"GUIDE-NIST-800-53-2eebb65a40bd","version":"499d3b7dcf89a257","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"ATO Package Requirements for AI Systems / Standard ATO Components","statement":"- System Security Plan (SSP) — documents implementation of all applicable 800-53 controls\n- Security Assessment Report (SAR) — results of independent control assessment\n- Plan of Action and Milestones (POA&M) — tracks identified weaknesses and remediation\n- Continuous Monitoring Plan — ongoing monitoring strategy and metrics\n- Privacy Impact Assessment (PIA) — if the system processes PII","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-31beb12f9cd8@37949cb5e01270cd","id":"GUIDE-NIST-800-53-31beb12f9cd8","version":"37949cb5e01270cd","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Assess — 800-53 Evaluation Methodology / Continuous Assess (Ongoing Monitoring)","statement":"Maps to CA-7 (Continuous Monitoring) requirements. Monitors key controls for AI systems:\n- AU controls: log completeness, retention compliance\n- CM controls: model version drift, unauthorized changes\n- IR controls: incident detection coverage, response SLA\n- SI controls: model integrity, input validation, output monitoring\n\nGenerates monthly compliance posture reports and alerts on control degradation.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-418994068646@d2ec7e502a31b081","id":"GUIDE-NIST-800-53-418994068646","version":"d2ec7e502a31b081","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant Control Families — Detailed Coverage / IR — Incident Response","statement":"**Applicability to AI Governance:** AI incidents require specialized response procedures. Traditional incident response may not address AI-specific scenarios: bias-induced harm at scale, adversarial manipulation of AI decisions, data poisoning discovery, or large-scale confabulation events.\n\n**AI-Relevant Controls:**\n\n**IR-1 — Incident Response Policy and Procedures**\nRequires documented IR policy. For AI systems: IR policy must explicitly address AI incident types and response procedures.\n\n**IR-2 — Incident Response Training**\nRequires training on incident response. For AI systems: training must cover AI-specific incident scenarios: how to recognize bias-related harms, how to respond to adversarial attacks, when to suspend an AI system, and how to notify affected users.\n\n**IR-3 — Incident Response Testing**\nRequires testing of incident response capability. For AI systems: tabletop exercises should include AI incident scenarios — bias discovery, model poisoning, hallucination causing harm, AI system outage during critical operations.\n\n**IR-4 — Incident Handling**\nRequires incident handling capability. For AI systems: incident handling procedures must include:\n- Detection criteria for AI incidents (performance degradation thresholds, bias metric breach, anomalous output volume, user harm reports)\n- Containment options (suspend specific model endpoints, roll back to prior model version, enable human override, reduce inference rate)\n- Eradication steps (identify root cause — training data issue, model issue, adversarial input, infrastructure issue)\n- Recovery steps (revalidate model before restoring service, notify affected users, document lessons learned)\n- Post-incident review requirements\n\n**IR-5 — Incident Monitoring**\nRequires incident tracking. For AI systems: track AI incidents in the incident tracking system with AI-specific fields (model version, affected use case, number of users/decisions affected, harm category).\n\n**IR-6 — Incident Reporting**\nRequires incident reporting. For AI systems: define thresholds for external notification of AI incidents (e.g., EU AI Act Article 62 requires notification of serious incidents for high-risk AI systems within 15 days of becoming aware). Define internal reporting escalation paths.\n\n**IR-7 — Incident Response Assistance**\nRequires access to incident response assistance. For AI systems: identify subject matter experts for AI incident types (ML engineers for model issues, data scientists for bias, security team for adversarial attacks, legal for regulatory notification).\n\n**IR-8 — Incident Response Plan**\nRequires a documented incident response plan. For AI systems: the IR plan must include an AI incident annex covering AI-specific scenarios, containment options, rollback procedures, and notification requirements.\n\n**GOVERN Assess Evaluation:** IR family evaluated via IR plan review, AI incident scenario coverage, and incident response test records.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-6f01a27d6a6f@d4b53e1b497c487b","id":"GUIDE-NIST-800-53-6f01a27d6a6f","version":"d4b53e1b497c487b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"What NIST 800-53 Is","statement":"NIST Special Publication 800-53 Rev 5 establishes the catalog of security and privacy controls for federal information systems and organizations. It is the definitive control library for U.S. federal agency security programs and serves as the basis for FedRAMP, FISMA compliance, and Authority to Operate (ATO) packages.\n\nRev 5 (2020) is the most significant revision since the publication's inception. Key changes relevant to AI governance:\n- Privacy controls integrated directly into the catalog (no longer a separate appendix)\n- Supply chain risk management elevated to a standalone family (SR)\n- Increased emphasis on system development lifecycle (SDLC) security\n- Stronger controls for automated decision-making and system integrity\n- New program management controls for organizational risk governance\n\nFor AI systems deployed on or interfacing with federal systems, 800-53 controls apply to the underlying infrastructure and operations. The NIST AI RMF addresses AI-specific trustworthiness risks; 800-53 addresses system security and privacy controls. Together they constitute a complete AI governance framework for federal deployment.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-731b91db998a@462c5a0bf1798039","id":"GUIDE-NIST-800-53-731b91db998a","version":"462c5a0bf1798039","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 20 Control Families","statement":"| ID | Family Name | Description |\n|----|-------------|-------------|\n| AC | Access Control | User permissions, authentication, and authorization |\n| AT | Awareness and Training | Security training for personnel |\n| AU | Audit and Accountability | Logging, monitoring, and audit trails |\n| CA | Assessment, Authorization, and Monitoring | Continuous monitoring, system authorization |\n| CM | Configuration Management | Baseline configurations, change control |\n| CP | Contingency Planning | Backup, recovery, continuity |\n| IA | Identification and Authentication | Identity management, authentication mechanisms |\n| IR | Incident Response | Incident handling, reporting, and recovery |\n| MA | Maintenance | System maintenance procedures |\n| MP | Media Protection | Storage media control and disposal |\n| PE | Physical and Environmental Protection | Physical access, environmental hazards |\n| PL | Planning | Security and privacy planning |\n| PM | Program Management | Organization-level security program |\n| PS | Personnel Security | Background checks, termination procedures |\n| PT | PII Processing and Transparency | Privacy notice, consent, processing policies |\n| RA | Risk Assessment | Risk identification, assessment, and response |\n| SA | System and Services Acquisition | SDLC security, supply chain, vendor management |\n| SC | System and Communications Protection | Network architecture, data in transit, isolation |\n| SI | System and Information Integrity | Malware, software integrity, error handling |\n| SR | Supply Chain Risk Management | Third-party risk, component provenance |\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-73615bad7de2@156331b87924f9c8","id":"GUIDE-NIST-800-53-73615bad7de2","version":"156331b87924f9c8","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"FedRAMP Mapping / FedRAMP AI Annex (Emerging)","statement":"FedRAMP is developing AI-specific authorization guidance. GOVERN tracks FedRAMP AI Annex requirements and incorporates them into Assess workflows as they are published.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-736ea77000b8@fea1f874eab0216b","id":"GUIDE-NIST-800-53-736ea77000b8","version":"fea1f874eab0216b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant Control Families — Detailed Coverage / RA — Risk Assessment","statement":"**Applicability to AI Governance:** RA controls provide the systematic methodology for identifying, assessing, and responding to risks — directly applicable to AI system risk assessment and the MAP/MEASURE functions of the NIST AI RMF.\n\n**AI-Relevant Controls:**\n\n**RA-1 — Risk Assessment Policy and Procedures**\nRequires documented risk assessment policy. For AI systems: policy must include AI-specific risk assessment methodology, frequency of AI risk assessments, and required inputs (model documentation, TEVV results, bias assessments).\n\n**RA-2 — Security Categorization**\nRequires categorization of information systems by impact. For AI systems: categorize the AI system using FIPS 199 criteria (low/moderate/high for confidentiality, integrity, availability). Consider AI-specific impacts: a bias-laden AI system may have high integrity impact even if confidentiality and availability are low.\n\n**RA-3 — Risk Assessment**\nRequires formal risk assessment. For AI systems: risk assessment must include:\n- AI-specific threats (adversarial attacks, data poisoning, model theft, prompt injection)\n- AI-specific vulnerabilities (training data quality, model robustness, explainability gaps)\n- AI-specific impacts (discriminatory outcomes, decision errors at scale, privacy violations through model inversion)\n- AI-specific likelihood factors (system accessibility, attacker sophistication, data sensitivity)\n\n**RA-5 — Vulnerability Monitoring and Scanning**\nRequires vulnerability scanning. For AI systems: in addition to traditional vulnerability scanning, conduct AI-specific vulnerability assessments including adversarial robustness testing, bias audits, and model security evaluations.\n\n**RA-7 — Risk Response**\nRequires documented risk responses. For AI systems: document risk responses for AI-specific risks — model retraining to address bias, adversarial training to address robustness gaps, access control hardening for model theft risks, output filtering for harmful content risks.\n\n**RA-9 — Criticality Analysis**\nRequires analysis of AI component criticality. For AI systems: identify which AI components are most critical to organizational mission. Apply enhanced controls to critical AI components.\n\n**RA-10 — Threat Hunting**\nRequires proactive threat hunting. For AI systems: include AI-specific threat hunting — monitoring for signs of data poisoning, model theft attempts, adversarial probe patterns, and unauthorized model access.\n\n**GOVERN Assess Evaluation:** RA family evaluated via risk assessment documentation, AI threat model review, and vulnerability assessment scope verification.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-739d010f67db@67d0dc1f8ee0b454","id":"GUIDE-NIST-800-53-739d010f67db","version":"67d0dc1f8ee0b454","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Assess — 800-53 Evaluation Methodology / Deep Assess (Full 800-53 Coverage)","statement":"Evaluates all applicable 800-53 controls for an AI system, including the full 20 control families for systems requiring comprehensive ATO documentation. Produces:\n- Complete control-by-control assessment\n- Security Assessment Report (SAR) draft\n- Plan of Action and Milestones (POA&M)\n- ATO package readiness checklist\n\nTimeframe: 2–5 days with subject matter expert collaboration","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-8203737bcad6@b194315c5584aade","id":"GUIDE-NIST-800-53-8203737bcad6","version":"b194315c5584aade","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant Control Families — Detailed Coverage / PM — Program Management","statement":"**Applicability to AI Governance:** The PM family establishes the organizational infrastructure for security programs. For AI governance, PM controls ensure AI risk management is a sustained program, not a one-time assessment.\n\n**AI-Relevant Controls:**\n\n**PM-1 — Information Security Program Plan**\nRequires a documented security program plan. For AI systems: the program plan must address AI risk management as a component of the overall security program. Reference the organizational AI governance policy.\n\n**PM-2 — Information Security Program Leadership Roles**\nRequires leadership accountability. For AI systems: designate an AI governance lead (Chief AI Officer, AI Risk Officer, or equivalent) with clear authority and accountability for organizational AI risk management.\n\n**PM-9 — Risk Management Strategy**\nRequires a documented risk management strategy. For AI systems: the risk management strategy must include AI risks as a recognized risk category with defined risk tolerance, treatment approaches, and escalation criteria.\n\n**PM-10 — Authorization Process**\nRequires a process for authorizing systems. For AI systems: the authorization process must include AI-specific assessment requirements — AI RMF documentation, bias assessment, TEVV documentation, monitoring plan — as prerequisites for ATO.\n\n**PM-11 — Mission and Business Process Definition**\nRequires documentation of organizational missions. For AI systems: document how AI systems support organizational missions and business processes. Use this to determine AI system criticality and applicable security controls.\n\n**PM-28 — Risk Framing**\nRequires identification of key risk assumptions. For AI systems: document assumptions about AI system risk (e.g., assumed attack surface, assumed user population, assumed operating environment). Revisit assumptions when context changes.\n\n**PM-30 — Supply Chain Risk Management Strategy**\nRequires supply chain risk strategy. For AI systems: AI supply chain risks (third-party models, training datasets, AI frameworks, cloud AI services) must be addressed in the supply chain risk strategy.\n\n**PM-31 — Continuous Improvement**\nRequires continuous improvement processes. For AI systems: establish feedback loops from AI monitoring, incident response, and user feedback into AI system improvement. Track improvement outcomes.\n\n**GOVERN Assess Evaluation:** PM family evaluated via program documentation review, leadership accountability assessment, and risk management strategy review.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-9adfc07ac816@d28ae77fb99c199b","id":"GUIDE-NIST-800-53-9adfc07ac816","version":"d28ae77fb99c199b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant Control Families — Detailed Coverage / SI — System and Information Integrity","statement":"**Applicability to AI Governance:** SI controls protect the integrity of AI system software, data, and outputs. For AI, integrity extends beyond traditional software integrity to include model integrity (detecting poisoned or tampered models), data integrity (detecting corrupted training data), and output integrity (detecting hallucinations and adversarial outputs).\n\n**AI-Relevant Controls:**\n\n**SI-1 — System and Information Integrity Policy and Procedures**\nRequires documented integrity policy. For AI systems: integrity policy must address model artifact integrity verification, training data integrity controls, and output integrity monitoring.\n\n**SI-2 — Flaw Remediation**\nRequires patching and remediation of flaws. For AI systems: flaws include both traditional software vulnerabilities in AI infrastructure and AI-specific issues (discovered bias, adversarial vulnerabilities, performance degradation). Define remediation processes for AI-specific flaws.\n\n**SI-3 — Malicious Code Protection**\nRequires malware protection. For AI systems: AI development environments are targets for malware that steals model artifacts or poisons training data. Apply malware protection to AI development and serving infrastructure.\n\n**SI-4 — System Monitoring**\nRequires system monitoring. For AI systems: monitoring must include AI-specific indicators of compromise: anomalous inference patterns, model performance drift, unusual output distributions, signs of adversarial probing, data exfiltration through model inference (model inversion).\n\n**SI-5 — Security Alerts, Advisories, and Directives**\nRequires response to security alerts. For AI systems: subscribe to AI security vulnerability feeds. Track CVEs affecting AI frameworks (TensorFlow, PyTorch, Hugging Face). Respond to AI-specific security advisories.\n\n**SI-7 — Software, Firmware, and Information Integrity**\nRequires integrity verification of software and data. For AI systems:\n- Hash and sign model artifacts; verify integrity before deployment\n- Verify integrity of training datasets before training runs\n- Detect unauthorized modifications to AI system components\n- Use model provenance tracking to verify model origin\n\n**SI-8 — Spam and Phishing Protection**\nRequires anti-spam protection. For AI systems: AI systems that process email, documents, or user-submitted content must include input validation to prevent prompt injection via malicious content in processed data.\n\n**SI-10 — Information Input Validation**\nRequires validation of information inputs. For AI systems: validate inputs to AI inference APIs — length limits, content type validation, schema validation, and detection of adversarial inputs. Reject malformed or potentially adversarial inputs before they reach the model.\n\n**SI-12 — Information Management and Retention**\nRequires information management policies. For AI systems: define retention policies for AI training data, model artifacts, inference logs, and bias assessment records. Comply with applicable legal and regulatory retention requirements.\n\n**SI-14 — Non-Persistence**\nRequires non-persistence of certain data. For AI systems: AI systems that process PII or sensitive data should not persist sensitive inputs beyond what is required for the inference operation. Define data minimization policies for AI inference.\n\n**SI-19 — De-Identification**\nRequires de-identification of PII. For AI systems: de-identify training data containing PII before use in model training. Apply differential privacy techniques where de-identification is insufficient. Verify de-identification effectiveness.\n\n**SI-20 — Tainting**\nControls information tainting. For AI systems: track provenance of data that flows into AI training pipelines. Detect when tainted (compromised or low-quality) data contaminates training datasets.\n\n**GOVERN Assess Evaluation:** SI family evaluated via model integrity verification review, input validation assessment, monitoring coverage analysis, and output integrity control review.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-a7525c04851c@81f099eda58e210d","id":"GUIDE-NIST-800-53-a7525c04851c","version":"81f099eda58e210d","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"ATO Package Requirements for AI Systems / AI-Specific ATO Components","statement":"- AI Risk Management documentation per NIST AI RMF (GOVERN, MAP, MEASURE, MANAGE)\n- Model card or equivalent technical documentation\n- Bias assessment results covering protected demographic categories\n- Adversarial robustness testing results\n- TEVV documentation (test datasets, metrics, tools, results)\n- Explainability assessment for high-stakes decision AI systems\n- AI incident response procedures (IR annex)\n- Post-deployment monitoring plan with AI-specific metrics\n- Third-party AI component inventory and risk assessments\n- Training data provenance documentation","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-adb5566704f5@e729eb62a8aea3b5","id":"GUIDE-NIST-800-53-adb5566704f5","version":"e729eb62a8aea3b5","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant Control Families — Detailed Coverage / SC — System and Communications Protection","statement":"**Applicability to AI Governance:** SC controls protect data in transit and at rest — directly applicable to protecting AI training data, model artifacts, and inference payloads. AI systems often handle sensitive data; SC controls ensure that data is protected throughout the AI pipeline.\n\n**AI-Relevant Controls:**\n\n**SC-1 — System and Communications Protection Policy and Procedures**\nRequires documented communications protection policy. For AI systems: policy must address encryption of AI training data, model artifacts, and inference API communications.\n\n**SC-5 — Denial-of-Service Protection**\nRequires DoS protection. For AI systems: AI inference APIs are targets for abuse (computational DoS via complex queries, resource exhaustion via high-frequency requests). Implement rate limiting, query complexity limits, and abuse detection for AI inference endpoints.\n\n**SC-7 — Boundary Protection**\nRequires network boundary controls. For AI systems: AI inference services, model registries, and training infrastructure should be network-isolated. Control ingress and egress. Use API gateways for inference endpoint exposure.\n\n**SC-8 — Transmission Confidentiality and Integrity**\nRequires protection of transmitted information. For AI systems: encrypt all inference API communications (TLS 1.3 minimum). Protect training data pipelines with encryption in transit. Sign model artifact transfers to verify integrity.\n\n**SC-12 — Cryptographic Key Establishment and Management**\nRequires cryptographic key management. For AI systems: manage cryptographic keys used to sign model artifacts, encrypt training data, and authenticate AI service accounts. Use hardware security modules (HSMs) for high-value key material.\n\n**SC-13 — Cryptographic Protection**\nRequires approved cryptographic mechanisms. For AI systems: use NIST-approved algorithms for all AI system encryption. Consider post-quantum cryptography for long-lived model artifacts.\n\n**SC-28 — Protection of Information at Rest**\nRequires encryption of stored information. For AI systems: encrypt AI training datasets, model artifacts (weights, embeddings), and AI decision logs at rest. Define encryption key management for model storage.\n\n**SC-39 — Process Isolation**\nRequires process isolation. For AI systems: isolate AI inference processes from other system processes. Prevent inference workloads from accessing training data repositories, administrative interfaces, or other sensitive resources.\n\n**SC-45 — System Time Synchronization**\nRequires time synchronization. For AI systems: accurate timestamps are critical for AI audit logs, incident correlation, and regulatory compliance. Ensure AI system infrastructure uses synchronized time sources.\n\n**GOVERN Assess Evaluation:** SC family evaluated via network architecture review, encryption configuration assessment, and data protection control verification.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-b950af7c81af@c88f4ee8bb4dbfe5","id":"GUIDE-NIST-800-53-b950af7c81af","version":"c88f4ee8bb4dbfe5","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant Control Families — Detailed Coverage","statement":"---\n\n### AC — Access Control\n\n**Applicability to AI Governance:** AI systems require access control to protect models, training data, inference APIs, and decision outputs from unauthorized access. AI-assisted access decisions must themselves be governed.\n\n**AI-Relevant Controls:**\n\n**AC-1 — Access Control Policy and Procedures**\nRequires documented access control policy covering all system components. For AI systems: policy must explicitly address access to model weights, training data repositories, inference endpoints, and AI pipeline components.\n\n**AC-2 — Account Management**\nRequires lifecycle management of accounts with access to system resources. For AI systems: manage accounts for data scientists, ML engineers, inference API users, and automated pipeline service accounts. Monitor for unused accounts with access to model artifacts.\n\n**AC-3 — Access Enforcement**\nRequires enforcement of approved authorizations. For AI systems: enforce role-based access to training data (read vs. write), model artifacts (read vs. deploy), and inference APIs. Use attribute-based access control (ABAC) for fine-grained control over which users can query which AI models.\n\n**AC-4 — Information Flow Enforcement**\nControls information flow within and between systems. For AI systems: control data flows from sensitive source systems into AI training pipelines. Prevent unauthorized exfiltration of AI model outputs that may contain sensitive information (e.g., model inversion attacks, membership inference).\n\n**AC-6 — Least Privilege**\nRequires minimum necessary access. For AI systems: service accounts running AI inference should have only the permissions required for inference, not training or deployment. Data scientists should not have production deployment rights.\n\n**AC-17 — Remote Access**\nControls remote access to systems. For AI systems: remote access to AI training infrastructure, MLOps platforms, and model registries must be authenticated, encrypted, and logged.\n\n**AC-22 — Publicly Accessible Content**\nControls information posted to publicly accessible systems. For AI systems: verify that publicly accessible AI APIs do not expose sensitive training data or model internals. Validate that AI-generated content does not inadvertently disclose restricted information.\n\n**GOVERN Assess Evaluation:** AC family evaluated via infrastructure configuration review, access control matrix review, and API access pattern analysis.\n\n---\n\n### AU — Audit and Accountability\n\n**Applicability to AI Governance:** AI systems must log decisions, inputs, outputs, and model changes to support accountability, incident investigation, and regulatory compliance. AI decision logging is foundational to the EU AI Act and emerging AI transparency requirements.\n\n**AI-Relevant Controls:**\n\n**AU-1 — Audit and Accountability Policy and Procedures**\nRequires documented audit policy. For AI systems: audit policy must address what AI system events are logged (inference requests, decision outputs, model deployments, training runs, configuration changes) and how logs are protected.\n\n**AU-2 — Event Logging**\nDefines events to be logged. For AI systems, required events include:\n- Inference API calls (timestamp, user/system ID, input hash, output hash)\n- Model deployment events (which model version deployed by whom)\n- Training run initiation and completion\n- Access to training data repositories\n- Model configuration changes\n- Anomalous output events (outputs flagged by monitoring)\n- Human override of AI decisions\n\n**AU-3 — Content of Audit Records**\nDefines the content of audit log entries. For AI systems: logs must capture sufficient context to reconstruct the AI decision — model version, input parameters, output, confidence score, and the identity of the requesting user or system.\n\n**AU-6 — Audit Record Review, Analysis, and Reporting**\nRequires regular review of audit logs. For AI systems: periodic review of AI decision logs for anomalies, bias patterns, unusual access, and evidence of adversarial inputs.\n\n**AU-9 — Protection of Audit Information**\nPrevents unauthorized access to audit logs. For AI systems: AI decision logs must be write-protected and stored independently of the systems that generate them (defense against log tampering after adversarial incident).\n\n**AU-10 — Non-Repudiation**\nProvides evidence that actions cannot be denied. For AI systems: digital signing of AI inference requests and responses supports non-repudiation for high-stakes AI decisions (medical, financial, legal, regulatory).\n\n**AU-11 — Audit Record Retention**\nDefines retention periods. For AI systems: retain AI decision logs for the period required by applicable regulations. EU AI Act requires post-market monitoring records for 10 years for high-risk AI systems. Financial services AI decisions may require 5–7 year retention.\n\n**AU-12 — Audit Record Generation**\nRequires audit record generation capability. For AI systems: ensure every AI system component (inference API, model serving infrastructure, training pipeline) generates audit records that flow to the centralized audit repository.\n\n**AU-14 — Session Audit**\nRequires logging of session activity. For AI systems: log user sessions interacting with AI systems, capturing the sequence of AI queries and human actions taken on AI outputs.\n\n**GOVERN Assess Evaluation:** AU family evaluated via log completeness review, retention period verification, and AI decision log format assessment.\n\n---\n\n### CA — Assessment, Authorization, and Monitoring\n\n**Applicability to AI Governance:** AI systems deployed on federal infrastructure require authorization (ATO). CA controls govern the assessment process that supports authorization decisions and the continuous monitoring that maintains authorization.\n\n**AI-Relevant Controls:**\n\n**CA-1 — Assessment, Authorization, and Monitoring Policy and Procedures**\nRequires documented policy for system authorization. For AI systems: policy must address the AI-specific assessment activities required before authorization, including AI RMF MEASURE activities, bias assessments, and adversarial robustness testing.\n\n**CA-2 — Control Assessments**\nRequires regular assessment of security controls. For AI systems: control assessments must include AI-specific controls (model integrity, output monitoring, bias metrics) in addition to traditional security controls.\n\n**CA-3 — Information Exchange**\nControls connections between systems. For AI systems: document all API integrations between the AI system and other systems. Assess risk of each integration. Control data flows through formal interconnection agreements.\n\n**CA-5 — Plan of Action and Milestones (POA&M)**\nRequires tracking of identified security weaknesses. For AI systems: AI-specific findings from assessments (bias issues, adversarial vulnerabilities, explainability gaps) must be tracked in the POA&M with remediation milestones.\n\n**CA-6 — Authorization**\nRequires formal authorization before operation. For AI systems: ATO package for an AI system must include AI RMF documentation, bias assessment results, TEVV documentation, and monitoring plan in addition to standard 800-53 control documentation.\n\n**CA-7 — Continuous Monitoring**\nRequires ongoing monitoring of security controls. For AI systems: continuous monitoring program must include AI-specific metrics (model performance drift, bias metric trends, anomalous output rates, adversarial probe detection) alongside traditional security monitoring.\n\n**CA-8 — Penetration Testing**\nRequires periodic penetration testing. For AI systems: penetration testing scope must include AI-specific attack surfaces — prompt injection, model inversion, membership inference, adversarial examples, and model extraction attacks.\n\n**CA-9 — Internal System Connections**\nControls internal connections. For AI systems: document and assess internal connections between AI inference services, model registries, training pipelines, and data stores.\n\n**GOVERN Assess Evaluation:** CA family evaluated by reviewing ATO documentation, continuous monitoring plans, and penetration test scope coverage of AI attack surfaces.\n\n---\n\n### CM — Configuration Management\n\n**Applicability to AI Governance:** AI model version control is a direct application of configuration management. Controlling which model version is deployed, tracking changes, and maintaining a secure baseline are CM responsibilities extended to the AI domain.\n\n**AI-Relevant Controls:**\n\n**CM-1 — Configuration Management Policy and Procedures**\nRequires documented CM policy. For AI systems: CM policy must explicitly address model versioning, model registry governance, hyperparameter configuration control, and deployment pipeline security.\n\n**CM-2 — Baseline Configuration**\nRequires maintained baseline configurations. For AI systems: the baseline includes the model version (artifact hash), inference server configuration, input/output schema, performance benchmarks, and approved dependency versions. Any deviation from baseline requires change control.\n\n**CM-3 — Configuration Change Control**\nRequires change control process. For AI systems: any change to a deployed model (fine-tuning, RAG corpus update, prompt template change, system prompt modification, threshold change) requires a change control ticket, impact assessment, and authorization.\n\n**CM-4 — Impact Analyses**\nRequires analysis before changes are implemented. For AI systems: AI model update impact analysis must include bias re-assessment, performance regression testing, safety testing, and review of changes to output distribution.\n\n**CM-6 — Configuration Settings**\nRequires configuration of security settings. For AI systems: define and enforce configuration standards for AI serving infrastructure — disable debug endpoints, enforce output filtering, set rate limits, configure authentication on inference APIs.\n\n**CM-7 — Least Functionality**\nRequires minimum functionality. For AI systems: disable unused inference capabilities, model endpoints not in active use, and administrative interfaces. Apply principle of least functionality to AI system capabilities.\n\n**CM-8 — System Component Inventory**\nRequires inventory of system components. For AI systems: maintain an inventory that includes all AI models (with artifact hashes), model versions, training dataset versions, framework dependencies, and third-party AI components (APIs, SDKs, pre-trained models).\n\n**CM-10 — Software Usage Restrictions**\nControls software licensing. For AI systems: verify licensing for all AI frameworks, pre-trained models, and datasets used. Track license terms that may restrict commercial use or require disclosure of derivative works.\n\n**CM-11 — User-Installed Software**\nControls unauthorized software. For AI systems: prevent data scientists and engineers from installing unapproved AI frameworks, libraries, or models on production systems.\n\n**GOVERN Assess Evaluation:** CM family evaluated via model registry review, change control log analysis, and AI component inventory verification.\n\n---\n\n### IA — Identification and Authentication\n\n**Applicability to AI Governance:** AI systems themselves are principals in identity architectures. Service accounts, API keys, and automated pipeline identities require the same rigor as human identities.\n\n**AI-Relevant Controls:**\n\n**IA-1 — Identification and Authentication Policy and Procedures**\nRequires documented IA policy. For AI systems: policy must address authentication for human users of AI systems, authentication of AI service accounts, and authentication of AI API clients.\n\n**IA-2 — Identification and Authentication (Organizational Users)**\nRequires multi-factor authentication for users. For AI systems: MFA required for access to AI model registries, training platforms, MLOps dashboards, and inference API administrative interfaces.\n\n**IA-3 — Device Identification and Authentication**\nRequires device-level authentication. For AI systems: inference server instances, training workers, and pipeline automation agents must authenticate to the AI system infrastructure before receiving credentials or accessing model artifacts.\n\n**IA-4 — Identifier Management**\nManages identifiers for users and devices. For AI systems: assign unique identifiers to each AI model version, each training run, and each inference service instance. Use identifiers for audit trail traceability.\n\n**IA-5 — Authenticator Management**\nManages credentials. For AI systems: rotate API keys for AI inference endpoints regularly. Store AI system credentials in secrets management systems (not in code repositories or configuration files). Audit credential access.\n\n**IA-8 — Identification and Authentication (Non-Organizational Users)**\nAddresses external user authentication. For AI systems: users outside the organization accessing AI APIs (customers, partners) must be authenticated. Define authentication requirements in AI API access policies.\n\n**IA-9 — Service Identification and Authentication**\nRequires mutual authentication for services. For AI systems: AI microservices (inference, training, data pipelines) must mutually authenticate using service mesh identities or mTLS. Prevent rogue services from impersonating AI system components.\n\n**IA-10 — Adaptive Authentication**\nAllows risk-based authentication. For AI systems: consider step-up authentication for high-stakes AI API calls (e.g., AI-assisted financial transactions, medical AI recommendations, identity verification).\n\n**GOVERN Assess Evaluation:** IA family evaluated via authentication mechanism review, credential management policy assessment, and service account inventory.\n\n---\n\n### IR — Incident Response\n\n**Applicability to AI Governance:** AI incidents require specialized response procedures. Traditional incident response may not address AI-specific scenarios: bias-induced harm at scale, adversarial manipulation of AI decisions, data poisoning discovery, or large-scale confabulation events.\n\n**AI-Relevant Controls:**\n\n**IR-1 — Incident Response Policy and Procedures**\nRequires documented IR policy. For AI systems: IR policy must explicitly address AI incident types and response procedures.\n\n**IR-2 — Incident Response Training**\nRequires training on incident response. For AI systems: training must cover AI-specific incident scenarios: how to recognize bias-related harms, how to respond to adversarial attacks, when to suspend an AI system, and how to notify affected users.\n\n**IR-3 — Incident Response Testing**\nRequires testing of incident response capability. For AI systems: tabletop exercises should include AI incident scenarios — bias discovery, model poisoning, hallucination causing harm, AI system outage during critical operations.\n\n**IR-4 — Incident Handling**\nRequires incident handling capability. For AI systems: incident handling procedures must include:\n- Detection criteria for AI incidents (performance degradation thresholds, bias metric breach, anomalous output volume, user harm reports)\n- Containment options (suspend specific model endpoints, roll back to prior model version, enable human override, reduce inference rate)\n- Eradication steps (identify root cause — training data issue, model issue, adversarial input, infrastructure issue)\n- Recovery steps (revalidate model before restoring service, notify affected users, document lessons learned)\n- Post-incident review requirements\n\n**IR-5 — Incident Monitoring**\nRequires incident tracking. For AI systems: track AI incidents in the incident tracking system with AI-specific fields (model version, affected use case, number of users/decisions affected, harm category).\n\n**IR-6 — Incident Reporting**\nRequires incident reporting. For AI systems: define thresholds for external notification of AI incidents (e.g., EU AI Act Article 62 requires notification of serious incidents for high-risk AI systems within 15 days of becoming aware). Define internal reporting escalation paths.\n\n**IR-7 — Incident Response Assistance**\nRequires access to incident response assistance. For AI systems: identify subject matter experts for AI incident types (ML engineers for model issues, data scientists for bias, security team for adversarial attacks, legal for regulatory notification).\n\n**IR-8 — Incident Response Plan**\nRequires a documented incident response plan. For AI systems: the IR plan must include an AI incident annex covering AI-specific scenarios, containment options, rollback procedures, and notification requirements.\n\n**GOVERN Assess Evaluation:** IR family evaluated via IR plan review, AI incident scenario coverage, and incident response test records.\n\n---\n\n### PM — Program Management\n\n**Applicability to AI Governance:** The PM family establishes the organizational infrastructure for security programs. For AI governance, PM controls ensure AI risk management is a sustained program, not a one-time assessment.\n\n**AI-Relevant Controls:**\n\n**PM-1 — Information Security Program Plan**\nRequires a documented security program plan. For AI systems: the program plan must address AI risk management as a component of the overall security program. Reference the organizational AI governance policy.\n\n**PM-2 — Information Security Program Leadership Roles**\nRequires leadership accountability. For AI systems: designate an AI governance lead (Chief AI Officer, AI Risk Officer, or equivalent) with clear authority and accountability for organizational AI risk management.\n\n**PM-9 — Risk Management Strategy**\nRequires a documented risk management strategy. For AI systems: the risk management strategy must include AI risks as a recognized risk category with defined risk tolerance, treatment approaches, and escalation criteria.\n\n**PM-10 — Authorization Process**\nRequires a process for authorizing systems. For AI systems: the authorization process must include AI-specific assessment requirements — AI RMF documentation, bias assessment, TEVV documentation, monitoring plan — as prerequisites for ATO.\n\n**PM-11 — Mission and Business Process Definition**\nRequires documentation of organizational missions. For AI systems: document how AI systems support organizational missions and business processes. Use this to determine AI system criticality and applicable security controls.\n\n**PM-28 — Risk Framing**\nRequires identification of key risk assumptions. For AI systems: document assumptions about AI system risk (e.g., assumed attack surface, assumed user population, assumed operating environment). Revisit assumptions when context changes.\n\n**PM-30 — Supply Chain Risk Management Strategy**\nRequires supply chain risk strategy. For AI systems: AI supply chain risks (third-party models, training datasets, AI frameworks, cloud AI services) must be addressed in the supply chain risk strategy.\n\n**PM-31 — Continuous Improvement**\nRequires continuous improvement processes. For AI systems: establish feedback loops from AI monitoring, incident response, and user feedback into AI system improvement. Track improvement outcomes.\n\n**GOVERN Assess Evaluation:** PM family evaluated via program documentation review, leadership accountability assessment, and risk management strategy review.\n\n---\n\n### RA — Risk Assessment\n\n**Applicability to AI Governance:** RA controls provide the systematic methodology for identifying, assessing, and responding to risks — directly applicable to AI system risk assessment and the MAP/MEASURE functions of the NIST AI RMF.\n\n**AI-Relevant Controls:**\n\n**RA-1 — Risk Assessment Policy and Procedures**\nRequires documented risk assessment policy. For AI systems: policy must include AI-specific risk assessment methodology, frequency of AI risk assessments, and required inputs (model documentation, TEVV results, bias assessments).\n\n**RA-2 — Security Categorization**\nRequires categorization of information systems by impact. For AI systems: categorize the AI system using FIPS 199 criteria (low/moderate/high for confidentiality, integrity, availability). Consider AI-specific impacts: a bias-laden AI system may have high integrity impact even if confidentiality and availability are low.\n\n**RA-3 — Risk Assessment**\nRequires formal risk assessment. For AI systems: risk assessment must include:\n- AI-specific threats (adversarial attacks, data poisoning, model theft, prompt injection)\n- AI-specific vulnerabilities (training data quality, model robustness, explainability gaps)\n- AI-specific impacts (discriminatory outcomes, decision errors at scale, privacy violations through model inversion)\n- AI-specific likelihood factors (system accessibility, attacker sophistication, data sensitivity)\n\n**RA-5 — Vulnerability Monitoring and Scanning**\nRequires vulnerability scanning. For AI systems: in addition to traditional vulnerability scanning, conduct AI-specific vulnerability assessments including adversarial robustness testing, bias audits, and model security evaluations.\n\n**RA-7 — Risk Response**\nRequires documented risk responses. For AI systems: document risk responses for AI-specific risks — model retraining to address bias, adversarial training to address robustness gaps, access control hardening for model theft risks, output filtering for harmful content risks.\n\n**RA-9 — Criticality Analysis**\nRequires analysis of AI component criticality. For AI systems: identify which AI components are most critical to organizational mission. Apply enhanced controls to critical AI components.\n\n**RA-10 — Threat Hunting**\nRequires proactive threat hunting. For AI systems: include AI-specific threat hunting — monitoring for signs of data poisoning, model theft attempts, adversarial probe patterns, and unauthorized model access.\n\n**GOVERN Assess Evaluation:** RA family evaluated via risk assessment documentation, AI threat model review, and vulnerability assessment scope verification.\n\n---\n\n### SA — System and Services Acquisition\n\n**Applicability to AI Governance:** SA controls govern how organizations acquire AI systems and services, including third-party AI models, AI-as-a-Service platforms, and AI development tools. AI procurement governance is increasingly critical as organizations deploy AI from a complex ecosystem of vendors.\n\n**AI-Relevant Controls:**\n\n**SA-1 — System and Services Acquisition Policy and Procedures**\nRequires documented acquisition policy. For AI systems: acquisition policy must address AI-specific procurement requirements — vendor AI governance practices, model transparency documentation, bias testing evidence, security assessment requirements.\n\n**SA-3 — System Development Life Cycle**\nRequires SDLC security integration. For AI systems: the AI development lifecycle (data collection, model training, validation, deployment, monitoring) must integrate security and privacy at each stage. Align with ML-specific SDLC frameworks (MLOps, ModelOps).\n\n**SA-4 — Acquisition Process**\nRequires security requirements in acquisitions. For AI systems: include AI-specific security and governance requirements in all AI procurement contracts:\n- Model transparency and documentation requirements\n- Bias testing evidence requirements\n- Security assessment results\n- Data handling and privacy requirements\n- Incident response obligations\n- Access to model cards and technical documentation\n- Audit rights\n\n**SA-5 — System Documentation**\nRequires system documentation from vendors. For AI systems: require from AI vendors: model cards, data sheets, technical documentation of model architecture and training, known limitations, performance benchmarks, bias evaluation results.\n\n**SA-8 — Security and Privacy Engineering Principles**\nRequires security and privacy engineering. For AI systems: apply privacy-by-design to AI systems. Consider privacy-preserving ML techniques (differential privacy, federated learning) where applicable. Document privacy engineering decisions.\n\n**SA-9 — External System Services**\nControls external service dependencies. For AI systems: document all third-party AI services used (LLM APIs, computer vision APIs, speech recognition services). Assess risk of each dependency. Ensure continuity if third-party service is discontinued.\n\n**SA-10 — Developer Configuration Management**\nRequires developer CM practices. For AI systems: require from AI developers: model version control, reproducibility of training runs, documentation of training data provenance, and change tracking for model updates.\n\n**SA-11 — Developer Testing and Evaluation**\nRequires developer security testing. For AI systems: require from AI developers: evidence of security testing (adversarial robustness, model inversion resistance), bias testing across protected categories, and TEVV documentation.\n\n**SA-15 — Development Process, Standards, and Tools**\nRequires secure development practices. For AI systems: require AI development teams to use approved, version-controlled ML frameworks. Scan AI dependencies for vulnerabilities. Use secure ML development environments.\n\n**SA-16 — Developer-Provided Training**\nRequires developer training provision. For AI systems: require AI vendors to provide training on AI system limitations, appropriate use cases, and risk indicators operators should monitor.\n\n**SA-17 — Developer Security and Privacy Architecture**\nRequires architectural documentation from developers. For AI systems: require architectural documentation showing how AI system components are secured, how data flows are protected, and how privacy is maintained.\n\n**GOVERN Assess Evaluation:** SA family evaluated via procurement policy review, vendor contract analysis, and third-party AI service inventory assessment.\n\n---\n\n### SC — System and Communications Protection\n\n**Applicability to AI Governance:** SC controls protect data in transit and at rest — directly applicable to protecting AI training data, model artifacts, and inference payloads. AI systems often handle sensitive data; SC controls ensure that data is protected throughout the AI pipeline.\n\n**AI-Relevant Controls:**\n\n**SC-1 — System and Communications Protection Policy and Procedures**\nRequires documented communications protection policy. For AI systems: policy must address encryption of AI training data, model artifacts, and inference API communications.\n\n**SC-5 — Denial-of-Service Protection**\nRequires DoS protection. For AI systems: AI inference APIs are targets for abuse (computational DoS via complex queries, resource exhaustion via high-frequency requests). Implement rate limiting, query complexity limits, and abuse detection for AI inference endpoints.\n\n**SC-7 — Boundary Protection**\nRequires network boundary controls. For AI systems: AI inference services, model registries, and training infrastructure should be network-isolated. Control ingress and egress. Use API gateways for inference endpoint exposure.\n\n**SC-8 — Transmission Confidentiality and Integrity**\nRequires protection of transmitted information. For AI systems: encrypt all inference API communications (TLS 1.3 minimum). Protect training data pipelines with encryption in transit. Sign model artifact transfers to verify integrity.\n\n**SC-12 — Cryptographic Key Establishment and Management**\nRequires cryptographic key management. For AI systems: manage cryptographic keys used to sign model artifacts, encrypt training data, and authenticate AI service accounts. Use hardware security modules (HSMs) for high-value key material.\n\n**SC-13 — Cryptographic Protection**\nRequires approved cryptographic mechanisms. For AI systems: use NIST-approved algorithms for all AI system encryption. Consider post-quantum cryptography for long-lived model artifacts.\n\n**SC-28 — Protection of Information at Rest**\nRequires encryption of stored information. For AI systems: encrypt AI training datasets, model artifacts (weights, embeddings), and AI decision logs at rest. Define encryption key management for model storage.\n\n**SC-39 — Process Isolation**\nRequires process isolation. For AI systems: isolate AI inference processes from other system processes. Prevent inference workloads from accessing training data repositories, administrative interfaces, or other sensitive resources.\n\n**SC-45 — System Time Synchronization**\nRequires time synchronization. For AI systems: accurate timestamps are critical for AI audit logs, incident correlation, and regulatory compliance. Ensure AI system infrastructure uses synchronized time sources.\n\n**GOVERN Assess Evaluation:** SC family evaluated via network architecture review, encryption configuration assessment, and data protection control verification.\n\n---\n\n### SI — System and Information Integrity\n\n**Applicability to AI Governance:** SI controls protect the integrity of AI system software, data, and outputs. For AI, integrity extends beyond traditional software integrity to include model integrity (detecting poisoned or tampered models), data integrity (detecting corrupted training data), and output integrity (detecting hallucinations and adversarial outputs).\n\n**AI-Relevant Controls:**\n\n**SI-1 — System and Information Integrity Policy and Procedures**\nRequires documented integrity policy. For AI systems: integrity policy must address model artifact integrity verification, training data integrity controls, and output integrity monitoring.\n\n**SI-2 — Flaw Remediation**\nRequires patching and remediation of flaws. For AI systems: flaws include both traditional software vulnerabilities in AI infrastructure and AI-specific issues (discovered bias, adversarial vulnerabilities, performance degradation). Define remediation processes for AI-specific flaws.\n\n**SI-3 — Malicious Code Protection**\nRequires malware protection. For AI systems: AI development environments are targets for malware that steals model artifacts or poisons training data. Apply malware protection to AI development and serving infrastructure.\n\n**SI-4 — System Monitoring**\nRequires system monitoring. For AI systems: monitoring must include AI-specific indicators of compromise: anomalous inference patterns, model performance drift, unusual output distributions, signs of adversarial probing, data exfiltration through model inference (model inversion).\n\n**SI-5 — Security Alerts, Advisories, and Directives**\nRequires response to security alerts. For AI systems: subscribe to AI security vulnerability feeds. Track CVEs affecting AI frameworks (TensorFlow, PyTorch, Hugging Face). Respond to AI-specific security advisories.\n\n**SI-7 — Software, Firmware, and Information Integrity**\nRequires integrity verification of software and data. For AI systems:\n- Hash and sign model artifacts; verify integrity before deployment\n- Verify integrity of training datasets before training runs\n- Detect unauthorized modifications to AI system components\n- Use model provenance tracking to verify model origin\n\n**SI-8 — Spam and Phishing Protection**\nRequires anti-spam protection. For AI systems: AI systems that process email, documents, or user-submitted content must include input validation to prevent prompt injection via malicious content in processed data.\n\n**SI-10 — Information Input Validation**\nRequires validation of information inputs. For AI systems: validate inputs to AI inference APIs — length limits, content type validation, schema validation, and detection of adversarial inputs. Reject malformed or potentially adversarial inputs before they reach the model.\n\n**SI-12 — Information Management and Retention**\nRequires information management policies. For AI systems: define retention policies for AI training data, model artifacts, inference logs, and bias assessment records. Comply with applicable legal and regulatory retention requirements.\n\n**SI-14 — Non-Persistence**\nRequires non-persistence of certain data. For AI systems: AI systems that process PII or sensitive data should not persist sensitive inputs beyond what is required for the inference operation. Define data minimization policies for AI inference.\n\n**SI-19 — De-Identification**\nRequires de-identification of PII. For AI systems: de-identify training data containing PII before use in model training. Apply differential privacy techniques where de-identification is insufficient. Verify de-identification effectiveness.\n\n**SI-20 — Tainting**\nControls information tainting. For AI systems: track provenance of data that flows into AI training pipelines. Detect when tainted (compromised or low-quality) data contaminates training datasets.\n\n**GOVERN Assess Evaluation:** SI family evaluated via model integrity verification review, input validation assessment, monitoring coverage analysis, and output integrity control review.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-bec100c5792c@8cdde3f477e5d273","id":"GUIDE-NIST-800-53-bec100c5792c","version":"8cdde3f477e5d273","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"ATO Package Requirements for AI Systems / ATO Risk Acceptance Levels","statement":"| AI System Risk Level | Required ATO Type | Review Authority |\n|---------------------|-------------------|-----------------|\n| Low impact, low AI risk | Authority to Operate | System Owner |\n| Moderate impact or moderate AI risk | Authority to Operate | AO with ISSO |\n| High impact or high AI risk | Full ATO with AI addendum | AO + AI Risk Officer |\n| Critical infrastructure or law enforcement | Full ATO + enhanced AI review | CISO + AO + Legal |\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-c73acc1a14c9@6978decbe1821433","id":"GUIDE-NIST-800-53-c73acc1a14c9","version":"6978decbe1821433","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"FedRAMP Mapping / AI-Specific FedRAMP Documentation Requirements","statement":"**For AI SaaS providers seeking FedRAMP authorization:**\n- Document AI model training data handling in SSP Section 13 (Incident Response)\n- Address model update change management in CM-3 implementation\n- Describe AI-specific monitoring in CA-7 implementation statement\n- Document AI supply chain risks in SR family implementations\n\n**For agencies using FedRAMP-authorized AI services:**\n- Customer responsibility matrix must address AI-specific inherited vs. customer-controlled risks\n- Agencies must implement customer-responsible AI controls (input validation, output monitoring, access control to AI APIs)\n- Agency ATO must reference FedRAMP authorization of underlying AI service","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-d147bc7034d0@0523c2965273d51a","id":"GUIDE-NIST-800-53-d147bc7034d0","version":"0523c2965273d51a","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant Control Families — Detailed Coverage / CA — Assessment, Authorization, and Monitoring","statement":"**Applicability to AI Governance:** AI systems deployed on federal infrastructure require authorization (ATO). CA controls govern the assessment process that supports authorization decisions and the continuous monitoring that maintains authorization.\n\n**AI-Relevant Controls:**\n\n**CA-1 — Assessment, Authorization, and Monitoring Policy and Procedures**\nRequires documented policy for system authorization. For AI systems: policy must address the AI-specific assessment activities required before authorization, including AI RMF MEASURE activities, bias assessments, and adversarial robustness testing.\n\n**CA-2 — Control Assessments**\nRequires regular assessment of security controls. For AI systems: control assessments must include AI-specific controls (model integrity, output monitoring, bias metrics) in addition to traditional security controls.\n\n**CA-3 — Information Exchange**\nControls connections between systems. For AI systems: document all API integrations between the AI system and other systems. Assess risk of each integration. Control data flows through formal interconnection agreements.\n\n**CA-5 — Plan of Action and Milestones (POA&M)**\nRequires tracking of identified security weaknesses. For AI systems: AI-specific findings from assessments (bias issues, adversarial vulnerabilities, explainability gaps) must be tracked in the POA&M with remediation milestones.\n\n**CA-6 — Authorization**\nRequires formal authorization before operation. For AI systems: ATO package for an AI system must include AI RMF documentation, bias assessment results, TEVV documentation, and monitoring plan in addition to standard 800-53 control documentation.\n\n**CA-7 — Continuous Monitoring**\nRequires ongoing monitoring of security controls. For AI systems: continuous monitoring program must include AI-specific metrics (model performance drift, bias metric trends, anomalous output rates, adversarial probe detection) alongside traditional security monitoring.\n\n**CA-8 — Penetration Testing**\nRequires periodic penetration testing. For AI systems: penetration testing scope must include AI-specific attack surfaces — prompt injection, model inversion, membership inference, adversarial examples, and model extraction attacks.\n\n**CA-9 — Internal System Connections**\nControls internal connections. For AI systems: document and assess internal connections between AI inference services, model registries, training pipelines, and data stores.\n\n**GOVERN Assess Evaluation:** CA family evaluated by reviewing ATO documentation, continuous monitoring plans, and penetration test scope coverage of AI attack surfaces.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-e0409438abb1@a75885e36e0d7710","id":"GUIDE-NIST-800-53-e0409438abb1","version":"a75885e36e0d7710","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"FedRAMP Mapping","statement":"For cloud-hosted AI systems, FedRAMP authorization builds on 800-53 Rev 5. AI-specific FedRAMP considerations:\n\n### FedRAMP Baseline Control Sets\n\n| FedRAMP Baseline | 800-53 Controls | AI System Applicability |\n|-----------------|----------------|------------------------|\n| FedRAMP Low | ~125 controls | AI systems with low data sensitivity, non-critical use cases |\n| FedRAMP Moderate | ~325 controls | AI systems processing CUI, moderate-impact use cases |\n| FedRAMP High | ~421 controls | AI systems in law enforcement, national security, critical infrastructure |\n\n### AI-Specific FedRAMP Documentation Requirements\n\n**For AI SaaS providers seeking FedRAMP authorization:**\n- Document AI model training data handling in SSP Section 13 (Incident Response)\n- Address model update change management in CM-3 implementation\n- Describe AI-specific monitoring in CA-7 implementation statement\n- Document AI supply chain risks in SR family implementations\n\n**For agencies using FedRAMP-authorized AI services:**\n- Customer responsibility matrix must address AI-specific inherited vs. customer-controlled risks\n- Agencies must implement customer-responsible AI controls (input validation, output monitoring, access control to AI APIs)\n- Agency ATO must reference FedRAMP authorization of underlying AI service\n\n### FedRAMP AI Annex (Emerging)\n\nFedRAMP is developing AI-specific authorization guidance. GOVERN tracks FedRAMP AI Annex requirements and incorporates them into Assess workflows as they are published.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-e65249c4d2c1@7f6ba98d9cae3f50","id":"GUIDE-NIST-800-53-e65249c4d2c1","version":"7f6ba98d9cae3f50","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Cross-Framework Control Mapping","statement":"| 800-53 Control | NIST AI RMF | ISO 42001 | EU AI Act |\n|---------------|-------------|-----------|-----------|\n| AU-2, AU-3 — Event Logging | MS-3.3 | Clause 9.1 | Article 12 |\n| CA-2 — Control Assessments | MS-1.1, MS-2.1 | Clause 9.3 | Article 9 |\n| CA-7 — Continuous Monitoring | MS-3.3, MG-4.1 | Clause 9.1 | Article 61 |\n| CM-2, CM-3 — Baseline + Change Control | GV-1.5 | Clause 8.4 | Article 17 |\n| IR-4, IR-6 — Incident Handling + Reporting | MG-2.3 | Clause 10.2 | Article 62 |\n| PM-9 — Risk Management Strategy | GV-5.1 | Clause 6.1 | Article 9 |\n| RA-3 — Risk Assessment | MP-1.4, MP-1.5 | Clause 6.1 | Article 9 |\n| SA-4 — Acquisition Process | GV-1.6 | Clause 8.4 | Article 28 |\n| SI-7 — Software Integrity | MS-2.1 | Clause 8.4 | Article 15 |\n| SI-10 — Input Validation | MS-2.2 | Clause 8.3 | Article 15 |\n\n---\n\n*This document is maintained in GOVERN's Policy Engine as the NIST 800-53 Rev 5 framework template for AI governance assessments. Content is derived from NIST SP 800-53 Rev 5 (public domain). This document does not substitute for the full NIST SP 800-53 Rev 5 publication; consult the authoritative source for complete control requirements.*","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-ebbde2e3b2f5@797e5a166229d141","id":"GUIDE-NIST-800-53-ebbde2e3b2f5","version":"797e5a166229d141","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"ATO Package Requirements for AI Systems","statement":"An Authority to Operate (ATO) package for an AI system must include:\n\n### Standard ATO Components\n\n- System Security Plan (SSP) — documents implementation of all applicable 800-53 controls\n- Security Assessment Report (SAR) — results of independent control assessment\n- Plan of Action and Milestones (POA&M) — tracks identified weaknesses and remediation\n- Continuous Monitoring Plan — ongoing monitoring strategy and metrics\n- Privacy Impact Assessment (PIA) — if the system processes PII\n\n### AI-Specific ATO Components\n\n- AI Risk Management documentation per NIST AI RMF (GOVERN, MAP, MEASURE, MANAGE)\n- Model card or equivalent technical documentation\n- Bias assessment results covering protected demographic categories\n- Adversarial robustness testing results\n- TEVV documentation (test datasets, metrics, tools, results)\n- Explainability assessment for high-stakes decision AI systems\n- AI incident response procedures (IR annex)\n- Post-deployment monitoring plan with AI-specific metrics\n- Third-party AI component inventory and risk assessments\n- Training data provenance documentation\n\n### ATO Risk Acceptance Levels\n\n| AI System Risk Level | Required ATO Type | Review Authority |\n|---------------------|-------------------|-----------------|\n| Low impact, low AI risk | Authority to Operate | System Owner |\n| Moderate impact or moderate AI risk | Authority to Operate | AO with ISSO |\n| High impact or high AI risk | Full ATO with AI addendum | AO + AI Risk Officer |\n| Critical infrastructure or law enforcement | Full ATO + enhanced AI review | CISO + AO + Legal |\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-f0a601342e91@dcec9a029ab33a57","id":"GUIDE-NIST-800-53-f0a601342e91","version":"dcec9a029ab33a57","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"FedRAMP Mapping / FedRAMP Baseline Control Sets","statement":"| FedRAMP Baseline | 800-53 Controls | AI System Applicability |\n|-----------------|----------------|------------------------|\n| FedRAMP Low | ~125 controls | AI systems with low data sensitivity, non-critical use cases |\n| FedRAMP Moderate | ~325 controls | AI systems processing CUI, moderate-impact use cases |\n| FedRAMP High | ~421 controls | AI systems in law enforcement, national security, critical infrastructure |","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-f1486694983a@cb6c81d2063349cf","id":"GUIDE-NIST-800-53-f1486694983a","version":"cb6c81d2063349cf","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant Control Families — Detailed Coverage / SA — System and Services Acquisition","statement":"**Applicability to AI Governance:** SA controls govern how organizations acquire AI systems and services, including third-party AI models, AI-as-a-Service platforms, and AI development tools. AI procurement governance is increasingly critical as organizations deploy AI from a complex ecosystem of vendors.\n\n**AI-Relevant Controls:**\n\n**SA-1 — System and Services Acquisition Policy and Procedures**\nRequires documented acquisition policy. For AI systems: acquisition policy must address AI-specific procurement requirements — vendor AI governance practices, model transparency documentation, bias testing evidence, security assessment requirements.\n\n**SA-3 — System Development Life Cycle**\nRequires SDLC security integration. For AI systems: the AI development lifecycle (data collection, model training, validation, deployment, monitoring) must integrate security and privacy at each stage. Align with ML-specific SDLC frameworks (MLOps, ModelOps).\n\n**SA-4 — Acquisition Process**\nRequires security requirements in acquisitions. For AI systems: include AI-specific security and governance requirements in all AI procurement contracts:\n- Model transparency and documentation requirements\n- Bias testing evidence requirements\n- Security assessment results\n- Data handling and privacy requirements\n- Incident response obligations\n- Access to model cards and technical documentation\n- Audit rights\n\n**SA-5 — System Documentation**\nRequires system documentation from vendors. For AI systems: require from AI vendors: model cards, data sheets, technical documentation of model architecture and training, known limitations, performance benchmarks, bias evaluation results.\n\n**SA-8 — Security and Privacy Engineering Principles**\nRequires security and privacy engineering. For AI systems: apply privacy-by-design to AI systems. Consider privacy-preserving ML techniques (differential privacy, federated learning) where applicable. Document privacy engineering decisions.\n\n**SA-9 — External System Services**\nControls external service dependencies. For AI systems: document all third-party AI services used (LLM APIs, computer vision APIs, speech recognition services). Assess risk of each dependency. Ensure continuity if third-party service is discontinued.\n\n**SA-10 — Developer Configuration Management**\nRequires developer CM practices. For AI systems: require from AI developers: model version control, reproducibility of training runs, documentation of training data provenance, and change tracking for model updates.\n\n**SA-11 — Developer Testing and Evaluation**\nRequires developer security testing. For AI systems: require from AI developers: evidence of security testing (adversarial robustness, model inversion resistance), bias testing across protected categories, and TEVV documentation.\n\n**SA-15 — Development Process, Standards, and Tools**\nRequires secure development practices. For AI systems: require AI development teams to use approved, version-controlled ML frameworks. Scan AI dependencies for vulnerabilities. Use secure ML development environments.\n\n**SA-16 — Developer-Provided Training**\nRequires developer training provision. For AI systems: require AI vendors to provide training on AI system limitations, appropriate use cases, and risk indicators operators should monitor.\n\n**SA-17 — Developer Security and Privacy Architecture**\nRequires architectural documentation from developers. For AI systems: require architectural documentation showing how AI system components are secured, how data flows are protected, and how privacy is maintained.\n\n**GOVERN Assess Evaluation:** SA family evaluated via procurement policy review, vendor contract analysis, and third-party AI service inventory assessment.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-800-53-f2bf89da1da4@d5e73ec6aab7e575","id":"GUIDE-NIST-800-53-f2bf89da1da4","version":"d5e73ec6aab7e575","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"AI-Relevant Control Families — Detailed Coverage / AC — Access Control","statement":"**Applicability to AI Governance:** AI systems require access control to protect models, training data, inference APIs, and decision outputs from unauthorized access. AI-assisted access decisions must themselves be governed.\n\n**AI-Relevant Controls:**\n\n**AC-1 — Access Control Policy and Procedures**\nRequires documented access control policy covering all system components. For AI systems: policy must explicitly address access to model weights, training data repositories, inference endpoints, and AI pipeline components.\n\n**AC-2 — Account Management**\nRequires lifecycle management of accounts with access to system resources. For AI systems: manage accounts for data scientists, ML engineers, inference API users, and automated pipeline service accounts. Monitor for unused accounts with access to model artifacts.\n\n**AC-3 — Access Enforcement**\nRequires enforcement of approved authorizations. For AI systems: enforce role-based access to training data (read vs. write), model artifacts (read vs. deploy), and inference APIs. Use attribute-based access control (ABAC) for fine-grained control over which users can query which AI models.\n\n**AC-4 — Information Flow Enforcement**\nControls information flow within and between systems. For AI systems: control data flows from sensitive source systems into AI training pipelines. Prevent unauthorized exfiltration of AI model outputs that may contain sensitive information (e.g., model inversion attacks, membership inference).\n\n**AC-6 — Least Privilege**\nRequires minimum necessary access. For AI systems: service accounts running AI inference should have only the permissions required for inference, not training or deployment. Data scientists should not have production deployment rights.\n\n**AC-17 — Remote Access**\nControls remote access to systems. For AI systems: remote access to AI training infrastructure, MLOps platforms, and model registries must be authenticated, encrypted, and logged.\n\n**AC-22 — Publicly Accessible Content**\nControls information posted to publicly accessible systems. For AI systems: verify that publicly accessible AI APIs do not expose sensitive training data or model internals. Validate that AI-generated content does not inadvertently disclose restricted information.\n\n**GOVERN Assess Evaluation:** AC family evaluated via infrastructure configuration review, access control matrix review, and API access pattern analysis.\n\n---","family":"NIST-800-53","body":{"sourceFile":"POLICY(8).md","sourceFamily":"NIST-800-53","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-04c74e63063d@61c4203de98a0df6","id":"GUIDE-NIST-AI-RMF-04c74e63063d","version":"61c4203de98a0df6","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"How GOVERN Implements Each Function / GOVERN Function Implementation","statement":"| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| GV-1.1 — AI governance policies | Policy Engine — loads, versions, and tracks AI governance policies |\n| GV-1.5 — Ongoing monitoring | Continuous Monitoring Dashboard — tracks governance posture |\n| GV-1.6 — Third-party risk | Third-Party Assess Mode — vendor AI risk assessment workflow |\n| GV-2.1 — Roles and responsibilities | Accountability Ledger — role registry, RACI matrix |\n| GV-5.2 — Risk tolerance | Risk Tolerance Configuration — per-system tolerance thresholds |\n| GV-6.1 — Legal requirements | Regulatory Mapping Engine — jurisdiction inventory, regulation tracker |","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-062eb065e58e@6c463216a74b7cf1","id":"GUIDE-NIST-AI-RMF-062eb065e58e","version":"6c463216a74b7cf1","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 19 Categories and 72 Subcategories / GOVERN Categories and Subcategories","statement":"**GV-1: Policies, Processes, Procedures, and Practices**\n\nGV-1.1 — Organizational policies and practices are in place to plan, prioritize, govern, and monitor AI risk management activities.\n*Playbook:* Document an AI governance policy. Assign an AI risk owner. Define scope of covered AI systems. Establish a review cadence. Communicate the policy organization-wide.\n\nGV-1.2 — Organizational teams are committed to a culture that considers and communicates AI risks.\n*Playbook:* Executive messaging on responsible AI. Include AI risk in team onboarding. Hold periodic AI risk awareness sessions. Create channels for raising AI risk concerns.\n\nGV-1.3 — Organizational leadership takes responsibility for decisions about risks associated with AI system development and deployment.\n*Playbook:* Assign a named AI executive sponsor. Document leadership sign-off on high-risk AI decisions. Create escalation paths for unresolved AI risks.\n\nGV-1.4 — Organizational teams are committed to transparent organizational practices and policies.\n*Playbook:* Publish AI system disclosure policies. Define what AI use is disclosed to users. Maintain an internal inventory of AI systems.\n\nGV-1.5 — Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review.\n*Playbook:* Set a minimum annual review of AI governance practices. Define who owns each monitoring activity. Track metrics on governance effectiveness.\n\nGV-1.6 — Policies and procedures are in place for the organizational risk governance and oversight of AI systems developed, used, or acquired from third parties, and for risk management of AI-specific supply chain issues including third-party data and AI components.\n*Playbook:* Require AI risk documentation from AI vendors. Assess third-party AI models against the same criteria as internal models. Track AI components in the software supply chain.\n\n**GV-2: Accountability Structures**\n\nGV-2.1 — Roles and responsibilities and organizational accountabilities for personnel involved with the design, development, deployment, assessment and monitoring of AI systems are established.\n*Playbook:* Publish a RACI matrix for AI lifecycle roles. Define AI-specific responsibilities for existing roles (data scientists, engineers, product managers, legal, compliance, audit).\n\nGV-2.2 — The risk or legal review function is documented and accountable to senior leadership.\n*Playbook:* Establish AI legal/risk review function with direct reporting to senior leadership. Document review authority and scope.\n\nGV-2.3 — Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.\n*Playbook:* Document board-level or C-suite AI risk acknowledgments. Create board AI risk reporting cadence. Obtain leadership attestation for high-risk AI deployments.\n\n**GV-3: Workforce Diversity, Equity, Inclusion, and Accessibility**\n\nGV-3.1 — Organizational policies and practices are in place to foster a critical thinking culture.\n*Playbook:* Create a structured process for raising AI concerns. Ensure no retaliation for raising AI risks. Establish red-team or devil's advocate processes for high-risk AI decisions.\n\nGV-3.2 — Policies, practices, and mechanisms are in place for the training and certification of AI personnel.\n*Playbook:* Define AI literacy requirements by role. Provide AI ethics training. Track completion. Consider external certifications for key AI risk roles.\n\nGV-3.3 — Fairness and bias — human factors and diversity considerations exist in organizational policies and practices across the AI lifecycle.\n*Playbook:* Assess AI team demographic diversity. Document processes for incorporating diverse perspectives in AI system design reviews. Engage external reviewers from affected communities for high-impact systems.\n\n**GV-4: Organizational Teams Are Committed**\n\nGV-4.1 — Organizational policies and practices are in place to foster AI risk awareness and to create a culture of trustworthy, responsible AI.\n*Playbook:* Publish organizational AI ethics principles. Incorporate AI responsibility into performance expectations. Make AI risk training mandatory for AI-involved roles.\n\nGV-4.2 — Organizational teams document the risks and potential impacts of AI technologies applied to their functions and using their data.\n*Playbook:* Require each business unit using AI to maintain an AI risk register. Include AI risk documentation in project intake processes.\n\n**GV-5: Organizational Risk Strategy**\n\nGV-5.1 — Organizational risk policies include and are inclusive of AI risks.\n*Playbook:* Update enterprise risk management policies to explicitly include AI risks. Map AI risks to existing risk categories (operational, reputational, legal, financial).\n\nGV-5.2 — Risk tolerance for the development and deployment of AI systems — including organizational risk tolerance for known trustworthiness limitations of AI systems — is established, communicated, and regularly reviewed.\n*Playbook:* Define risk tolerance thresholds for each AI risk category. Document acceptable levels of AI system error rates, bias thresholds, and explainability requirements. Review tolerance annually or upon significant AI deployment changes.\n\n**GV-6: Policies and Procedures**\n\nGV-6.1 — Policies and procedures are in place for the identification and documentation of legal requirements related to AI use, including international requirements for AI systems used in multiple jurisdictions.\n*Playbook:* Conduct legal inventory of applicable AI regulations per jurisdiction. Map AI systems to applicable requirements (EU AI Act, CCPA, HIPAA, sector-specific rules). Update as regulations change.\n\nGV-6.2 — Organizational risk policies are inclusive of regulatory compliance and legal requirements.\n*Playbook:* Incorporate regulatory requirements into AI risk management policies. Assign compliance owners for each applicable regulation. Track compliance posture in governance reporting.\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-167ce49106e6@28a3786f2493069f","id":"GUIDE-NIST-AI-RMF-167ce49106e6","version":"28a3786f2493069f","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Relationship to Other Frameworks / Executive Order 14110 (October 2023)","statement":"EO 14110 directed federal agencies to:\n- Apply the NIST AI RMF to AI systems they use or develop\n- Report on high-impact AI systems to OMB\n- Conduct AI risk assessments before deploying high-impact AI\n- Designate Chief AI Officers with AI RMF responsibilities\n\nThe AI RMF is the primary technical standard for EO 14110 implementation.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-27ef85883347@cadbe8d331e0b436","id":"GUIDE-NIST-AI-RMF-27ef85883347","version":"cadbe8d331e0b436","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Relationship to Other Frameworks / ISO/IEC 42001:2023","statement":"ISO 42001 is the international AI management system standard. It shares significant structural overlap with NIST AI RMF:\n- ISO 42001 Clause 6 (Planning) aligns with MAP and parts of GOVERN\n- ISO 42001 Clause 8 (Operation) aligns with MEASURE\n- ISO 42001 Clause 9 (Performance evaluation) aligns with MEASURE and MANAGE\n- ISO 42001 Clause 10 (Improvement) aligns with MANAGE feedback loops\n\nGOVERN supports dual-framework assessment: a single assessment can produce evidence satisfying both NIST AI RMF and ISO 42001 requirements.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-369744f54a55@6203fd0a0fc4911b","id":"GUIDE-NIST-AI-RMF-369744f54a55","version":"6203fd0a0fc4911b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Relationship to Other Frameworks / NIST 800-53 Rev 5","statement":"For federal systems, NIST 800-53 controls apply to the AI system infrastructure. The AI RMF addresses AI-specific risks that 800-53 does not directly cover (bias, fairness, transparency, AI-specific adversarial attacks). Together, they provide comprehensive coverage: 800-53 for system security and privacy; AI RMF for AI-specific trustworthiness.\n\n---\n\n*This document is maintained in GOVERN's Policy Engine as the NIST AI RMF framework template. Content is derived from NIST AI 100-1 (public domain) and NIST AI 600-1 (public domain).*","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-40cd5d352cd9@9640d7036af8ac0b","id":"GUIDE-NIST-AI-RMF-40cd5d352cd9","version":"9640d7036af8ac0b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Relationship to Other Frameworks / EU AI Act (2024)","statement":"The EU AI Act imposes mandatory requirements for high-risk AI systems deployed in the EU. The AI RMF's voluntary structure maps onto EU AI Act mandatory requirements:\n- AI RMF GOVERN → EU AI Act Articles 9, 17 (risk management, quality management)\n- AI RMF MAP → EU AI Act Articles 10, 13 (data governance, transparency)\n- AI RMF MEASURE → EU AI Act Articles 15, 61 (accuracy, post-market monitoring)\n- AI RMF MANAGE → EU AI Act Articles 9, 62 (risk management, incident reporting)\n\nOrganizations subject to the EU AI Act can use NIST AI RMF compliance as the foundation for demonstrating EU AI Act compliance, supplemented by EU-specific mandatory requirements.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-4e4b91eb92c2@a36520d442951010","id":"GUIDE-NIST-AI-RMF-4e4b91eb92c2","version":"a36520d442951010","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 19 Categories and 72 Subcategories","statement":"### GOVERN Categories and Subcategories\n\n**GV-1: Policies, Processes, Procedures, and Practices**\n\nGV-1.1 — Organizational policies and practices are in place to plan, prioritize, govern, and monitor AI risk management activities.\n*Playbook:* Document an AI governance policy. Assign an AI risk owner. Define scope of covered AI systems. Establish a review cadence. Communicate the policy organization-wide.\n\nGV-1.2 — Organizational teams are committed to a culture that considers and communicates AI risks.\n*Playbook:* Executive messaging on responsible AI. Include AI risk in team onboarding. Hold periodic AI risk awareness sessions. Create channels for raising AI risk concerns.\n\nGV-1.3 — Organizational leadership takes responsibility for decisions about risks associated with AI system development and deployment.\n*Playbook:* Assign a named AI executive sponsor. Document leadership sign-off on high-risk AI decisions. Create escalation paths for unresolved AI risks.\n\nGV-1.4 — Organizational teams are committed to transparent organizational practices and policies.\n*Playbook:* Publish AI system disclosure policies. Define what AI use is disclosed to users. Maintain an internal inventory of AI systems.\n\nGV-1.5 — Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review.\n*Playbook:* Set a minimum annual review of AI governance practices. Define who owns each monitoring activity. Track metrics on governance effectiveness.\n\nGV-1.6 — Policies and procedures are in place for the organizational risk governance and oversight of AI systems developed, used, or acquired from third parties, and for risk management of AI-specific supply chain issues including third-party data and AI components.\n*Playbook:* Require AI risk documentation from AI vendors. Assess third-party AI models against the same criteria as internal models. Track AI components in the software supply chain.\n\n**GV-2: Accountability Structures**\n\nGV-2.1 — Roles and responsibilities and organizational accountabilities for personnel involved with the design, development, deployment, assessment and monitoring of AI systems are established.\n*Playbook:* Publish a RACI matrix for AI lifecycle roles. Define AI-specific responsibilities for existing roles (data scientists, engineers, product managers, legal, compliance, audit).\n\nGV-2.2 — The risk or legal review function is documented and accountable to senior leadership.\n*Playbook:* Establish AI legal/risk review function with direct reporting to senior leadership. Document review authority and scope.\n\nGV-2.3 — Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.\n*Playbook:* Document board-level or C-suite AI risk acknowledgments. Create board AI risk reporting cadence. Obtain leadership attestation for high-risk AI deployments.\n\n**GV-3: Workforce Diversity, Equity, Inclusion, and Accessibility**\n\nGV-3.1 — Organizational policies and practices are in place to foster a critical thinking culture.\n*Playbook:* Create a structured process for raising AI concerns. Ensure no retaliation for raising AI risks. Establish red-team or devil's advocate processes for high-risk AI decisions.\n\nGV-3.2 — Policies, practices, and mechanisms are in place for the training and certification of AI personnel.\n*Playbook:* Define AI literacy requirements by role. Provide AI ethics training. Track completion. Consider external certifications for key AI risk roles.\n\nGV-3.3 — Fairness and bias — human factors and diversity considerations exist in organizational policies and practices across the AI lifecycle.\n*Playbook:* Assess AI team demographic diversity. Document processes for incorporating diverse perspectives in AI system design reviews. Engage external reviewers from affected communities for high-impact systems.\n\n**GV-4: Organizational Teams Are Committed**\n\nGV-4.1 — Organizational policies and practices are in place to foster AI risk awareness and to create a culture of trustworthy, responsible AI.\n*Playbook:* Publish organizational AI ethics principles. Incorporate AI responsibility into performance expectations. Make AI risk training mandatory for AI-involved roles.\n\nGV-4.2 — Organizational teams document the risks and potential impacts of AI technologies applied to their functions and using their data.\n*Playbook:* Require each business unit using AI to maintain an AI risk register. Include AI risk documentation in project intake processes.\n\n**GV-5: Organizational Risk Strategy**\n\nGV-5.1 — Organizational risk policies include and are inclusive of AI risks.\n*Playbook:* Update enterprise risk management policies to explicitly include AI risks. Map AI risks to existing risk categories (operational, reputational, legal, financial).\n\nGV-5.2 — Risk tolerance for the development and deployment of AI systems — including organizational risk tolerance for known trustworthiness limitations of AI systems — is established, communicated, and regularly reviewed.\n*Playbook:* Define risk tolerance thresholds for each AI risk category. Document acceptable levels of AI system error rates, bias thresholds, and explainability requirements. Review tolerance annually or upon significant AI deployment changes.\n\n**GV-6: Policies and Procedures**\n\nGV-6.1 — Policies and procedures are in place for the identification and documentation of legal requirements related to AI use, including international requirements for AI systems used in multiple jurisdictions.\n*Playbook:* Conduct legal inventory of applicable AI regulations per jurisdiction. Map AI systems to applicable requirements (EU AI Act, CCPA, HIPAA, sector-specific rules). Update as regulations change.\n\nGV-6.2 — Organizational risk policies are inclusive of regulatory compliance and legal requirements.\n*Playbook:* Incorporate regulatory requirements into AI risk management policies. Assign compliance owners for each applicable regulation. Track compliance posture in governance reporting.\n\n---\n\n### MAP Categories and Subcategories\n\n**MP-1: Context Is Established**\n\nMP-1.1 — Intended purpose, potentially beneficial uses, context of use, and risks of AI systems are understood and documented.\n*Playbook:* Create an AI system fact sheet for every AI deployment. Document intended use cases, foreseeable misuse, affected populations, and deployment environment.\n\nMP-1.2 — Scientific findings, technical standards, and trustworthiness of AI systems are understood, documented, and communicated.\n*Playbook:* Produce or obtain model cards for AI models in use. Document training data sources, architecture, known limitations, and applicable standards.\n\nMP-1.3 — Potential benefits of intended AI system deployment — including financial, societal, and broadly beneficial uses — are examined and documented.\n*Playbook:* Document the anticipated benefits of the AI system. Include quantified estimates where possible. Consider benefits to all stakeholder groups.\n\nMP-1.4 — Risks or harms of deployed AI systems — and their potential consequences to individuals, groups, communities, organizations, and society — are examined and documented.\n*Playbook:* Conduct AI impact assessment before deployment. Identify affected populations. Document high-risk harm scenarios. Engage affected communities for high-impact systems.\n\nMP-1.5 — Likelihood and magnitude of each identified AI system risk or impact are estimated and documented.\n*Playbook:* Score each identified risk on likelihood and magnitude. Use a consistent scoring methodology. Document rationale for scores.\n\nMP-1.6 — Risks or harms from third-party use of the organization's data or AI systems, including data provenance, data quality, and supply chain risks, are documented.\n*Playbook:* Assess data provenance and quality for all training and inference data. Document third-party data use agreements. Evaluate AI supply chain risks.\n\n**MP-2: Scientific Basis of AI Risk**\n\nMP-2.1 — Scientific community norms for validating AI risks and potential impacts are followed.\n*Playbook:* Reference peer-reviewed methods for AI evaluation. Use standardized benchmarks where available. Document validation methodology and limitations.\n\nMP-2.2 — Risk classifications are defined by the organization and used in AI risk classification decisions.\n*Playbook:* Define a risk taxonomy with clear classification criteria. Apply consistently across AI systems. Document classification decisions with rationale.\n\nMP-2.3 — AI system risk and benefit analysis incorporates considerations of affected individuals and groups.\n*Playbook:* Disaggregate risk and benefit analysis by affected population. Identify groups at disproportionate risk. Engage stakeholder representation in analysis.\n\n**MP-3: AI Capabilities and Limitations**\n\nMP-3.1 — Potential impacts of bias are characterized in data, models, and downstream uses and impacts are documented.\n*Playbook:* Conduct bias analysis on training data and model outputs. Use established bias metrics (demographic parity, equalized odds, etc.). Document known bias characteristics and acceptable thresholds.\n\nMP-3.2 — Scientific methods — including those from risk sciences, harm sciences, and social sciences — are used to inform bias assessments and documentation.\n*Playbook:* Engage multidisciplinary expertise in bias assessments. Reference validated bias assessment methodologies. Document methodology choices and limitations.\n\nMP-3.3 — Processes for operator and user feedback about AI system performance and trustworthiness are established and integrated into AI system updates.\n*Playbook:* Establish feedback channels for operators and users. Define process for triaging and acting on feedback. Document feedback integration into model updates.\n\n**MP-4: Risks Are Prioritized**\n\nMP-4.1 — The organization's risk tolerance for the AI system under consideration is established, communicated, and incorporated into the risk identification and classification process.\n*Playbook:* Apply organizational risk tolerance thresholds at the system level. Document whether system risk level is within tolerance. Escalate systems outside tolerance before deployment.\n\nMP-4.2 — Risk levels of AI systems at deployment are documented per risk classification and tolerance levels.\n*Playbook:* Assign a risk rating to each AI system at deployment. Document the basis for the rating. Update ratings as system context changes.\n\n**MP-5: Organizational Risk Management**\n\nMP-5.1 — Likelihood of encountering AI risks given use of AI and organizational risk tolerances is determined.\n*Playbook:* Calculate exposure to AI risk across the AI portfolio. Consider frequency of AI use, affected populations, and deployment environment. Document exposure analysis.\n\nMP-5.2 — Organizations are transparent about known limitations and where knowledge is incomplete.\n*Playbook:* Publish limitations documentation for AI systems. Communicate limitations to operators and users. Acknowledge uncertainty in risk estimates.\n\nMP-5.3 — Organizational risk policies include and are inclusive of AI risks.\n*Playbook:* Verify AI risk is explicitly addressed in enterprise risk policies. Update policies as AI use evolves.\n\nMP-5.4 — Risk tolerance for the development and deployment of AI systems is established, communicated, and regularly reviewed.\n*Playbook:* Establish formal risk tolerance review cadence. Document tolerance levels and their basis. Communicate tolerance levels to all AI-involved teams.\n\nMP-5.5 — Practices and documentation establish how identified risks will be addressed and where they fall in the organization's risk management framework.\n*Playbook:* Document risk treatment methodology. Map AI risks to enterprise risk management processes. Ensure AI risks receive equivalent treatment as other enterprise risks.\n\n---\n\n### MEASURE Categories and Subcategories\n\n**MS-1: Risk Metrics and Methods**\n\nMS-1.1 — Approaches and metrics for measurement of AI risks and trustworthiness characteristics reflect deployment context and organizational risk tolerance.\n*Playbook:* Define metrics for each NIST AI trustworthiness dimension: accuracy, fairness, transparency, privacy, security, reliability. Calibrate metric thresholds to risk tolerance.\n\nMS-1.2 — Trustworthiness characteristics of AI systems are assessed independently and in the context of AI systems to which they may be connected.\n*Playbook:* Conduct standalone system assessments. Also assess AI systems in the context of their integrations and dependencies. Document interconnected system risks.\n\nMS-1.3 — Internal experts are consulted to assess AI risks.\n*Playbook:* Define which AI risk assessments require expert review. Maintain a list of qualified internal reviewers. Document expert review findings.\n\n**MS-2: Risk Analysis**\n\nMS-2.1 — Test sets, metrics, and details about the tools used during test, evaluation, validation, and verification (TEVV) are documented.\n*Playbook:* Document all test datasets, evaluation metrics, validation methods, and tools used in AI system assessment. Retain test artifacts. Track TEVV coverage.\n\nMS-2.2 — AI system trustworthiness characteristics are calibrated for risks of under- and over-reliance on AI systems.\n*Playbook:* Test for appropriate confidence calibration. Evaluate uncertainty quantification. Assess whether users appropriately rely on AI outputs in practice.\n\nMS-2.3 — AI system performance and trustworthiness characteristics are evaluated regularly against benchmarks.\n*Playbook:* Define performance benchmarks for each AI system. Establish evaluation cadence (minimum annually; more frequently for high-risk systems). Document benchmark results.\n\nMS-2.4 — The ability of humans to interpret AI system outputs when needed is evaluated on a regular basis.\n*Playbook:* Test explainability mechanisms with representative users. Measure whether explanations improve appropriate reliance. Document explainability evaluation results.\n\nMS-2.5 — Risk characteristics established in MAP are employed in the measurement and analysis of AI system risks and trustworthiness.\n*Playbook:* Verify traceability from MAP risk inventory to MEASURE evaluation plan. Ensure all identified risks have corresponding measurement activities.\n\nMS-2.6 — Risk or performance characteristics established in and of AI systems are verified with the relevant populations.\n*Playbook:* Conduct evaluation studies with representative samples of affected populations. Disaggregate results by demographic group. Document population-level validation findings.\n\n**MS-3: Performance Monitoring**\n\nMS-3.1 — Ongoing monitoring plans are in place to address the identified AI risks and trustworthiness characteristics of the AI system.\n*Playbook:* Document a monitoring plan for each deployed AI system. Define monitored metrics, monitoring frequency, alert thresholds, and escalation procedures.\n\nMS-3.2 — The risk or performance characteristics of the AI system to be deployed are examined and documented.\n*Playbook:* Complete pre-deployment performance review. Document performance against defined thresholds. Obtain approval before deployment.\n\nMS-3.3 — AI system risks and trustworthiness are measured in deployment and monitoring contexts.\n*Playbook:* Implement production monitoring for key metrics. Capture performance data continuously. Store monitoring data for review.\n\nMS-3.4 — Feedback processes for end users and impacted communities to report problems and provide feedback are established.\n*Playbook:* Create accessible feedback channels for end users. Establish triage process for reported issues. Close the loop by communicating actions taken.\n\n**MS-4: Feedback Integration**\n\nMS-4.1 — Measurement approaches for identifying AI risks are connected to organizational risk tolerance and relevant laws, regulations, and standards.\n*Playbook:* Map measurement methodologies to applicable regulatory requirements. Verify that measured thresholds satisfy legal requirements. Update measurement approaches as regulations change.\n\nMS-4.2 — Measurement results inform updates to the risk mapping and risk management approaches.\n*Playbook:* Establish a process for measurement findings to feed back into MAP risk classification and MG treatment plans. Document feedback loop. Track improvements resulting from measurement.\n\n---\n\n### MANAGE Categories and Subcategories\n\n**MG-1: Risk Response Plans**\n\nMG-1.1 — A set of risk treatment options (responses) are documented for AI risks including the avoidance, acceptance, transfer, and control of risks.\n*Playbook:* Define available risk treatment options. Document criteria for selecting each treatment type. Document selected treatment with rationale for each identified risk.\n\nMG-1.2 — Treatment of AI risks includes a determination of residual risks after the risk response plan has been implemented.\n*Playbook:* Assess residual risk after each treatment. Document residual risk level and acceptability. Obtain approval for deployment if residual risk is within tolerance.\n\nMG-1.3 — Responses to the AI risks deemed high priority are developed, planned, and documented.\n*Playbook:* Create expedited response planning process for high-priority risks. Define SLA for high-priority risk treatment. Track response implementation.\n\n**MG-2: Risk Response Execution**\n\nMG-2.1 — Resources required to manage AI risks are taken into account including the staff, budget, and compute required for implementation.\n*Playbook:* Document resource requirements for AI risk management activities. Include AI risk management in organizational budgeting. Track resource utilization.\n\nMG-2.2 — Mechanisms are in place and applied to sustain the value of deployed AI systems and to manage the risks of AI system decommissioning, including appropriate archiving of useful elements.\n*Playbook:* Document AI system lifecycle stages including decommissioning. Create decommissioning checklist. Archive model artifacts, documentation, and decision records before decommission.\n\nMG-2.3 — Procedures are followed to respond to and recover from a previously unknown risk.\n*Playbook:* Create AI incident response procedure. Include discovery, triage, containment, notification, and recovery steps. Test procedure periodically.\n\nMG-2.4 — Mechanisms are in place to allow personnel to report problems to management.\n*Playbook:* Establish internal reporting channels for AI risk findings. Protect reporters from retaliation. Define escalation process. Track report resolution.\n\n**MG-3: Risk Treatment Feedback**\n\nMG-3.1 — Risk treatment strategies and methods are documented, as are the reasons for the selection of risk treatment options.\n*Playbook:* Document each treatment decision with rationale. Record alternatives considered. Maintain treatment rationale for audit purposes.\n\nMG-3.2 — Treatment of AI risks includes a determination of residual risk after the risk response plan has been implemented.\n*Playbook:* Conduct post-treatment residual risk assessment. Document residual risk level. Verify residual risk is within organizational tolerance.\n\nMG-3.3 — Feedback processes are in place to inform updates to the risk mapping, risk analysis, risk treatment, and monitoring activities.\n*Playbook:* Define feedback loop from MANAGE findings to MAP and MEASURE. Review effectiveness of risk treatments periodically. Update MAP risk inventory based on treatment outcomes.\n\nMG-3.4 — Risk treatment plans for AI systems are maintained and updated regularly.\n*Playbook:* Schedule regular treatment plan reviews. Update plans when AI system context changes. Document plan revision history.\n\n**MG-4: Risk Communication**\n\nMG-4.1 — Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors across the AI lifecycle.\n*Playbook:* Activate monitoring plan at deployment. Capture user feedback and operational data. Review monitoring data on defined cadence.\n\nMG-4.2 — Measurable performance improvements or declines and other changes in deployed AI system trustworthiness are evaluated and documented.\n*Playbook:* Track performance trends over time. Document significant changes in AI system behavior. Evaluate whether changes require risk re-assessment.\n\nMG-4.3 — Feedback processes for improvement are followed for deployed AI systems.\n*Playbook:* Use monitoring and feedback data to drive AI system improvements. Document improvement actions taken. Track improvement outcomes.\n\nMG-4.4 — Organizational teams communicate with personnel to report problems and suggest opportunities for improvement across the AI lifecycle.\n*Playbook:* Create internal communication forums for AI risk findings. Include AI risk in team retrospectives and reviews. Reward problem identification and improvement suggestions.\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-4f8971da28d6@1fdab7ff5532c7e9","id":"GUIDE-NIST-AI-RMF-4f8971da28d6","version":"1fdab7ff5532c7e9","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 4 Core Functions / MEASURE","statement":"The MEASURE function provides methods to analyze, quantify, and track AI risks. MEASURE activities include: selecting appropriate metrics for trustworthiness characteristics; conducting test, evaluation, validation, and verification (TEVV); monitoring performance in deployment; and calibrating confidence in AI system outputs.\n\nMEASURE transforms the qualitative risk picture from MAP into quantified evidence that supports risk treatment decisions.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-54c30d9f2758@672e9717a620ec50","id":"GUIDE-NIST-AI-RMF-54c30d9f2758","version":"672e9717a620ec50","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"How GOVERN Implements Each Function / MEASURE Function Implementation","statement":"| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| MS-1.1 — Trustworthiness metrics | Metrics Library — pre-built metric templates per trustworthiness dimension |\n| MS-2.1 — TEVV documentation | TEVV Documentation Module — test artifact registry, coverage tracking |\n| MS-2.3 — Performance benchmarking | Benchmarking Scheduler — benchmark runs, result ledger, trend tracking |\n| MS-2.4 — Explainability evaluation | Explainability Assessment — interpretability testing workflow |\n| MS-3.1 — Monitoring plans | Monitoring Plan Builder — plan templates, monitoring schedule |\n| MS-3.3 — Deployment monitoring | Live Monitoring Dashboard — real-time metric tracking, alert engine |","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-67bf02f03c63@b71e7ae6744b87dd","id":"GUIDE-NIST-AI-RMF-67bf02f03c63","version":"b71e7ae6744b87dd","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 4 Core Functions / MANAGE","statement":"The MANAGE function defines how organizations respond to identified and measured risks. MANAGE activities include: developing risk treatment plans; allocating resources for risk response; implementing monitoring and feedback loops; communicating risk to stakeholders; and continuously improving risk management practices.\n\nMANAGE closes the loop — treatment decisions inform future MAP and MEASURE activities.\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-7c6db84cd8c4@0e9f2bee89aa5338","id":"GUIDE-NIST-AI-RMF-7c6db84cd8c4","version":"0e9f2bee89aa5338","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"What It Is","statement":"The NIST AI Risk Management Framework (AI RMF) is a voluntary framework developed by NIST to help organizations better manage risks to individuals, organizations, and society associated with the design, development, deployment, evaluation, and use of AI systems.\n\nThe AI RMF is structured around four core functions — GOVERN, MAP, MEASURE, MANAGE — and 19 categories with 72 subcategories. It is a living document designed to evolve with the AI field and applicable to any organization regardless of size, sector, or AI maturity level.\n\n**Publication lineage:**\n- NIST AI 100-1 (January 2023) — Core AI RMF\n- NIST AI 600-1 (July 2024) — Generative AI Profile (\"GenAI Profile\")\n- NIST CSWP 29 — AI RMF Playbook (companion resource)\n- NIST AI RMF Roadmap — Planned future publications including sector-specific profiles\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-85df6670bfba@311d05c17dd6514b","id":"GUIDE-NIST-AI-RMF-85df6670bfba","version":"311d05c17dd6514b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Key Profiles / Critical Infrastructure Profile","statement":"Being developed in collaboration with CISA and sector-specific agencies. Applies AI RMF in 16 critical infrastructure sectors (energy, water, transportation, healthcare, financial services, etc.). Key additions: sector-specific risk thresholds, mandatory MEASURE activities for critical safety functions, coordination requirements with sector regulators.\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-927be92340ef@f5ecae1e6f760bc7","id":"GUIDE-NIST-AI-RMF-927be92340ef","version":"f5ecae1e6f760bc7","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 19 Categories and 72 Subcategories / MAP Categories and Subcategories","statement":"**MP-1: Context Is Established**\n\nMP-1.1 — Intended purpose, potentially beneficial uses, context of use, and risks of AI systems are understood and documented.\n*Playbook:* Create an AI system fact sheet for every AI deployment. Document intended use cases, foreseeable misuse, affected populations, and deployment environment.\n\nMP-1.2 — Scientific findings, technical standards, and trustworthiness of AI systems are understood, documented, and communicated.\n*Playbook:* Produce or obtain model cards for AI models in use. Document training data sources, architecture, known limitations, and applicable standards.\n\nMP-1.3 — Potential benefits of intended AI system deployment — including financial, societal, and broadly beneficial uses — are examined and documented.\n*Playbook:* Document the anticipated benefits of the AI system. Include quantified estimates where possible. Consider benefits to all stakeholder groups.\n\nMP-1.4 — Risks or harms of deployed AI systems — and their potential consequences to individuals, groups, communities, organizations, and society — are examined and documented.\n*Playbook:* Conduct AI impact assessment before deployment. Identify affected populations. Document high-risk harm scenarios. Engage affected communities for high-impact systems.\n\nMP-1.5 — Likelihood and magnitude of each identified AI system risk or impact are estimated and documented.\n*Playbook:* Score each identified risk on likelihood and magnitude. Use a consistent scoring methodology. Document rationale for scores.\n\nMP-1.6 — Risks or harms from third-party use of the organization's data or AI systems, including data provenance, data quality, and supply chain risks, are documented.\n*Playbook:* Assess data provenance and quality for all training and inference data. Document third-party data use agreements. Evaluate AI supply chain risks.\n\n**MP-2: Scientific Basis of AI Risk**\n\nMP-2.1 — Scientific community norms for validating AI risks and potential impacts are followed.\n*Playbook:* Reference peer-reviewed methods for AI evaluation. Use standardized benchmarks where available. Document validation methodology and limitations.\n\nMP-2.2 — Risk classifications are defined by the organization and used in AI risk classification decisions.\n*Playbook:* Define a risk taxonomy with clear classification criteria. Apply consistently across AI systems. Document classification decisions with rationale.\n\nMP-2.3 — AI system risk and benefit analysis incorporates considerations of affected individuals and groups.\n*Playbook:* Disaggregate risk and benefit analysis by affected population. Identify groups at disproportionate risk. Engage stakeholder representation in analysis.\n\n**MP-3: AI Capabilities and Limitations**\n\nMP-3.1 — Potential impacts of bias are characterized in data, models, and downstream uses and impacts are documented.\n*Playbook:* Conduct bias analysis on training data and model outputs. Use established bias metrics (demographic parity, equalized odds, etc.). Document known bias characteristics and acceptable thresholds.\n\nMP-3.2 — Scientific methods — including those from risk sciences, harm sciences, and social sciences — are used to inform bias assessments and documentation.\n*Playbook:* Engage multidisciplinary expertise in bias assessments. Reference validated bias assessment methodologies. Document methodology choices and limitations.\n\nMP-3.3 — Processes for operator and user feedback about AI system performance and trustworthiness are established and integrated into AI system updates.\n*Playbook:* Establish feedback channels for operators and users. Define process for triaging and acting on feedback. Document feedback integration into model updates.\n\n**MP-4: Risks Are Prioritized**\n\nMP-4.1 — The organization's risk tolerance for the AI system under consideration is established, communicated, and incorporated into the risk identification and classification process.\n*Playbook:* Apply organizational risk tolerance thresholds at the system level. Document whether system risk level is within tolerance. Escalate systems outside tolerance before deployment.\n\nMP-4.2 — Risk levels of AI systems at deployment are documented per risk classification and tolerance levels.\n*Playbook:* Assign a risk rating to each AI system at deployment. Document the basis for the rating. Update ratings as system context changes.\n\n**MP-5: Organizational Risk Management**\n\nMP-5.1 — Likelihood of encountering AI risks given use of AI and organizational risk tolerances is determined.\n*Playbook:* Calculate exposure to AI risk across the AI portfolio. Consider frequency of AI use, affected populations, and deployment environment. Document exposure analysis.\n\nMP-5.2 — Organizations are transparent about known limitations and where knowledge is incomplete.\n*Playbook:* Publish limitations documentation for AI systems. Communicate limitations to operators and users. Acknowledge uncertainty in risk estimates.\n\nMP-5.3 — Organizational risk policies include and are inclusive of AI risks.\n*Playbook:* Verify AI risk is explicitly addressed in enterprise risk policies. Update policies as AI use evolves.\n\nMP-5.4 — Risk tolerance for the development and deployment of AI systems is established, communicated, and regularly reviewed.\n*Playbook:* Establish formal risk tolerance review cadence. Document tolerance levels and their basis. Communicate tolerance levels to all AI-involved teams.\n\nMP-5.5 — Practices and documentation establish how identified risks will be addressed and where they fall in the organization's risk management framework.\n*Playbook:* Document risk treatment methodology. Map AI risks to enterprise risk management processes. Ensure AI risks receive equivalent treatment as other enterprise risks.\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-a17b86a657d5@2a0a15cf90e53939","id":"GUIDE-NIST-AI-RMF-a17b86a657d5","version":"2a0a15cf90e53939","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"How GOVERN Implements Each Function","statement":"### GOVERN Function Implementation\n\n| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| GV-1.1 — AI governance policies | Policy Engine — loads, versions, and tracks AI governance policies |\n| GV-1.5 — Ongoing monitoring | Continuous Monitoring Dashboard — tracks governance posture |\n| GV-1.6 — Third-party risk | Third-Party Assess Mode — vendor AI risk assessment workflow |\n| GV-2.1 — Roles and responsibilities | Accountability Ledger — role registry, RACI matrix |\n| GV-5.2 — Risk tolerance | Risk Tolerance Configuration — per-system tolerance thresholds |\n| GV-6.1 — Legal requirements | Regulatory Mapping Engine — jurisdiction inventory, regulation tracker |\n\n### MAP Function Implementation\n\n| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| MP-1.1 — System purpose and context | System Inventory — AI system fact sheets, use case registry |\n| MP-1.2 — Model documentation | Model Card Integration — model card ingestion and display |\n| MP-1.4 — Risk and harm documentation | Harm Assessment Module — structured impact assessment workflow |\n| MP-1.5 — Risk likelihood and magnitude | Risk Scoring Engine — probability-impact matrix, risk scoring |\n| MP-2.2 — Risk classification | Risk Classification Workflow — taxonomy engine, classification records |\n| MP-3.1 — Bias characterization | Bias Assessment Module — bias analysis workflows, bias report generator |\n\n### MEASURE Function Implementation\n\n| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| MS-1.1 — Trustworthiness metrics | Metrics Library — pre-built metric templates per trustworthiness dimension |\n| MS-2.1 — TEVV documentation | TEVV Documentation Module — test artifact registry, coverage tracking |\n| MS-2.3 — Performance benchmarking | Benchmarking Scheduler — benchmark runs, result ledger, trend tracking |\n| MS-2.4 — Explainability evaluation | Explainability Assessment — interpretability testing workflow |\n| MS-3.1 — Monitoring plans | Monitoring Plan Builder — plan templates, monitoring schedule |\n| MS-3.3 — Deployment monitoring | Live Monitoring Dashboard — real-time metric tracking, alert engine |\n\n### MANAGE Function Implementation\n\n| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| MG-1.1 — Risk treatment options | Risk Treatment Library — treatment templates, selection workflow |\n| MG-1.3 — High-priority responses | Priority Risk Response Queue — SLA tracking, escalation workflows |\n| MG-2.3 — Incident response | Incident Response Playbook — structured response procedures |\n| MG-3.3 — Feedback loop | Cross-Function Feedback Loop — MAP/MEASURE/MANAGE integration |\n| MG-4.2 — Performance trends | Performance Trend Tracker — delta reporting, trend visualization |\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-a29c7c79013c@263671feea0b9021","id":"GUIDE-NIST-AI-RMF-a29c7c79013c","version":"263671feea0b9021","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 4 Core Functions / MAP","statement":"The MAP function frames the context for AI risk. Before risks can be measured or managed, they must be identified and categorized. MAP activities include: documenting the intended purpose of AI systems; identifying stakeholders and affected communities; classifying AI risks by likelihood and magnitude; and connecting AI system context to the organization's risk appetite.\n\nMAP is executed before and during AI system design, development, and deployment. It produces the risk inventory that MEASURE and MANAGE act on.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-a919355c4e09@0591523d8c0a9635","id":"GUIDE-NIST-AI-RMF-a919355c4e09","version":"0591523d8c0a9635","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 19 Categories and 72 Subcategories / MANAGE Categories and Subcategories","statement":"**MG-1: Risk Response Plans**\n\nMG-1.1 — A set of risk treatment options (responses) are documented for AI risks including the avoidance, acceptance, transfer, and control of risks.\n*Playbook:* Define available risk treatment options. Document criteria for selecting each treatment type. Document selected treatment with rationale for each identified risk.\n\nMG-1.2 — Treatment of AI risks includes a determination of residual risks after the risk response plan has been implemented.\n*Playbook:* Assess residual risk after each treatment. Document residual risk level and acceptability. Obtain approval for deployment if residual risk is within tolerance.\n\nMG-1.3 — Responses to the AI risks deemed high priority are developed, planned, and documented.\n*Playbook:* Create expedited response planning process for high-priority risks. Define SLA for high-priority risk treatment. Track response implementation.\n\n**MG-2: Risk Response Execution**\n\nMG-2.1 — Resources required to manage AI risks are taken into account including the staff, budget, and compute required for implementation.\n*Playbook:* Document resource requirements for AI risk management activities. Include AI risk management in organizational budgeting. Track resource utilization.\n\nMG-2.2 — Mechanisms are in place and applied to sustain the value of deployed AI systems and to manage the risks of AI system decommissioning, including appropriate archiving of useful elements.\n*Playbook:* Document AI system lifecycle stages including decommissioning. Create decommissioning checklist. Archive model artifacts, documentation, and decision records before decommission.\n\nMG-2.3 — Procedures are followed to respond to and recover from a previously unknown risk.\n*Playbook:* Create AI incident response procedure. Include discovery, triage, containment, notification, and recovery steps. Test procedure periodically.\n\nMG-2.4 — Mechanisms are in place to allow personnel to report problems to management.\n*Playbook:* Establish internal reporting channels for AI risk findings. Protect reporters from retaliation. Define escalation process. Track report resolution.\n\n**MG-3: Risk Treatment Feedback**\n\nMG-3.1 — Risk treatment strategies and methods are documented, as are the reasons for the selection of risk treatment options.\n*Playbook:* Document each treatment decision with rationale. Record alternatives considered. Maintain treatment rationale for audit purposes.\n\nMG-3.2 — Treatment of AI risks includes a determination of residual risk after the risk response plan has been implemented.\n*Playbook:* Conduct post-treatment residual risk assessment. Document residual risk level. Verify residual risk is within organizational tolerance.\n\nMG-3.3 — Feedback processes are in place to inform updates to the risk mapping, risk analysis, risk treatment, and monitoring activities.\n*Playbook:* Define feedback loop from MANAGE findings to MAP and MEASURE. Review effectiveness of risk treatments periodically. Update MAP risk inventory based on treatment outcomes.\n\nMG-3.4 — Risk treatment plans for AI systems are maintained and updated regularly.\n*Playbook:* Schedule regular treatment plan reviews. Update plans when AI system context changes. Document plan revision history.\n\n**MG-4: Risk Communication**\n\nMG-4.1 — Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors across the AI lifecycle.\n*Playbook:* Activate monitoring plan at deployment. Capture user feedback and operational data. Review monitoring data on defined cadence.\n\nMG-4.2 — Measurable performance improvements or declines and other changes in deployed AI system trustworthiness are evaluated and documented.\n*Playbook:* Track performance trends over time. Document significant changes in AI system behavior. Evaluate whether changes require risk re-assessment.\n\nMG-4.3 — Feedback processes for improvement are followed for deployed AI systems.\n*Playbook:* Use monitoring and feedback data to drive AI system improvements. Document improvement actions taken. Track improvement outcomes.\n\nMG-4.4 — Organizational teams communicate with personnel to report problems and suggest opportunities for improvement across the AI lifecycle.\n*Playbook:* Create internal communication forums for AI risk findings. Include AI risk in team retrospectives and reviews. Reward problem identification and improvement suggestions.\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-acae6214195c@e9cd01e808172860","id":"GUIDE-NIST-AI-RMF-acae6214195c","version":"e9cd01e808172860","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"How GOVERN Implements Each Function / MANAGE Function Implementation","statement":"| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| MG-1.1 — Risk treatment options | Risk Treatment Library — treatment templates, selection workflow |\n| MG-1.3 — High-priority responses | Priority Risk Response Queue — SLA tracking, escalation workflows |\n| MG-2.3 — Incident response | Incident Response Playbook — structured response procedures |\n| MG-3.3 — Feedback loop | Cross-Function Feedback Loop — MAP/MEASURE/MANAGE integration |\n| MG-4.2 — Performance trends | Performance Trend Tracker — delta reporting, trend visualization |\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-bd8b35579fc3@83814a74b2ae9d80","id":"GUIDE-NIST-AI-RMF-bd8b35579fc3","version":"83814a74b2ae9d80","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Relationship to Other Frameworks / NIST Cybersecurity Framework (CSF)","statement":"The AI RMF is designed as a companion to the NIST CSF. Organizations with mature CSF implementations can extend them to AI risk by mapping CSF functions (Identify, Protect, Detect, Respond, Recover) to AI RMF functions. GOVERN provides a unified assessment that covers both CSF and AI RMF.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-d1571dca21dd@3210336c4fe6b49d","id":"GUIDE-NIST-AI-RMF-d1571dca21dd","version":"3210336c4fe6b49d","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 4 Core Functions / GOVERN","statement":"The GOVERN function is foundational. It sets the organizational tone, policies, accountability structures, and culture that make all AI risk management possible. GOVERN is not a gate to pass through — it is the ongoing environment in which MAP, MEASURE, and MANAGE operate.\n\nGOVERN activities include: establishing AI risk policies; defining roles and responsibilities; setting risk tolerance; ensuring legal and regulatory compliance; building an AI-aware organizational culture; and providing oversight of AI lifecycle decisions.","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-dac8513ddd37@6b1f6e12d859d904","id":"GUIDE-NIST-AI-RMF-dac8513ddd37","version":"6b1f6e12d859d904","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Key Profiles / GenAI Profile (NIST AI 600-1, July 2024)","statement":"The Generative AI Profile addresses AI RMF implementation for generative AI systems, including large language models, image generation models, and multimodal systems. Key additions:\n\n**Unique risks addressed by the GenAI Profile:**\n- Confabulation (hallucination)\n- Data privacy and model inversion attacks\n- Homogenization of outputs and perspectives\n- Harmful content generation\n- Overreliance on AI-generated content\n- Data provenance and training data quality\n- Prompt injection and jailbreaking\n- Value alignment and emergent behaviors\n\n**GenAI-specific GOVERN additions:**\n- Policies for AI-generated content disclosure\n- Human oversight requirements for high-stakes GenAI use\n- Policies on AI-generated content in regulated domains (legal, medical, financial)\n\n**GenAI-specific MAP additions:**\n- Characterize confabulation risk per use case\n- Map training data sources and assess contamination risks\n- Identify downstream uses of AI-generated content\n\n**GenAI-specific MEASURE additions:**\n- Benchmark hallucination rates\n- Evaluate output diversity and homogenization\n- Test for harmful content generation across demographic groups\n- Measure human oversight effectiveness\n\n**GenAI-specific MANAGE additions:**\n- Response plans for confabulation-related harms\n- Procedures for managing viral harmful content\n- Human-in-the-loop protocols for high-stakes decisions","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-dc191148229a@5bd1e394c3c18f3f","id":"GUIDE-NIST-AI-RMF-dc191148229a","version":"5bd1e394c3c18f3f","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Who Must Comply","statement":"**Federal agencies:** Executive Order 14110 (Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, October 2023) requires federal agencies to apply the NIST AI RMF to AI systems they develop, use, or procure. Specific thresholds apply for high-impact AI systems.\n\n**Federal contractors:** Not formally mandated but increasingly referenced in federal AI procurement requirements, RFPs, and ATO packages.\n\n**Private sector:** Voluntary. However, the AI RMF is increasingly adopted as the de facto standard for enterprise AI governance, and alignment is expected under frameworks such as ISO 42001, EU AI Act, and sector-specific guidance (healthcare, financial services, critical infrastructure).\n\n**Critical infrastructure operators:** NIST is developing sector-specific profiles for critical infrastructure sectors. AI RMF alignment is expected in CISA guidance.\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-de65ea7212a1@259f65bf14c86181","id":"GUIDE-NIST-AI-RMF-de65ea7212a1","version":"259f65bf14c86181","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 4 Core Functions","statement":"### GOVERN\n\nThe GOVERN function is foundational. It sets the organizational tone, policies, accountability structures, and culture that make all AI risk management possible. GOVERN is not a gate to pass through — it is the ongoing environment in which MAP, MEASURE, and MANAGE operate.\n\nGOVERN activities include: establishing AI risk policies; defining roles and responsibilities; setting risk tolerance; ensuring legal and regulatory compliance; building an AI-aware organizational culture; and providing oversight of AI lifecycle decisions.\n\n### MAP\n\nThe MAP function frames the context for AI risk. Before risks can be measured or managed, they must be identified and categorized. MAP activities include: documenting the intended purpose of AI systems; identifying stakeholders and affected communities; classifying AI risks by likelihood and magnitude; and connecting AI system context to the organization's risk appetite.\n\nMAP is executed before and during AI system design, development, and deployment. It produces the risk inventory that MEASURE and MANAGE act on.\n\n### MEASURE\n\nThe MEASURE function provides methods to analyze, quantify, and track AI risks. MEASURE activities include: selecting appropriate metrics for trustworthiness characteristics; conducting test, evaluation, validation, and verification (TEVV); monitoring performance in deployment; and calibrating confidence in AI system outputs.\n\nMEASURE transforms the qualitative risk picture from MAP into quantified evidence that supports risk treatment decisions.\n\n### MANAGE\n\nThe MANAGE function defines how organizations respond to identified and measured risks. MANAGE activities include: developing risk treatment plans; allocating resources for risk response; implementing monitoring and feedback loops; communicating risk to stakeholders; and continuously improving risk management practices.\n\nMANAGE closes the loop — treatment decisions inform future MAP and MEASURE activities.\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-e318cd54a2b7@72f29d480d06f9c3","id":"GUIDE-NIST-AI-RMF-e318cd54a2b7","version":"72f29d480d06f9c3","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Key Profiles","statement":"### GenAI Profile (NIST AI 600-1, July 2024)\n\nThe Generative AI Profile addresses AI RMF implementation for generative AI systems, including large language models, image generation models, and multimodal systems. Key additions:\n\n**Unique risks addressed by the GenAI Profile:**\n- Confabulation (hallucination)\n- Data privacy and model inversion attacks\n- Homogenization of outputs and perspectives\n- Harmful content generation\n- Overreliance on AI-generated content\n- Data provenance and training data quality\n- Prompt injection and jailbreaking\n- Value alignment and emergent behaviors\n\n**GenAI-specific GOVERN additions:**\n- Policies for AI-generated content disclosure\n- Human oversight requirements for high-stakes GenAI use\n- Policies on AI-generated content in regulated domains (legal, medical, financial)\n\n**GenAI-specific MAP additions:**\n- Characterize confabulation risk per use case\n- Map training data sources and assess contamination risks\n- Identify downstream uses of AI-generated content\n\n**GenAI-specific MEASURE additions:**\n- Benchmark hallucination rates\n- Evaluate output diversity and homogenization\n- Test for harmful content generation across demographic groups\n- Measure human oversight effectiveness\n\n**GenAI-specific MANAGE additions:**\n- Response plans for confabulation-related harms\n- Procedures for managing viral harmful content\n- Human-in-the-loop protocols for high-stakes decisions\n\n### Critical Infrastructure Profile\n\nBeing developed in collaboration with CISA and sector-specific agencies. Applies AI RMF in 16 critical infrastructure sectors (energy, water, transportation, healthcare, financial services, etc.). Key additions: sector-specific risk thresholds, mandatory MEASURE activities for critical safety functions, coordination requirements with sector regulators.\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-e4cae8eec3a7@c129fa4bb56f9cbc","id":"GUIDE-NIST-AI-RMF-e4cae8eec3a7","version":"c129fa4bb56f9cbc","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 19 Categories and 72 Subcategories / MEASURE Categories and Subcategories","statement":"**MS-1: Risk Metrics and Methods**\n\nMS-1.1 — Approaches and metrics for measurement of AI risks and trustworthiness characteristics reflect deployment context and organizational risk tolerance.\n*Playbook:* Define metrics for each NIST AI trustworthiness dimension: accuracy, fairness, transparency, privacy, security, reliability. Calibrate metric thresholds to risk tolerance.\n\nMS-1.2 — Trustworthiness characteristics of AI systems are assessed independently and in the context of AI systems to which they may be connected.\n*Playbook:* Conduct standalone system assessments. Also assess AI systems in the context of their integrations and dependencies. Document interconnected system risks.\n\nMS-1.3 — Internal experts are consulted to assess AI risks.\n*Playbook:* Define which AI risk assessments require expert review. Maintain a list of qualified internal reviewers. Document expert review findings.\n\n**MS-2: Risk Analysis**\n\nMS-2.1 — Test sets, metrics, and details about the tools used during test, evaluation, validation, and verification (TEVV) are documented.\n*Playbook:* Document all test datasets, evaluation metrics, validation methods, and tools used in AI system assessment. Retain test artifacts. Track TEVV coverage.\n\nMS-2.2 — AI system trustworthiness characteristics are calibrated for risks of under- and over-reliance on AI systems.\n*Playbook:* Test for appropriate confidence calibration. Evaluate uncertainty quantification. Assess whether users appropriately rely on AI outputs in practice.\n\nMS-2.3 — AI system performance and trustworthiness characteristics are evaluated regularly against benchmarks.\n*Playbook:* Define performance benchmarks for each AI system. Establish evaluation cadence (minimum annually; more frequently for high-risk systems). Document benchmark results.\n\nMS-2.4 — The ability of humans to interpret AI system outputs when needed is evaluated on a regular basis.\n*Playbook:* Test explainability mechanisms with representative users. Measure whether explanations improve appropriate reliance. Document explainability evaluation results.\n\nMS-2.5 — Risk characteristics established in MAP are employed in the measurement and analysis of AI system risks and trustworthiness.\n*Playbook:* Verify traceability from MAP risk inventory to MEASURE evaluation plan. Ensure all identified risks have corresponding measurement activities.\n\nMS-2.6 — Risk or performance characteristics established in and of AI systems are verified with the relevant populations.\n*Playbook:* Conduct evaluation studies with representative samples of affected populations. Disaggregate results by demographic group. Document population-level validation findings.\n\n**MS-3: Performance Monitoring**\n\nMS-3.1 — Ongoing monitoring plans are in place to address the identified AI risks and trustworthiness characteristics of the AI system.\n*Playbook:* Document a monitoring plan for each deployed AI system. Define monitored metrics, monitoring frequency, alert thresholds, and escalation procedures.\n\nMS-3.2 — The risk or performance characteristics of the AI system to be deployed are examined and documented.\n*Playbook:* Complete pre-deployment performance review. Document performance against defined thresholds. Obtain approval before deployment.\n\nMS-3.3 — AI system risks and trustworthiness are measured in deployment and monitoring contexts.\n*Playbook:* Implement production monitoring for key metrics. Capture performance data continuously. Store monitoring data for review.\n\nMS-3.4 — Feedback processes for end users and impacted communities to report problems and provide feedback are established.\n*Playbook:* Create accessible feedback channels for end users. Establish triage process for reported issues. Close the loop by communicating actions taken.\n\n**MS-4: Feedback Integration**\n\nMS-4.1 — Measurement approaches for identifying AI risks are connected to organizational risk tolerance and relevant laws, regulations, and standards.\n*Playbook:* Map measurement methodologies to applicable regulatory requirements. Verify that measured thresholds satisfy legal requirements. Update measurement approaches as regulations change.\n\nMS-4.2 — Measurement results inform updates to the risk mapping and risk management approaches.\n*Playbook:* Establish a process for measurement findings to feed back into MAP risk classification and MG treatment plans. Document feedback loop. Track improvements resulting from measurement.\n\n---","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-e64fca448669@04bc7d28f3ce21ff","id":"GUIDE-NIST-AI-RMF-e64fca448669","version":"04bc7d28f3ce21ff","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"How GOVERN Implements Each Function / MAP Function Implementation","statement":"| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| MP-1.1 — System purpose and context | System Inventory — AI system fact sheets, use case registry |\n| MP-1.2 — Model documentation | Model Card Integration — model card ingestion and display |\n| MP-1.4 — Risk and harm documentation | Harm Assessment Module — structured impact assessment workflow |\n| MP-1.5 — Risk likelihood and magnitude | Risk Scoring Engine — probability-impact matrix, risk scoring |\n| MP-2.2 — Risk classification | Risk Classification Workflow — taxonomy engine, classification records |\n| MP-3.1 — Bias characterization | Bias Assessment Module — bias analysis workflows, bias report generator |","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-NIST-AI-RMF-f4955f27718e@0f8e4b82e29ad23a","id":"GUIDE-NIST-AI-RMF-f4955f27718e","version":"0f8e4b82e29ad23a","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Relationship to Other Frameworks","statement":"### ISO/IEC 42001:2023\n\nISO 42001 is the international AI management system standard. It shares significant structural overlap with NIST AI RMF:\n- ISO 42001 Clause 6 (Planning) aligns with MAP and parts of GOVERN\n- ISO 42001 Clause 8 (Operation) aligns with MEASURE\n- ISO 42001 Clause 9 (Performance evaluation) aligns with MEASURE and MANAGE\n- ISO 42001 Clause 10 (Improvement) aligns with MANAGE feedback loops\n\nGOVERN supports dual-framework assessment: a single assessment can produce evidence satisfying both NIST AI RMF and ISO 42001 requirements.\n\n### EU AI Act (2024)\n\nThe EU AI Act imposes mandatory requirements for high-risk AI systems deployed in the EU. The AI RMF's voluntary structure maps onto EU AI Act mandatory requirements:\n- AI RMF GOVERN → EU AI Act Articles 9, 17 (risk management, quality management)\n- AI RMF MAP → EU AI Act Articles 10, 13 (data governance, transparency)\n- AI RMF MEASURE → EU AI Act Articles 15, 61 (accuracy, post-market monitoring)\n- AI RMF MANAGE → EU AI Act Articles 9, 62 (risk management, incident reporting)\n\nOrganizations subject to the EU AI Act can use NIST AI RMF compliance as the foundation for demonstrating EU AI Act compliance, supplemented by EU-specific mandatory requirements.\n\n### Executive Order 14110 (October 2023)\n\nEO 14110 directed federal agencies to:\n- Apply the NIST AI RMF to AI systems they use or develop\n- Report on high-impact AI systems to OMB\n- Conduct AI risk assessments before deploying high-impact AI\n- Designate Chief AI Officers with AI RMF responsibilities\n\nThe AI RMF is the primary technical standard for EO 14110 implementation.\n\n### NIST Cybersecurity Framework (CSF)\n\nThe AI RMF is designed as a companion to the NIST CSF. Organizations with mature CSF implementations can extend them to AI risk by mapping CSF functions (Identify, Protect, Detect, Respond, Recover) to AI RMF functions. GOVERN provides a unified assessment that covers both CSF and AI RMF.\n\n### NIST 800-53 Rev 5\n\nFor federal systems, NIST 800-53 controls apply to the AI system infrastructure. The AI RMF addresses AI-specific risks that 800-53 does not directly cover (bias, fairness, transparency, AI-specific adversarial attacks). Together, they provide comprehensive coverage: 800-53 for system security and privacy; AI RMF for AI-specific trustworthiness.\n\n---\n\n*This document is maintained in GOVERN's Policy Engine as the NIST AI RMF framework template. Content is derived from NIST AI 100-1 (public domain) and NIST AI 600-1 (public domain).*","family":"NIST-AI-RMF","body":{"sourceFile":"POLICY(9).md","sourceFamily":"NIST-AI-RMF","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-06bab9e19df5@291a039c2afef20d","id":"GUIDE-OWASP-LLM-2025-06bab9e19df5","version":"291a039c2afef20d","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM02 — Sensitive Information Disclosure / Detection Methods","statement":"- Output scanning for PII patterns (SSN, credit card, email, phone formats)\n- System prompt similarity detection in outputs\n- Credential and secret pattern scanning in generated content\n- Session isolation verification\n- Regular red-team extraction attempts","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-07d274f56b42@170722f267b3b8ad","id":"GUIDE-OWASP-LLM-2025-07d274f56b42","version":"170722f267b3b8ad","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM07 — System Prompt Leakage","statement":"### Description\nUnauthorized disclosure of system prompt contents, revealing proprietary instructions, business logic, security constraints, or persona configuration. System prompts often contain sensitive intellectual property and security-relevant instructions whose disclosure enables more effective attacks.\n\n### Real-World Examples\n- Extraction of competitor AI assistant system prompts revealing proprietary persona configurations\n- System prompt disclosure revealing the exact safety constraint wording, enabling targeted bypass\n- Internal tool instructions revealed through model verbosity in error states\n- Multi-model routing logic exposed through system prompt extraction\n\n### Detection Methods\n- Output similarity comparison against system prompt contents\n- Red team extraction attempt battery\n- Model instruction-following robustness testing\n- Monitoring for verbatim system prompt reproduction\n\n### Mitigations\n- Instruct LLM explicitly not to reveal system prompt contents\n- Minimize sensitive content in system prompts (avoid embedding credentials or business secrets)\n- Test system prompt confidentiality before deployment\n- Use separate confidential and operational instruction layers\n- Monitor production outputs for system prompt signatures\n\n### GOVERN Policy Engine\nPolicy rules: flag outputs with high similarity to known system prompt contents, require system prompt confidentiality testing before deployment approval, block embedding of credentials or secrets in system prompts.\n\n### GOVERN Assess\nTests system prompt extraction resistance using known jailbreak and extraction techniques. Measures similarity between model outputs and system prompt contents. Flags inadequate confidentiality configurations.\n\n### GOVERN Probe\nRuntime computes cosine similarity between outputs and registered system prompt signatures. Triggers alert when similarity exceeds threshold. Logs all suspected leakage events.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-0b2e07fa8e29@831898f078d1b763","id":"GUIDE-OWASP-LLM-2025-0b2e07fa8e29","version":"831898f078d1b763","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM06 — Excessive Agency / Mitigations","statement":"- Minimal permission grants — only tools required for the specific task\n- Human-in-the-loop approval for irreversible or high-consequence actions\n- Rate limiting on automated action execution\n- Separate permission scopes for different agent roles\n- Audit logging of all agent-initiated actions","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-0c521534ee21@a623bd8664b932b1","id":"GUIDE-OWASP-LLM-2025-0c521534ee21","version":"a623bd8664b932b1","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM10 — Unbounded Consumption / Description","statement":"Excessive resource consumption by LLM applications enabling denial of service, cost amplification, or service degradation. Attackers can craft inputs that cause disproportionately expensive computation (context window exhaustion, recursive reasoning loops, excessive tool calls) or simply flood the API.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-0d13f6c26718@8ab4954acf5d683c","id":"GUIDE-OWASP-LLM-2025-0d13f6c26718","version":"8ab4954acf5d683c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM07 — System Prompt Leakage / GOVERN Assess","statement":"Tests system prompt extraction resistance using known jailbreak and extraction techniques. Measures similarity between model outputs and system prompt contents. Flags inadequate confidentiality configurations.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-1226515d46f4@35b5a5f74c340c4e","id":"GUIDE-OWASP-LLM-2025-1226515d46f4","version":"35b5a5f74c340c4e","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM05 — Improper Output Handling / GOVERN Probe","statement":"Runtime scans LLM outputs for injection patterns before downstream consumption. Validates structured outputs against schemas. Enforces sandboxing for code execution requests.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-1295be80c5ef@6dfe248c03858897","id":"GUIDE-OWASP-LLM-2025-1295be80c5ef","version":"6dfe248c03858897","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM09 — Misinformation / Mitigations","statement":"- Retrieval-augmented generation with authoritative sources\n- Citation requirements for factual claims\n- Confidence thresholding with fallback to human review\n- Domain expert review for regulated content (medical, legal, financial)\n- User disclosure of AI-generated content with accuracy caveats","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-12d7f20e97aa@fe801f8a2d7889c3","id":"GUIDE-OWASP-LLM-2025-12d7f20e97aa","version":"fe801f8a2d7889c3","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM06 — Excessive Agency / Description","statement":"LLM agents granted more permissions, capabilities, or autonomy than necessary for their intended function. When an over-privileged agent is compromised (via prompt injection or other attacks), the blast radius is proportional to its granted permissions. The principle of least privilege is the primary defense.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-157ee04104e7@15e9ae5b64736133","id":"GUIDE-OWASP-LLM-2025-157ee04104e7","version":"15e9ae5b64736133","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM05 — Improper Output Handling / Mitigations","statement":"- Treat all LLM outputs as untrusted user input\n- Context-sensitive output encoding (HTML encode for HTML context, parameterized queries for SQL)\n- Sandboxed execution environments for LLM-generated code\n- Schema validation of structured LLM outputs before use\n- Output length and format constraints","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-1e15f2a62cf2@8ff548031a0a226a","id":"GUIDE-OWASP-LLM-2025-1e15f2a62cf2","version":"8ff548031a0a226a","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM04 — Data and Model Poisoning / GOVERN Probe","statement":"Monitors knowledge base for unauthorized modifications. Detects behavioral drift indicating poisoning effects. Validates training data integrity before each fine-tuning cycle.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-25fa7b58c8a8@cf882bdb5202a8a5","id":"GUIDE-OWASP-LLM-2025-25fa7b58c8a8","version":"cf882bdb5202a8a5","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM01 — Prompt Injection","statement":"### Description\nAttackers craft inputs that override or subvert an LLM's intended instructions. Direct prompt injection manipulates the system prompt or user prompt directly. Indirect prompt injection embeds adversarial instructions in data the LLM processes — web pages, documents, emails, database records — causing the LLM to follow attacker instructions when reading that data.\n\n### Real-World Examples\n- Indirect injection via malicious web content causing an AI browsing assistant to exfiltrate user data\n- System prompt override through user message framing (\"Ignore previous instructions and...\")\n- Injection via retrieved RAG documents causing a customer service bot to provide false information\n- Jailbreak attacks using role-play framing to bypass safety systems\n- Multi-turn injection accumulating context across conversation turns\n\n### Detection Methods\n- Pattern matching on known injection templates (prefix-based, delimiter confusion, role-play framing)\n- Input/output semantic consistency checking\n- Instruction hierarchy enforcement with explicit delimiting\n- Sandboxed LLM as judge for injection detection\n- Canary tokens in system prompts to detect leakage\n\n### Mitigations\n- Strict input/output delimiting with clearly marked instruction boundaries\n- Least-privilege tool permissions for agentic systems\n- Human approval checkpoints for high-consequence actions\n- Separate trusted and untrusted data pipelines\n- Output validation before action execution\n\n### GOVERN Policy Engine\nPolicy rules: flag inputs containing injection pattern signatures, block system-prompt-override attempts, require human approval before agentic actions on externally-sourced data.\n\n### GOVERN Assess\nEvaluates LLM application prompt architecture for injection resistance. Runs injection attack battery (100+ templates) against the application. Scores injection resilience and flags structural vulnerabilities.\n\n### GOVERN Probe\nRuntime monitors input patterns for injection signatures. Detects prompt boundary violations and unexpected instruction overrides. Flags indirect injection attempts via content ingestion pipelines.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-30014e32669c@a999ad4b6bf365c4","id":"GUIDE-OWASP-LLM-2025-30014e32669c","version":"a999ad4b6bf365c4","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM01 — Prompt Injection / Description","statement":"Attackers craft inputs that override or subvert an LLM's intended instructions. Direct prompt injection manipulates the system prompt or user prompt directly. Indirect prompt injection embeds adversarial instructions in data the LLM processes — web pages, documents, emails, database records — causing the LLM to follow attacker instructions when reading that data.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-318712d2f340@5ea94e6248985221","id":"GUIDE-OWASP-LLM-2025-318712d2f340","version":"5ea94e6248985221","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM08 — Vector and Embedding Weaknesses","statement":"### Description\nVulnerabilities in the vector databases, embedding models, and retrieval systems that underpin RAG (Retrieval-Augmented Generation) architectures. Attackers can exploit vector search to inject adversarial documents, manipulate semantic similarity to retrieve inappropriate content, or attack the embedding model itself.\n\n### Real-World Examples\n- Adversarial documents crafted to be semantically similar to benign queries, poisoning RAG retrieval\n- Embedding model manipulation causing incorrect semantic similarity computation\n- Vector database access control gaps exposing documents from other tenants\n- Prompt injection payloads embedded in chunked document storage\n\n### Detection Methods\n- Adversarial retrieval testing with crafted attack documents\n- Document content scanning before vectorization\n- Multi-tenant isolation verification in vector databases\n- Embedding model robustness evaluation\n\n### Mitigations\n- Scan documents for injection payloads before vectorization and storage\n- Implement strong multi-tenant isolation in vector databases\n- Apply access controls at retrieval time, not just storage time\n- Use diverse retrieval strategies (not only nearest-neighbor) for resilience\n- Monitor retrieved document relevance distributions for anomalies\n\n### GOVERN Policy Engine\nPolicy rules: require document scanning before RAG ingestion, enforce multi-tenant isolation verification for shared vector stores, mandate access control audits for retrieval systems.\n\n### GOVERN Assess\nAudits RAG architecture for vector database security controls. Tests adversarial retrieval resistance. Verifies multi-tenant isolation. Evaluates embedding model robustness.\n\n### GOVERN Probe\nScans documents before vectorization for injection payloads. Monitors retrieval distributions for anomalous document surfacing. Validates access control enforcement at retrieval time.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-36078fd2244a@39741edb162d20ee","id":"GUIDE-OWASP-LLM-2025-36078fd2244a","version":"39741edb162d20ee","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM07 — System Prompt Leakage / GOVERN Probe","statement":"Runtime computes cosine similarity between outputs and registered system prompt signatures. Triggers alert when similarity exceeds threshold. Logs all suspected leakage events.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-389a2eb29de7@049169f27717f2a4","id":"GUIDE-OWASP-LLM-2025-389a2eb29de7","version":"049169f27717f2a4","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM06 — Excessive Agency / GOVERN Probe","statement":"Runtime logs all agent tool invocations. Detects anomalous action patterns. Enforces human approval gates for high-consequence actions. Monitors action rate against configured limits.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-3962733dc087@1f1f8deaf9fd59a4","id":"GUIDE-OWASP-LLM-2025-3962733dc087","version":"1f1f8deaf9fd59a4","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM05 — Improper Output Handling / GOVERN Assess","statement":"Audits LLM application code for improper output handling patterns. Tests output encoding and injection prevention. Evaluates code execution controls for agentic systems.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-3c955bf27a33@a31bfb4c6bdc407b","id":"GUIDE-OWASP-LLM-2025-3c955bf27a33","version":"a31bfb4c6bdc407b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM01 — Prompt Injection / GOVERN Probe","statement":"Runtime monitors input patterns for injection signatures. Detects prompt boundary violations and unexpected instruction overrides. Flags indirect injection attempts via content ingestion pipelines.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-3d7a231766b7@28796b76df479a62","id":"GUIDE-OWASP-LLM-2025-3d7a231766b7","version":"28796b76df479a62","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM10 — Unbounded Consumption","statement":"### Description\nExcessive resource consumption by LLM applications enabling denial of service, cost amplification, or service degradation. Attackers can craft inputs that cause disproportionately expensive computation (context window exhaustion, recursive reasoning loops, excessive tool calls) or simply flood the API.\n\n### Real-World Examples\n- \"Prompt flooding\" attacks exhausting context windows with irrelevant content to force expensive completions\n- Agentic loops triggered by crafted inputs causing recursive tool call chains\n- Context injection attacks maximizing token generation to amplify per-request cost\n- Jailbroken LLMs used to proxy expensive API calls at attacker direction\n\n### Detection Methods\n- Token consumption monitoring per request and per user\n- Tool call chain depth monitoring for agentic systems\n- Latency anomaly detection for unusually long completions\n- Cost per session tracking with alert thresholds\n\n### Mitigations\n- Per-user and per-session token budgets\n- Maximum context window size enforcement\n- Tool call depth limits for agentic systems\n- Rate limiting at API gateway and application layers\n- Cost circuit breakers triggering review above thresholds\n\n### GOVERN Policy Engine\nPolicy rules: enforce per-user token consumption limits, set maximum tool call chain depth (default: 10), require cost circuit breakers above configurable thresholds, mandate rate limiting at all API surfaces.\n\n### GOVERN Assess\nEvaluates LLM application resource consumption controls. Tests for DoS vulnerability via context flooding. Reviews agentic loop depth constraints. Assesses cost control architecture.\n\n### GOVERN Probe\nRuntime monitors token consumption, latency, and tool call chains per request. Triggers cost circuit breakers when thresholds exceeded. Detects anomalous consumption patterns consistent with abuse.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-3f43e0354a54@e448dff1d90ecf0d","id":"GUIDE-OWASP-LLM-2025-3f43e0354a54","version":"e448dff1d90ecf0d","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM03 — Supply Chain / Real-World Examples","statement":"- Backdoored pre-trained models distributed on public model hubs\n- Poisoned fine-tuning datasets from untrusted third-party sources\n- Compromised LLM inference libraries with embedded data exfiltration\n- Malicious LLM plugins with excessive permissions\n- Vulnerable vector databases in RAG pipelines enabling injection","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-44dedd4b1869@0586318b52800bf9","id":"GUIDE-OWASP-LLM-2025-44dedd4b1869","version":"0586318b52800bf9","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM06 — Excessive Agency / Real-World Examples","statement":"- Customer service LLM with write access to production databases enabling data destruction via prompt injection\n- AI coding assistant with full filesystem access exfiltrating sensitive files\n- LLM email assistant with send permissions used to execute spear-phishing campaigns\n- Agentic system with unrestricted web access performing unauthorized transactions","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-47c7b15c5e00@899675ebcaa91aad","id":"GUIDE-OWASP-LLM-2025-47c7b15c5e00","version":"899675ebcaa91aad","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM08 — Vector and Embedding Weaknesses / Detection Methods","statement":"- Adversarial retrieval testing with crafted attack documents\n- Document content scanning before vectorization\n- Multi-tenant isolation verification in vector databases\n- Embedding model robustness evaluation","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-4971f15eae25@9513c0449c91d085","id":"GUIDE-OWASP-LLM-2025-4971f15eae25","version":"9513c0449c91d085","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM09 — Misinformation / Description","statement":"LLMs generating plausible but factually incorrect, misleading, or fabricated content (hallucinations). Unlike other LLM vulnerabilities, misinformation risk is inherent to LLM architecture — models generate statistically plausible sequences regardless of factual grounding.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-4c849547fb93@2d8a428244f449c9","id":"GUIDE-OWASP-LLM-2025-4c849547fb93","version":"2d8a428244f449c9","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM06 — Excessive Agency","statement":"### Description\nLLM agents granted more permissions, capabilities, or autonomy than necessary for their intended function. When an over-privileged agent is compromised (via prompt injection or other attacks), the blast radius is proportional to its granted permissions. The principle of least privilege is the primary defense.\n\n### Real-World Examples\n- Customer service LLM with write access to production databases enabling data destruction via prompt injection\n- AI coding assistant with full filesystem access exfiltrating sensitive files\n- LLM email assistant with send permissions used to execute spear-phishing campaigns\n- Agentic system with unrestricted web access performing unauthorized transactions\n\n### Detection Methods\n- Permission audit of all LLM tool grants\n- Action logging for all tool invocations by LLM agents\n- Anomaly detection on action frequency and type\n- Human review requirements for high-consequence actions\n\n### Mitigations\n- Minimal permission grants — only tools required for the specific task\n- Human-in-the-loop approval for irreversible or high-consequence actions\n- Rate limiting on automated action execution\n- Separate permission scopes for different agent roles\n- Audit logging of all agent-initiated actions\n\n### GOVERN Policy Engine\nPolicy rules: block agent deployments with excessive tool permissions relative to stated purpose, require human approval for irreversible actions (delete, send, execute), enforce action rate limits per agent instance.\n\n### GOVERN Assess\nEvaluates all tool permission grants for each LLM agent. Maps permissions to stated use case and flags over-provisioning. Scores agency risk based on permission scope and action reversibility.\n\n### GOVERN Probe\nRuntime logs all agent tool invocations. Detects anomalous action patterns. Enforces human approval gates for high-consequence actions. Monitors action rate against configured limits.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-53a66f6341e1@6555f52e8452d880","id":"GUIDE-OWASP-LLM-2025-53a66f6341e1","version":"6555f52e8452d880","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM02 — Sensitive Information Disclosure","statement":"### Description\nLLMs may reveal confidential information including training data, system prompts, internal architecture details, proprietary business logic, or user data from other sessions. This occurs through direct extraction, contextual inference, or memorization leakage.\n\n### Real-World Examples\n- System prompt extraction revealing proprietary AI persona instructions\n- Training data reconstruction revealing PII from pre-training corpora\n- Cross-session data leakage in misconfigured context management\n- Internal API key or credential exposure through LLM tool call verbosity\n- Model revealing business logic embedded in its fine-tuning\n\n### Detection Methods\n- Output scanning for PII patterns (SSN, credit card, email, phone formats)\n- System prompt similarity detection in outputs\n- Credential and secret pattern scanning in generated content\n- Session isolation verification\n- Regular red-team extraction attempts\n\n### Mitigations\n- Mark system prompts as confidential and instruct LLM accordingly\n- Output filtering for PII and secret patterns before serving\n- Session isolation with strict context boundaries\n- Minimal system prompt footprint — avoid embedding sensitive business logic\n- Differential privacy in fine-tuning for sensitive domains\n\n### GOVERN Policy Engine\nPolicy rules: block outputs containing PII regex matches, reject responses that reproduce system prompt contents verbatim, require output sanitization for regulated data categories.\n\n### GOVERN Assess\nScans LLM application configuration for sensitive data exposure risks. Tests system prompt extraction resistance. Evaluates fine-tuned model memorization for PII from training data.\n\n### GOVERN Probe\nRuntime scans all LLM outputs for PII, credentials, and system prompt signatures before delivery. Logs disclosure attempts with full context for forensic review.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-5ac4070bfd22@12281d88dad3c76f","id":"GUIDE-OWASP-LLM-2025-5ac4070bfd22","version":"12281d88dad3c76f","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM08 — Vector and Embedding Weaknesses / Description","statement":"Vulnerabilities in the vector databases, embedding models, and retrieval systems that underpin RAG (Retrieval-Augmented Generation) architectures. Attackers can exploit vector search to inject adversarial documents, manipulate semantic similarity to retrieve inappropriate content, or attack the embedding model itself.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-5ccb3347058a@85fd67460a3650d7","id":"GUIDE-OWASP-LLM-2025-5ccb3347058a","version":"85fd67460a3650d7","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM06 — Excessive Agency / GOVERN Policy Engine","statement":"Policy rules: block agent deployments with excessive tool permissions relative to stated purpose, require human approval for irreversible actions (delete, send, execute), enforce action rate limits per agent instance.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-66eccc7d5a2e@427bd71f0b232d76","id":"GUIDE-OWASP-LLM-2025-66eccc7d5a2e","version":"427bd71f0b232d76","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM02 — Sensitive Information Disclosure / Real-World Examples","statement":"- System prompt extraction revealing proprietary AI persona instructions\n- Training data reconstruction revealing PII from pre-training corpora\n- Cross-session data leakage in misconfigured context management\n- Internal API key or credential exposure through LLM tool call verbosity\n- Model revealing business logic embedded in its fine-tuning","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-680e0fb740f6@cbb979e80f389d5d","id":"GUIDE-OWASP-LLM-2025-680e0fb740f6","version":"cbb979e80f389d5d","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM09 — Misinformation / GOVERN Probe","statement":"Runtime evaluates output groundedness against retrieved sources for RAG systems. Monitors confidence scores for calibration drift. Flags low-confidence outputs in high-stakes domains for human review.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-69824d3b0e70@f045b4e2d26280e4","id":"GUIDE-OWASP-LLM-2025-69824d3b0e70","version":"f045b4e2d26280e4","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"References","statement":"- OWASP Top 10 for LLM Applications 2025: https://owasp.org/www-project-top-10-for-large-language-model-applications/\n- NIST AI 100-1: Artificial Intelligence Risk Management Framework\n- MITRE ATLAS: Adversarial Threat Landscape for AI Systems\n- OWASP WSTG (Web Security Testing Guide) — adapted for LLM contexts\n- Anthropic Model Card: Claude 3 Safety Evaluation","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-6a0068187d05@029b6f3794e02275","id":"GUIDE-OWASP-LLM-2025-6a0068187d05","version":"029b6f3794e02275","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM01 — Prompt Injection / Real-World Examples","statement":"- Indirect injection via malicious web content causing an AI browsing assistant to exfiltrate user data\n- System prompt override through user message framing (\"Ignore previous instructions and...\")\n- Injection via retrieved RAG documents causing a customer service bot to provide false information\n- Jailbreak attacks using role-play framing to bypass safety systems\n- Multi-turn injection accumulating context across conversation turns","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-6b31f1dab462@8ba0780917311d2d","id":"GUIDE-OWASP-LLM-2025-6b31f1dab462","version":"8ba0780917311d2d","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM02 — Sensitive Information Disclosure / GOVERN Policy Engine","statement":"Policy rules: block outputs containing PII regex matches, reject responses that reproduce system prompt contents verbatim, require output sanitization for regulated data categories.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-6f85a1a132eb@6f89618929f57d67","id":"GUIDE-OWASP-LLM-2025-6f85a1a132eb","version":"6f89618929f57d67","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM03 — Supply Chain","statement":"### Description\nVulnerabilities introduced through compromised components in the LLM supply chain: pre-trained model weights, training datasets, inference frameworks, RAG data sources, plugins, and third-party integrations. Adversaries can compromise any layer and have that compromise propagate to production.\n\n### Real-World Examples\n- Backdoored pre-trained models distributed on public model hubs\n- Poisoned fine-tuning datasets from untrusted third-party sources\n- Compromised LLM inference libraries with embedded data exfiltration\n- Malicious LLM plugins with excessive permissions\n- Vulnerable vector databases in RAG pipelines enabling injection\n\n### Detection Methods\n- Model artifact hash verification against signed manifests\n- SBOM (Software Bill of Materials) for all ML dependencies\n- Behavioral testing of integrated third-party components\n- Plugin permission auditing\n- CVE monitoring for ML framework dependencies\n\n### Mitigations\n- Private model registry with signed artifacts and audit logs\n- Vendor security assessment for all LLM component providers\n- Minimal permission grants for plugins and integrations\n- Dependency pinning and automated vulnerability scanning\n- Regular integrity verification of deployed model artifacts\n\n### GOVERN Policy Engine\nPolicy rules: require verified provenance for all model artifacts, block plugins requesting excessive permissions, enforce dependency scanning before deployment approval.\n\n### GOVERN Assess\nConducts supply chain risk assessment: verifies model artifact provenance, scans dependencies for known CVEs, audits plugin permission requests against principle of least privilege.\n\n### GOVERN Probe\nRuntime verifies model artifact integrity on each load. Monitors third-party integration behavior for anomalous patterns. Detects unauthorized model replacement.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-70c023247d26@ebbe7b07f906eb6d","id":"GUIDE-OWASP-LLM-2025-70c023247d26","version":"ebbe7b07f906eb6d","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM03 — Supply Chain / GOVERN Policy Engine","statement":"Policy rules: require verified provenance for all model artifacts, block plugins requesting excessive permissions, enforce dependency scanning before deployment approval.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-71440703f4b7@fc8b9d083ab47bb0","id":"GUIDE-OWASP-LLM-2025-71440703f4b7","version":"fc8b9d083ab47bb0","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM03 — Supply Chain / GOVERN Assess","statement":"Conducts supply chain risk assessment: verifies model artifact provenance, scans dependencies for known CVEs, audits plugin permission requests against principle of least privilege.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-7706e7e9b7b6@fd1611c5b3ad9f26","id":"GUIDE-OWASP-LLM-2025-7706e7e9b7b6","version":"fd1611c5b3ad9f26","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM03 — Supply Chain / Mitigations","statement":"- Private model registry with signed artifacts and audit logs\n- Vendor security assessment for all LLM component providers\n- Minimal permission grants for plugins and integrations\n- Dependency pinning and automated vulnerability scanning\n- Regular integrity verification of deployed model artifacts","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-7798ca0d2dfa@2363b774d4fb43f4","id":"GUIDE-OWASP-LLM-2025-7798ca0d2dfa","version":"2363b774d4fb43f4","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM10 — Unbounded Consumption / GOVERN Policy Engine","statement":"Policy rules: enforce per-user token consumption limits, set maximum tool call chain depth (default: 10), require cost circuit breakers above configurable thresholds, mandate rate limiting at all API surfaces.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-78f477d17d08@56d8b428f60f0dfe","id":"GUIDE-OWASP-LLM-2025-78f477d17d08","version":"56d8b428f60f0dfe","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM07 — System Prompt Leakage / GOVERN Policy Engine","statement":"Policy rules: flag outputs with high similarity to known system prompt contents, require system prompt confidentiality testing before deployment approval, block embedding of credentials or secrets in system prompts.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-81d2108e2b97@6bbabbd9979771af","id":"GUIDE-OWASP-LLM-2025-81d2108e2b97","version":"6bbabbd9979771af","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM04 — Data and Model Poisoning / GOVERN Policy Engine","statement":"Policy rules: require signed provenance for all training data, mandate human review of data samples flagged as anomalous by influence analysis, block knowledge base updates without integrity verification.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-833a87566bc1@ab06e4ad60d2c83f","id":"GUIDE-OWASP-LLM-2025-833a87566bc1","version":"ab06e4ad60d2c83f","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM03 — Supply Chain / Detection Methods","statement":"- Model artifact hash verification against signed manifests\n- SBOM (Software Bill of Materials) for all ML dependencies\n- Behavioral testing of integrated third-party components\n- Plugin permission auditing\n- CVE monitoring for ML framework dependencies","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-8668f86ea2b9@9dfe8ff685d63e25","id":"GUIDE-OWASP-LLM-2025-8668f86ea2b9","version":"9dfe8ff685d63e25","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM01 — Prompt Injection / GOVERN Policy Engine","statement":"Policy rules: flag inputs containing injection pattern signatures, block system-prompt-override attempts, require human approval before agentic actions on externally-sourced data.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-87f93fc34f39@67a0b58181f1fa98","id":"GUIDE-OWASP-LLM-2025-87f93fc34f39","version":"67a0b58181f1fa98","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM04 — Data and Model Poisoning / Mitigations","statement":"- Cryptographic signing of training datasets\n- Human review of high-influence training samples before inclusion\n- Anomaly detection on crowdsourced or user-generated labels\n- Immutable knowledge base storage with change audit trails\n- Separate validation pipeline with clean, verified ground truth data","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-8eea2c58ecbf@95513d429c113232","id":"GUIDE-OWASP-LLM-2025-8eea2c58ecbf","version":"95513d429c113232","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM10 — Unbounded Consumption / Real-World Examples","statement":"- \"Prompt flooding\" attacks exhausting context windows with irrelevant content to force expensive completions\n- Agentic loops triggered by crafted inputs causing recursive tool call chains\n- Context injection attacks maximizing token generation to amplify per-request cost\n- Jailbroken LLMs used to proxy expensive API calls at attacker direction","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-91aa88183e20@e342f8d7488ef5b5","id":"GUIDE-OWASP-LLM-2025-91aa88183e20","version":"e342f8d7488ef5b5","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM10 — Unbounded Consumption / Detection Methods","statement":"- Token consumption monitoring per request and per user\n- Tool call chain depth monitoring for agentic systems\n- Latency anomaly detection for unusually long completions\n- Cost per session tracking with alert thresholds","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-922edb48d46d@af4eff0667977fa6","id":"GUIDE-OWASP-LLM-2025-922edb48d46d","version":"af4eff0667977fa6","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM10 — Unbounded Consumption / GOVERN Assess","statement":"Evaluates LLM application resource consumption controls. Tests for DoS vulnerability via context flooding. Reviews agentic loop depth constraints. Assesses cost control architecture.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-939b442560c6@99f123349d4f9da9","id":"GUIDE-OWASP-LLM-2025-939b442560c6","version":"99f123349d4f9da9","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM07 — System Prompt Leakage / Description","statement":"Unauthorized disclosure of system prompt contents, revealing proprietary instructions, business logic, security constraints, or persona configuration. System prompts often contain sensitive intellectual property and security-relevant instructions whose disclosure enables more effective attacks.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-96a223013baa@d21759c22fba7220","id":"GUIDE-OWASP-LLM-2025-96a223013baa","version":"d21759c22fba7220","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM09 — Misinformation / GOVERN Policy Engine","statement":"Policy rules: require RAG grounding for factual claims in regulated domains, mandate confidence disclosure in outputs, block deployment of LLM applications making medical/legal/financial claims without human review checkpoints.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-9fce493a2e4e@0453f5d39db0076b","id":"GUIDE-OWASP-LLM-2025-9fce493a2e4e","version":"0453f5d39db0076b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM04 — Data and Model Poisoning / Detection Methods","statement":"- Training data provenance and chain-of-custody logging\n- Influence function analysis to identify anomalous training samples\n- Behavioral testing comparing base model vs fine-tuned model on adversarial inputs\n- Knowledge base integrity monitoring for RAG systems\n- Feedback quality scoring before incorporation into training","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-a755af857924@fda6bb1be92157e5","id":"GUIDE-OWASP-LLM-2025-a755af857924","version":"fda6bb1be92157e5","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM07 — System Prompt Leakage / Detection Methods","statement":"- Output similarity comparison against system prompt contents\n- Red team extraction attempt battery\n- Model instruction-following robustness testing\n- Monitoring for verbatim system prompt reproduction","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-ae9ad1b46138@b345118b4dd7d52b","id":"GUIDE-OWASP-LLM-2025-ae9ad1b46138","version":"b345118b4dd7d52b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM01 — Prompt Injection / Mitigations","statement":"- Strict input/output delimiting with clearly marked instruction boundaries\n- Least-privilege tool permissions for agentic systems\n- Human approval checkpoints for high-consequence actions\n- Separate trusted and untrusted data pipelines\n- Output validation before action execution","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-b01dd39ee9eb@107d847e9a140a40","id":"GUIDE-OWASP-LLM-2025-b01dd39ee9eb","version":"107d847e9a140a40","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM04 — Data and Model Poisoning / Real-World Examples","statement":"- Fine-tuning dataset poisoned to make a customer service bot provide incorrect information about a competitor\n- Retrieval-augmented generation (RAG) knowledge base poisoned with false information\n- RLHF preference data manipulation causing model to favor harmful outputs\n- Continuous learning systems poisoned through adversarial user feedback","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-b0392b89d1e5@433f7facc64c24f6","id":"GUIDE-OWASP-LLM-2025-b0392b89d1e5","version":"433f7facc64c24f6","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM02 — Sensitive Information Disclosure / Mitigations","statement":"- Mark system prompts as confidential and instruct LLM accordingly\n- Output filtering for PII and secret patterns before serving\n- Session isolation with strict context boundaries\n- Minimal system prompt footprint — avoid embedding sensitive business logic\n- Differential privacy in fine-tuning for sensitive domains","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-b6d9654c7322@8400dd6f7e8be934","id":"GUIDE-OWASP-LLM-2025-b6d9654c7322","version":"8400dd6f7e8be934","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM09 — Misinformation / Detection Methods","statement":"- Groundedness evaluation against authoritative sources\n- Confidence calibration measurement\n- Factual consistency checking for retrievable claims\n- Human expert review sampling for domain-specific applications\n- Hallucination benchmark evaluation (TruthfulQA, HaluEval)","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-b6f5e5a7a236@329fcac81f726bb4","id":"GUIDE-OWASP-LLM-2025-b6f5e5a7a236","version":"329fcac81f726bb4","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM02 — Sensitive Information Disclosure / Description","statement":"LLMs may reveal confidential information including training data, system prompts, internal architecture details, proprietary business logic, or user data from other sessions. This occurs through direct extraction, contextual inference, or memorization leakage.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-b8b8b3821562@087f01d94c518a46","id":"GUIDE-OWASP-LLM-2025-b8b8b3821562","version":"087f01d94c518a46","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM04 — Data and Model Poisoning","statement":"### Description\nAdversarial manipulation of training or fine-tuning data to corrupt model behavior. Unlike ML supply chain attacks, this focuses on the training pipeline itself — attackers who can influence training data can embed biases, backdoors, or behavioral modifications that survive into production.\n\n### Real-World Examples\n- Fine-tuning dataset poisoned to make a customer service bot provide incorrect information about a competitor\n- Retrieval-augmented generation (RAG) knowledge base poisoned with false information\n- RLHF preference data manipulation causing model to favor harmful outputs\n- Continuous learning systems poisoned through adversarial user feedback\n\n### Detection Methods\n- Training data provenance and chain-of-custody logging\n- Influence function analysis to identify anomalous training samples\n- Behavioral testing comparing base model vs fine-tuned model on adversarial inputs\n- Knowledge base integrity monitoring for RAG systems\n- Feedback quality scoring before incorporation into training\n\n### Mitigations\n- Cryptographic signing of training datasets\n- Human review of high-influence training samples before inclusion\n- Anomaly detection on crowdsourced or user-generated labels\n- Immutable knowledge base storage with change audit trails\n- Separate validation pipeline with clean, verified ground truth data\n\n### GOVERN Policy Engine\nPolicy rules: require signed provenance for all training data, mandate human review of data samples flagged as anomalous by influence analysis, block knowledge base updates without integrity verification.\n\n### GOVERN Assess\nEvaluates training and fine-tuning data pipeline for poisoning risk. Runs influence function analysis on current training data. Tests RAG knowledge bases for injected false information.\n\n### GOVERN Probe\nMonitors knowledge base for unauthorized modifications. Detects behavioral drift indicating poisoning effects. Validates training data integrity before each fine-tuning cycle.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-bb73c2b77831@0d1748c203c889f7","id":"GUIDE-OWASP-LLM-2025-bb73c2b77831","version":"0d1748c203c889f7","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM05 — Improper Output Handling / GOVERN Policy Engine","statement":"Policy rules: require output sanitization for all LLM content passed to downstream systems, enforce sandboxed execution for LLM-generated code, validate structured outputs against defined schemas.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-bbdd28946ee5@60caedb08e98fa32","id":"GUIDE-OWASP-LLM-2025-bbdd28946ee5","version":"60caedb08e98fa32","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM09 — Misinformation / GOVERN Assess","statement":"Evaluates model on standardized hallucination benchmarks. Tests groundedness in RAG configurations. Measures confidence calibration. Scores factual accuracy for domain-specific deployments.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-bda235d59494@ee1fefa9c1071500","id":"GUIDE-OWASP-LLM-2025-bda235d59494","version":"ee1fefa9c1071500","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM10 — Unbounded Consumption / Mitigations","statement":"- Per-user and per-session token budgets\n- Maximum context window size enforcement\n- Tool call depth limits for agentic systems\n- Rate limiting at API gateway and application layers\n- Cost circuit breakers triggering review above thresholds","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-c30a8864d6b7@c7f10ef3b4888d45","id":"GUIDE-OWASP-LLM-2025-c30a8864d6b7","version":"c7f10ef3b4888d45","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM08 — Vector and Embedding Weaknesses / Mitigations","statement":"- Scan documents for injection payloads before vectorization and storage\n- Implement strong multi-tenant isolation in vector databases\n- Apply access controls at retrieval time, not just storage time\n- Use diverse retrieval strategies (not only nearest-neighbor) for resilience\n- Monitor retrieved document relevance distributions for anomalies","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-c78216df5eac@0b951f8a52c4ad6c","id":"GUIDE-OWASP-LLM-2025-c78216df5eac","version":"0b951f8a52c4ad6c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM05 — Improper Output Handling / Description","statement":"Insufficient validation, sanitization, or handling of LLM-generated content before passing it to downstream systems. LLM outputs can contain executable code, SQL, HTML, OS commands, or other content that causes injection vulnerabilities when passed unsanitized to interpreters, databases, or rendering engines.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-c99af8fb9b72@e8f96efc4c3fa3f9","id":"GUIDE-OWASP-LLM-2025-c99af8fb9b72","version":"e8f96efc4c3fa3f9","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM08 — Vector and Embedding Weaknesses / GOVERN Policy Engine","statement":"Policy rules: require document scanning before RAG ingestion, enforce multi-tenant isolation verification for shared vector stores, mandate access control audits for retrieval systems.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-c9b02a4092b4@26fb833baba3fae2","id":"GUIDE-OWASP-LLM-2025-c9b02a4092b4","version":"26fb833baba3fae2","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM07 — System Prompt Leakage / Mitigations","statement":"- Instruct LLM explicitly not to reveal system prompt contents\n- Minimize sensitive content in system prompts (avoid embedding credentials or business secrets)\n- Test system prompt confidentiality before deployment\n- Use separate confidential and operational instruction layers\n- Monitor production outputs for system prompt signatures","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-d1b02093c29d@7aaeff2d2d37c5a1","id":"GUIDE-OWASP-LLM-2025-d1b02093c29d","version":"7aaeff2d2d37c5a1","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Component Coverage Matrix","statement":"| Risk | Policy Engine | Assess | Probe |\n|------|:---:|:---:|:---:|\n| LLM01 Prompt Injection | Injection pattern rules | Injection battery testing | Real-time input monitoring |\n| LLM02 Sensitive Info Disclosure | PII block rules | Extraction resistance testing | Output scanning |\n| LLM03 Supply Chain | Provenance requirements | Component risk assessment | Artifact integrity monitoring |\n| LLM04 Data Poisoning | Data signing requirements | Influence function analysis | Knowledge base monitoring |\n| LLM05 Improper Output Handling | Sanitization enforcement | Code audit | Output validation |\n| LLM06 Excessive Agency | Permission scope rules | Permission audit | Action logging + gates |\n| LLM07 System Prompt Leakage | Confidentiality rules | Extraction testing | Similarity detection |\n| LLM08 Vector/Embedding | RAG scanning requirements | Architecture audit | Pre-ingestion scanning |\n| LLM09 Misinformation | Grounding requirements | Hallucination benchmarks | Groundedness monitoring |\n| LLM10 Unbounded Consumption | Rate/budget limits | DoS resistance testing | Consumption monitoring |\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-d1c0f03cc24d@3908b2f7213c1d8f","id":"GUIDE-OWASP-LLM-2025-d1c0f03cc24d","version":"3908b2f7213c1d8f","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM03 — Supply Chain / Description","statement":"Vulnerabilities introduced through compromised components in the LLM supply chain: pre-trained model weights, training datasets, inference frameworks, RAG data sources, plugins, and third-party integrations. Adversaries can compromise any layer and have that compromise propagate to production.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-d27feb93b609@464ba8fefee39f23","id":"GUIDE-OWASP-LLM-2025-d27feb93b609","version":"464ba8fefee39f23","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM08 — Vector and Embedding Weaknesses / GOVERN Assess","statement":"Audits RAG architecture for vector database security controls. Tests adversarial retrieval resistance. Verifies multi-tenant isolation. Evaluates embedding model robustness.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-d4b1ea5708dd@cd44ac29977646fd","id":"GUIDE-OWASP-LLM-2025-d4b1ea5708dd","version":"cd44ac29977646fd","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Overview","statement":"The OWASP LLM Top 10 identifies the most critical security and safety vulnerabilities specific to large language model applications. These risks are distinct from traditional application vulnerabilities — they exploit the probabilistic, generative nature of LLMs and their increasing agency in production systems. GOVERN's three-layer architecture addresses each risk through complementary enforcement points.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-d5c26cf498a7@8ed3adf0ab2c3253","id":"GUIDE-OWASP-LLM-2025-d5c26cf498a7","version":"8ed3adf0ab2c3253","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM05 — Improper Output Handling / Real-World Examples","statement":"- LLM-generated SQL passed directly to a database without sanitization enabling SQL injection\n- LLM-generated HTML rendered without escaping enabling stored XSS\n- LLM-generated code executed directly enabling arbitrary code execution\n- LLM-generated OS commands passed to shell without validation\n- SSRF via LLM-generated URLs in agentic web-browsing contexts","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-d688c985ff87@f21236fce59db60c","id":"GUIDE-OWASP-LLM-2025-d688c985ff87","version":"f21236fce59db60c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM08 — Vector and Embedding Weaknesses / Real-World Examples","statement":"- Adversarial documents crafted to be semantically similar to benign queries, poisoning RAG retrieval\n- Embedding model manipulation causing incorrect semantic similarity computation\n- Vector database access control gaps exposing documents from other tenants\n- Prompt injection payloads embedded in chunked document storage","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-d9c16257105d@56f7b1ab2b5a62f5","id":"GUIDE-OWASP-LLM-2025-d9c16257105d","version":"56f7b1ab2b5a62f5","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM08 — Vector and Embedding Weaknesses / GOVERN Probe","statement":"Scans documents before vectorization for injection payloads. Monitors retrieval distributions for anomalous document surfacing. Validates access control enforcement at retrieval time.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-dbd0bcddf152@6a5c852556ea0206","id":"GUIDE-OWASP-LLM-2025-dbd0bcddf152","version":"6a5c852556ea0206","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM02 — Sensitive Information Disclosure / GOVERN Assess","statement":"Scans LLM application configuration for sensitive data exposure risks. Tests system prompt extraction resistance. Evaluates fine-tuned model memorization for PII from training data.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-dd1187cf221c@aa2cf0eb7a86ea0c","id":"GUIDE-OWASP-LLM-2025-dd1187cf221c","version":"aa2cf0eb7a86ea0c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM10 — Unbounded Consumption / GOVERN Probe","statement":"Runtime monitors token consumption, latency, and tool call chains per request. Triggers cost circuit breakers when thresholds exceeded. Detects anomalous consumption patterns consistent with abuse.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-ddd044ffba36@f5b909b17365b6ca","id":"GUIDE-OWASP-LLM-2025-ddd044ffba36","version":"f5b909b17365b6ca","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM03 — Supply Chain / GOVERN Probe","statement":"Runtime verifies model artifact integrity on each load. Monitors third-party integration behavior for anomalous patterns. Detects unauthorized model replacement.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-df0252acd5f3@ca80c398783a4bde","id":"GUIDE-OWASP-LLM-2025-df0252acd5f3","version":"ca80c398783a4bde","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM02 — Sensitive Information Disclosure / GOVERN Probe","statement":"Runtime scans all LLM outputs for PII, credentials, and system prompt signatures before delivery. Logs disclosure attempts with full context for forensic review.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-e4dc38dde086@08dc7672848d4a40","id":"GUIDE-OWASP-LLM-2025-e4dc38dde086","version":"08dc7672848d4a40","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM06 — Excessive Agency / Detection Methods","statement":"- Permission audit of all LLM tool grants\n- Action logging for all tool invocations by LLM agents\n- Anomaly detection on action frequency and type\n- Human review requirements for high-consequence actions","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-e76e0ae7e054@f1acc931a2ccbe18","id":"GUIDE-OWASP-LLM-2025-e76e0ae7e054","version":"f1acc931a2ccbe18","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM06 — Excessive Agency / GOVERN Assess","statement":"Evaluates all tool permission grants for each LLM agent. Maps permissions to stated use case and flags over-provisioning. Scores agency risk based on permission scope and action reversibility.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-e9fe62e9b03b@c767198a491c5a72","id":"GUIDE-OWASP-LLM-2025-e9fe62e9b03b","version":"c767198a491c5a72","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM09 — Misinformation","statement":"### Description\nLLMs generating plausible but factually incorrect, misleading, or fabricated content (hallucinations). Unlike other LLM vulnerabilities, misinformation risk is inherent to LLM architecture — models generate statistically plausible sequences regardless of factual grounding.\n\n### Real-World Examples\n- AI legal research tools hallucinating case citations that don't exist\n- Medical AI providing incorrect dosing information with high apparent confidence\n- AI-generated news summaries fabricating quotes and statistics\n- Customer service bots providing incorrect product specifications\n\n### Detection Methods\n- Groundedness evaluation against authoritative sources\n- Confidence calibration measurement\n- Factual consistency checking for retrievable claims\n- Human expert review sampling for domain-specific applications\n- Hallucination benchmark evaluation (TruthfulQA, HaluEval)\n\n### Mitigations\n- Retrieval-augmented generation with authoritative sources\n- Citation requirements for factual claims\n- Confidence thresholding with fallback to human review\n- Domain expert review for regulated content (medical, legal, financial)\n- User disclosure of AI-generated content with accuracy caveats\n\n### GOVERN Policy Engine\nPolicy rules: require RAG grounding for factual claims in regulated domains, mandate confidence disclosure in outputs, block deployment of LLM applications making medical/legal/financial claims without human review checkpoints.\n\n### GOVERN Assess\nEvaluates model on standardized hallucination benchmarks. Tests groundedness in RAG configurations. Measures confidence calibration. Scores factual accuracy for domain-specific deployments.\n\n### GOVERN Probe\nRuntime evaluates output groundedness against retrieved sources for RAG systems. Monitors confidence scores for calibration drift. Flags low-confidence outputs in high-stakes domains for human review.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-ea404651be03@21956335e6e226f5","id":"GUIDE-OWASP-LLM-2025-ea404651be03","version":"21956335e6e226f5","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM09 — Misinformation / Real-World Examples","statement":"- AI legal research tools hallucinating case citations that don't exist\n- Medical AI providing incorrect dosing information with high apparent confidence\n- AI-generated news summaries fabricating quotes and statistics\n- Customer service bots providing incorrect product specifications","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-eb1dc90907fb@e264c9b534ccb8c8","id":"GUIDE-OWASP-LLM-2025-eb1dc90907fb","version":"e264c9b534ccb8c8","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM07 — System Prompt Leakage / Real-World Examples","statement":"- Extraction of competitor AI assistant system prompts revealing proprietary persona configurations\n- System prompt disclosure revealing the exact safety constraint wording, enabling targeted bypass\n- Internal tool instructions revealed through model verbosity in error states\n- Multi-model routing logic exposed through system prompt extraction","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-ec98e4af2fe3@d968b48094cf6c68","id":"GUIDE-OWASP-LLM-2025-ec98e4af2fe3","version":"d968b48094cf6c68","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM04 — Data and Model Poisoning / Description","statement":"Adversarial manipulation of training or fine-tuning data to corrupt model behavior. Unlike ML supply chain attacks, this focuses on the training pipeline itself — attackers who can influence training data can embed biases, backdoors, or behavioral modifications that survive into production.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-ed9bcdeffe38@099de8c76e54338f","id":"GUIDE-OWASP-LLM-2025-ed9bcdeffe38","version":"099de8c76e54338f","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM01 — Prompt Injection / Detection Methods","statement":"- Pattern matching on known injection templates (prefix-based, delimiter confusion, role-play framing)\n- Input/output semantic consistency checking\n- Instruction hierarchy enforcement with explicit delimiting\n- Sandboxed LLM as judge for injection detection\n- Canary tokens in system prompts to detect leakage","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-f3540baee82f@bd6ac8c6af661d50","id":"GUIDE-OWASP-LLM-2025-f3540baee82f","version":"bd6ac8c6af661d50","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM05 — Improper Output Handling / Detection Methods","statement":"- Static analysis of LLM output handling code\n- Dynamic testing with injection payloads in LLM responses\n- Context-sensitive output encoding verification\n- Code execution sandbox for LLM-generated code","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-f68bab7e3905@79a457b93f0bf4bd","id":"GUIDE-OWASP-LLM-2025-f68bab7e3905","version":"79a457b93f0bf4bd","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM01 — Prompt Injection / GOVERN Assess","statement":"Evaluates LLM application prompt architecture for injection resistance. Runs injection attack battery (100+ templates) against the application. Scores injection resilience and flags structural vulnerabilities.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-f9ac17eaac49@a9b8748b9bc6c714","id":"GUIDE-OWASP-LLM-2025-f9ac17eaac49","version":"a9b8748b9bc6c714","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM05 — Improper Output Handling","statement":"### Description\nInsufficient validation, sanitization, or handling of LLM-generated content before passing it to downstream systems. LLM outputs can contain executable code, SQL, HTML, OS commands, or other content that causes injection vulnerabilities when passed unsanitized to interpreters, databases, or rendering engines.\n\n### Real-World Examples\n- LLM-generated SQL passed directly to a database without sanitization enabling SQL injection\n- LLM-generated HTML rendered without escaping enabling stored XSS\n- LLM-generated code executed directly enabling arbitrary code execution\n- LLM-generated OS commands passed to shell without validation\n- SSRF via LLM-generated URLs in agentic web-browsing contexts\n\n### Detection Methods\n- Static analysis of LLM output handling code\n- Dynamic testing with injection payloads in LLM responses\n- Context-sensitive output encoding verification\n- Code execution sandbox for LLM-generated code\n\n### Mitigations\n- Treat all LLM outputs as untrusted user input\n- Context-sensitive output encoding (HTML encode for HTML context, parameterized queries for SQL)\n- Sandboxed execution environments for LLM-generated code\n- Schema validation of structured LLM outputs before use\n- Output length and format constraints\n\n### GOVERN Policy Engine\nPolicy rules: require output sanitization for all LLM content passed to downstream systems, enforce sandboxed execution for LLM-generated code, validate structured outputs against defined schemas.\n\n### GOVERN Assess\nAudits LLM application code for improper output handling patterns. Tests output encoding and injection prevention. Evaluates code execution controls for agentic systems.\n\n### GOVERN Probe\nRuntime scans LLM outputs for injection patterns before downstream consumption. Validates structured outputs against schemas. Enforces sandboxing for code execution requests.\n\n---","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-OWASP-LLM-2025-fe44732a946d@9bd0d5c3ca83a12c","id":"GUIDE-OWASP-LLM-2025-fe44732a946d","version":"9bd0d5c3ca83a12c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"LLM04 — Data and Model Poisoning / GOVERN Assess","statement":"Evaluates training and fine-tuning data pipeline for poisoning risk. Runs influence function analysis on current training data. Tests RAG knowledge bases for injected false information.","family":"OWASP-LLM-2025","body":{"sourceFile":"POLICY(10).md","sourceFamily":"OWASP-LLM-2025","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-0ce93a3ddbe4@5efb25b53db84c35","id":"GUIDE-TAIMSCORE-0ce93a3ddbe4","version":"5efb25b53db84c35","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Standards Alignment / ISO/IEC 42001:2023","statement":"| ISO 42001 Clause | TAIMScore Controls |\n|-----------------|-------------------|\n| 4 (Context of the organization) | GV-1.1, MP-1.1 |\n| 5 (Leadership) | GV-1.3, GV-2.3 |\n| 6 (Planning) | GV-5.1, GV-5.2, MP-4.1 |\n| 7 (Support) | GV-3.2, GV-4.1 |\n| 8 (Operation) | MP-1.4, MP-3.1, MS-2.1 |\n| 9 (Performance evaluation) | MS-3.1, MS-3.3, MS-4.1 |\n| 10 (Improvement) | MG-3.3, MG-4.3 |","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-0eff381f83ef@51ed2a746c92b9e0","id":"GUIDE-TAIMSCORE-0eff381f83ef","version":"51ed2a746c92b9e0","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MAP Function (MP) / MP-5: Organizational Risk Management","statement":"**Purpose:** AI risk management is integrated with enterprise risk management processes.\n\n**Subcategories:**\n\n**MP-5.1** — Likelihood of encountering AI risks given use of AI and organizational risk tolerances is determined.\n- Requires probability analysis of AI risk exposure\n- GOVERN component: Exposure analysis module\n\n**MP-5.2** — Organizations are transparent about known limitations and where knowledge is incomplete.\n- Requires documented limitations section in AI system documentation\n- GOVERN component: Limitations register, transparency report\n\n**MP-5.3** — Organizational risk policies include and are inclusive of AI risks.\n- Requires AI risk explicitly included in enterprise risk policies\n- GOVERN component: Policy integration audit\n\n**MP-5.4** — Risk tolerance for the development and deployment of AI systems is established, communicated, and regularly reviewed.\n- Requires formal risk tolerance review cadence\n- GOVERN component: Risk tolerance review scheduler, review records\n\n**MP-5.5** — Practices and documentation establish how identified risks will be addressed and where they fall in the organization's risk management framework.\n- Requires documented risk treatment methodology\n- GOVERN component: Risk treatment tracker, treatment workflow engine\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-12c4f1c01329@963980a8509e0f3c","id":"GUIDE-TAIMSCORE-12c4f1c01329","version":"963980a8509e0f3c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Standards Alignment / NIST AI RMF 1.0 (NIST AI 100-1)","statement":"TAIMScore is structurally equivalent to NIST AI RMF. Full coverage across all 4 functions, 19 categories, 72 subcategories.","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-2130b0d37ddb@c1549abbbeccd969","id":"GUIDE-TAIMSCORE-2130b0d37ddb","version":"c1549abbbeccd969","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Function (GV) / GV-5: Organizational Risk Strategy","statement":"**Purpose:** AI risk tolerance and strategy are defined and integrated with enterprise risk.\n\n**Subcategories:**\n\n**GV-5.1** — Organizational risk policies include and are inclusive of AI risks.\n- Requires AI risk integrated into enterprise risk management framework\n- GOVERN component: ERM integration module, risk appetite statement\n\n**GV-5.2** — Risk tolerance for the development and deployment of AI systems — including organizational risk tolerance for known trustworthiness limitations of AI systems — is established, communicated, and regularly reviewed.\n- Requires documented risk tolerance thresholds by AI risk category\n- Requires regular board/leadership review of AI risk tolerance\n- GOVERN component: Risk tolerance dashboard, threshold alert engine\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-249dc0c1e2d0@8172d54f33e1ad1c","id":"GUIDE-TAIMSCORE-249dc0c1e2d0","version":"8172d54f33e1ad1c","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MAP Function (MP) / MP-4: Risks Are Prioritized","statement":"**Purpose:** Identified risks are triaged and prioritized for response.\n\n**Subcategories:**\n\n**MP-4.1** — The organization's risk tolerance for the AI system under consideration is established, communicated, and incorporated into the risk identification and classification process.\n- Requires risk tolerance applied at system level\n- GOVERN component: Per-system risk tolerance configuration\n\n**MP-4.2** — Risk levels of AI systems at deployment are documented per risk classification and tolerance levels.\n- Requires system-level risk rating at deployment\n- GOVERN component: Deployment risk certification, risk ledger\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-256e9d391809@2fa12dd681854989","id":"GUIDE-TAIMSCORE-256e9d391809","version":"2fa12dd681854989","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"NIST AI RMF Alignment","statement":"TAIMScore IS the NIST AI RMF structure. The mapping is direct:\n\n| TAIMScore Function | NIST AI RMF Core Function | Category Count | Subcategory Count |\n|-------------------|--------------------------|---------------|------------------|\n| GOVERN (GV) | GOVERN | 6 | 19 |\n| MAP (MP) | MAP | 5 | 18 |\n| MEASURE (MS) | MEASURE | 4 | 15 |\n| MANAGE (MG) | MANAGE | 4 | 20 |\n| **Total** | | **19** | **72** |\n\nTAIMScore adds to the NIST AI RMF:\n- Quantified maturity scoring (0–4 per control)\n- Composite score calculation\n- GOVERN component automation mapping\n- Enterprise workflow integration\n- Multi-standard alignment layer (ISO 42001, SOC 2, EU AI Act)\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-2c232da2adbd@2bba1850a1b6b745","id":"GUIDE-TAIMSCORE-2c232da2adbd","version":"2bba1850a1b6b745","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"The 4 Functions","statement":"| Function | ID Range | Purpose |\n|----------|----------|---------|\n| GOVERN | GV-1 through GV-6 | Establishes accountability, culture, and policies that frame all AI risk work |\n| MAP | MP-1 through MP-5 | Identifies and classifies AI risks in context |\n| MEASURE | MS-1 through MS-4 | Analyzes and tracks AI risks quantitatively |\n| MANAGE | MG-1 through MG-4 | Prioritizes, responds to, and monitors AI risks |\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-2d7ec48f3fae@3a5adbc1cbd68835","id":"GUIDE-TAIMSCORE-2d7ec48f3fae","version":"3a5adbc1cbd68835","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MANAGE Function (MG) / MG-3: Risk Treatment Feedback","statement":"**Purpose:** Treatment effectiveness is assessed and improvements are made.\n\n**Subcategories:**\n\n**MG-3.1** — Risk treatment strategies and methods are documented, as are the reasons for the selection of risk treatment options.\n- Requires treatment selection rationale documentation\n- GOVERN component: Treatment rationale ledger\n\n**MG-3.2** — Treatment of AI risks includes a determination of residual risk after the risk response plan has been implemented.\n- Requires residual risk assessment post-implementation\n- GOVERN component: Post-treatment residual risk review\n\n**MG-3.3** — Feedback processes are in place to inform updates to the risk mapping, risk analysis, risk treatment, and monitoring activities.\n- Requires cross-function feedback loop from MANAGE back to MAP and MEASURE\n- GOVERN component: Feedback integration engine, continuous improvement workflow\n\n**MG-3.4** — Risk treatment plans for AI systems are maintained and updated regularly.\n- Requires periodic review and update of treatment plans\n- GOVERN component: Treatment plan review scheduler, update records\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-2fb801c9fc14@8e1b366d53700130","id":"GUIDE-TAIMSCORE-2fb801c9fc14","version":"8e1b366d53700130","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Function (GV) / GV-1: Policies, Processes, Procedures, and Practices","statement":"**Purpose:** Organizational policies and practices are in place to govern AI risk.\n\n**Subcategories:**\n\n**GV-1.1** — Organizational policies and practices are in place to plan, prioritize, govern, and monitor AI risk management activities.\n- Requires documented AI governance charter or policy\n- Must define scope of AI systems covered\n- Must assign accountability for AI risk oversight\n- GOVERN component: Policy Engine — loads framework, tracks compliance posture\n\n**GV-1.2** — Organizational teams are committed to a culture that considers and communicates AI risks.\n- Requires executive-level AI risk acknowledgment\n- Requires training and awareness program for AI risk\n- GOVERN component: Awareness module, council deliberation records\n\n**GV-1.3** — Organizational leadership takes responsibility for decisions about risks associated with AI system development and deployment.\n- Requires named AI risk owner at leadership level\n- Requires escalation path for high-risk AI decisions\n- GOVERN component: Role assignment, accountability ledger\n\n**GV-1.4** — Organizational teams are committed to transparent organizational practices and policies.\n- Requires disclosure framework for AI system use\n- Requires stakeholder communication plan\n- GOVERN component: Disclosure report generator\n\n**GV-1.5** — Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review.\n- Requires defined review cadence (minimum annual)\n- Requires metrics for monitoring effectiveness\n- GOVERN component: Continuous monitoring dashboard, alert engine\n\n**GV-1.6** — Policies and procedures are in place for the organizational risk governance and oversight of AI systems developed, used, or acquired from third parties, and for risk management of AI-specific supply chain issues including third-party data and AI components.\n- Requires third-party AI vendor assessment process\n- Requires AI supply chain risk policy\n- GOVERN component: Third-party assess mode, vendor registry\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-38782814f6d4@62b6df5ed655a7d4","id":"GUIDE-TAIMSCORE-38782814f6d4","version":"62b6df5ed655a7d4","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MAP Function (MP) / MP-1: Context Is Established","statement":"**Purpose:** The organizational context and AI system context are documented before risk assessment.\n\n**Subcategories:**\n\n**MP-1.1** — Intended purpose, potentially beneficial uses, context of use, and risks of AI systems are understood and documented.\n- Requires documented AI system purpose statement\n- Requires identification of intended use cases and out-of-scope uses\n- GOVERN component: System inventory, use case registry\n\n**MP-1.2** — Scientific findings, technical standards, and trustworthiness of AI systems are understood, documented, and communicated.\n- Requires technical documentation of AI model architecture, training data, and performance characteristics\n- GOVERN component: Technical fact sheet generator, model card integration\n\n**MP-1.3** — Potential benefits of intended AI system deployment — including financial, societal, and broadly beneficial uses — are examined and documented.\n- Requires documented benefits analysis per AI system\n- GOVERN component: Benefits documentation module\n\n**MP-1.4** — Risks or harms of deployed AI systems — and their potential consequences to individuals, groups, communities, organizations, and society — are examined and documented.\n- Requires impact assessment covering affected individuals and groups\n- Requires documentation of high-risk harm scenarios\n- GOVERN component: Harm assessment module, impact ledger\n\n**MP-1.5** — Likelihood and magnitude of each identified AI system risk or impact are estimated and documented.\n- Requires risk likelihood and magnitude scoring methodology\n- GOVERN component: Risk scoring engine, probability-impact matrix\n\n**MP-1.6** — Risks or harms from third-party use of the organization's data or AI systems, including data provenance, data quality, and supply chain risks, are documented.\n- Requires third-party data risk documentation\n- GOVERN component: Data provenance tracker, supply chain risk register\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-3be8f011f4f8@fe3bbd42f3960f1a","id":"GUIDE-TAIMSCORE-3be8f011f4f8","version":"fe3bbd42f3960f1a","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Standards Alignment","statement":"### NIST AI RMF 1.0 (NIST AI 100-1)\n\nTAIMScore is structurally equivalent to NIST AI RMF. Full coverage across all 4 functions, 19 categories, 72 subcategories.\n\n### ISO/IEC 42001:2023\n\n| ISO 42001 Clause | TAIMScore Controls |\n|-----------------|-------------------|\n| 4 (Context of the organization) | GV-1.1, MP-1.1 |\n| 5 (Leadership) | GV-1.3, GV-2.3 |\n| 6 (Planning) | GV-5.1, GV-5.2, MP-4.1 |\n| 7 (Support) | GV-3.2, GV-4.1 |\n| 8 (Operation) | MP-1.4, MP-3.1, MS-2.1 |\n| 9 (Performance evaluation) | MS-3.1, MS-3.3, MS-4.1 |\n| 10 (Improvement) | MG-3.3, MG-4.3 |\n\n### SOC 2 Type II\n\n| SOC 2 Trust Service Criterion | TAIMScore Controls |\n|------------------------------|-------------------|\n| CC1 (Control Environment) | GV-1.1, GV-2.1 |\n| CC2 (Communication and Information) | GV-1.4, MG-4.4 |\n| CC3 (Risk Assessment) | MP-1.5, MP-2.2 |\n| CC4 (Monitoring of Controls) | GV-1.5, MS-3.3 |\n| CC5 (Control Activities) | MG-1.1, MG-2.3 |\n| CC6 (Logical and Physical Access) | GV-2.1, GV-1.6 |\n| CC7 (System Operations) | MS-3.1, MS-3.3 |\n| CC8 (Change Management) | MP-3.3, MG-2.2 |\n| CC9 (Risk Mitigation) | MG-1.2, MG-1.3 |\n\n### EU AI Act (2024)\n\n| EU AI Act Requirement | TAIMScore Controls |\n|----------------------|-------------------|\n| Article 9 (Risk management system) | MP-1.4, MP-1.5, MG-1.1 |\n| Article 10 (Data governance) | MP-1.6, MP-3.1 |\n| Article 11 (Technical documentation) | MP-1.2, MS-2.1 |\n| Article 12 (Record keeping) | GV-1.5, MS-3.3 |\n| Article 13 (Transparency) | MP-1.1, MP-5.2 |\n| Article 14 (Human oversight) | MS-2.4, MG-2.4 |\n| Article 15 (Accuracy and robustness) | MS-2.3, MS-3.1 |\n| Article 61 (Post-market monitoring) | MG-4.1, MG-4.2 |\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-45605fb5fe93@708cc67ec8a01c3b","id":"GUIDE-TAIMSCORE-45605fb5fe93","version":"708cc67ec8a01c3b","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MEASURE Function (MS) / MS-1: Risk Metrics and Methods","statement":"**Purpose:** Appropriate risk measurement methods are selected and applied.\n\n**Subcategories:**\n\n**MS-1.1** — Approaches and metrics for measurement of AI risks and trustworthiness characteristics reflect deployment context and organizational risk tolerance.\n- Requires defined metrics for each trustworthiness dimension (accuracy, fairness, transparency, privacy, security, reliability)\n- GOVERN component: Metrics library, measurement configuration\n\n**MS-1.2** — Trustworthiness characteristics of AI systems are assessed independently and in the context of AI systems to which they may be connected.\n- Requires system-level and ecosystem-level trustworthiness assessment\n- GOVERN component: System interdependency map, interconnected system assessment\n\n**MS-1.3** — Internal experts are consulted to assess AI risks.\n- Requires expert review process for AI risk assessments\n- GOVERN component: Expert review workflow, reviewer registry\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-4ceafb318fc8@b3ff6accd8ac717f","id":"GUIDE-TAIMSCORE-4ceafb318fc8","version":"b3ff6accd8ac717f","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Standards Alignment / EU AI Act (2024)","statement":"| EU AI Act Requirement | TAIMScore Controls |\n|----------------------|-------------------|\n| Article 9 (Risk management system) | MP-1.4, MP-1.5, MG-1.1 |\n| Article 10 (Data governance) | MP-1.6, MP-3.1 |\n| Article 11 (Technical documentation) | MP-1.2, MS-2.1 |\n| Article 12 (Record keeping) | GV-1.5, MS-3.3 |\n| Article 13 (Transparency) | MP-1.1, MP-5.2 |\n| Article 14 (Human oversight) | MS-2.4, MG-2.4 |\n| Article 15 (Accuracy and robustness) | MS-2.3, MS-3.1 |\n| Article 61 (Post-market monitoring) | MG-4.1, MG-4.2 |\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-5a4de5f38b1b@1d8df7b6391324bb","id":"GUIDE-TAIMSCORE-5a4de5f38b1b","version":"1d8df7b6391324bb","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MEASURE Function (MS) / MS-3: Performance Monitoring","statement":"**Purpose:** AI system performance is tracked throughout the deployment lifecycle.\n\n**Subcategories:**\n\n**MS-3.1** — Ongoing monitoring plans are in place to address the identified AI risks and trustworthiness characteristics of the AI system.\n- Requires monitoring plan documentation per AI system\n- GOVERN component: Monitoring plan builder, monitoring schedule\n\n**MS-3.2** — The risk or performance characteristics of the AI system to be deployed are examined and documented.\n- Requires pre-deployment performance documentation\n- GOVERN component: Pre-deployment risk certification\n\n**MS-3.3** — AI system risks and trustworthiness are measured in deployment and monitoring contexts.\n- Requires in-deployment performance and risk monitoring\n- GOVERN component: Live monitoring dashboard, alert engine\n\n**MS-3.4** — Feedback processes for end users and impacted communities to report problems and provide feedback are established.\n- Requires user-facing feedback mechanism for AI system issues\n- GOVERN component: Public feedback intake module\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-5fcf17139776@97ae24c6b37d1df6","id":"GUIDE-TAIMSCORE-5fcf17139776","version":"97ae24c6b37d1df6","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Function (GV)","statement":"The GOVERN function establishes the organizational policies, processes, and culture required to enable responsible AI risk management across the full lifecycle.\n\n### GV-1: Policies, Processes, Procedures, and Practices\n\n**Purpose:** Organizational policies and practices are in place to govern AI risk.\n\n**Subcategories:**\n\n**GV-1.1** — Organizational policies and practices are in place to plan, prioritize, govern, and monitor AI risk management activities.\n- Requires documented AI governance charter or policy\n- Must define scope of AI systems covered\n- Must assign accountability for AI risk oversight\n- GOVERN component: Policy Engine — loads framework, tracks compliance posture\n\n**GV-1.2** — Organizational teams are committed to a culture that considers and communicates AI risks.\n- Requires executive-level AI risk acknowledgment\n- Requires training and awareness program for AI risk\n- GOVERN component: Awareness module, council deliberation records\n\n**GV-1.3** — Organizational leadership takes responsibility for decisions about risks associated with AI system development and deployment.\n- Requires named AI risk owner at leadership level\n- Requires escalation path for high-risk AI decisions\n- GOVERN component: Role assignment, accountability ledger\n\n**GV-1.4** — Organizational teams are committed to transparent organizational practices and policies.\n- Requires disclosure framework for AI system use\n- Requires stakeholder communication plan\n- GOVERN component: Disclosure report generator\n\n**GV-1.5** — Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review.\n- Requires defined review cadence (minimum annual)\n- Requires metrics for monitoring effectiveness\n- GOVERN component: Continuous monitoring dashboard, alert engine\n\n**GV-1.6** — Policies and procedures are in place for the organizational risk governance and oversight of AI systems developed, used, or acquired from third parties, and for risk management of AI-specific supply chain issues including third-party data and AI components.\n- Requires third-party AI vendor assessment process\n- Requires AI supply chain risk policy\n- GOVERN component: Third-party assess mode, vendor registry\n\n---\n\n### GV-2: Accountability Structures\n\n**Purpose:** Accountability is established across the AI lifecycle.\n\n**Subcategories:**\n\n**GV-2.1** — Roles and responsibilities and organizational accountabilities for personnel involved with the design, development, deployment, assessment and monitoring of AI systems are established.\n- Requires RACI matrix for AI roles\n- Requires defined responsibilities for data scientists, ML engineers, risk officers, legal, compliance\n- GOVERN component: Role registry, accountability matrix\n\n**GV-2.2** — The risk or legal review function is documented and accountable to senior leadership.\n- Requires documented reporting structure for AI legal/risk function\n- GOVERN component: Governance structure documentation\n\n**GV-2.3** — Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.\n- Requires board-level or C-suite AI risk acknowledgment records\n- GOVERN component: Executive attestation module\n\n---\n\n### GV-3: Workforce Diversity, Equity, Inclusion, and Accessibility\n\n**Purpose:** Diverse teams reduce AI bias and improve risk detection.\n\n**Subcategories:**\n\n**GV-3.1** — Organizational policies and practices are in place to foster a critical thinking culture.\n- Requires documented process for raising AI risk concerns\n- Requires psychological safety mechanisms\n- GOVERN component: Risk flagging interface, anonymous reporting channel\n\n**GV-3.2** — Policies, practices, and mechanisms are in place for the training and certification of AI personnel.\n- Requires defined AI literacy curriculum\n- Requires certification tracking for key roles\n- GOVERN component: Training tracker, certification registry\n\n**GV-3.3** — Fairness and bias — human factors and diversity considerations exist in organizational policies and practices across the AI lifecycle.\n- Requires demographic diversity analysis in AI teams\n- Requires process for incorporating diverse perspectives in AI design\n- GOVERN component: Diversity and inclusion assessment panel\n\n---\n\n### GV-4: Organizational Teams Are Committed\n\n**Purpose:** Cross-functional commitment to AI risk management is embedded.\n\n**Subcategories:**\n\n**GV-4.1** — Organizational policies and practices are in place to foster AI risk awareness and to create a culture of trustworthy, responsible AI.\n- Requires AI ethics principles documented and socialized\n- Requires leadership messaging on responsible AI\n- GOVERN component: Culture assessment, policy publication engine\n\n**GV-4.2** — Organizational teams document the risks and potential impacts of AI technologies applied to their functions and using their data.\n- Requires business unit AI risk registers\n- Requires impact documentation per AI use case\n- GOVERN component: Risk register, per-system risk ledger\n\n---\n\n### GV-5: Organizational Risk Strategy\n\n**Purpose:** AI risk tolerance and strategy are defined and integrated with enterprise risk.\n\n**Subcategories:**\n\n**GV-5.1** — Organizational risk policies include and are inclusive of AI risks.\n- Requires AI risk integrated into enterprise risk management framework\n- GOVERN component: ERM integration module, risk appetite statement\n\n**GV-5.2** — Risk tolerance for the development and deployment of AI systems — including organizational risk tolerance for known trustworthiness limitations of AI systems — is established, communicated, and regularly reviewed.\n- Requires documented risk tolerance thresholds by AI risk category\n- Requires regular board/leadership review of AI risk tolerance\n- GOVERN component: Risk tolerance dashboard, threshold alert engine\n\n---\n\n### GV-6: Policies and Procedures\n\n**Purpose:** Legal, compliance, and governance requirements are integrated into AI processes.\n\n**Subcategories:**\n\n**GV-6.1** — Policies and procedures are in place for the identification and documentation of legal requirements related to AI use, including international requirements for AI systems used in multiple jurisdictions.\n- Requires legal inventory of applicable AI regulations per jurisdiction\n- Requires documentation of AI system jurisdictional scope\n- GOVERN component: Regulatory mapping engine, jurisdiction tracker\n\n**GV-6.2** — Organizational risk policies are inclusive of regulatory compliance and legal requirements.\n- Requires AI compliance program covering NIST, ISO, EU AI Act, FedRAMP as applicable\n- GOVERN component: Compliance gap tracker, standard alignment report\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-6879b220016e@456cd412309ec481","id":"GUIDE-TAIMSCORE-6879b220016e","version":"456cd412309ec481","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Function (GV) / GV-3: Workforce Diversity, Equity, Inclusion, and Accessibility","statement":"**Purpose:** Diverse teams reduce AI bias and improve risk detection.\n\n**Subcategories:**\n\n**GV-3.1** — Organizational policies and practices are in place to foster a critical thinking culture.\n- Requires documented process for raising AI risk concerns\n- Requires psychological safety mechanisms\n- GOVERN component: Risk flagging interface, anonymous reporting channel\n\n**GV-3.2** — Policies, practices, and mechanisms are in place for the training and certification of AI personnel.\n- Requires defined AI literacy curriculum\n- Requires certification tracking for key roles\n- GOVERN component: Training tracker, certification registry\n\n**GV-3.3** — Fairness and bias — human factors and diversity considerations exist in organizational policies and practices across the AI lifecycle.\n- Requires demographic diversity analysis in AI teams\n- Requires process for incorporating diverse perspectives in AI design\n- GOVERN component: Diversity and inclusion assessment panel\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-72386903860b@e0f6769dbaf0778a","id":"GUIDE-TAIMSCORE-72386903860b","version":"e0f6769dbaf0778a","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MEASURE Function (MS)","statement":"The MEASURE function provides analytical methods to assess and track AI risks quantitatively and qualitatively.\n\n### MS-1: Risk Metrics and Methods\n\n**Purpose:** Appropriate risk measurement methods are selected and applied.\n\n**Subcategories:**\n\n**MS-1.1** — Approaches and metrics for measurement of AI risks and trustworthiness characteristics reflect deployment context and organizational risk tolerance.\n- Requires defined metrics for each trustworthiness dimension (accuracy, fairness, transparency, privacy, security, reliability)\n- GOVERN component: Metrics library, measurement configuration\n\n**MS-1.2** — Trustworthiness characteristics of AI systems are assessed independently and in the context of AI systems to which they may be connected.\n- Requires system-level and ecosystem-level trustworthiness assessment\n- GOVERN component: System interdependency map, interconnected system assessment\n\n**MS-1.3** — Internal experts are consulted to assess AI risks.\n- Requires expert review process for AI risk assessments\n- GOVERN component: Expert review workflow, reviewer registry\n\n---\n\n### MS-2: Risk Analysis\n\n**Purpose:** AI risks are evaluated using measurement data and expert analysis.\n\n**Subcategories:**\n\n**MS-2.1** — Test sets, metrics, and details about the tools used during test, evaluation, validation, and verification (TEVV) are documented.\n- Requires TEVV documentation including test datasets, metrics, and tools\n- GOVERN component: TEVV documentation module, test artifact registry\n\n**MS-2.2** — AI system trustworthiness characteristics are calibrated for risks of under- and over-reliance on AI systems.\n- Requires calibration testing for confidence and uncertainty estimation\n- GOVERN component: Calibration assessment, uncertainty quantification tracker\n\n**MS-2.3** — AI system performance and trustworthiness characteristics are evaluated regularly against benchmarks.\n- Requires regular performance benchmarking cadence\n- GOVERN component: Benchmarking scheduler, benchmark results ledger\n\n**MS-2.4** — The ability of humans to interpret AI system outputs when needed is evaluated on a regular basis.\n- Requires explainability and interpretability testing\n- GOVERN component: Explainability assessment module\n\n**MS-2.5** — Risk characteristics established in MP are employed in the measurement and analysis of AI system risks and trustworthiness.\n- Requires traceability from risk identification (MAP) to risk measurement (MEASURE)\n- GOVERN component: Cross-function traceability engine\n\n**MS-2.6** — Risk or performance characteristics established in and of AI systems are verified with the relevant populations.\n- Requires performance validation against representative population samples\n- GOVERN component: Population-representative validation module\n\n---\n\n### MS-3: Performance Monitoring\n\n**Purpose:** AI system performance is tracked throughout the deployment lifecycle.\n\n**Subcategories:**\n\n**MS-3.1** — Ongoing monitoring plans are in place to address the identified AI risks and trustworthiness characteristics of the AI system.\n- Requires monitoring plan documentation per AI system\n- GOVERN component: Monitoring plan builder, monitoring schedule\n\n**MS-3.2** — The risk or performance characteristics of the AI system to be deployed are examined and documented.\n- Requires pre-deployment performance documentation\n- GOVERN component: Pre-deployment risk certification\n\n**MS-3.3** — AI system risks and trustworthiness are measured in deployment and monitoring contexts.\n- Requires in-deployment performance and risk monitoring\n- GOVERN component: Live monitoring dashboard, alert engine\n\n**MS-3.4** — Feedback processes for end users and impacted communities to report problems and provide feedback are established.\n- Requires user-facing feedback mechanism for AI system issues\n- GOVERN component: Public feedback intake module\n\n---\n\n### MS-4: Feedback Integration\n\n**Purpose:** Measurement results and feedback are integrated into AI risk management.\n\n**Subcategories:**\n\n**MS-4.1** — Measurement approaches for identifying AI risks are connected to organizational risk tolerance and relevant laws, regulations, and standards.\n- Requires measurement methodology tied to regulatory requirements\n- GOVERN component: Regulatory measurement alignment\n\n**MS-4.2** — Measurement results inform updates to the risk mapping and risk management approaches.\n- Requires feedback loop from measurement results to MAP and MANAGE functions\n- GOVERN component: Cross-function feedback loop, update workflow\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-7819380f4108@b0b30c9338575829","id":"GUIDE-TAIMSCORE-7819380f4108","version":"b0b30c9338575829","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MAP Function (MP) / MP-3: AI Capabilities and Limitations","statement":"**Purpose:** AI system capabilities, limitations, and trustworthiness properties are documented.\n\n**Subcategories:**\n\n**MP-3.1** — Potential impacts of bias are characterized in data, models, and downstream uses and impacts are documented.\n- Requires bias analysis of training data and model outputs\n- Requires documentation of known bias characteristics\n- GOVERN component: Bias assessment module, bias report generator\n\n**MP-3.2** — Scientific methods — including those from risk sciences, harm sciences, and social sciences — are used to inform bias assessments and documentation.\n- Requires peer-reviewed or validated bias assessment methodology\n- GOVERN component: Methodology documentation, validation records\n\n**MP-3.3** — Processes for operator and user feedback about AI system performance and trustworthiness are established and integrated into AI system updates.\n- Requires feedback channel for operators and users to report AI performance issues\n- Requires process to incorporate feedback into system updates\n- GOVERN component: Feedback intake module, change management integration\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-80ed04b7deed@8370d2982cfae971","id":"GUIDE-TAIMSCORE-80ed04b7deed","version":"8370d2982cfae971","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Function (GV) / GV-4: Organizational Teams Are Committed","statement":"**Purpose:** Cross-functional commitment to AI risk management is embedded.\n\n**Subcategories:**\n\n**GV-4.1** — Organizational policies and practices are in place to foster AI risk awareness and to create a culture of trustworthy, responsible AI.\n- Requires AI ethics principles documented and socialized\n- Requires leadership messaging on responsible AI\n- GOVERN component: Culture assessment, policy publication engine\n\n**GV-4.2** — Organizational teams document the risks and potential impacts of AI technologies applied to their functions and using their data.\n- Requires business unit AI risk registers\n- Requires impact documentation per AI use case\n- GOVERN component: Risk register, per-system risk ledger\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-88782766250f@07d9fe9c36eed563","id":"GUIDE-TAIMSCORE-88782766250f","version":"07d9fe9c36eed563","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MEASURE Function (MS) / MS-2: Risk Analysis","statement":"**Purpose:** AI risks are evaluated using measurement data and expert analysis.\n\n**Subcategories:**\n\n**MS-2.1** — Test sets, metrics, and details about the tools used during test, evaluation, validation, and verification (TEVV) are documented.\n- Requires TEVV documentation including test datasets, metrics, and tools\n- GOVERN component: TEVV documentation module, test artifact registry\n\n**MS-2.2** — AI system trustworthiness characteristics are calibrated for risks of under- and over-reliance on AI systems.\n- Requires calibration testing for confidence and uncertainty estimation\n- GOVERN component: Calibration assessment, uncertainty quantification tracker\n\n**MS-2.3** — AI system performance and trustworthiness characteristics are evaluated regularly against benchmarks.\n- Requires regular performance benchmarking cadence\n- GOVERN component: Benchmarking scheduler, benchmark results ledger\n\n**MS-2.4** — The ability of humans to interpret AI system outputs when needed is evaluated on a regular basis.\n- Requires explainability and interpretability testing\n- GOVERN component: Explainability assessment module\n\n**MS-2.5** — Risk characteristics established in MP are employed in the measurement and analysis of AI system risks and trustworthiness.\n- Requires traceability from risk identification (MAP) to risk measurement (MEASURE)\n- GOVERN component: Cross-function traceability engine\n\n**MS-2.6** — Risk or performance characteristics established in and of AI systems are verified with the relevant populations.\n- Requires performance validation against representative population samples\n- GOVERN component: Population-representative validation module\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-8ac247cb874b@084933159965f0d5","id":"GUIDE-TAIMSCORE-8ac247cb874b","version":"084933159965f0d5","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Function (GV) / GV-2: Accountability Structures","statement":"**Purpose:** Accountability is established across the AI lifecycle.\n\n**Subcategories:**\n\n**GV-2.1** — Roles and responsibilities and organizational accountabilities for personnel involved with the design, development, deployment, assessment and monitoring of AI systems are established.\n- Requires RACI matrix for AI roles\n- Requires defined responsibilities for data scientists, ML engineers, risk officers, legal, compliance\n- GOVERN component: Role registry, accountability matrix\n\n**GV-2.2** — The risk or legal review function is documented and accountable to senior leadership.\n- Requires documented reporting structure for AI legal/risk function\n- GOVERN component: Governance structure documentation\n\n**GV-2.3** — Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.\n- Requires board-level or C-suite AI risk acknowledgment records\n- GOVERN component: Executive attestation module\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-aa6d2eda81a0@30691f48ee9e09ba","id":"GUIDE-TAIMSCORE-aa6d2eda81a0","version":"30691f48ee9e09ba","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MANAGE Function (MG) / MG-4: Risk Communication","statement":"**Purpose:** AI risk information is communicated to relevant stakeholders.\n\n**Subcategories:**\n\n**MG-4.1** — Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors across the AI lifecycle.\n- Requires active post-deployment monitoring program\n- GOVERN component: Post-deployment monitoring dashboard\n\n**MG-4.2** — Measurable performance improvements or declines and other changes in deployed AI system trustworthiness are evaluated and documented.\n- Requires performance trend tracking over time\n- GOVERN component: Performance trend tracker, delta reporting\n\n**MG-4.3** — Feedback processes for improvement are followed for deployed AI systems.\n- Requires documented improvement process using monitoring and feedback data\n- GOVERN component: Improvement workflow engine\n\n**MG-4.4** — Organizational teams communicate with personnel to report problems and suggest opportunities for improvement across the AI lifecycle.\n- Requires internal communication process for AI risk findings\n- GOVERN component: Internal communication module, findings distribution\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-b403499ddae8@55ea6367216eb219","id":"GUIDE-TAIMSCORE-b403499ddae8","version":"55ea6367216eb219","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Function (GV) / GV-6: Policies and Procedures","statement":"**Purpose:** Legal, compliance, and governance requirements are integrated into AI processes.\n\n**Subcategories:**\n\n**GV-6.1** — Policies and procedures are in place for the identification and documentation of legal requirements related to AI use, including international requirements for AI systems used in multiple jurisdictions.\n- Requires legal inventory of applicable AI regulations per jurisdiction\n- Requires documentation of AI system jurisdictional scope\n- GOVERN component: Regulatory mapping engine, jurisdiction tracker\n\n**GV-6.2** — Organizational risk policies are inclusive of regulatory compliance and legal requirements.\n- Requires AI compliance program covering NIST, ISO, EU AI Act, FedRAMP as applicable\n- GOVERN component: Compliance gap tracker, standard alignment report\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-c24d6381bc21@26ce2491fe9416f6","id":"GUIDE-TAIMSCORE-c24d6381bc21","version":"26ce2491fe9416f6","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Assessment Workflow in GOVERN","statement":"1. **Intake** — User identifies AI system, deployment context, and applicable standards\n2. **Profile Selection** — GOVERN loads appropriate TAIMScore profile (General / Federal / Healthcare / Financial Services)\n3. **Control Evaluation** — User or automated scan scores each of the 72 subcategories (0–4)\n4. **Evidence Collection** — GOVERN prompts for evidence artifacts per control\n5. **Gap Analysis** — GOVERN identifies controls below threshold (default threshold: score ≥ 3 for Established)\n6. **Remediation Plan** — GOVERN generates prioritized remediation tasks per gap\n7. **Report Generation** — TAIMScore Composite + function scores + gap list + remediation roadmap\n8. **Continuous Monitoring** — GOVERN re-evaluates MS and MG controls on defined cadence\n\n---\n\n*TAIMScore™ is a trademark of HISPI Project Cerebellum. Framework content aligns with NIST AI 100-1 (public domain). This document is maintained in GOVERN's Policy Engine as the TAIMScore framework template.*","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-cd0ce40680a4@b7f780cfda3b881d","id":"GUIDE-TAIMSCORE-cd0ce40680a4","version":"b7f780cfda3b881d","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MANAGE Function (MG) / MG-1: Risk Response Plans","statement":"**Purpose:** Responses to identified AI risks are planned and documented.\n\n**Subcategories:**\n\n**MG-1.1** — A set of risk treatment options (responses) are documented for AI risks including the avoidance, acceptance, transfer, and control of risks.\n- Requires documented risk treatment options per risk category\n- Requires justification for selected treatment approach\n- GOVERN component: Risk treatment library, treatment selection workflow\n\n**MG-1.2** — Treatment of AI risks includes a determination of residual risks after the risk response plan has been implemented.\n- Requires residual risk documentation post-treatment\n- GOVERN component: Residual risk tracker\n\n**MG-1.3** — Responses to the AI risks deemed high priority are developed, planned, and documented.\n- Requires expedited response plans for high-priority risks\n- GOVERN component: Priority risk response queue, response SLA tracking\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-d60b914f6dd6@c6c63571fab7605d","id":"GUIDE-TAIMSCORE-d60b914f6dd6","version":"c6c63571fab7605d","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MANAGE Function (MG) / MG-2: Risk Response Execution","statement":"**Purpose:** Risk responses are implemented effectively.\n\n**Subcategories:**\n\n**MG-2.1** — Resources required to manage AI risks are taken into account including the staff, budget, and compute required for implementation.\n- Requires resource plan for AI risk management activities\n- GOVERN component: Resource allocation module\n\n**MG-2.2** — Mechanisms are in place and applied to sustain the value of deployed AI systems and to manage the risks of AI system decommissioning, including appropriate archiving of useful elements.\n- Requires AI system lifecycle management process including decommissioning\n- GOVERN component: Lifecycle management tracker, decommissioning checklist\n\n**MG-2.3** — Procedures are followed to respond to and recover from a previously unknown risk.\n- Requires incident response procedure for novel AI risks\n- GOVERN component: Incident response playbook, novel risk intake\n\n**MG-2.4** — Mechanisms are in place to allow personnel to report problems to management.\n- Requires internal reporting mechanism for AI risk issues\n- GOVERN component: Internal risk reporting module, escalation workflow\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-e5a52228ee60@3bdbf30b9ef74343","id":"GUIDE-TAIMSCORE-e5a52228ee60","version":"3bdbf30b9ef74343","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"Standards Alignment / SOC 2 Type II","statement":"| SOC 2 Trust Service Criterion | TAIMScore Controls |\n|------------------------------|-------------------|\n| CC1 (Control Environment) | GV-1.1, GV-2.1 |\n| CC2 (Communication and Information) | GV-1.4, MG-4.4 |\n| CC3 (Risk Assessment) | MP-1.5, MP-2.2 |\n| CC4 (Monitoring of Controls) | GV-1.5, MS-3.3 |\n| CC5 (Control Activities) | MG-1.1, MG-2.3 |\n| CC6 (Logical and Physical Access) | GV-2.1, GV-1.6 |\n| CC7 (System Operations) | MS-3.1, MS-3.3 |\n| CC8 (Change Management) | MP-3.3, MG-2.2 |\n| CC9 (Risk Mitigation) | MG-1.2, MG-1.3 |","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-e76ce119f90c@f66687dbfe6679aa","id":"GUIDE-TAIMSCORE-e76ce119f90c","version":"f66687dbfe6679aa","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"GOVERN Component Mapping","statement":"The following table maps TAIMScore controls to GOVERN's functional components:\n\n| TAIMScore Control | GOVERN Component |\n|------------------|-----------------|\n| GV-1.1, GV-1.2, GV-6.1, GV-6.2 | Policy Engine |\n| GV-1.3, GV-2.1, GV-2.2, GV-2.3 | Accountability Ledger |\n| GV-1.5, MS-3.3, MG-4.1 | Continuous Monitoring Dashboard |\n| GV-1.6, MP-1.6 | Third-Party Assess Mode |\n| GV-3.2 | Training and Certification Tracker |\n| GV-5.2, MP-4.1 | Risk Tolerance Configuration |\n| MP-1.1, MP-1.2 | System Inventory and Model Card |\n| MP-1.4, MP-1.5 | Harm Assessment and Risk Scoring Engine |\n| MP-2.2 | Risk Classification Workflow |\n| MP-3.1 | Bias Assessment Module |\n| MS-1.1 | Metrics Library |\n| MS-2.1 | TEVV Documentation Module |\n| MS-2.4 | Explainability Assessment |\n| MS-3.1, MS-3.2 | Pre-Deployment Risk Certification |\n| MG-1.1, MG-1.3 | Risk Treatment Queue |\n| MG-2.3 | Incident Response Playbook |\n| MG-3.3, MS-4.2 | Cross-Function Feedback Loop |\n| MG-4.2 | Performance Trend Tracker |\n\n**GOVERN Assess Modes:**\n- **Rapid Assess** — surveys GV and MP controls; produces TAIMScore Composite with gaps highlighted\n- **Deep Assess** — full 72-control evaluation; produces scored report, gap remediation plan, evidence requirements\n- **Continuous Assess** — ongoing monitoring against MS and MG controls; alerts on score degradation\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-e7b8b8990fe3@3f324f97a6010437","id":"GUIDE-TAIMSCORE-e7b8b8990fe3","version":"3f324f97a6010437","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MAP Function (MP) / MP-2: Scientific Basis of AI Risk","statement":"**Purpose:** AI risks are classified and framed relative to accepted scientific knowledge.\n\n**Subcategories:**\n\n**MP-2.1** — Scientific community norms for validating AI risks and potential impacts are followed.\n- Requires model validation methodology documentation\n- Requires reference to peer-reviewed standards and research\n- GOVERN component: Validation methodology registry\n\n**MP-2.2** — Risk classifications are defined by the organization and used in AI risk classification decisions.\n- Requires defined risk taxonomy (e.g., low/medium/high/critical)\n- Requires documented classification criteria\n- GOVERN component: Risk taxonomy engine, classification workflow\n\n**MP-2.3** — AI system risk and benefit analysis incorporates considerations of affected individuals and groups.\n- Requires stakeholder impact analysis covering affected populations\n- GOVERN component: Stakeholder mapping module\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-eb6cc3ec525c@559936d9d7d0351e","id":"GUIDE-TAIMSCORE-eb6cc3ec525c","version":"559936d9d7d0351e","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MANAGE Function (MG)","statement":"The MANAGE function addresses AI risks that have been identified and prioritized, defining responses, treatments, and ongoing monitoring.\n\n### MG-1: Risk Response Plans\n\n**Purpose:** Responses to identified AI risks are planned and documented.\n\n**Subcategories:**\n\n**MG-1.1** — A set of risk treatment options (responses) are documented for AI risks including the avoidance, acceptance, transfer, and control of risks.\n- Requires documented risk treatment options per risk category\n- Requires justification for selected treatment approach\n- GOVERN component: Risk treatment library, treatment selection workflow\n\n**MG-1.2** — Treatment of AI risks includes a determination of residual risks after the risk response plan has been implemented.\n- Requires residual risk documentation post-treatment\n- GOVERN component: Residual risk tracker\n\n**MG-1.3** — Responses to the AI risks deemed high priority are developed, planned, and documented.\n- Requires expedited response plans for high-priority risks\n- GOVERN component: Priority risk response queue, response SLA tracking\n\n---\n\n### MG-2: Risk Response Execution\n\n**Purpose:** Risk responses are implemented effectively.\n\n**Subcategories:**\n\n**MG-2.1** — Resources required to manage AI risks are taken into account including the staff, budget, and compute required for implementation.\n- Requires resource plan for AI risk management activities\n- GOVERN component: Resource allocation module\n\n**MG-2.2** — Mechanisms are in place and applied to sustain the value of deployed AI systems and to manage the risks of AI system decommissioning, including appropriate archiving of useful elements.\n- Requires AI system lifecycle management process including decommissioning\n- GOVERN component: Lifecycle management tracker, decommissioning checklist\n\n**MG-2.3** — Procedures are followed to respond to and recover from a previously unknown risk.\n- Requires incident response procedure for novel AI risks\n- GOVERN component: Incident response playbook, novel risk intake\n\n**MG-2.4** — Mechanisms are in place to allow personnel to report problems to management.\n- Requires internal reporting mechanism for AI risk issues\n- GOVERN component: Internal risk reporting module, escalation workflow\n\n---\n\n### MG-3: Risk Treatment Feedback\n\n**Purpose:** Treatment effectiveness is assessed and improvements are made.\n\n**Subcategories:**\n\n**MG-3.1** — Risk treatment strategies and methods are documented, as are the reasons for the selection of risk treatment options.\n- Requires treatment selection rationale documentation\n- GOVERN component: Treatment rationale ledger\n\n**MG-3.2** — Treatment of AI risks includes a determination of residual risk after the risk response plan has been implemented.\n- Requires residual risk assessment post-implementation\n- GOVERN component: Post-treatment residual risk review\n\n**MG-3.3** — Feedback processes are in place to inform updates to the risk mapping, risk analysis, risk treatment, and monitoring activities.\n- Requires cross-function feedback loop from MANAGE back to MAP and MEASURE\n- GOVERN component: Feedback integration engine, continuous improvement workflow\n\n**MG-3.4** — Risk treatment plans for AI systems are maintained and updated regularly.\n- Requires periodic review and update of treatment plans\n- GOVERN component: Treatment plan review scheduler, update records\n\n---\n\n### MG-4: Risk Communication\n\n**Purpose:** AI risk information is communicated to relevant stakeholders.\n\n**Subcategories:**\n\n**MG-4.1** — Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors across the AI lifecycle.\n- Requires active post-deployment monitoring program\n- GOVERN component: Post-deployment monitoring dashboard\n\n**MG-4.2** — Measurable performance improvements or declines and other changes in deployed AI system trustworthiness are evaluated and documented.\n- Requires performance trend tracking over time\n- GOVERN component: Performance trend tracker, delta reporting\n\n**MG-4.3** — Feedback processes for improvement are followed for deployed AI systems.\n- Requires documented improvement process using monitoring and feedback data\n- GOVERN component: Improvement workflow engine\n\n**MG-4.4** — Organizational teams communicate with personnel to report problems and suggest opportunities for improvement across the AI lifecycle.\n- Requires internal communication process for AI risk findings\n- GOVERN component: Internal communication module, findings distribution\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-ee606d117560@6af48156e0d04548","id":"GUIDE-TAIMSCORE-ee606d117560","version":"6af48156e0d04548","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MEASURE Function (MS) / MS-4: Feedback Integration","statement":"**Purpose:** Measurement results and feedback are integrated into AI risk management.\n\n**Subcategories:**\n\n**MS-4.1** — Measurement approaches for identifying AI risks are connected to organizational risk tolerance and relevant laws, regulations, and standards.\n- Requires measurement methodology tied to regulatory requirements\n- GOVERN component: Regulatory measurement alignment\n\n**MS-4.2** — Measurement results inform updates to the risk mapping and risk management approaches.\n- Requires feedback loop from measurement results to MAP and MANAGE functions\n- GOVERN component: Cross-function feedback loop, update workflow\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-f8a4f7493775@a881da89dbaa2337","id":"GUIDE-TAIMSCORE-f8a4f7493775","version":"a881da89dbaa2337","kind":"guidance","lifecycle":"SECONDARY_REFERENCE","title":"MAP Function (MP)","statement":"The MAP function establishes the context for AI risk assessment — categorizing systems, identifying stakeholders, and framing the risks present.\n\n### MP-1: Context Is Established\n\n**Purpose:** The organizational context and AI system context are documented before risk assessment.\n\n**Subcategories:**\n\n**MP-1.1** — Intended purpose, potentially beneficial uses, context of use, and risks of AI systems are understood and documented.\n- Requires documented AI system purpose statement\n- Requires identification of intended use cases and out-of-scope uses\n- GOVERN component: System inventory, use case registry\n\n**MP-1.2** — Scientific findings, technical standards, and trustworthiness of AI systems are understood, documented, and communicated.\n- Requires technical documentation of AI model architecture, training data, and performance characteristics\n- GOVERN component: Technical fact sheet generator, model card integration\n\n**MP-1.3** — Potential benefits of intended AI system deployment — including financial, societal, and broadly beneficial uses — are examined and documented.\n- Requires documented benefits analysis per AI system\n- GOVERN component: Benefits documentation module\n\n**MP-1.4** — Risks or harms of deployed AI systems — and their potential consequences to individuals, groups, communities, organizations, and society — are examined and documented.\n- Requires impact assessment covering affected individuals and groups\n- Requires documentation of high-risk harm scenarios\n- GOVERN component: Harm assessment module, impact ledger\n\n**MP-1.5** — Likelihood and magnitude of each identified AI system risk or impact are estimated and documented.\n- Requires risk likelihood and magnitude scoring methodology\n- GOVERN component: Risk scoring engine, probability-impact matrix\n\n**MP-1.6** — Risks or harms from third-party use of the organization's data or AI systems, including data provenance, data quality, and supply chain risks, are documented.\n- Requires third-party data risk documentation\n- GOVERN component: Data provenance tracker, supply chain risk register\n\n---\n\n### MP-2: Scientific Basis of AI Risk\n\n**Purpose:** AI risks are classified and framed relative to accepted scientific knowledge.\n\n**Subcategories:**\n\n**MP-2.1** — Scientific community norms for validating AI risks and potential impacts are followed.\n- Requires model validation methodology documentation\n- Requires reference to peer-reviewed standards and research\n- GOVERN component: Validation methodology registry\n\n**MP-2.2** — Risk classifications are defined by the organization and used in AI risk classification decisions.\n- Requires defined risk taxonomy (e.g., low/medium/high/critical)\n- Requires documented classification criteria\n- GOVERN component: Risk taxonomy engine, classification workflow\n\n**MP-2.3** — AI system risk and benefit analysis incorporates considerations of affected individuals and groups.\n- Requires stakeholder impact analysis covering affected populations\n- GOVERN component: Stakeholder mapping module\n\n---\n\n### MP-3: AI Capabilities and Limitations\n\n**Purpose:** AI system capabilities, limitations, and trustworthiness properties are documented.\n\n**Subcategories:**\n\n**MP-3.1** — Potential impacts of bias are characterized in data, models, and downstream uses and impacts are documented.\n- Requires bias analysis of training data and model outputs\n- Requires documentation of known bias characteristics\n- GOVERN component: Bias assessment module, bias report generator\n\n**MP-3.2** — Scientific methods — including those from risk sciences, harm sciences, and social sciences — are used to inform bias assessments and documentation.\n- Requires peer-reviewed or validated bias assessment methodology\n- GOVERN component: Methodology documentation, validation records\n\n**MP-3.3** — Processes for operator and user feedback about AI system performance and trustworthiness are established and integrated into AI system updates.\n- Requires feedback channel for operators and users to report AI performance issues\n- Requires process to incorporate feedback into system updates\n- GOVERN component: Feedback intake module, change management integration\n\n---\n\n### MP-4: Risks Are Prioritized\n\n**Purpose:** Identified risks are triaged and prioritized for response.\n\n**Subcategories:**\n\n**MP-4.1** — The organization's risk tolerance for the AI system under consideration is established, communicated, and incorporated into the risk identification and classification process.\n- Requires risk tolerance applied at system level\n- GOVERN component: Per-system risk tolerance configuration\n\n**MP-4.2** — Risk levels of AI systems at deployment are documented per risk classification and tolerance levels.\n- Requires system-level risk rating at deployment\n- GOVERN component: Deployment risk certification, risk ledger\n\n---\n\n### MP-5: Organizational Risk Management\n\n**Purpose:** AI risk management is integrated with enterprise risk management processes.\n\n**Subcategories:**\n\n**MP-5.1** — Likelihood of encountering AI risks given use of AI and organizational risk tolerances is determined.\n- Requires probability analysis of AI risk exposure\n- GOVERN component: Exposure analysis module\n\n**MP-5.2** — Organizations are transparent about known limitations and where knowledge is incomplete.\n- Requires documented limitations section in AI system documentation\n- GOVERN component: Limitations register, transparency report\n\n**MP-5.3** — Organizational risk policies include and are inclusive of AI risks.\n- Requires AI risk explicitly included in enterprise risk policies\n- GOVERN component: Policy integration audit\n\n**MP-5.4** — Risk tolerance for the development and deployment of AI systems is established, communicated, and regularly reviewed.\n- Requires formal risk tolerance review cadence\n- GOVERN component: Risk tolerance review scheduler, review records\n\n**MP-5.5** — Practices and documentation establish how identified risks will be addressed and where they fall in the organization's risk management framework.\n- Requires documented risk treatment methodology\n- GOVERN component: Risk treatment tracker, treatment workflow engine\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"MS-HISTORICAL-GAP-01@ef333861512e5931","id":"MS-HISTORICAL-GAP-01","version":"ef333861512e5931","kind":"historical_finding","lifecycle":"HISTORICAL","title":"Coverage claim mismatch","statement":"User described ten AI systems; code contains nine adapters.","family":"Historical implementation gap","body":{"severity":"High","risk":"Inventory and scope integrity","recommendation":"Confirm the intended tenth system; drive UI count from adapter registry.","linkedBaseline":"OP-09","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-02@704ee5c4492909d6","id":"MS-HISTORICAL-GAP-02","version":"704ee5c4492909d6","kind":"historical_finding","lifecycle":"HISTORICAL","title":"External response not intercepted","statement":"Third-party AI outputs are not scanned, redacted or held.","family":"Historical implementation gap","body":{"severity":"Critical","risk":"Sensitive disclosure, misinformation, unsafe output","recommendation":"Add response interception/gateway integration and OU rules.","linkedBaseline":"OU-01–OU-12","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-03@a613206359c61d90","id":"MS-HISTORICAL-GAP-03","version":"a613206359c61d90","kind":"historical_finding","lifecycle":"HISTORICAL","title":"Uploads are not stopped","statement":"Readable text files ≤1 MB are scanned/logged, but upload events are not prevented.","family":"Historical implementation gap","body":{"severity":"Critical","risk":"Sensitive data and malicious document ingestion","recommendation":"Block/quarantine before upload; cover binary, archive, OCR and oversize files.","linkedBaseline":"DP; IN-02; IN-03; IN-05","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-04@a2b05c620c5f50ed","id":"MS-HISTORICAL-GAP-04","version":"a2b05c620c5f50ed","kind":"historical_finding","lifecycle":"HISTORICAL","title":"Fail-open enforcement","statement":"Engine errors, timeouts and selector misses allow the request to continue.","family":"Historical implementation gap","body":{"severity":"Critical","risk":"Critical rule bypass","recommendation":"Use severity-aware fail-closed behavior, health checks and user-visible safe fallback.","linkedBaseline":"OP-05; all Critical rules","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-05@fd1e5fbd26653f52","id":"MS-HISTORICAL-GAP-05","version":"fd1e5fbd26653f52","kind":"historical_finding","lifecycle":"HISTORICAL","title":"Limited detector set","statement":"Built-ins cover email, phone, credit card, SSN, IBAN, IP and secrets only.","family":"Historical implementation gap","body":{"severity":"High","risk":"Uncovered regulated and enterprise data","recommendation":"Add bank routing/account, PHI, biometrics, location, CUI, privilege, MNPI and organization entities.","linkedBaseline":"DP-01–DP-18","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-06@638e326b96b3fcf3","id":"MS-HISTORICAL-GAP-06","version":"638e326b96b3fcf3","kind":"historical_finding","lifecycle":"HISTORICAL","title":"No identity or device context","statement":"No SSO, MFA, role, group, tenant or managed-device assertion is used.","family":"Historical implementation gap","body":{"severity":"Critical","risk":"Unauthorized AI use and data access","recommendation":"Integrate IdP/device posture and enforce AU-02/AU-03/AU-06.","linkedBaseline":"AU-02; AU-03; AU-06","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-07@9c8fde7f6beb59a9","id":"MS-HISTORICAL-GAP-07","version":"9c8fde7f6beb59a9","kind":"historical_finding","lifecycle":"HISTORICAL","title":"No exceptions lifecycle","statement":"No scoped approval, compensating control, expiry or auto-revocation model.","family":"Historical implementation gap","body":{"severity":"High","risk":"Permanent bypasses and audit gaps","recommendation":"Implement versioned exceptions with owner, scope and expiry.","linkedBaseline":"OP-07","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-08@454bf9cdcc63df06","id":"MS-HISTORICAL-GAP-08","version":"454bf9cdcc63df06","kind":"historical_finding","lifecycle":"HISTORICAL","title":"No unified evidence store","statement":"Runtime events exist, but evidence types, integrity, retention and framework claims are not modeled holistically.","family":"Historical implementation gap","body":{"severity":"High","risk":"Weak auditability","recommendation":"Create evidence objects linked to rule, control, system, period and assessor.","linkedBaseline":"OP-01; score model","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-09@3df71044c3ecb595","id":"MS-HISTORICAL-GAP-09","version":"3df71044c3ecb595","kind":"historical_finding","lifecycle":"HISTORICAL","title":"No agent-action enforcement","statement":"No tool-call, connector, transaction, recipient or destructive-action controls.","family":"Historical implementation gap","body":{"severity":"Critical","risk":"Excessive agency and irreversible harm","recommendation":"Add agent gateway and AG-01–AG-10.","linkedBaseline":"AG-01–AG-10","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-10@9d50c828fd6ea39b","id":"MS-HISTORICAL-GAP-10","version":"9d50c828fd6ea39b","kind":"historical_finding","lifecycle":"HISTORICAL","title":"No rule version/effective dates","statement":"Rules lack formal versions, applicability conditions, tests, approvals and effective dates.","family":"Historical implementation gap","body":{"severity":"High","risk":"Uncontrolled policy changes","recommendation":"Add rule lifecycle states, versioning, deployment and rollback.","linkedBaseline":"OP-06; OP-12","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-11@4ae486b4e3826e21","id":"MS-HISTORICAL-GAP-11","version":"4ae486b4e3826e21","kind":"historical_finding","lifecycle":"HISTORICAL","title":"No tenant or case isolation","statement":"No explicit tenant, customer, matter or RAG-context boundary.","family":"Historical implementation gap","body":{"severity":"Critical","risk":"Cross-tenant leakage","recommendation":"Enforce context isolation and canary tests.","linkedBaseline":"AG-08; OU-01","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-12@a7a5a6c9616fce50","id":"MS-HISTORICAL-GAP-12","version":"a7a5a6c9616fce50","kind":"historical_finding","lifecycle":"HISTORICAL","title":"No efficacy metrics","statement":"No precision, recall, bypass, drift or false-positive thresholds are evidenced.","family":"Historical implementation gap","body":{"severity":"Critical","risk":"Controls may appear enabled but fail","recommendation":"Build representative eval sets and release/monitoring thresholds.","linkedBaseline":"OP-03; OP-12","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-13@17c770c42c111ef5","id":"MS-HISTORICAL-GAP-13","version":"17c770c42c111ef5","kind":"historical_finding","lifecycle":"HISTORICAL","title":"No classification-label integration","statement":"Runtime decisions do not consume enterprise DLP labels, repositories, matters or data owners.","family":"Historical implementation gap","body":{"severity":"High","risk":"Context-blind rules","recommendation":"Integrate DLP/classification and organization entities.","linkedBaseline":"DP-07–DP-18","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-14@9547f69026f10453","id":"MS-HISTORICAL-GAP-14","version":"9547f69026f10453","kind":"historical_finding","lifecycle":"HISTORICAL","title":"Adherence terminology overclaims","statement":"The UI divides enabled chat policies by total framework controls and calls it adherence.","family":"Historical implementation gap","body":{"severity":"High","risk":"Misleading compliance claim","recommendation":"Rename to ‘chat-control coverage’; never represent it as compliance or framework adherence.","linkedBaseline":"Scoring model","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-15@b99678b120eb54ee","id":"MS-HISTORICAL-GAP-15","version":"b99678b120eb54ee","kind":"historical_finding","lifecycle":"HISTORICAL","title":"Framework seed scope is narrow","statement":"Only ten U.S.-centric seed frameworks and 35 disabled starter policies are in code.","family":"Historical implementation gap","body":{"severity":"Medium","risk":"Incomplete AI and international coverage","recommendation":"Add NIST AI RMF/GAI, EU AI Act, GDPR, ISO, OWASP 2026 and current state/federal policy mappings.","linkedBaseline":"Framework catalog","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-16@f32af55c238717e3","id":"MS-HISTORICAL-GAP-16","version":"f32af55c238717e3","kind":"historical_finding","lifecycle":"HISTORICAL","title":"Current-source drift","statement":"TAIM references OWASP 2025 and a White House EO category; EO 14110 was rescinded and OWASP 2026 is current.","family":"Historical implementation gap","body":{"severity":"High","risk":"Stale obligations and guidance","recommendation":"Version sources; mark superseded material; monitor authoritative updates.","linkedBaseline":"Framework catalog; Sources","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-17@64b248d8f26e8ce8","id":"MS-HISTORICAL-GAP-17","version":"64b248d8f26e8ce8","kind":"historical_finding","lifecycle":"HISTORICAL","title":"Extracted rules can be semantically unsafe","statement":"Document extraction may convert broad nouns/directives into keyword or semantic rules without applicability context.","family":"Historical implementation gap","body":{"severity":"High","risk":"Overblocking, underblocking, false compliance","recommendation":"Require applicability, owner, decision table, test set and approval before activation.","linkedBaseline":"Rule lifecycle","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-HISTORICAL-GAP-18@f5078914a88d60e6","id":"MS-HISTORICAL-GAP-18","version":"f5078914a88d60e6","kind":"historical_finding","lifecycle":"HISTORICAL","title":"Local logs and admin separation","statement":"Local-only storage can lack centralized integrity, retention, separation of duties and enterprise investigation access.","family":"Historical implementation gap","body":{"severity":"High","risk":"Evidence loss or tampering","recommendation":"Add signed export/central collection, RBAC and retention controls while preserving privacy.","linkedBaseline":"OP-01; OP-04","reportedStatus":"Open","observedInSource":"2026-08-20","currentHostVerified":false}},{"key":"MS-SEED-0318ca8123595a60@ce3f096f7c803475","id":"MS-SEED-0318ca8123595a60","version":"ce3f096f7c803475","kind":"implementation_template","lifecycle":"DISABLED","title":"Student contact details","statement":"Student email addresses require directory-information handling.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"email","action":"warn","severity":"medium","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-0d5943f602c4e0c6@0b72544338892151","id":"MS-SEED-0d5943f602c4e0c6","version":"0b72544338892151","kind":"implementation_template","lifecycle":"DISABLED","title":"Customer data confidentiality","statement":"Customer data must not be disclosed to unauthorized parties.","family":"Disabled code seed","body":{"ruleType":"semantic","detector":null,"action":"warn","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-1362e1ef9da30d6a@a69019f699a9743e","id":"MS-SEED-1362e1ef9da30d6a","version":"a69019f699a9743e","kind":"implementation_template","lifecycle":"DISABLED","title":"SSNs in health records","statement":"Social Security numbers are PHI identifiers and must not be disclosed.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"ssn","action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-189bbb416d04da7a@9eca359a04a266eb","id":"MS-SEED-189bbb416d04da7a","version":"9eca359a04a266eb","kind":"implementation_template","lifecycle":"DISABLED","title":"System configuration details","statement":"Do not reveal system configuration or architecture details to unauthorized parties.","family":"Disabled code seed","body":{"ruleType":"semantic","detector":null,"action":"warn","severity":"medium","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-18fc98793e3aa932@1b1b44969e446920","id":"MS-SEED-18fc98793e3aa932","version":"1b1b44969e446920","kind":"implementation_template","lifecycle":"DISABLED","title":"Customer contact details","statement":"Customer email addresses are confidential customer data.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"email","action":"warn","severity":"medium","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-273c936c3ac5a321@609ed6ce29a693b3","id":"MS-SEED-273c936c3ac5a321","version":"609ed6ce29a693b3","kind":"implementation_template","lifecycle":"DISABLED","title":"Patient email addresses","statement":"Patient email addresses are PHI identifiers.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"email","action":"warn","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-274a1827288fe0cb@596d8feb02101b0a","id":"MS-SEED-274a1827288fe0cb","version":"596d8feb02101b0a","kind":"implementation_template","lifecycle":"DISABLED","title":"Material nonpublic information","statement":"Never share material nonpublic information such as unannounced mergers, acquisitions or deals.","family":"Disabled code seed","body":{"ruleType":"semantic","detector":null,"action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-3545abaedc039060@41f9aeca34965328","id":"MS-SEED-3545abaedc039060","version":"41f9aeca34965328","kind":"implementation_template","lifecycle":"DISABLED","title":"Consumer email addresses","statement":"Consumer email addresses are personal information under the CCPA.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"email","action":"warn","severity":"medium","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-38a0f0c058b76861@f7e97b882e8d03d9","id":"MS-SEED-38a0f0c058b76861","version":"f7e97b882e8d03d9","kind":"implementation_template","lifecycle":"DISABLED","title":"Protected health information","statement":"Never reveal a patient\\u2019s diagnosis, illness, treatment plan or prescribed medication.","family":"Disabled code seed","body":{"ruleType":"semantic","detector":null,"action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-3a800d0a422ff4cf@bb27bd955ce6ac5b","id":"MS-SEED-3a800d0a422ff4cf","version":"bb27bd955ce6ac5b","kind":"implementation_template","lifecycle":"DISABLED","title":"Student records","statement":"Do not disclose grades, transcripts or disciplinary records of students.","family":"Disabled code seed","body":{"ruleType":"semantic","detector":null,"action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-3b2df0684d924bea@d76862e507e52a9e","id":"MS-SEED-3b2df0684d924bea","version":"d76862e507e52a9e","kind":"implementation_template","lifecycle":"DISABLED","title":"Federal metadata addresses","statement":"Do not expose internal government system IP addresses.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"ip","action":"warn","severity":"medium","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-3c262146dff584d9@65146e1683c930ec","id":"MS-SEED-3c262146dff584d9","version":"65146e1683c930ec","kind":"implementation_template","lifecycle":"DISABLED","title":"Authenticator content","statement":"Passwords, keys and other authenticators must not be transmitted in plain text.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"secret","action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-45c0aa82a09ceac4@b7de303ed373dc1e","id":"MS-SEED-45c0aa82a09ceac4","version":"b7de303ed373dc1e","kind":"implementation_template","lifecycle":"DISABLED","title":"Customer financial information","statement":"Do not disclose customer balances, transactions or credit information.","family":"Disabled code seed","body":{"ruleType":"semantic","detector":null,"action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-59116351fad45b18@cef308c28bb05b77","id":"MS-SEED-59116351fad45b18","version":"cef308c28bb05b77","kind":"implementation_template","lifecycle":"DISABLED","title":"Primary account numbers","statement":"Payment card numbers (PAN) must never appear in messages or logs.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"credit_card","action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-68e6b67355afdda4@2380ad816add7da2","id":"MS-SEED-68e6b67355afdda4","version":"2380ad816add7da2","kind":"implementation_template","lifecycle":"DISABLED","title":"Security findings stay internal","statement":"Do not share audit findings or control gaps outside the engagement.","family":"Disabled code seed","body":{"ruleType":"semantic","detector":null,"action":"warn","severity":"medium","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-6962f396beb2c752@af6c264d193e2846","id":"MS-SEED-6962f396beb2c752","version":"af6c264d193e2846","kind":"implementation_template","lifecycle":"DISABLED","title":"Unreleased financial results","statement":"Never share unreleased financial results, revenue numbers or earnings figures before they are announced.","family":"Disabled code seed","body":{"ruleType":"semantic","detector":null,"action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-71dcb43d4ab69039@2cb8ac94477f4fc1","id":"MS-SEED-71dcb43d4ab69039","version":"2cb8ac94477f4fc1","kind":"implementation_template","lifecycle":"DISABLED","title":"PII in messages (SSN)","statement":"Social Security numbers are personally identifiable information and must not be shared.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"ssn","action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-72c2d3940fb2e07d@a30b48de591bab74","id":"MS-SEED-72c2d3940fb2e07d","version":"a30b48de591bab74","kind":"implementation_template","lifecycle":"DISABLED","title":"Selling personal information","statement":"Do not share or sell consumer personal information without an opt-out path.","family":"Disabled code seed","body":{"ruleType":"semantic","detector":null,"action":"warn","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-773a80bd6da7f832@fbd7a85624f21c94","id":"MS-SEED-773a80bd6da7f832","version":"fbd7a85624f21c94","kind":"implementation_template","lifecycle":"DISABLED","title":"Federal system credentials","statement":"Credentials for federal information systems must never be shared.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"secret","action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-7c38f47e89353be2@c668276dcce2c02c","id":"MS-SEED-7c38f47e89353be2","version":"c668276dcce2c02c","kind":"implementation_template","lifecycle":"DISABLED","title":"Cardholder data environment","statement":"Never describe the cardholder data environment, its architecture or network layout to outside parties.","family":"Disabled code seed","body":{"ruleType":"semantic","detector":null,"action":"warn","severity":"medium","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-98c36050538db5d1@65ffe1e6e8668a51","id":"MS-SEED-98c36050538db5d1","version":"65ffe1e6e8668a51","kind":"implementation_template","lifecycle":"DISABLED","title":"Internal IP addresses","statement":"Do not disclose internal network addresses to outside parties.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"ip","action":"warn","severity":"medium","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-9b9cda9c97338d12@ceb60bcac22b5550","id":"MS-SEED-9b9cda9c97338d12","version":"ceb60bcac22b5550","kind":"implementation_template","lifecycle":"DISABLED","title":"Card numbers of customers","statement":"Customer payment card numbers are nonpublic personal information.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"credit_card","action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-ad9fe38d530f8f1e@d7fcddbdb30bd016","id":"MS-SEED-ad9fe38d530f8f1e","version":"d7fcddbdb30bd016","kind":"implementation_template","lifecycle":"DISABLED","title":"Vulnerability details","statement":"Never share details of unpatched security vulnerabilities with anyone outside the company.","family":"Disabled code seed","body":{"ruleType":"semantic","detector":null,"action":"warn","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-af63591ae8a0d1d3@cf9fcbd0c3f96907","id":"MS-SEED-af63591ae8a0d1d3","version":"cf9fcbd0c3f96907","kind":"implementation_template","lifecycle":"DISABLED","title":"Bank account numbers","statement":"Customer account and routing numbers are nonpublic personal information.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"iban","action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-af6d2822af49aa78@15cfcad58c3a6910","id":"MS-SEED-af6d2822af49aa78","version":"15cfcad58c3a6910","kind":"implementation_template","lifecycle":"DISABLED","title":"Audit workpapers","statement":"Audit workpapers and drafts must not circulate outside the audit team.","family":"Disabled code seed","body":{"ruleType":"keyword","detector":"audit workpaper, workpapers","action":"warn","severity":"medium","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-c3235745be75933b@c2946015ae62bccb","id":"MS-SEED-c3235745be75933b","version":"c2946015ae62bccb","kind":"implementation_template","lifecycle":"DISABLED","title":"Card verification codes","statement":"CVV/CVC codes must never be stored or transmitted after authorization.","family":"Disabled code seed","body":{"ruleType":"keyword","detector":"cvv, cvc, card verification","action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-db227e3fca1cbc72@ad3e673390385458","id":"MS-SEED-db227e3fca1cbc72","version":"ad3e673390385458","kind":"implementation_template","lifecycle":"DISABLED","title":"Authorization boundary details","statement":"Do not describe the authorization boundary or POA&M items externally.","family":"Disabled code seed","body":{"ruleType":"semantic","detector":null,"action":"warn","severity":"medium","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-e7da922c47d356c8@a8f292c00608d481","id":"MS-SEED-e7da922c47d356c8","version":"a8f292c00608d481","kind":"implementation_template","lifecycle":"DISABLED","title":"Student SSNs","statement":"Student Social Security numbers are protected identifiers.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"ssn","action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-ea7497b6cbeba00e@7470eaf94aa87c41","id":"MS-SEED-ea7497b6cbeba00e","version":"7470eaf94aa87c41","kind":"implementation_template","lifecycle":"DISABLED","title":"Incident details stay internal","statement":"Do not discuss active security incidents with anyone outside the response team.","family":"Disabled code seed","body":{"ruleType":"semantic","detector":null,"action":"warn","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-f14ef687ebdcf6dd@e868935a9f5522b7","id":"MS-SEED-f14ef687ebdcf6dd","version":"e868935a9f5522b7","kind":"implementation_template","lifecycle":"DISABLED","title":"Consumer phone numbers","statement":"Consumer phone numbers are personal information under the CCPA.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"phone","action":"warn","severity":"medium","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-f24cc8315666f56b@0b522650197658e0","id":"MS-SEED-f24cc8315666f56b","version":"0b522650197658e0","kind":"implementation_template","lifecycle":"DISABLED","title":"SSNs of consumers","statement":"Social Security numbers require heightened protection under the CPRA.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"ssn","action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-fa17b2e8b13c54ec@c3bb1f47e455b596","id":"MS-SEED-fa17b2e8b13c54ec","version":"c3bb1f47e455b596","kind":"implementation_template","lifecycle":"DISABLED","title":"Controlled Unclassified Information","statement":"Controlled Unclassified Information must not leave authorized channels.","family":"Disabled code seed","body":{"ruleType":"keyword","detector":"CUI","action":"warn","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-fabd8a5fa3829b34@a1173a790d6af788","id":"MS-SEED-fabd8a5fa3829b34","version":"a1173a790d6af788","kind":"implementation_template","lifecycle":"DISABLED","title":"Production credentials","statement":"Production credentials and access tokens must never be shared.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"secret","action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-fc49123874e83c92@1ed210287f703b82","id":"MS-SEED-fc49123874e83c92","version":"1ed210287f703b82","kind":"implementation_template","lifecycle":"DISABLED","title":"Credentials & API keys","statement":"Authentication secrets, API keys and tokens must never be shared in messages.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"secret","action":"block","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-SEED-fc55d1561526efc3@99d4d53f8b22179d","id":"MS-SEED-fc55d1561526efc3","version":"99d4d53f8b22179d","kind":"implementation_template","lifecycle":"DISABLED","title":"Patient contact information","statement":"Patient phone numbers are PHI identifiers.","family":"Disabled code seed","body":{"ruleType":"pii_builtin","detector":"phone","action":"warn","severity":"high","reportedDefaultState":"Disabled","note":"Chat-addressable seed only; review applicability and test before enabling.","machineExecutable":false,"enforcementVerified":false}},{"key":"MS-OVERLAY-CUS-01@ef016720fa4b77d5","id":"MS-OVERLAY-CUS-01","version":"ef016720fa4b77d5","kind":"overlay","lifecycle":"TEMPLATE","title":"Block named individuals’ or VIP data","statement":"Organization-specific identifier lists","family":"Organization-specific overlay","body":{"sourceId":"CUS-01","requiredOrganizationInput":"Organization-specific identifier lists","parentRules":["DP-05","DP-09"],"mechanism":"Regex/keyword/entity","defaultAction":"Block","suggestedOwner":"Privacy owner","designNote":"Needs strict access and false-positive testing","adopted":false}},{"key":"MS-OVERLAY-CUS-02@2bdb2cb7097a15c7","id":"MS-OVERLAY-CUS-02","version":"2bdb2cb7097a15c7","kind":"overlay","lifecycle":"TEMPLATE","title":"Block client and project codewords","statement":"Client names, codenames, deal rooms and matter numbers","family":"Organization-specific overlay","body":{"sourceId":"CUS-02","requiredOrganizationInput":"Client names, codenames, deal rooms and matter numbers","parentRules":["DP-14","DP-16","DP-18"],"mechanism":"Keyword/entity/classification","defaultAction":"Block or approve","suggestedOwner":"Business data owner","designNote":"Often not present in external frameworks","adopted":false}},{"key":"MS-OVERLAY-CUS-03@9e0dd72cbcd36d06","id":"MS-OVERLAY-CUS-03","version":"9e0dd72cbcd36d06","kind":"overlay","lifecycle":"TEMPLATE","title":"Restrict specific email domains","statement":"Personal, competitor, customer or external domains","family":"Organization-specific overlay","body":{"sourceId":"CUS-03","requiredOrganizationInput":"Personal, competitor, customer or external domains","parentRules":["AU-01","AG-05"],"mechanism":"Domain/context","defaultAction":"Block or warn","suggestedOwner":"IT / Security","designNote":"May combine with recipient approval","adopted":false}},{"key":"MS-OVERLAY-CUS-04@1f8a3af1c8e871ca","id":"MS-OVERLAY-CUS-04","version":"1f8a3af1c8e871ca","kind":"overlay","lifecycle":"TEMPLATE","title":"Restrict repositories and file paths","statement":"Production repos, regulated shares, privileged folders","family":"Organization-specific overlay","body":{"sourceId":"CUS-04","requiredOrganizationInput":"Production repos, regulated shares, privileged folders","parentRules":["DP-14","DP-16"],"mechanism":"Path/repository metadata","defaultAction":"Block","suggestedOwner":"Engineering / Data owner","designNote":"Requires upload/source metadata","adopted":false}},{"key":"MS-OVERLAY-CUS-05@312949a220d7aa56","id":"MS-OVERLAY-CUS-05","version":"312949a220d7aa56","kind":"overlay","lifecycle":"TEMPLATE","title":"Approved model and version list","statement":"Enterprise-approved model IDs and release channels","family":"Organization-specific overlay","body":{"sourceId":"CUS-05","requiredOrganizationInput":"Enterprise-approved model IDs and release channels","parentRules":["AU-04"],"mechanism":"Allowlist","defaultAction":"Block","suggestedOwner":"AI governance","designNote":"Reassess on model change","adopted":false}},{"key":"MS-OVERLAY-CUS-06@b76726eea76800fb","id":"MS-OVERLAY-CUS-06","version":"b76726eea76800fb","kind":"overlay","lifecycle":"TEMPLATE","title":"Approved geography and tenant","statement":"Regions, tenant IDs, enterprise accounts and device posture","family":"Organization-specific overlay","body":{"sourceId":"CUS-06","requiredOrganizationInput":"Regions, tenant IDs, enterprise accounts and device posture","parentRules":["AU-02","AU-05","AU-06"],"mechanism":"Session/context","defaultAction":"Block","suggestedOwner":"Security / Privacy","designNote":"Needs identity and provider integration","adopted":false}},{"key":"MS-OVERLAY-CUS-07@e7e1902f4641a2b9","id":"MS-OVERLAY-CUS-07","version":"e7e1902f4641a2b9","kind":"overlay","lifecycle":"TEMPLATE","title":"Required disclaimer by workflow","statement":"Legal, medical, financial, support or public-facing wording","family":"Organization-specific overlay","body":{"sourceId":"CUS-07","requiredOrganizationInput":"Legal, medical, financial, support or public-facing wording","parentRules":["OU-04","OU-12"],"mechanism":"Use-case response template","defaultAction":"Transform/hold","suggestedOwner":"Legal / Product","designNote":"Do not treat disclaimer as a substitute for oversight","adopted":false}},{"key":"MS-OVERLAY-CUS-08@f2e9d1cd2e00bcf6","id":"MS-OVERLAY-CUS-08","version":"f2e9d1cd2e00bcf6","kind":"overlay","lifecycle":"TEMPLATE","title":"Transaction amount limits","statement":"Dollar, quantity, frequency and cumulative limits","family":"Organization-specific overlay","body":{"sourceId":"CUS-08","requiredOrganizationInput":"Dollar, quantity, frequency and cumulative limits","parentRules":["AG-07"],"mechanism":"Numeric/context","defaultAction":"Block/approve","suggestedOwner":"Finance / Risk","designNote":"Include cumulative and split-transaction detection","adopted":false}},{"key":"MS-OVERLAY-CUS-09@fa0395a46d9792dd","id":"MS-OVERLAY-CUS-09","version":"fa0395a46d9792dd","kind":"overlay","lifecycle":"TEMPLATE","title":"Approved external recipients","statement":"Domains, people, distribution lists and channels","family":"Organization-specific overlay","body":{"sourceId":"CUS-09","requiredOrganizationInput":"Domains, people, distribution lists and channels","parentRules":["AG-05"],"mechanism":"Identity/recipient allowlist","defaultAction":"Approve/block","suggestedOwner":"Business owner","designNote":"Resolve recipient identity before send","adopted":false}},{"key":"MS-OVERLAY-CUS-10@d2a5b80a68088779","id":"MS-OVERLAY-CUS-10","version":"d2a5b80a68088779","kind":"overlay","lifecycle":"TEMPLATE","title":"Connector and tool allowlist","statement":"Specific MCP servers, SaaS connectors, APIs and actions","family":"Organization-specific overlay","body":{"sourceId":"CUS-10","requiredOrganizationInput":"Specific MCP servers, SaaS connectors, APIs and actions","parentRules":["AG-01","AG-10"],"mechanism":"Tool identity/version","defaultAction":"Block","suggestedOwner":"Platform security","designNote":"Pin publisher, schema and version","adopted":false}},{"key":"MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7","id":"MS-OVERLAY-CUS-11","version":"3ce1dbae9eca1ae7","kind":"overlay","lifecycle":"TEMPLATE","title":"Retention by use case","statement":"Prompt, response, file, log, vector and memory retention","family":"Organization-specific overlay","body":{"sourceId":"CUS-11","requiredOrganizationInput":"Prompt, response, file, log, vector and memory retention","parentRules":["AU-05","OP-11"],"mechanism":"Use-case/configuration","defaultAction":"Configure/block","suggestedOwner":"Data governance","designNote":"Verify downstream copies and backups","adopted":false}},{"key":"MS-OVERLAY-CUS-12@b7241f443c6c3622","id":"MS-OVERLAY-CUS-12","version":"b7241f443c6c3622","kind":"overlay","lifecycle":"TEMPLATE","title":"Production credential boundary","statement":"Known production hosts, tokens, vault paths and environments","family":"Organization-specific overlay","body":{"sourceId":"CUS-12","requiredOrganizationInput":"Known production hosts, tokens, vault paths and environments","parentRules":["DP-01","DP-15"],"mechanism":"Keyword/regex/context","defaultAction":"Block","suggestedOwner":"Engineering / Security","designNote":"Seed only synthetic examples in tests","adopted":false}},{"key":"MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7","id":"MS-OVERLAY-CUS-13","version":"7fdb1363b6e1eaa7","kind":"overlay","lifecycle":"TEMPLATE","title":"Oversize or unscannable attachment handling","statement":"Encrypted, image-only, archive, binary and size thresholds","family":"Organization-specific overlay","body":{"sourceId":"CUS-13","requiredOrganizationInput":"Encrypted, image-only, archive, binary and size thresholds","parentRules":["IN-03","IN-05"],"mechanism":"File metadata/scanner","defaultAction":"Block/quarantine","suggestedOwner":"Security","designNote":"Current build fails to enforce this","adopted":false}},{"key":"MS-OVERLAY-CUS-14@360b13cad7621179","id":"MS-OVERLAY-CUS-14","version":"360b13cad7621179","kind":"overlay","lifecycle":"TEMPLATE","title":"Business-specific prohibited advice","statement":"Product suitability, underwriting, pricing, HR or safety boundaries","family":"Organization-specific overlay","body":{"sourceId":"CUS-14","requiredOrganizationInput":"Product suitability, underwriting, pricing, HR or safety boundaries","parentRules":["IN-07","OU-04"],"mechanism":"Semantic/use-case","defaultAction":"Hold/block","suggestedOwner":"Legal / Business owner","designNote":"Requires domain evaluation","adopted":false}},{"key":"MS-OVERLAY-CUS-15@bdd9abeff8cb9654","id":"MS-OVERLAY-CUS-15","version":"bdd9abeff8cb9654","kind":"overlay","lifecycle":"TEMPLATE","title":"Required human approval groups","statement":"Named roles/groups for defined actions and risk tiers","family":"Organization-specific overlay","body":{"sourceId":"CUS-15","requiredOrganizationInput":"Named roles/groups for defined actions and risk tiers","parentRules":["AG-03","AG-04","OP-08"],"mechanism":"Workflow/identity","defaultAction":"Approve","suggestedOwner":"Risk / Business owner","designNote":"Must handle delegation and conflicts","adopted":false}},{"key":"MS-OVERLAY-CUS-16@5dc4891c003c8c70","id":"MS-OVERLAY-CUS-16","version":"5dc4891c003c8c70","kind":"overlay","lifecycle":"TEMPLATE","title":"Data-loss canaries","statement":"Unique synthetic markers in hidden context, RAG and tenant data","family":"Organization-specific overlay","body":{"sourceId":"CUS-16","requiredOrganizationInput":"Unique synthetic markers in hidden context, RAG and tenant data","parentRules":["OU-01","OU-02","AG-08"],"mechanism":"Canary/token","defaultAction":"Block/alert","suggestedOwner":"Security / AI assurance","designNote":"Use to test leakage without real sensitive data","adopted":false}},{"key":"MS-OVERLAY-CUS-17@3b8c3e6e3715795f","id":"MS-OVERLAY-CUS-17","version":"3b8c3e6e3715795f","kind":"overlay","lifecycle":"TEMPLATE","title":"Brand and communications standard","statement":"Tone, claims, regulated wording and approval thresholds","family":"Organization-specific overlay","body":{"sourceId":"CUS-17","requiredOrganizationInput":"Tone, claims, regulated wording and approval thresholds","parentRules":["OU-03","OU-12","AG-05"],"mechanism":"Semantic/template","defaultAction":"Warn/hold","suggestedOwner":"Communications / Legal","designNote":"Separate brand preference from safety criticality","adopted":false}},{"key":"MS-OVERLAY-CUS-18@d7a54daf6d4edffb","id":"MS-OVERLAY-CUS-18","version":"d7a54daf6d4edffb","kind":"overlay","lifecycle":"TEMPLATE","title":"Change blackout and release windows","statement":"Freeze dates, required approvers and emergency path","family":"Organization-specific overlay","body":{"sourceId":"CUS-18","requiredOrganizationInput":"Freeze dates, required approvers and emergency path","parentRules":["OP-06","OP-12"],"mechanism":"Workflow/time","defaultAction":"Hold","suggestedOwner":"Engineering / Change management","designNote":"Useful for high-impact production systems","adopted":false}},{"key":"MS-POL-POL-01@49c4c01e6c0532bb","id":"MS-POL-POL-01","version":"49c4c01e6c0532bb","kind":"policy","lifecycle":"TEMPLATE","title":"AI Governance and Accountability","statement":"Board/executive accountability, roles, risk appetite, inventory, metrics and reporting","family":"Internal policy template","body":{"sourceId":"POL-01","reportedBaselineStatus":"Required","linkedRules":["OP-09","AU-04","OP-07"],"minimumEvidence":"Policy + charter + minutes","suggestedOwner":"Chief AI / Risk Officer","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-01@c04293698c8a9261","id":"MS-POL-POL-01","version":"c04293698c8a9261","kind":"policy","lifecycle":"TEMPLATE","title":"AI Governance and Accountability","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-01","catalog":"Core 22","reportedBaselineStatus":"Required","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["OP-09","AU-04","OP-07"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Policy + charter + minutes","suggestedOwner":"Chief AI / Risk Officer","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-02@1d53076e8a906a49","id":"MS-POL-POL-02","version":"1d53076e8a906a49","kind":"policy","lifecycle":"TEMPLATE","title":"AI Acceptable Use","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-02","catalog":"Core 22","reportedBaselineStatus":"Required","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["IN-07","OU-06","OU-07"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Policy + attestation","suggestedOwner":"CISO / Legal / HR","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-02@aa0847ee55585424","id":"MS-POL-POL-02","version":"aa0847ee55585424","kind":"policy","lifecycle":"TEMPLATE","title":"AI Acceptable Use","statement":"Permitted/prohibited uses, user duties, escalation, sanctions and safe-use expectations","family":"Internal policy template","body":{"sourceId":"POL-02","reportedBaselineStatus":"Required","linkedRules":["IN-07","OU-06","OU-07"],"minimumEvidence":"Policy + attestation","suggestedOwner":"CISO / Legal / HR","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-03@11c99e7398913f0f","id":"MS-POL-POL-03","version":"11c99e7398913f0f","kind":"policy","lifecycle":"TEMPLATE","title":"Approved AI Tools and Shadow AI","statement":"Sanctioned providers, personal-account restrictions, onboarding and discovery","family":"Internal policy template","body":{"sourceId":"POL-03","reportedBaselineStatus":"Required","linkedRules":["AU-01","AU-02","AU-08"],"minimumEvidence":"Policy + inventory + egress logs","suggestedOwner":"CISO / IT","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-03@3cb30c5e249da778","id":"MS-POL-POL-03","version":"3cb30c5e249da778","kind":"policy","lifecycle":"TEMPLATE","title":"Approved AI Tools and Shadow AI","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-03","catalog":"Core 22","reportedBaselineStatus":"Required","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["AU-01","AU-02","AU-08"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Policy + inventory + egress logs","suggestedOwner":"CISO / IT","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-04@44f05efa6918df27","id":"MS-POL-POL-04","version":"44f05efa6918df27","kind":"policy","lifecycle":"TEMPLATE","title":"Data Classification for AI","statement":"Which data classes may enter which AI systems under which conditions","family":"Internal policy template","body":{"sourceId":"POL-04","reportedBaselineStatus":"Required","linkedRules":["DP-01–DP-18","AU-05","AU-06"],"minimumEvidence":"Standard + decision matrix + DLP events","suggestedOwner":"Data Protection / Security","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-04@879f79e7b7ac1d86","id":"MS-POL-POL-04","version":"879f79e7b7ac1d86","kind":"policy","lifecycle":"TEMPLATE","title":"Data Classification for AI","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-04","catalog":"Core 22","reportedBaselineStatus":"Required","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["DP-01","DP-02","DP-03","DP-04","DP-05","DP-06","DP-07","DP-08","DP-09","DP-10","DP-11","DP-12","DP-13","DP-14","DP-15","DP-16","DP-17","DP-18","AU-05","AU-06"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Standard + decision matrix + DLP events","suggestedOwner":"Data Protection / Security","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-05@50ff2ba2fff0e774","id":"MS-POL-POL-05","version":"50ff2ba2fff0e774","kind":"policy","lifecycle":"TEMPLATE","title":"Prompt and Output Interaction","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-05","catalog":"Core 22","reportedBaselineStatus":"Required","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["OU-01","OU-02","OU-03","OU-04","OU-05","OU-06","OU-07","OU-08","OU-09","OU-10","OU-11","OU-12"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Policy + runtime events","suggestedOwner":"AI Product / Compliance","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-05@9c8c386d8437959c","id":"MS-POL-POL-05","version":"9c8c386d8437959c","kind":"policy","lifecycle":"TEMPLATE","title":"Prompt and Output Interaction","statement":"Prompt hygiene, output review, citations, disclosure and publication rules","family":"Internal policy template","body":{"sourceId":"POL-05","reportedBaselineStatus":"Required","linkedRules":["OU-01–OU-12"],"minimumEvidence":"Policy + runtime events","suggestedOwner":"AI Product / Compliance","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-06@3e3864614f0da24e","id":"MS-POL-POL-06","version":"3e3864614f0da24e","kind":"policy","lifecycle":"TEMPLATE","title":"Privacy and Personal Data","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-06","catalog":"Core 22","reportedBaselineStatus":"Required where personal data exists","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["DP-05","DP-06","DP-07","DP-08","DP-09","DP-10","DP-11","OU-11"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Privacy policy + DPIA + configuration","suggestedOwner":"DPO / Privacy","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-06@8603eff3ea33a61f","id":"MS-POL-POL-06","version":"8603eff3ea33a61f","kind":"policy","lifecycle":"TEMPLATE","title":"Privacy and Personal Data","statement":"Purpose, minimization, lawful basis, DPIA, rights, retention and sensitive data","family":"Internal policy template","body":{"sourceId":"POL-06","reportedBaselineStatus":"Required where personal data exists","linkedRules":["DP-05–DP-11","OU-11"],"minimumEvidence":"Privacy policy + DPIA + configuration","suggestedOwner":"DPO / Privacy","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-07@a1b6f11dcbba27b5","id":"MS-POL-POL-07","version":"a1b6f11dcbba27b5","kind":"policy","lifecycle":"TEMPLATE","title":"AI Security and Prompt Injection","statement":"Threat model, injection defenses, input trust, secrets and vulnerability handling","family":"Internal policy template","body":{"sourceId":"POL-07","reportedBaselineStatus":"Required","linkedRules":["IN-01–IN-05","DP-15"],"minimumEvidence":"Security standard + tests + events","suggestedOwner":"CISO / AppSec","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-07@a95261fb9bd47400","id":"MS-POL-POL-07","version":"a95261fb9bd47400","kind":"policy","lifecycle":"TEMPLATE","title":"AI Security and Prompt Injection","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-07","catalog":"Core 22","reportedBaselineStatus":"Required","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["IN-01","IN-02","IN-03","IN-04","IN-05","DP-15"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Security standard + tests + events","suggestedOwner":"CISO / AppSec","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-08@6b73225de437a7ac","id":"MS-POL-POL-08","version":"6b73225de437a7ac","kind":"policy","lifecycle":"TEMPLATE","title":"High-Impact AI and Human Oversight","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-08","catalog":"Core 22","reportedBaselineStatus":"Required for consequential use","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["OU-04","OU-05","AG-03","AG-04","OP-05"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Impact assessment + approval + logs","suggestedOwner":"Risk / Legal / Business owner","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-08@ee4729bdeed9ad16","id":"MS-POL-POL-08","version":"ee4729bdeed9ad16","kind":"policy","lifecycle":"TEMPLATE","title":"High-Impact AI and Human Oversight","statement":"High-impact definition, required reviewers, fail-safe and prohibited autonomy","family":"Internal policy template","body":{"sourceId":"POL-08","reportedBaselineStatus":"Required for consequential use","linkedRules":["OU-04","OU-05","AG-03","AG-04","OP-05"],"minimumEvidence":"Impact assessment + approval + logs","suggestedOwner":"Risk / Legal / Business owner","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-09@30cd5cb249f58ae2","id":"MS-POL-POL-09","version":"30cd5cb249f58ae2","kind":"policy","lifecycle":"TEMPLATE","title":"AI Impact Assessment and Risk Acceptance","statement":"Intake, impact assessment, control selection, risk acceptance and reassessment","family":"Internal policy template","body":{"sourceId":"POL-09","reportedBaselineStatus":"Required","linkedRules":["AU-04","OP-06","OP-07"],"minimumEvidence":"Assessment + approval","suggestedOwner":"Enterprise Risk","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-09@8c04be5259127986","id":"MS-POL-POL-09","version":"8c04be5259127986","kind":"policy","lifecycle":"TEMPLATE","title":"AI Impact Assessment and Risk Acceptance","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-09","catalog":"Core 22","reportedBaselineStatus":"Required","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["AU-04","OP-06","OP-07"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Assessment + approval","suggestedOwner":"Enterprise Risk","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-10@85ee73762e51641d","id":"MS-POL-POL-10","version":"85ee73762e51641d","kind":"policy","lifecycle":"TEMPLATE","title":"Evaluation, Red Team and Benchmarking","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-10","catalog":"Core 22","reportedBaselineStatus":"Required","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["OP-03","OP-12"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Test evidence","suggestedOwner":"AI Assurance / Model Risk","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-10@cce53ffd6ac04512","id":"MS-POL-POL-10","version":"cce53ffd6ac04512","kind":"policy","lifecycle":"TEMPLATE","title":"Evaluation, Red Team and Benchmarking","statement":"Test dimensions, datasets, thresholds, independence, cadence and release gates","family":"Internal policy template","body":{"sourceId":"POL-10","reportedBaselineStatus":"Required","linkedRules":["OP-03","OP-12"],"minimumEvidence":"Test evidence","suggestedOwner":"AI Assurance / Model Risk","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-11@2c947637536e9be0","id":"MS-POL-POL-11","version":"2c947637536e9be0","kind":"policy","lifecycle":"TEMPLATE","title":"AI Monitoring and Logging","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-11","catalog":"Core 22","reportedBaselineStatus":"Required","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["OP-01","OP-02","OP-03"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Logs + monitoring evidence","suggestedOwner":"Security Operations / Platform","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-11@4cbd6ed56751cc97","id":"MS-POL-POL-11","version":"4cbd6ed56751cc97","kind":"policy","lifecycle":"TEMPLATE","title":"AI Monitoring and Logging","statement":"Events, content minimization, metrics, alerting, access, integrity and retention","family":"Internal policy template","body":{"sourceId":"POL-11","reportedBaselineStatus":"Required","linkedRules":["OP-01–OP-03"],"minimumEvidence":"Logs + monitoring evidence","suggestedOwner":"Security Operations / Platform","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-12@2bcf920fc5a05e6b","id":"MS-POL-POL-12","version":"2bcf920fc5a05e6b","kind":"policy","lifecycle":"TEMPLATE","title":"AI Incident Response and Kill Switch","statement":"AI incident taxonomy, escalation, containment, reporting, kill switch and recovery","family":"Internal policy template","body":{"sourceId":"POL-12","reportedBaselineStatus":"Required","linkedRules":["OP-04","OP-05"],"minimumEvidence":"Plan + drill + incident evidence","suggestedOwner":"CISO / Incident Response","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-12@d890555e2ad21089","id":"MS-POL-POL-12","version":"d890555e2ad21089","kind":"policy","lifecycle":"TEMPLATE","title":"AI Incident Response and Kill Switch","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-12","catalog":"Core 22","reportedBaselineStatus":"Required","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["OP-04","OP-05"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Plan + drill + incident evidence","suggestedOwner":"CISO / Incident Response","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-13@05690649552c9bb9","id":"MS-POL-POL-13","version":"05690649552c9bb9","kind":"policy","lifecycle":"TEMPLATE","title":"Vendor and AI Procurement","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-13","catalog":"Core 22","reportedBaselineStatus":"Required for third parties","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["AU-05","AU-06","OP-10"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Contract + assessment","suggestedOwner":"Procurement / Legal / Security","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-13@e8a7e91b791104ce","id":"MS-POL-POL-13","version":"e8a7e91b791104ce","kind":"policy","lifecycle":"TEMPLATE","title":"Vendor and AI Procurement","statement":"Due diligence, DPA/BAA, training use, subprocessors, SLAs, audit, exit and change notice","family":"Internal policy template","body":{"sourceId":"POL-13","reportedBaselineStatus":"Required for third parties","linkedRules":["AU-05","AU-06","OP-10"],"minimumEvidence":"Contract + assessment","suggestedOwner":"Procurement / Legal / Security","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-14@2a83e30bc6f88f8a","id":"MS-POL-POL-14","version":"2a83e30bc6f88f8a","kind":"policy","lifecycle":"TEMPLATE","title":"Agentic AI and Connectors","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-14","catalog":"Core 22","reportedBaselineStatus":"Required where tools/actions exist","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["AG-01","AG-02","AG-03","AG-04","AG-05","AG-06","AG-07","AG-08","AG-09","IN-08"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Policy + tool logs + approvals","suggestedOwner":"AI Platform / Security","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-14@aa241dc1520b8ab5","id":"MS-POL-POL-14","version":"aa241dc1520b8ab5","kind":"policy","lifecycle":"TEMPLATE","title":"Agentic AI and Connectors","statement":"Tool allowlists, least privilege, approvals, limits, memory and transaction controls","family":"Internal policy template","body":{"sourceId":"POL-14","reportedBaselineStatus":"Required where tools/actions exist","linkedRules":["AG-01–AG-09","IN-08"],"minimumEvidence":"Policy + tool logs + approvals","suggestedOwner":"AI Platform / Security","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-15@66ce06439b6303c8","id":"MS-POL-POL-15","version":"66ce06439b6303c8","kind":"policy","lifecycle":"TEMPLATE","title":"AI Secure Development Lifecycle","statement":"Threat modeling, design review, output handling, change, release and rollback","family":"Internal policy template","body":{"sourceId":"POL-15","reportedBaselineStatus":"Required for built AI","linkedRules":["OU-08","OU-09","OP-06","OP-12"],"minimumEvidence":"SDLC records + tests","suggestedOwner":"Engineering / AppSec","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-15@92db373c77f25877","id":"MS-POL-POL-15","version":"92db373c77f25877","kind":"policy","lifecycle":"TEMPLATE","title":"AI Secure Development Lifecycle","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-15","catalog":"Core 22","reportedBaselineStatus":"Required for built AI","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["OU-08","OU-09","OP-06","OP-12"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"SDLC records + tests","suggestedOwner":"Engineering / AppSec","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-16@e96f7674899ecd20","id":"MS-POL-POL-16","version":"e96f7674899ecd20","kind":"policy","lifecycle":"TEMPLATE","title":"Bias, Fairness and Civil Rights","statement":"Protected groups, evaluation, accommodations, monitoring and remediation","family":"Internal policy template","body":{"sourceId":"POL-16","reportedBaselineStatus":"Required for people-impacting AI","linkedRules":["OU-05"],"minimumEvidence":"Fairness assessment + monitoring","suggestedOwner":"Legal / Model Risk","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-16@ee0f7d2e98b800e9","id":"MS-POL-POL-16","version":"ee0f7d2e98b800e9","kind":"policy","lifecycle":"TEMPLATE","title":"Bias, Fairness and Civil Rights","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-16","catalog":"Core 22","reportedBaselineStatus":"Required for people-impacting AI","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["OU-05"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Fairness assessment + monitoring","suggestedOwner":"Legal / Model Risk","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-17@ec7601a706961f3f","id":"MS-POL-POL-17","version":"ec7601a706961f3f","kind":"policy","lifecycle":"TEMPLATE","title":"Transparency, Disclosure and Provenance","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-17","catalog":"Core 22","reportedBaselineStatus":"Required for user-facing AI","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["OU-03","OU-12","OP-02"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Notices + provenance logs","suggestedOwner":"Product / Legal","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-17@fbd2f1193b92724a","id":"MS-POL-POL-17","version":"fbd2f1193b92724a","kind":"policy","lifecycle":"TEMPLATE","title":"Transparency, Disclosure and Provenance","statement":"Notices, explainability, citations, synthetic-content labels and provenance","family":"Internal policy template","body":{"sourceId":"POL-17","reportedBaselineStatus":"Required for user-facing AI","linkedRules":["OU-03","OU-12","OP-02"],"minimumEvidence":"Notices + provenance logs","suggestedOwner":"Product / Legal","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-18@97f5690fa7f7084e","id":"MS-POL-POL-18","version":"97f5690fa7f7084e","kind":"policy","lifecycle":"TEMPLATE","title":"IP, Copyright and Confidentiality","statement":"Trade secrets, customer data, privilege, copyright, license and publication review","family":"Internal policy template","body":{"sourceId":"POL-18","reportedBaselineStatus":"Required","linkedRules":["DP-14","DP-16–DP-18","OU-10"],"minimumEvidence":"Policy + review records","suggestedOwner":"Legal / Information Governance","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-18@ee2264a9b561bd1a","id":"MS-POL-POL-18","version":"ee2264a9b561bd1a","kind":"policy","lifecycle":"TEMPLATE","title":"IP, Copyright and Confidentiality","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-18","catalog":"Core 22","reportedBaselineStatus":"Required","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["DP-14","DP-16","DP-17","DP-18","OU-10"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Policy + review records","suggestedOwner":"Legal / Information Governance","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-19@aed1a48acd06ccbe","id":"MS-POL-POL-19","version":"aed1a48acd06ccbe","kind":"policy","lifecycle":"TEMPLATE","title":"AI Training, Literacy and Competency","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-19","catalog":"Core 22","reportedBaselineStatus":"Required","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["DP-01","DP-02","DP-03","DP-04","DP-05","DP-06","DP-07","DP-08","DP-09","DP-10","DP-11","DP-12","DP-13","DP-14","DP-15","DP-16","DP-17","DP-18","AU-01","AU-02","AU-03","AU-04","AU-05","AU-06","AU-07","AU-08","IN-01","IN-02","IN-03","IN-04","IN-05","IN-06","IN-07","IN-08","OU-01","OU-02","OU-03","OU-04","OU-05","OU-06","OU-07","OU-08","OU-09","OU-10","OU-11","OU-12","AG-01","AG-02","AG-03","AG-04","AG-05","AG-06","AG-07","AG-08","AG-09","AG-10","OP-01","OP-02","OP-03","OP-04","OP-05","OP-06","OP-07","OP-08","OP-09","OP-10","OP-11","OP-12"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Completion + assessment","suggestedOwner":"HR / Compliance","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-19@d6f23b7346439395","id":"MS-POL-POL-19","version":"d6f23b7346439395","kind":"policy","lifecycle":"TEMPLATE","title":"AI Training, Literacy and Competency","statement":"Role-based literacy, operator competency, developer safety and executive duties","family":"Internal policy template","body":{"sourceId":"POL-19","reportedBaselineStatus":"Required","linkedRules":["Supports all rules"],"minimumEvidence":"Completion + assessment","suggestedOwner":"HR / Compliance","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-20@c9a396428183869a","id":"MS-POL-POL-20","version":"c9a396428183869a","kind":"policy","lifecycle":"TEMPLATE","title":"Exceptions, Appeals and Risk Acceptance","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-20","catalog":"Core 22","reportedBaselineStatus":"Required","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["OP-07","OP-08"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Workflow records","suggestedOwner":"Risk / Legal","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-20@ea163decd6c07a16","id":"MS-POL-POL-20","version":"ea163decd6c07a16","kind":"policy","lifecycle":"TEMPLATE","title":"Exceptions, Appeals and Risk Acceptance","statement":"User appeal, operator override, risk acceptance, compensating controls and expiry","family":"Internal policy template","body":{"sourceId":"POL-20","reportedBaselineStatus":"Required","linkedRules":["OP-07","OP-08"],"minimumEvidence":"Workflow records","suggestedOwner":"Risk / Legal","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-21@20a70c7870aa9b0a","id":"MS-POL-POL-21","version":"20a70c7870aa9b0a","kind":"policy","lifecycle":"TEMPLATE","title":"AI Decommissioning and Data Lifecycle","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-21","catalog":"Core 22","reportedBaselineStatus":"Required","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["OP-11"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Deletion and revocation evidence","suggestedOwner":"Data Governance / IT","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-21@9a99a10275e80192","id":"MS-POL-POL-21","version":"9a99a10275e80192","kind":"policy","lifecycle":"TEMPLATE","title":"AI Decommissioning and Data Lifecycle","statement":"Retention, deletion, memory/vector cleanup, access revocation, records and exit","family":"Internal policy template","body":{"sourceId":"POL-21","reportedBaselineStatus":"Required","linkedRules":["OP-11"],"minimumEvidence":"Deletion and revocation evidence","suggestedOwner":"Data Governance / IT","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-22@7864cb607001d95d","id":"MS-POL-POL-22","version":"7864cb607001d95d","kind":"policy","lifecycle":"TEMPLATE","title":"Data, Model and RAG Supply Chain","statement":"Provenance, authorization, poisoning defense, embedding isolation, dataset/model versioning","family":"Internal policy template","body":{"sourceId":"POL-22","reportedBaselineStatus":"Required for RAG/training/custom models","linkedRules":["IN-06","AG-08","AG-10"],"minimumEvidence":"Provenance + test + SBOM evidence","suggestedOwner":"Data / ML Platform / Security","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-22@e64fee0922267d4e","id":"MS-POL-POL-22","version":"e64fee0922267d4e","kind":"policy","lifecycle":"TEMPLATE","title":"Data, Model and RAG Supply Chain","statement":"Core enterprise AI policy baseline","family":"Expanded policy workplan","body":{"sourceId":"POL-22","catalog":"Core 22","reportedBaselineStatus":"Required for RAG/training/custom models","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":[],"existingRules":["IN-06","AG-08","AG-10"],"proposedRules":[],"reportedControlCount":"1","minimumEvidence":"Provenance + test + SBOM evidence","suggestedOwner":"Data / ML Platform / Security","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-23@daaad9ef8b33a963","id":"MS-POL-POL-23","version":"daaad9ef8b33a963","kind":"policy","lifecycle":"TEMPLATE","title":"AI Records, Retention and Legal Hold","statement":"Records, investigations, public administration, regulated decisions, or material business evidence","family":"Internal policy template","body":{"sourceId":"POL-23","reportedBaselineStatus":"Context-required when triggered","linkedRules":["OP-01","OP-02","OP-09","OP-11","DP-18","OP-13"],"minimumEvidence":"Schedule + retention configuration + hold record + deletion certificate","suggestedOwner":"Records / Legal / Data Governance","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-23@f183914bbbf48a36","id":"MS-POL-POL-23","version":"f183914bbbf48a36","kind":"policy","lifecycle":"TEMPLATE","title":"AI Records, Retention and Legal Hold","statement":"Records, investigations, public administration, regulated decisions, or material business evidence","family":"Expanded policy workplan","body":{"sourceId":"POL-23","catalog":"Profile expansion","reportedBaselineStatus":"Context-required when triggered","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":["SOX","OMB-M25-21","CJIS-6.1","IRS-1075","UK-DP-AI","GDPR"],"existingRules":["OP-01","OP-02","OP-09","OP-11","DP-18"],"proposedRules":["OP-13"],"reportedControlCount":"3","minimumEvidence":"Schedule + retention configuration + hold record + deletion certificate","suggestedOwner":"Records / Legal / Data Governance","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-24@1d7f4f0e0bd28468","id":"MS-POL-POL-24","version":"1d7f4f0e0bd28468","kind":"policy","lifecycle":"TEMPLATE","title":"AI Accessibility and Inclusive Design","statement":"Federal or public-sector ICT, public-facing AI, or people-impacting use","family":"Expanded policy workplan","body":{"sourceId":"POL-24","catalog":"Profile expansion","reportedBaselineStatus":"Context-required when triggered","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":["SECTION-508","EU-AI-ACT","NIST-AI-RMF"],"existingRules":["OU-04","OU-05","OU-12","OP-12"],"proposedRules":["OU-13"],"reportedControlCount":"3","minimumEvidence":"Accessibility requirements + ACR/VPAT + test results + exception record","suggestedOwner":"Accessibility / Product / Procurement","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-24@3ac8bb46b53fea08","id":"MS-POL-POL-24","version":"3ac8bb46b53fea08","kind":"policy","lifecycle":"TEMPLATE","title":"AI Accessibility and Inclusive Design","statement":"Federal or public-sector ICT, public-facing AI, or people-impacting use","family":"Internal policy template","body":{"sourceId":"POL-24","reportedBaselineStatus":"Context-required when triggered","linkedRules":["OU-04","OU-05","OU-12","OP-12","OU-13"],"minimumEvidence":"Accessibility requirements + ACR/VPAT + test results + exception record","suggestedOwner":"Accessibility / Product / Procurement","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-25@597e30d9cfdaf3d4","id":"MS-POL-POL-25","version":"597e30d9cfdaf3d4","kind":"policy","lifecycle":"TEMPLATE","title":"Automated Employment and Workforce Decisions","statement":"AI influences recruitment, hiring, promotion, monitoring, scheduling, pay or termination","family":"Expanded policy workplan","body":{"sourceId":"POL-25","catalog":"Profile expansion","reportedBaselineStatus":"Context-required when triggered","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":["NYC-LL144","IL-AIVIA","EU-AI-ACT","GDPR"],"existingRules":["OU-04","OU-05","OU-12","OP-02","OP-03","OP-08","OP-12"],"proposedRules":["OP-14","OU-14","OP-18"],"reportedControlCount":"3","minimumEvidence":"Use inventory + notice/consent + bias audit + publication + decision logs","suggestedOwner":"HR / Employment Legal / Model Risk","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-25@cbf2a67c65532b7d","id":"MS-POL-POL-25","version":"cbf2a67c65532b7d","kind":"policy","lifecycle":"TEMPLATE","title":"Automated Employment and Workforce Decisions","statement":"AI influences recruitment, hiring, promotion, monitoring, scheduling, pay or termination","family":"Internal policy template","body":{"sourceId":"POL-25","reportedBaselineStatus":"Context-required when triggered","linkedRules":["OU-04","OU-05","OU-12","OP-02","OP-03","OP-08","OP-12","OP-14","OU-14","OP-18"],"minimumEvidence":"Use inventory + notice/consent + bias audit + publication + decision logs","suggestedOwner":"HR / Employment Legal / Model Risk","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-26@306487f686bd6069","id":"MS-POL-POL-26","version":"306487f686bd6069","kind":"policy","lifecycle":"TEMPLATE","title":"Consumer Credit and Adverse Action","statement":"AI makes or supports credit, pricing, limit, servicing or collection decisions","family":"Internal policy template","body":{"sourceId":"POL-26","reportedBaselineStatus":"Context-required when triggered","linkedRules":["OU-03","OU-04","OU-05","OP-02","OP-03","OP-08","OP-12","OU-14","OP-17"],"minimumEvidence":"Model documentation + validation + decision factors + notices + complaints","suggestedOwner":"Fair Lending / Compliance / Model Risk","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-26@d4fc522de78b75ea","id":"MS-POL-POL-26","version":"d4fc522de78b75ea","kind":"policy","lifecycle":"TEMPLATE","title":"Consumer Credit and Adverse Action","statement":"AI makes or supports credit, pricing, limit, servicing or collection decisions","family":"Expanded policy workplan","body":{"sourceId":"POL-26","catalog":"Profile expansion","reportedBaselineStatus":"Context-required when triggered","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":["ECOA-REG-B","FRB-MRM-2026","GLBA","GDPR"],"existingRules":["OU-03","OU-04","OU-05","OP-02","OP-03","OP-08","OP-12"],"proposedRules":["OU-14","OP-17"],"reportedControlCount":"3","minimumEvidence":"Model documentation + validation + decision factors + notices + complaints","suggestedOwner":"Fair Lending / Compliance / Model Risk","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-27@24ccacabdf3df91b","id":"MS-POL-POL-27","version":"24ccacabdf3df91b","kind":"policy","lifecycle":"TEMPLATE","title":"Clinical AI and Patient Safety","statement":"AI supports diagnosis, treatment, triage, clinical workflow, medical devices or patient communication","family":"Internal policy template","body":{"sourceId":"POL-27","reportedBaselineStatus":"Context-required when triggered","linkedRules":["DP-07","OU-03","OU-04","OU-05","OP-03","OP-05","OP-06","OP-12","OP-15"],"minimumEvidence":"Intended-use statement + validation + reviewer logs + monitoring + safety events","suggestedOwner":"Clinical Safety / Quality / Privacy","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-27@68833138d9c86a50","id":"MS-POL-POL-27","version":"68833138d9c86a50","kind":"policy","lifecycle":"TEMPLATE","title":"Clinical AI and Patient Safety","statement":"AI supports diagnosis, treatment, triage, clinical workflow, medical devices or patient communication","family":"Expanded policy workplan","body":{"sourceId":"POL-27","catalog":"Profile expansion","reportedBaselineStatus":"Context-required when triggered","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":["HIPAA","HHS-PART2","ONC-HTI1","FDA-AI-MD"],"existingRules":["DP-07","OU-03","OU-04","OU-05","OP-03","OP-05","OP-06","OP-12"],"proposedRules":["OP-15"],"reportedControlCount":"3","minimumEvidence":"Intended-use statement + validation + reviewer logs + monitoring + safety events","suggestedOwner":"Clinical Safety / Quality / Privacy","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-28@0647c4283f3dd806","id":"MS-POL-POL-28","version":"0647c4283f3dd806","kind":"policy","lifecycle":"TEMPLATE","title":"Child and Youth AI Safety","statement":"Children or students interact with AI or their data is processed","family":"Expanded policy workplan","body":{"sourceId":"POL-28","catalog":"Profile expansion","reportedBaselineStatus":"Context-required when triggered","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":["COPPA","FERPA","EU-AI-ACT"],"existingRules":["DP-08","DP-09","DP-10","DP-11","OU-06","OU-07","OU-12","OP-08"],"proposedRules":["DP-19","OU-15"],"reportedControlCount":"3","minimumEvidence":"Age assessment + consent + data map + safety tests + deletion evidence","suggestedOwner":"Privacy / Trust & Safety / Education Legal","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-28@d850b62ebf5806ef","id":"MS-POL-POL-28","version":"d850b62ebf5806ef","kind":"policy","lifecycle":"TEMPLATE","title":"Child and Youth AI Safety","statement":"Children or students interact with AI or their data is processed","family":"Internal policy template","body":{"sourceId":"POL-28","reportedBaselineStatus":"Context-required when triggered","linkedRules":["DP-08","DP-09","DP-10","DP-11","OU-06","OU-07","OU-12","OP-08","DP-19","OU-15"],"minimumEvidence":"Age assessment + consent + data map + safety tests + deletion evidence","suggestedOwner":"Privacy / Trust & Safety / Education Legal","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-29@0ed02484ce9e6aaa","id":"MS-POL-POL-29","version":"0ed02484ce9e6aaa","kind":"policy","lifecycle":"TEMPLATE","title":"Public-Sector Due Process and Citizen Services","statement":"AI affects benefits, licensing, enforcement, investigations, justice or other government decisions","family":"Expanded policy workplan","body":{"sourceId":"POL-29","catalog":"Profile expansion","reportedBaselineStatus":"Context-required when triggered","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":["OMB-M25-21","NIST-800-53","CJIS-6.1","SECTION-508","EU-AI-ACT"],"existingRules":["OU-04","OU-05","OU-12","AG-03","AG-04","OP-02","OP-08","OP-09"],"proposedRules":["OP-16","AG-11","OP-18"],"reportedControlCount":"3","minimumEvidence":"Impact assessment + notice + decision record + approvals + appeal outcomes","suggestedOwner":"Program Integrity / Civil Rights / General Counsel","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-29@15da853e19e2751a","id":"MS-POL-POL-29","version":"15da853e19e2751a","kind":"policy","lifecycle":"TEMPLATE","title":"Public-Sector Due Process and Citizen Services","statement":"AI affects benefits, licensing, enforcement, investigations, justice or other government decisions","family":"Internal policy template","body":{"sourceId":"POL-29","reportedBaselineStatus":"Context-required when triggered","linkedRules":["OU-04","OU-05","OU-12","AG-03","AG-04","OP-02","OP-08","OP-09","OP-16","AG-11","OP-18"],"minimumEvidence":"Impact assessment + notice + decision record + approvals + appeal outcomes","suggestedOwner":"Program Integrity / Civil Rights / General Counsel","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-30@09fcec49716e93c1","id":"MS-POL-POL-30","version":"09fcec49716e93c1","kind":"policy","lifecycle":"TEMPLATE","title":"Specially Regulated Data Handling Addendum","statement":"CUI, classified, criminal justice, federal tax, SUD or export-controlled data enters the AI environment","family":"Internal policy template","body":{"sourceId":"POL-30","reportedBaselineStatus":"Context-required when triggered","linkedRules":["DP-07","DP-12","DP-13","AU-03","AU-05","OP-01","OP-09","OP-11","AU-09"],"minimumEvidence":"Handling matrix + labels + boundary config + access logs + inspections","suggestedOwner":"Security / Privacy / Records / Program Owner","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-30@83f7dac5a0008a83","id":"MS-POL-POL-30","version":"83f7dac5a0008a83","kind":"policy","lifecycle":"TEMPLATE","title":"Specially Regulated Data Handling Addendum","statement":"CUI, classified, criminal justice, federal tax, SUD or export-controlled data enters the AI environment","family":"Expanded policy workplan","body":{"sourceId":"POL-30","catalog":"Profile expansion","reportedBaselineStatus":"Context-required when triggered","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":["NIST-800-171","CMMC","CJIS-6.1","IRS-1075","HHS-PART2","EAR"],"existingRules":["DP-07","DP-12","DP-13","AU-03","AU-05","OP-01","OP-09","OP-11"],"proposedRules":["AU-09"],"reportedControlCount":"3","minimumEvidence":"Handling matrix + labels + boundary config + access logs + inspections","suggestedOwner":"Security / Privacy / Records / Program Owner","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-31@0c25dadb14d3c446","id":"MS-POL-POL-31","version":"0c25dadb14d3c446","kind":"policy","lifecycle":"TEMPLATE","title":"AI Model Risk Management and Independent Validation","statement":"Models materially influence financial, insurance, safety or high-impact decisions","family":"Expanded policy workplan","body":{"sourceId":"POL-31","catalog":"Profile expansion","reportedBaselineStatus":"Context-required when triggered","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":["FRB-MRM-2026","NAIC-AI","ISO-42005","NIST-AI-RMF"],"existingRules":["OU-03","OU-05","OP-03","OP-06","OP-12"],"proposedRules":["OP-17"],"reportedControlCount":"3","minimumEvidence":"Tiering + model inventory + validation + findings + approvals","suggestedOwner":"Model Risk / Internal Audit / Business Owner","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-31@1e5f7eb3de495c93","id":"MS-POL-POL-31","version":"1e5f7eb3de495c93","kind":"policy","lifecycle":"TEMPLATE","title":"AI Model Risk Management and Independent Validation","statement":"Models materially influence financial, insurance, safety or high-impact decisions","family":"Internal policy template","body":{"sourceId":"POL-31","reportedBaselineStatus":"Context-required when triggered","linkedRules":["OU-03","OU-05","OP-03","OP-06","OP-12","OP-17"],"minimumEvidence":"Tiering + model inventory + validation + findings + approvals","suggestedOwner":"Model Risk / Internal Audit / Business Owner","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-32@04591876ceb8b167","id":"MS-POL-POL-32","version":"04591876ceb8b167","kind":"policy","lifecycle":"TEMPLATE","title":"Cross-Border AI Data and Sovereignty","statement":"AI providers, support, training, administrators or data stores cross national boundaries","family":"Expanded policy workplan","body":{"sourceId":"POL-32","catalog":"Profile expansion","reportedBaselineStatus":"Context-required when triggered","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":["GDPR","UK-DP-AI","BR-LGPD","AU-PRIVACY-AI","DOJ-DSP","EAR"],"existingRules":["AU-05","AU-06","DP-09","DP-10","DP-11","OP-10"],"proposedRules":["AU-10"],"reportedControlCount":"3","minimumEvidence":"Data map + transfer assessment + screening + contracts + audit records","suggestedOwner":"Privacy / Export / Security / Procurement","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-32@9422d7fab14d948a","id":"MS-POL-POL-32","version":"9422d7fab14d948a","kind":"policy","lifecycle":"TEMPLATE","title":"Cross-Border AI Data and Sovereignty","statement":"AI providers, support, training, administrators or data stores cross national boundaries","family":"Internal policy template","body":{"sourceId":"POL-32","reportedBaselineStatus":"Context-required when triggered","linkedRules":["AU-05","AU-06","DP-09","DP-10","DP-11","OP-10","AU-10"],"minimumEvidence":"Data map + transfer assessment + screening + contracts + audit records","suggestedOwner":"Privacy / Export / Security / Procurement","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-33@2173f98ce3d3e4e6","id":"MS-POL-POL-33","version":"2173f98ce3d3e4e6","kind":"policy","lifecycle":"TEMPLATE","title":"Automated Decision Transparency and Registry","statement":"High-impact, public-facing, regulated or externally consequential AI","family":"Internal policy template","body":{"sourceId":"POL-33","reportedBaselineStatus":"Context-required when triggered","linkedRules":["OU-12","OP-02","OP-09","OP-18"],"minimumEvidence":"Registry + disclosures + approval + discovery/reconciliation logs","suggestedOwner":"AI Governance / Legal / Product","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-33@2a0117a70af5164b","id":"MS-POL-POL-33","version":"2a0117a70af5164b","kind":"policy","lifecycle":"TEMPLATE","title":"Automated Decision Transparency and Registry","statement":"High-impact, public-facing, regulated or externally consequential AI","family":"Expanded policy workplan","body":{"sourceId":"POL-33","catalog":"Profile expansion","reportedBaselineStatus":"Context-required when triggered","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":["EU-AI-ACT","ONC-HTI1","NYC-LL144","OMB-M25-21","CO-AI"],"existingRules":["OU-12","OP-02","OP-09"],"proposedRules":["OP-18"],"reportedControlCount":"3","minimumEvidence":"Registry + disclosures + approval + discovery/reconciliation logs","suggestedOwner":"AI Governance / Legal / Product","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-34@262ec774eaab089e","id":"MS-POL-POL-34","version":"262ec774eaab089e","kind":"policy","lifecycle":"TEMPLATE","title":"AI Research, Human Subjects and Scientific Integrity","statement":"AI research uses identifiable human data, interacts with participants, or informs regulated research","family":"Expanded policy workplan","body":{"sourceId":"POL-34","catalog":"Profile expansion","reportedBaselineStatus":"Context-required when triggered","profileResult":"Example workbook snapshot; not a current organizational determination","frameworkDrivers":["HIPAA","HHS-PART2","FDA-AI-MD","GDPR"],"existingRules":["DP-07","DP-09","OU-03","OP-12"],"proposedRules":["OP-19"],"reportedControlCount":"3","minimumEvidence":"Protocol + ethics approval + consent + data authorization + reproducibility record","suggestedOwner":"Research Integrity / IRB / Privacy","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-POL-POL-34@93db44d68b4d6aaf","id":"MS-POL-POL-34","version":"93db44d68b4d6aaf","kind":"policy","lifecycle":"TEMPLATE","title":"AI Research, Human Subjects and Scientific Integrity","statement":"AI research uses identifiable human data, interacts with participants, or informs regulated research","family":"Internal policy template","body":{"sourceId":"POL-34","reportedBaselineStatus":"Context-required when triggered","linkedRules":["DP-07","DP-09","OU-03","OP-12","OP-19"],"minimumEvidence":"Protocol + ethics approval + consent + data authorization + reproducibility record","suggestedOwner":"Research Integrity / IRB / Privacy","adopted":false,"sourceDate":"2026-08-20"}},{"key":"MS-PROPOSED-POL-2f6d2f60b014f568@6e778aebe316cf9f","id":"MS-PROPOSED-POL-2f6d2f60b014f568","version":"6e778aebe316cf9f","kind":"policy","lifecycle":"DRAFT","title":"AI Literacy Ensure all North Carolinians have the knowledge to understand,…","statement":"AI Literacy  Ensure all North Carolinians have the knowledge to understand, use, and critically evaluate AI technologies, enabling  people to make informed choices about the technology in their lives.","family":"Prototype policy proposal","body":{"suggestedRule":"DP-02","evidence":"Policy / training / approval","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","warning":"Low-confidence prototype mapping; original PDF not supplied.","adopted":false}},{"key":"MS-PROPOSED-POL-931e90fdca61e0e8@1d9be900f9903f26","id":"MS-PROPOSED-POL-931e90fdca61e0e8","version":"1d9be900f9903f26","kind":"policy","lifecycle":"DRAFT","title":"2, 2025, created the Council to advise on “AI strategy, policy,…","statement":"2, 2025, created the Council to advise on “AI strategy, policy, and  training to ensure North Carolina becomes a national leader in AI literacy, governance, and deployment to the benefit of our  residents, communities, and economy.” This Roadmap puts the State of North Carolina and its partners on a path to meet  this high standard, and we are pleased to share it with you.","family":"Prototype policy proposal","body":{"suggestedRule":"AU-06","evidence":"Policy / training / approval","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","warning":"Low-confidence prototype mapping; original PDF not supplied.","adopted":false}},{"key":"MS-PROPOSED-POL-c6fe56d775c8c7d1@9f3567316affb3c7","id":"MS-PROPOSED-POL-c6fe56d775c8c7d1","version":"9f3567316affb3c7","kind":"policy","lifecycle":"DRAFT","title":"Details: This program will deploy free, foundational AI literacy learning opportunities…","statement":"Details:   This program will deploy free, foundational AI literacy learning opportunities in all regions of North Carolina and  will be designed for residents of all backgrounds and skill levels, including the workforce, senior citizens, rural residents,  individuals with limited digital access, and other underserved communities.","family":"Prototype policy proposal","body":{"suggestedRule":"DP-01","evidence":"Policy / training / approval","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","warning":"Low-confidence prototype mapping; original PDF not supplied.","adopted":false}},{"key":"MS-PROPOSAL-00cd2cc8e14d4826@d106ca9a2b753b47","id":"MS-PROPOSAL-00cd2cc8e14d4826","version":"d106ca9a2b753b47","kind":"proposal","lifecycle":"DRAFT","title":"Additionally, tracking the re-skilling programs that successfully lead to meaningful employment…","statement":"Additionally, tracking the re-skilling programs that  successfully lead to meaningful employment will help improve other reskilling tracks.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-22","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-10","suggestedParentTitle":"Block biometric identifiers","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 22","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-0667934981c1ec5f@2c8bde4ea140f761","id":"MS-PROPOSAL-0667934981c1ec5f","version":"2c8bde4ea140f761","kind":"proposal","lifecycle":"DRAFT","title":"General Assembly shares our desire to safeguard public trust and empower…","statement":"General Assembly shares our desire to safeguard public trust and empower the  workforce, and NCGA support will be crucial.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-4","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-03","suggestedParentTitle":"Block payment card numbers","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 4","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-076eb3dc3ae44fc2@cc3b53d79d026400","id":"MS-PROPOSAL-076eb3dc3ae44fc2","version":"cc3b53d79d026400","kind":"proposal","lifecycle":"DRAFT","title":"This effort will be advanced through advocating for legislation to counteract…","statement":"This effort will be advanced through advocating for legislation to counteract potential AI-driven labor disruptions and  to prepare for any such disruptions.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-24","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-01","suggestedParentTitle":"Allow sanctioned AI services only","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 24","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-0a17dcd51c44464f@90205cad9c49eb85","id":"MS-PROPOSAL-0a17dcd51c44464f","version":"90205cad9c49eb85","kind":"proposal","lifecycle":"DRAFT","title":"The state will work in collaboration with utilities, security, and emergency…","statement":"The state will work in collaboration with utilities, security, and emergency  response teams to design a plan to recover those systems, including through redundant architectures, where possible.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-52","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OP-04","suggestedParentTitle":"Escalate AI incidents","prototypeMatchPercent":7,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 52","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-0cfb50ec0219d4a0@6caafe617501c815","id":"MS-PROPOSAL-0cfb50ec0219d4a0","version":"6caafe617501c815","kind":"proposal","lifecycle":"DRAFT","title":"8 Recommendation: Monitor and publicly disclose impacts of AI infrastructure on…","statement":"8  Recommendation:  Monitor and publicly disclose impacts of AI infrastructure on communities using third-party evaluations.","family":"Operations","body":{"sourceId":"doc-1787223639269-0-30","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OP-10","suggestedParentTitle":"Monitor vendor and model supply chain","prototypeMatchPercent":6,"prototypeConfidencePercent":"67","automationTier":"E1 — observe","enforcementMode":"Detect / log","evidence":"Event / log","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 30","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-0e1149ec5cb031c3@e14afe9e4c494dd2","id":"MS-PROPOSAL-0e1149ec5cb031c3","version":"e14afe9e4c494dd2","kind":"proposal","lifecycle":"DRAFT","title":"The state government will align government credentials and training with those…","statement":"The state government will align government credentials and training with those  employer requirements for continuity between sectors and will coordinate with partner companies to ensure the students  participating in the stackable curriculum can be placed into established entry-level roles.","family":"Data Protection","body":{"sourceId":"doc-1787223639269-0-77","reportedStatus":"draft","reportedOutcome":"Map existing","suggestedParentId":"DP-01","suggestedParentTitle":"Block credentials and secrets","prototypeMatchPercent":76,"prototypeConfidencePercent":"89","automationTier":"E0 — evidence","enforcementMode":"Require evidence","evidence":"Policy / training / approval","severity":"Critical","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 77","rationale":"Closest semantic and keyword match is DP-01 — Block credentials and secrets. The source adds applicability and evidence context.","test":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-1138c36f30d2f384@8b285e34a98e87bb","id":"MS-PROPOSAL-1138c36f30d2f384","version":"8b285e34a98e87bb","kind":"proposal","lifecycle":"DRAFT","title":"The state will also develop and deploy secure communication channels to…","statement":"The state will also develop and deploy secure communication channels to ensure confidential, real-  time exchange of AI threat intelligence and coordinated incident response with local governments and other partners.","family":"Operations","body":{"sourceId":"doc-1787223639269-0-57","reportedStatus":"draft","reportedOutcome":"Map existing","suggestedParentId":"DP-14","suggestedParentTitle":"Protect trade secrets and source code","prototypeMatchPercent":76,"prototypeConfidencePercent":"89","automationTier":"E1/E2 — observe + workflow","enforcementMode":"Monitor / escalate","evidence":"Event / workflow","severity":"High","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 57","rationale":"Closest semantic and keyword match is DP-14 — Protect trade secrets and source code. The source adds applicability and evidence context.","test":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-1403c7b83626610a@f286a79d011c4a8e","id":"MS-PROPOSAL-1403c7b83626610a","version":"f286a79d011c4a8e","kind":"proposal","lifecycle":"DRAFT","title":"Additionally, the state will distribute vetted AI frameworks and training modules…","statement":"Additionally, the state will distribute vetted AI frameworks and training modules to local government partners to guarantee  proven, safe, and transparent AI security practices are leveraged statewide, including privacy by design.","family":"Data Protection","body":{"sourceId":"doc-1787223639269-0-58","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-05","suggestedParentTitle":"Block national identifiers","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E0 — evidence","enforcementMode":"Require evidence","evidence":"Policy / training / approval","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 58","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-142cc5f026b13fb3@ea74fa81eb847f3e","id":"MS-PROPOSAL-142cc5f026b13fb3","version":"ea74fa81eb847f3e","kind":"proposal","lifecycle":"DRAFT","title":"Since the creation of the Executive Order, the Council has been…","statement":"Since the creation of the  Executive Order, the Council has been focused on creating informed recommendations on policy, governance, ethics, and literacy to ensure the safe, transparent,  and fair adoption of artificial intelligence across the state and to develop recommendations to address the potential impact of AI on the workforce.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-10","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-06","suggestedParentTitle":"Prevent provider training on enterprise content","prototypeMatchPercent":2,"prototypeConfidencePercent":"67","automationTier":"E0 — evidence","enforcementMode":"Require evidence","evidence":"Policy / training / approval","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 10","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-1696ab3086dea5a5@fc2ef3dc58a55ab7","id":"MS-PROPOSAL-1696ab3086dea5a5","version":"fc2ef3dc58a55ab7","kind":"proposal","lifecycle":"DRAFT","title":"With the state government’s support and backing, local governments and private…","statement":"With the  state government’s support and backing, local governments and private sector organizations will also be encouraged to  adopt such standards, reducing the potential for misinformation campaigns.","family":"Input and Content","body":{"sourceId":"doc-1787223639269-0-40","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-12","suggestedParentTitle":"Block classified, CUI and FCI","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 40","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-1bdd72c858c1df51@2442074e2644eec0","id":"MS-PROPOSAL-1bdd72c858c1df51","version":"2442074e2644eec0","kind":"proposal","lifecycle":"DRAFT","title":"Details: North Carolina must be ready to detect and respond to…","statement":"Details:   North Carolina must be ready to detect and respond to AI-driven labor disruptions early to stabilize the workforce.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-23","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-07","suggestedParentTitle":"Prohibit account sharing","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E1 — observe","enforcementMode":"Detect / log","evidence":"Event / log","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 23","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-230f9559fe32d442@7794a91209244139","id":"MS-PROPOSAL-230f9559fe32d442","version":"7794a91209244139","kind":"proposal","lifecycle":"DRAFT","title":"This role will ensure shared learning, avoid wasted resources, and proactively…","statement":"This role will ensure shared learning,  avoid wasted resources, and proactively address AI related threats and opportunities.","family":"Access and Use","body":{"sourceId":"doc-1787223639269-0-69","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AG-01","suggestedParentTitle":"Allowlisted tools and connectors only","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 69","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-25a757cf14a43bec@72c0774bfe859750","id":"MS-PROPOSAL-25a757cf14a43bec","version":"72c0774bfe859750","kind":"proposal","lifecycle":"DRAFT","title":"Recommendation: Monitor, detect, and analyze ongoing AI threats and create a…","statement":"Recommendation:  Monitor, detect, and analyze ongoing AI threats and create a mechanism to share risk landscape with trusted AI and cyber liaisons  in local government, as well as federal, peer state, and private sector partners.","family":"Operations","body":{"sourceId":"doc-1787223639269-0-54","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OP-07","suggestedParentTitle":"Time-bound exceptions and waivers","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E1 — observe","enforcementMode":"Detect / log","evidence":"Event / log","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 54","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-2fe0afebbb599c65@9feb7ca329f91f24","id":"MS-PROPOSAL-2fe0afebbb599c65","version":"9feb7ca329f91f24","kind":"proposal","lifecycle":"DRAFT","title":"Feedback mechanisms will be available to measure public sentiment and improve…","statement":"Feedback mechanisms will be available to measure  public sentiment and improve tools based on input.","family":"Input and Content","body":{"sourceId":"doc-1787223639269-0-47","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-09","suggestedParentTitle":"Protect contact information","prototypeMatchPercent":5,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 47","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-300bab388794cd89@84e23815566ae7bf","id":"MS-PROPOSAL-300bab388794cd89","version":"84e23815566ae7bf","kind":"proposal","lifecycle":"DRAFT","title":"Partnering with N.C. higher education institutions, the state will coordinate AI…","statement":"Partnering with N.C. higher education institutions, the state will coordinate AI education and  exposure across all levels of education so that students graduate with the competencies needed for public sector careers.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-80","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-08","suggestedParentTitle":"Restrict education records","prototypeMatchPercent":5,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 80","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-32a87c02df063e8b@5dfa56307b5c5a25","id":"MS-PROPOSAL-32a87c02df063e8b","version":"5dfa56307b5c5a25","kind":"proposal","lifecycle":"DRAFT","title":"The state’s 2025 Executive Order 24 also requires the AI Accelerator…","statement":"The state’s 2025   Executive Order 24   also requires the AI Accelerator to disclose all high-risk AI  use cases   to the public .","family":"Governance","body":{"sourceId":"doc-1787223639269-0-43","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-04","suggestedParentTitle":"Allow approved use cases and models only","prototypeMatchPercent":8,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 43","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-360eb4ffc4be5bd0@58d6a4f4f8ebbe58","id":"MS-PROPOSAL-360eb4ffc4be5bd0","version":"58d6a4f4f8ebbe58","kind":"proposal","lifecycle":"DRAFT","title":"The goals are grouped into three categories to ensure a clear…","statement":"The  goals are grouped into three categories to ensure a clear and actionable framework that supports statewide safety, opportunity, and innovation:  1)   Protect   focuses on safeguarding North Carolina residents through responsible AI use and strong risk mitigation practices.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-11","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OU-07","suggestedParentTitle":"Block dangerous and illegal content","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 11","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-36e6bb635eee9b28@79d3198bd7df5314","id":"MS-PROPOSAL-36e6bb635eee9b28","version":"79d3198bd7df5314","kind":"proposal","lifecycle":"DRAFT","title":"Across the United States, communities are using various methods to ensure…","statement":"Across the United States, communities are using various methods to ensure their members are AI literate.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-70","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OP-11","suggestedParentTitle":"Decommission safely and delete data","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 70","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-3c86836693534b52@113772d79e8aab91","id":"MS-PROPOSAL-3c86836693534b52","version":"113772d79e8aab91","kind":"proposal","lifecycle":"DRAFT","title":"However, AI presents fundamentally different challenges that these existing frameworks do…","statement":"However, AI  presents fundamentally different challenges that these existing frameworks do not account for.","family":"Access and Use","body":{"sourceId":"doc-1787223639269-0-61","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-07","suggestedParentTitle":"Prohibit account sharing","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 61","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-3d042969e2dd7283@4a5db8990aa161bb","id":"MS-PROPOSAL-3d042969e2dd7283","version":"4a5db8990aa161bb","kind":"proposal","lifecycle":"DRAFT","title":"It is essential for states to thoroughly assess the economic opportunities…","statement":"It is essential for states to thoroughly assess the economic opportunities data centers  bring alongside the impact these facilities have on communities to maximize benefits and reduce data center challenges.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-29","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OP-06","suggestedParentTitle":"Reassess on material change","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 29","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-41b8fc86cf49abf4@02a8df88dd123c74","id":"MS-PROPOSAL-41b8fc86cf49abf4","version":"02a8df88dd123c74","kind":"proposal","lifecycle":"DRAFT","title":"This recommendation calls for disclosure of AI utilization as any part…","statement":"This recommendation calls for disclosure of AI utilization  as any part of a benefits eligibility process and guardrails to ensure that final benefits determination decisions are not  made by AI systems.","family":"Output and Use","body":{"sourceId":"doc-1787223639269-0-49","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AG-04","suggestedParentTitle":"Prohibit autonomous consequential decisions","prototypeMatchPercent":7,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 49","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-42d267a546fb50ab@789c4c7d936793a3","id":"MS-PROPOSAL-42d267a546fb50ab","version":"789c4c7d936793a3","kind":"proposal","lifecycle":"DRAFT","title":"In parallel, partnering with higher education institutions will allow the collection…","statement":"In parallel, partnering with higher education institutions will  allow the collection of more granular unemployment and program-enrollment data that can signal emerging displacement  trends and inform rapid intervention strategies to improve early detection and response.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-26","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-08","suggestedParentTitle":"Restrict education records","prototypeMatchPercent":6,"prototypeConfidencePercent":"67","automationTier":"E1 — observe","enforcementMode":"Detect / log","evidence":"Event / log","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 26","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-46be5dea33b89cb5@368e67683bac1adc","id":"MS-PROPOSAL-46be5dea33b89cb5","version":"368e67683bac1adc","kind":"proposal","lifecycle":"DRAFT","title":"This mutually beneficial program would allow the private sector to help…","statement":"This mutually beneficial program  would allow the private sector to help tailor   higher education toward the skillsets required in their workforces and create  direct   pipelines to hire for those skills.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-78","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OU-04","suggestedParentTitle":"Require human validation for high-stakes advice","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 78","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-49c1bb8df481c775@740f716c3c1f5131","id":"MS-PROPOSAL-49c1bb8df481c775","version":"740f716c3c1f5131","kind":"proposal","lifecycle":"DRAFT","title":"Details: This initiative will build on existing continuous monitoring and threat…","statement":"Details:   This initiative will build on existing continuous monitoring and threat detection programs across state government  to identify emerging AI-related risks and alert trusted liaisons in state and local governments to act.","family":"Operations","body":{"sourceId":"doc-1787223639269-0-55","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-12","suggestedParentTitle":"Block classified, CUI and FCI","prototypeMatchPercent":2,"prototypeConfidencePercent":"67","automationTier":"E1 — observe","enforcementMode":"Detect / log","evidence":"Event / log","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 55","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-4bc5330aa9719598@dad87fe4893e4bf2","id":"MS-PROPOSAL-4bc5330aa9719598","version":"dad87fe4893e4bf2","kind":"proposal","lifecycle":"DRAFT","title":"General Assembly Timeline: March 2027 Goal 3: Account for Resource Demands…","statement":"General Assembly  Timeline:   March 2027  Goal 3: Account for Resource Demands and Impacts  Ensure appropriate environmental stewardship that balances community needs and public trust with the  demands that AI creates on land, water, and energy.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-27","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-07","suggestedParentTitle":"Prohibit account sharing","prototypeMatchPercent":2,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 27","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-4d94e48e6fcbbde5@91557292665d78f1","id":"MS-PROPOSAL-4d94e48e6fcbbde5","version":"91557292665d78f1","kind":"proposal","lifecycle":"DRAFT","title":"Using displacement data and worker feedback will support the design of…","statement":"Using  displacement data and worker feedback will support the design of career transition tracks tailored to the needs and  experiences of AI-impacted workers to avoid long-term unemployment.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-21","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-03","suggestedParentTitle":"Block payment card numbers","prototypeMatchPercent":5,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 21","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-5059089017de2506@cab4bb554d9a1cd2","id":"MS-PROPOSAL-5059089017de2506","version":"cab4bb554d9a1cd2","kind":"proposal","lifecycle":"DRAFT","title":"This effort will involve researching and adopting content verification standards already…","statement":"This  effort will involve researching and adopting content verification standards already widely accepted across industry, such as  Coalition for Content Provenance and Authenticity (C2PA).","family":"Governance","body":{"sourceId":"doc-1787223639269-0-36","reportedStatus":"draft","reportedOutcome":"Map existing","suggestedParentId":"OU-12","suggestedParentTitle":"Disclose AI-generated or synthetic content","prototypeMatchPercent":76,"prototypeConfidencePercent":"89","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 36","rationale":"Closest semantic and keyword match is OU-12 — Disclose AI-generated or synthetic content. The source adds applicability and evidence context.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-506a1d2644af5ca2@3afc264e970a0dc5","id":"MS-PROPOSAL-506a1d2644af5ca2","version":"3afc264e970a0dc5","kind":"proposal","lifecycle":"DRAFT","title":"2, 2025, created the Council to advise on “AI strategy, policy,…","statement":"2, 2025, created the Council to advise on “AI strategy, policy, and  training to ensure North Carolina becomes a national leader in AI literacy, governance, and deployment to the benefit of our  residents, communities, and economy.” This Roadmap puts the State of North Carolina and its partners on a path to meet  this high standard, and we are pleased to share it with you.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-1","reportedStatus":"draft","reportedOutcome":"New internal policy","suggestedParentId":"AU-06","suggestedParentTitle":"Prevent provider training on enterprise content","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E0 — evidence","enforcementMode":"Require evidence","evidence":"Policy / training / approval","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 1","rationale":"The directive establishes a program topic not represented as a distinct policy in the current 22-policy baseline.","test":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-52906f9344954603@05e5a8043989c722","id":"MS-PROPOSAL-52906f9344954603","version":"05e5a8043989c722","kind":"proposal","lifecycle":"DRAFT","title":"Dynamic dashboards will ensure transparency across state government by providing as…","statement":"Dynamic dashboards will ensure transparency across state government  by providing as much information as possible to the public while maintaining the security and integrity of systems.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-45","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-12","suggestedParentTitle":"Block classified, CUI and FCI","prototypeMatchPercent":6,"prototypeConfidencePercent":"67","automationTier":"E0 — evidence","enforcementMode":"Require evidence","evidence":"Policy / training / approval","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 45","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-54bef0badcd645e3@a91b49f9b39e14b5","id":"MS-PROPOSAL-54bef0badcd645e3","version":"a91b49f9b39e14b5","kind":"proposal","lifecycle":"DRAFT","title":"Embedding work-based learning opportunities and direct employer connections will accelerate reentry…","statement":"Embedding work-based  learning opportunities and direct employer connections will accelerate reentry into private- and public-sector roles.","family":"Access and Use","body":{"sourceId":"doc-1787223639269-0-20","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-03","suggestedParentTitle":"Enforce role and data-class authorization","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 20","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-5aeacd2415011ab5@288698f3a52d9f8e","id":"MS-PROPOSAL-5aeacd2415011ab5","version":"288698f3a52d9f8e","kind":"proposal","lifecycle":"DRAFT","title":"This effort will be achieved through collaborations with NCWorks Career Centers,…","statement":"This effort will be achieved through collaborations with NCWorks Career Centers, community colleges,  public libraries, community centers, and other community anchor institutions and deployed in a phased approach to reach  all regions of the state.","family":"Access and Use","body":{"sourceId":"doc-1787223639269-0-73","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OP-04","suggestedParentTitle":"Escalate AI incidents","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 73","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-5d2ae0fa2c414b55@14f7f404bdc5a752","id":"MS-PROPOSAL-5d2ae0fa2c414b55","version":"14f7f404bdc5a752","kind":"proposal","lifecycle":"DRAFT","title":"They will uphold whistleblower protections and coordinate across agencies in the…","statement":"They will uphold   whistleblower protections   and coordinate  across agencies in the event of an emergency related to or impacting AI use.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-68","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OP-11","suggestedParentTitle":"Decommission safely and delete data","prototypeMatchPercent":2,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 68","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-5fbeac2dc526ef57@ef8a8e394139f2e4","id":"MS-PROPOSAL-5fbeac2dc526ef57","version":"ef8a8e394139f2e4","kind":"proposal","lifecycle":"DRAFT","title":"Details: The state will partner with companies from key sectors in…","statement":"Details:   The state will partner with companies from key sectors in North Carolina to define the core entry-level AI  competencies employers need and publish them for higher education institutions to review and update course material  to teach these desired skills.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-75","reportedStatus":"draft","reportedOutcome":"Map existing","suggestedParentId":"DP-03","suggestedParentTitle":"Block payment card numbers","prototypeMatchPercent":76,"prototypeConfidencePercent":"89","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 75","rationale":"Closest semantic and keyword match is DP-03 — Block payment card numbers. The source adds applicability and evidence context.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-645c84845d09ab94@ea2271fd75c9a604","id":"MS-PROPOSAL-645c84845d09ab94","version":"ea2271fd75c9a604","kind":"proposal","lifecycle":"DRAFT","title":"These facilities serve as the backbone of AI, and as AI…","statement":"These  facilities serve as the backbone of AI, and as AI continues to advance, the demand for data centers will only increase.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-28","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-04","suggestedParentTitle":"Block CVV, CVC and PIN","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 28","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-65e6cebadb2c02ec@74a11ef76082e740","id":"MS-PROPOSAL-65e6cebadb2c02ec","version":"74a11ef76082e740","kind":"proposal","lifecycle":"DRAFT","title":"Agencies will implement a software bill of materials for deployed AI…","statement":"Agencies will  implement a software bill   of materials for deployed AI solutions that   map lineage of models, data,   and code to ensure  swift remediation.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-56","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-06","suggestedParentTitle":"Block bank-account data","prototypeMatchPercent":5,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 56","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-66641e97d4f18ff3@0733e169f0715701","id":"MS-PROPOSAL-66641e97d4f18ff3","version":"0733e169f0715701","kind":"proposal","lifecycle":"DRAFT","title":"Department of Information Technology, Agency AI Oversight Committees Timeline: December 2026…","statement":"Department of Information Technology, Agency AI Oversight Committees  Timeline:   December 2026  Recommendation:  Maintain transparency, traceability, and human oversight for any use of AI in the administration of government benefits programs,  ensuring AI systems do not make final benefits determinations.","family":"Operations","body":{"sourceId":"doc-1787223639269-0-48","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AG-04","suggestedParentTitle":"Prohibit autonomous consequential decisions","prototypeMatchPercent":6,"prototypeConfidencePercent":"67","automationTier":"E0 — evidence","enforcementMode":"Require evidence","evidence":"Policy / training / approval","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 48","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-6754d5f027221287@0686f0026feec556","id":"MS-PROPOSAL-6754d5f027221287","version":"0686f0026feec556","kind":"proposal","lifecycle":"DRAFT","title":"Dashboards will be updated regularly to reflect the most current information…","statement":"Dashboards will be updated regularly to reflect the most current information related to AI tools and will be accessible, with  information presented in plain language to promote transparency.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-46","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-08","suggestedParentTitle":"Detect shadow AI and unmanaged plugins","prototypeMatchPercent":5,"prototypeConfidencePercent":"67","automationTier":"E0 — evidence","enforcementMode":"Require evidence","evidence":"Policy / training / approval","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 46","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-69075cae86117cb2@68d298c2e3f80b76","id":"MS-PROPOSAL-69075cae86117cb2","version":"68d298c2e3f80b76","kind":"proposal","lifecycle":"DRAFT","title":"Legislation would strengthen this effort by requiring standardized disclosure of environmental,…","statement":"Legislation would strengthen this effort by requiring standardized disclosure of environmental, energy, and other baseline  consumption metrics from all AI data center developers and operators to ensure transparent and consistent tracking of  resource utilization.","family":"Output and Use","body":{"sourceId":"doc-1787223639269-0-32","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"IN-08","suggestedParentTitle":"Limit resource consumption","prototypeMatchPercent":6,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 32","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-6f68ea1d889cf656@0cf934ea0be48502","id":"MS-PROPOSAL-6f68ea1d889cf656","version":"0cf934ea0be48502","kind":"proposal","lifecycle":"DRAFT","title":"Additionally, these goals will strengthen North Carolina’s economy by empowering our…","statement":"Additionally, these goals will strengthen North Carolina’s economy by empowering  our workforce and businesses to deploy AI tools responsibly, supporting innovation and economic competitiveness, and  preparing communities for the economy of the future.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-2","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AG-01","suggestedParentTitle":"Allowlisted tools and connectors only","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 2","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-760bf582e8f19709@cab03c5192a6a576","id":"MS-PROPOSAL-760bf582e8f19709","version":"cab03c5192a6a576","kind":"proposal","lifecycle":"DRAFT","title":"Regardless of how states choose to disclose AI systems, the information…","statement":"Regardless of how states choose to disclose AI systems, the information disclosed typically includes  the system name, its purpose, a description of the use case, and the agency using the tool.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-42","reportedStatus":"draft","reportedOutcome":"Map existing","suggestedParentId":"OU-03","suggestedParentTitle":"Require evidence for factual claims","prototypeMatchPercent":76,"prototypeConfidencePercent":"89","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 42","rationale":"Closest semantic and keyword match is OU-03 — Require evidence for factual claims. The source adds applicability and evidence context.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-76e237f9cecac772@cf059b910c5f3968","id":"MS-PROPOSAL-76e237f9cecac772","version":"cf059b910c5f3968","kind":"proposal","lifecycle":"DRAFT","title":"Protect Prepare Transform • Protect Residents from AI Harms • Advance…","statement":"Protect   Prepare   Transform  •   Protect Residents from AI Harms   •   Advance Community Upskilling   •   Deliver Better for the Public  •   Expand Unemployment and Re-  Employment Programs   •   Create Pipelines to Workforce   •   Drive Statewide Innovation  •   Account for Resource Demands and  Impacts   •   Support PK-13 Education   •   Broaden Access to Critical Resources  •   Reduce Fraud, Manipulation, and  Deception   •   Promote Credentialing Opportunities   •   Build a Culture of Change  •   Improve Transparency and Accountability   •   Establish Government-Wide AI Resources  •   Develop Robust Contingency Plans  •   Strengthen Cybersecurity  •   Ensure Safe Government AI Usage","family":"Data Protection","body":{"sourceId":"doc-1787223639269-0-14","reportedStatus":"draft","reportedOutcome":"Map existing","suggestedParentId":"DP-01","suggestedParentTitle":"Block credentials and secrets","prototypeMatchPercent":76,"prototypeConfidencePercent":"89","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Critical","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 14","rationale":"Closest semantic and keyword match is DP-01 — Block credentials and secrets. The source adds applicability and evidence context.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-7a89e937b0b92eeb@3bb7653b48d2eb29","id":"MS-PROPOSAL-7a89e937b0b92eeb","version":"3bb7653b48d2eb29","kind":"proposal","lifecycle":"DRAFT","title":"This will be accomplished through identifying and supporting workers in roles…","statement":"This will be accomplished through identifying and supporting workers in roles most vulnerable to automation and  partnering with employers, Commerce’s Labor and Economic Analysis Division, community colleges, local workforce  development boards, and NCWorks Career Centers to track labor-market signals and pinpoint high-risk areas of AI-driven  displacement.","family":"Access and Use","body":{"sourceId":"doc-1787223639269-0-19","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-10","suggestedParentTitle":"Block biometric identifiers","prototypeMatchPercent":2,"prototypeConfidencePercent":"67","automationTier":"E0 — evidence","enforcementMode":"Require evidence","evidence":"Policy / training / approval","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 19","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-82cbbe360578240d@2a42bf79cfa9c3e0","id":"MS-PROPOSAL-82cbbe360578240d","version":"2a42bf79cfa9c3e0","kind":"proposal","lifecycle":"DRAFT","title":"This initiative will ensure that the state can continue delivering vital…","statement":"This initiative will ensure that the state  can continue delivering vital services to residents by defining and prioritizing critical statewide systems that use AI in the  event of system outages, failures, or attacks.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-51","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-15","suggestedParentTitle":"Protect architecture and vulnerability details","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Critical","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 51","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-83f291dc202b2f9e@0c3ad344046e19b8","id":"MS-PROPOSAL-83f291dc202b2f9e","version":"0c3ad344046e19b8","kind":"proposal","lifecycle":"DRAFT","title":"Worker Adjustment and Retraining Notification (WARN) data collection processes will help…","statement":"Worker Adjustment and Retraining Notification  (WARN) data collection processes will help to explicitly capture AI-related job losses and use these insights to inform  retraining opportunities to avoid long-term unemployment.","family":"Operations","body":{"sourceId":"doc-1787223639269-0-25","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-05","suggestedParentTitle":"Block national identifiers","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E0 — evidence","enforcementMode":"Require evidence","evidence":"Policy / training / approval","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 25","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-847984e1cf6b71ca@11486e59bd0f5e09","id":"MS-PROPOSAL-847984e1cf6b71ca","version":"11486e59bd0f5e09","kind":"proposal","lifecycle":"DRAFT","title":"The recommendations below were identified by the Council to improve AI…","statement":"The recommendations below were identified by the Council to improve  AI policy, governance, ethics, and literacy for the state with the understanding that AI will continue to evolve.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-13","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-06","suggestedParentTitle":"Prevent provider training on enterprise content","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E0 — evidence","enforcementMode":"Require evidence","evidence":"Policy / training / approval","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 13","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-84c559976cc7d642@21ade2548391dae3","id":"MS-PROPOSAL-84c559976cc7d642","version":"21ade2548391dae3","kind":"proposal","lifecycle":"DRAFT","title":"Clear procedures must be documented for enabling, bypassing, or overriding AI…","statement":"Clear procedures must be documented for enabling, bypassing, or overriding AI systems, and staff should be trained to  manually operate critical processes without AI assistance during outages.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-53","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OP-04","suggestedParentTitle":"Escalate AI incidents","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Critical","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 53","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-89b5ee189eb812ab@e89e92e4bbe14366","id":"MS-PROPOSAL-89b5ee189eb812ab","version":"e89e92e4bbe14366","kind":"proposal","lifecycle":"DRAFT","title":"Details: North Carolina must proactively provide accessible pathways back into high-demand,…","statement":"Details:   North Carolina must proactively provide accessible pathways back into high-demand, sustainable careers.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-18","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OP-08","suggestedParentTitle":"Support feedback, appeal and override","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 18","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-8e788525b874a12f@b96cbb3761820638","id":"MS-PROPOSAL-8e788525b874a12f","version":"b96cbb3761820638","kind":"proposal","lifecycle":"DRAFT","title":"General Assembly, Local Governments Timeline: June 2027 Goal 4: Reduce Fraud,…","statement":"General Assembly, Local Governments  Timeline:   June 2027  Goal 4: Reduce Fraud, Manipulation, and Deception  Ensure 100% of state government-produced content abides by a content authenticity standard.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-33","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OU-06","suggestedParentTitle":"Block harassment, hate and abuse","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 33","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-8ec797f3de89a1ec@5da8bc0529385f12","id":"MS-PROPOSAL-8ec797f3de89a1ec","version":"5da8bc0529385f12","kind":"proposal","lifecycle":"DRAFT","title":"AI Literacy Ensure all North Carolinians have the knowledge to understand,…","statement":"AI Literacy  Ensure all North Carolinians have the knowledge to understand, use, and critically evaluate AI technologies, enabling  people to make informed choices about the technology in their lives.","family":"Operations","body":{"sourceId":"doc-1787223639269-0-7","reportedStatus":"draft","reportedOutcome":"New internal policy","suggestedParentId":"DP-02","suggestedParentTitle":"Block passwords and authentication answers","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E0 — evidence","enforcementMode":"Require evidence","evidence":"Policy / training / approval","severity":"Critical","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 7","rationale":"The directive establishes a program topic not represented as a distinct policy in the current 22-policy baseline.","test":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-91977ab6033fc50e@2933d36b6b884cf3","id":"MS-PROPOSAL-91977ab6033fc50e","version":"2933d36b6b884cf3","kind":"proposal","lifecycle":"DRAFT","title":"Child safety components will focus on foundational safety requirements that encourage…","statement":"Child safety components will focus on foundational safety requirements that encourage non-  addictive designs and establish a standard duty of care.","family":"Input and Content","body":{"sourceId":"doc-1787223639269-0-16","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OU-06","suggestedParentTitle":"Block harassment, hate and abuse","prototypeMatchPercent":5,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 16","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-9a54b202264a974f@e3e9419848093815","id":"MS-PROPOSAL-9a54b202264a974f","version":"e3e9419848093815","kind":"proposal","lifecycle":"DRAFT","title":"Implementing a statewide content verification standard will strengthen public trust by…","statement":"Implementing a statewide content verification  standard will strengthen public trust by assuring residents content is authentic, especially in times of emergency.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-35","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OU-06","suggestedParentTitle":"Block harassment, hate and abuse","prototypeMatchPercent":5,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 35","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-9ba3144fe67b0898@f8b4752a1474e56d","id":"MS-PROPOSAL-9ba3144fe67b0898","version":"f8b4752a1474e56d","kind":"proposal","lifecycle":"DRAFT","title":"They each will maintain an AI inventory for the agency and…","statement":"They each will maintain an AI inventory for the agency and assist the AI Oversight Committees  in overseeing the ongoing monitoring of approved AI tools.","family":"Access and Use","body":{"sourceId":"doc-1787223639269-0-67","reportedStatus":"draft","reportedOutcome":"Map existing","suggestedParentId":"AU-01","suggestedParentTitle":"Allow sanctioned AI services only","prototypeMatchPercent":76,"prototypeConfidencePercent":"89","automationTier":"E0 — evidence","enforcementMode":"Require evidence","evidence":"Policy / training / approval","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 67","rationale":"Closest semantic and keyword match is AU-01 — Allow sanctioned AI services only. The source adds applicability and evidence context.","test":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-9dd049dd5788ec7f@c920b947bf344f6e","id":"MS-PROPOSAL-9dd049dd5788ec7f","version":"c920b947bf344f6e","kind":"proposal","lifecycle":"DRAFT","title":"They will also be the main point of contact for all…","statement":"They will also be the main point of contact for all  accountability escalation.","family":"Access and Use","body":{"sourceId":"doc-1787223639269-0-66","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-04","suggestedParentTitle":"Allow approved use cases and models only","prototypeMatchPercent":6,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 66","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-a013544d01fee287@c3fd7c117141fbd2","id":"MS-PROPOSAL-a013544d01fee287","version":"c3fd7c117141fbd2","kind":"proposal","lifecycle":"DRAFT","title":"When AI is used to help generate official content, the standard…","statement":"When AI is used to help generate official content, the standard  should also disclose how it was used to ensure transparency.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-37","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OU-12","suggestedParentTitle":"Disclose AI-generated or synthetic content","prototypeMatchPercent":9,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 37","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-a666d0d234297f32@939685e8d1b81471","id":"MS-PROPOSAL-a666d0d234297f32","version":"939685e8d1b81471","kind":"proposal","lifecycle":"DRAFT","title":"This recommendation will expand AI- focused registered apprenticeship tracks to address…","statement":"This recommendation will expand AI-  focused registered apprenticeship tracks to address workforce shortages and create clear entry points for emerging talent","family":"Governance","body":{"sourceId":"doc-1787223639269-0-79","reportedStatus":"draft","reportedOutcome":"Map existing","suggestedParentId":"DP-03","suggestedParentTitle":"Block payment card numbers","prototypeMatchPercent":76,"prototypeConfidencePercent":"89","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 79","rationale":"Closest semantic and keyword match is DP-03 — Block payment card numbers. The source adds applicability and evidence context.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-a9cd05757ef9ca8e@5add95a24b8b2e22","id":"MS-PROPOSAL-a9cd05757ef9ca8e","version":"5add95a24b8b2e22","kind":"proposal","lifecycle":"DRAFT","title":"Through these collective efforts, the state seeks to ensure that every…","statement":"Through these collective efforts, the  state seeks to ensure that every North Carolinian has the opportunity to thrive in a landscape that will be shaped by advanced  technology.","family":"Operations","body":{"sourceId":"doc-1787223639269-0-6","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-01","suggestedParentTitle":"Allow sanctioned AI services only","prototypeMatchPercent":2,"prototypeConfidencePercent":"67","automationTier":"E1 — observe","enforcementMode":"Detect / log","evidence":"Event / log","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 6","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-adbad1df6911bf37@20a0fea803b2e326","id":"MS-PROPOSAL-adbad1df6911bf37","version":"20a0fea803b2e326","kind":"proposal","lifecycle":"DRAFT","title":"To successfully implement most of the recommendations, the State will need…","statement":"To successfully implement most of the recommendations, the State will need to realign its existing funding, and in  other cases, seek more resources from governmental and non-governmental sources.","family":"Output and Use","body":{"sourceId":"doc-1787223639269-0-3","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-10","suggestedParentTitle":"Block biometric identifiers","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 3","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-ae0534fced3aad40@255044216162f04c","id":"MS-PROPOSAL-ae0534fced3aad40","version":"255044216162f04c","kind":"proposal","lifecycle":"DRAFT","title":"Recurring security testing of products will be conducted to check for…","statement":"Recurring security  testing of products will be conducted to check for emerging threats and defend against vulnerabilities.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-64","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"IN-04","suggestedParentTitle":"Restrict harmful cyber requests","prototypeMatchPercent":5,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 64","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-aff5a4c774c3e66b@e94443031a0389d8","id":"MS-PROPOSAL-aff5a4c774c3e66b","version":"e94443031a0389d8","kind":"proposal","lifecycle":"DRAFT","title":"Additionally, residents should be given the opportunity to opt out of…","statement":"Additionally, residents should be given the opportunity to opt out of their data being shared or used  in AI models beyond where required for program participation.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-50","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-03","suggestedParentTitle":"Enforce role and data-class authorization","prototypeMatchPercent":6,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 50","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-b1f44853d7f32a32@1f40bcec27b61ddf","id":"MS-PROPOSAL-b1f44853d7f32a32","version":"1f40bcec27b61ddf","kind":"proposal","lifecycle":"DRAFT","title":"This upskilling plan will target all skill levels, including senior citizens,…","statement":"This upskilling plan will target all skill levels, including senior citizens, students, and rural communities.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-39","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-04","suggestedParentTitle":"Block CVV, CVC and PIN","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 39","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-b54d5bfe50348a03@b3d18212e7b62451","id":"MS-PROPOSAL-b54d5bfe50348a03","version":"b3d18212e7b62451","kind":"proposal","lifecycle":"DRAFT","title":"This training will help residents build practical understanding of AI concepts,…","statement":"This training  will help residents build practical understanding of AI concepts, everyday digital tools, online safety, scam awareness, and  responsible AI use.","family":"Operations","body":{"sourceId":"doc-1787223639269-0-74","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OU-01","suggestedParentTitle":"Block sensitive output disclosure","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E0 — evidence","enforcementMode":"Require evidence","evidence":"Policy / training / approval","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 74","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-b768963a8f382071@6af99077b1e22c00","id":"MS-PROPOSAL-b768963a8f382071","version":"6af99077b1e22c00","kind":"proposal","lifecycle":"DRAFT","title":"To realize this ambitious vision, North Carolina state agencies will collaborate…","statement":"To realize this ambitious vision, North Carolina state agencies will collaborate with higher education institutions, private employers,  nonprofits, and workforce partners to create pathways for success in an AI-driven future.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-5","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-08","suggestedParentTitle":"Restrict education records","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 5","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-ba4c99c27e7c0a69@e1b27a897b6f076b","id":"MS-PROPOSAL-ba4c99c27e7c0a69","version":"e1b27a897b6f076b","kind":"proposal","lifecycle":"DRAFT","title":"Community upskilling efforts, via the Advancing Community Upskilling goal later in…","statement":"Community upskilling efforts, via the Advancing Community  Upskilling goal later in this framework, will include education on how to recognize verified content from government  sources.","family":"Output and Use","body":{"sourceId":"doc-1787223639269-0-38","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-06","suggestedParentTitle":"Prevent provider training on enterprise content","prototypeMatchPercent":5,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 38","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-bb55b5b2157c3ffc@586778c3cc63c5a5","id":"MS-PROPOSAL-bb55b5b2157c3ffc","version":"586778c3cc63c5a5","kind":"proposal","lifecycle":"DRAFT","title":"Recommendation: Establish minimum statewide trustworthy AI standards for all AI-enabled tools…","statement":"Recommendation:  Establish minimum statewide trustworthy AI standards for all AI-enabled tools and systems that must be met before agencies","family":"Governance","body":{"sourceId":"doc-1787223639269-0-60","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-01","suggestedParentTitle":"Block credentials and secrets","prototypeMatchPercent":7,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 60","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-bfa86fe3686b5314@9b33b24758f0f1c3","id":"MS-PROPOSAL-bfa86fe3686b5314","version":"9b33b24758f0f1c3","kind":"proposal","lifecycle":"DRAFT","title":"A feedback loop using hiring outcomes, employer demand, and worker feedback…","statement":"A feedback loop using hiring outcomes, employer demand, and worker feedback will allow  for continuous review and updates, keeping entry-level expectations current and strengthening the employment pipeline  from higher education to private sector.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-76","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OU-04","suggestedParentTitle":"Require human validation for high-stakes advice","prototypeMatchPercent":6,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 76","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-bfbd4ed15b4d6e90@9fc0efe52c05a9e6","id":"MS-PROPOSAL-bfbd4ed15b4d6e90","version":"9fc0efe52c05a9e6","kind":"proposal","lifecycle":"DRAFT","title":"The regional curriculum will be informed by community input","statement":"The regional curriculum will be informed by  community input.","family":"Access and Use","body":{"sourceId":"doc-1787223639269-0-72","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"IN-07","suggestedParentTitle":"Enforce allowed intent and scope","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 72","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-c0c6817ff57d97fb@eb28640456516466","id":"MS-PROPOSAL-c0c6817ff57d97fb","version":"eb28640456516466","kind":"proposal","lifecycle":"DRAFT","title":"Regardless of risk level, mitigation plans will include ongoing monitoring requirements…","statement":"Regardless of risk level, mitigation plans will  include ongoing monitoring requirements and accountability mechanisms for all AI-enabled systems.","family":"Access and Use","body":{"sourceId":"doc-1787223639269-0-63","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OP-09","suggestedParentTitle":"Maintain AI inventory and ownership","prototypeMatchPercent":8,"prototypeConfidencePercent":"67","automationTier":"E1 — observe","enforcementMode":"Detect / log","evidence":"Event / log","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 63","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-c1559724c3f73d52@a290a120522acfb8","id":"MS-PROPOSAL-c1559724c3f73d52","version":"a290a120522acfb8","kind":"proposal","lifecycle":"DRAFT","title":"National Guard, Local Governments Timeline: June 2027 Goal 8: Ensure Responsible…","statement":"National Guard, Local  Governments  Timeline:   June 2027  Goal 8: Ensure Responsible Government AI Usage  Ensure AI systems used by state agencies meet standardized internal safety, privacy, security, reliability,  fairness, and explainability requirements.","family":"Data Protection","body":{"sourceId":"doc-1787223639269-0-59","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OP-12","suggestedParentTitle":"Require predeployment evaluation and red team","prototypeMatchPercent":9,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"High","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 59","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-c36b0a9c7e9b371f@01f9fb829e6bacd4","id":"MS-PROPOSAL-c36b0a9c7e9b371f","version":"01f9fb829e6bacd4","kind":"proposal","lifecycle":"DRAFT","title":"Details: This program will deploy free, foundational AI literacy learning opportunities…","statement":"Details:   This program will deploy free, foundational AI literacy learning opportunities in all regions of North Carolina and  will be designed for residents of all backgrounds and skill levels, including the workforce, senior citizens, rural residents,  individuals with limited digital access, and other underserved communities.","family":"Access and Use","body":{"sourceId":"doc-1787223639269-0-71","reportedStatus":"draft","reportedOutcome":"New internal policy","suggestedParentId":"DP-01","suggestedParentTitle":"Block credentials and secrets","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E0 — evidence","enforcementMode":"Require evidence","evidence":"Policy / training / approval","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 71","rationale":"The directive establishes a program topic not represented as a distinct policy in the current 22-policy baseline.","test":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-cc97f1321e4a83b3@085fdf897d47a0ea","id":"MS-PROPOSAL-cc97f1321e4a83b3","version":"085fdf897d47a0ea","kind":"proposal","lifecycle":"DRAFT","title":"24: Advancing Trustworthy Artificial Intelligence That Benefits All North Carolinians requires…","statement":"24: Advancing Trustworthy Artificial Intelligence That Benefits All North Carolinians  requires the disclosure of high-risk AI use cases throughout state government, this initiative will strengthen public trust  by disclosing additional public-facing AI use.","family":"Output and Use","body":{"sourceId":"doc-1787223639269-0-44","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-04","suggestedParentTitle":"Allow approved use cases and models only","prototypeMatchPercent":7,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"High","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 44","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-d1e378f73b002350@21d3d782df317d92","id":"MS-PROPOSAL-d1e378f73b002350","version":"21d3d782df317d92","kind":"proposal","lifecycle":"DRAFT","title":"Details: To ensure public confidence in official government communications, all state…","statement":"Details:   To ensure public confidence in official government communications, all state agencies should verify the  authenticity of their communications with clear tracing of their origins.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-34","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OP-07","suggestedParentTitle":"Time-bound exceptions and waivers","prototypeMatchPercent":5,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 34","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-dc0f6149115ff494@208271654a02f362","id":"MS-PROPOSAL-dc0f6149115ff494","version":"208271654a02f362","kind":"proposal","lifecycle":"DRAFT","title":"This recommendation calls for a resource monitoring program that uses independent,…","statement":"This recommendation  calls for a resource monitoring program that uses independent, third-party evaluators to assess and publicly report the  environmental and community impacts of AI-related infrastructure, with a focus on land, water, energy, and public health  concerns.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-31","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"IN-08","suggestedParentTitle":"Limit resource consumption","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E1 — observe","enforcementMode":"Detect / log","evidence":"Event / log","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 31","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-dd8ea20b6b46d7f8@d413dad9632cf38c","id":"MS-PROPOSAL-dd8ea20b6b46d7f8","version":"d413dad9632cf38c","kind":"proposal","lifecycle":"DRAFT","title":"Details: As AI continues to reshape society, the state will explore…","statement":"Details:   As AI continues to reshape society, the state will explore a package of statewide policies that address numerous  concerns enabled by AI technologies, including child safety and mental health, lack of privacy protections, and senior  citizen fraud and abuse.","family":"Data Protection","body":{"sourceId":"doc-1787223639269-0-15","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OU-11","suggestedParentTitle":"Prevent re-identification","prototypeMatchPercent":6,"prototypeConfidencePercent":"67","automationTier":"E1 — observe","enforcementMode":"Detect / log","evidence":"Event / log","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 15","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-dea82959fec98f9a@fb54f162fc07c7cc","id":"MS-PROPOSAL-dea82959fec98f9a","version":"fb54f162fc07c7cc","kind":"proposal","lifecycle":"DRAFT","title":"Also must respect personal autonomy and dignity, maintaining people’s freedom to…","statement":"Systems also must respect personal autonomy and  dignity, maintaining people’s freedom to think, choose, and act independently, and systems must prevent manipulation or restriction of choices.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-9","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AG-09","suggestedParentTitle":"Govern agent memory writes","prototypeMatchPercent":5,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 9","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-e740125818f04c9b@3d1d2400e5d07aa2","id":"MS-PROPOSAL-e740125818f04c9b","version":"3d1d2400e5d07aa2","kind":"proposal","lifecycle":"DRAFT","title":"Workforce Empowerment Ensure technology augments rather than replaces the workforce by…","statement":"Workforce Empowerment  Ensure technology augments rather than replaces the workforce by preparing workers in all industries, including state  government, for an AI-enabled economy by upskilling, reskilling, and strengthening the worker safety net.","family":"Operations","body":{"sourceId":"doc-1787223639269-0-8","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OU-06","suggestedParentTitle":"Block harassment, hate and abuse","prototypeMatchPercent":4,"prototypeConfidencePercent":"67","automationTier":"E1 — observe","enforcementMode":"Detect / log","evidence":"Event / log","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 8","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-ed84c49272c9d971@af33162ce7aa3cec","id":"MS-PROPOSAL-ed84c49272c9d971","version":"af33162ce7aa3cec","kind":"proposal","lifecycle":"DRAFT","title":"These liaisons must be given a sufficient level of authority to…","statement":"These liaisons must  be given a sufficient level of authority to create accountability mechanisms to enforce the standards and governance  mechanisms established in the previous recommendation for this goal.","family":"Access and Use","body":{"sourceId":"doc-1787223639269-0-65","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"OP-09","suggestedParentTitle":"Maintain AI inventory and ownership","prototypeMatchPercent":5,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 65","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-f0d3794e7b463764@be2e942c093049e7","id":"MS-PROPOSAL-f0d3794e7b463764","version":"be2e942c093049e7","kind":"proposal","lifecycle":"DRAFT","title":"This initiative will create and implement a tiered governance model specific…","statement":"This initiative will create  and implement a tiered governance model specific to AI, with tailored mitigation plans according to risk level that address  safety concerns including bias, accuracy, model degradation, and more.","family":"Output and Use","body":{"sourceId":"doc-1787223639269-0-62","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-04","suggestedParentTitle":"Allow approved use cases and models only","prototypeMatchPercent":7,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"High","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 62","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-f1c48f21fa979e7a@f40be4194d438a7f","id":"MS-PROPOSAL-f1c48f21fa979e7a","version":"f40be4194d438a7f","kind":"proposal","lifecycle":"DRAFT","title":"Each of these recommendations has been created with an implementation plan…","statement":"Each of these recommendations has been created with an implementation plan and timeline, recognizing that work will progress and be shared as it is  available.","family":"Governance","body":{"sourceId":"doc-1787223639269-0-12","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"AU-07","suggestedParentTitle":"Prohibit account sharing","prototypeMatchPercent":3,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 12","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-f4cb1291ad18476e@095a64107deda61f","id":"MS-PROPOSAL-f4cb1291ad18476e","version":"095a64107deda61f","kind":"proposal","lifecycle":"DRAFT","title":"By 2029, approximately half of US jobs will be transformed by…","statement":"By 2029, approximately half of US jobs will be   transformed by AI .","family":"Governance","body":{"sourceId":"doc-1787223639269-0-17","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"PROPOSED","suggestedParentTitle":"No close canonical match","prototypeMatchPercent":0,"prototypeConfidencePercent":"67","automationTier":"E2 — govern","enforcementMode":"Warn / require","evidence":"Workflow / policy","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 17","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"MS-PROPOSAL-f833e9ff4c4adec2@be4d99a8a6250989","id":"MS-PROPOSAL-f833e9ff4c4adec2","version":"be4d99a8a6250989","kind":"proposal","lifecycle":"DRAFT","title":"Some states publish all AI systems in their inventory, while others…","statement":"Some states publish all AI systems in their inventory, while others focus  only on   high-risk systems .","family":"Operations","body":{"sourceId":"doc-1787223639269-0-41","reportedStatus":"draft","reportedOutcome":"New canonical rule","suggestedParentId":"DP-02","suggestedParentTitle":"Block passwords and authentication answers","prototypeMatchPercent":7,"prototypeConfidencePercent":"67","automationTier":"E1 — observe","enforcementMode":"Detect / log","evidence":"Event / log","severity":"Medium","originalSourceFile":"NC-statewide-ai-strategic-roadmap.pdf","originalLocator":"Directive 41","rationale":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","test":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","warning":"Prototype proposal, not an adopted rule. Original PDF not supplied; semantic/source review required.","sourceDate":"2026-08-20","adopted":false,"machineExecutable":false}},{"key":"FW-EO-14110@dfd56eb497a8628f","id":"FW-EO-14110","version":"dfd56eb497a8628f","kind":"reference_bundle","lifecycle":"HISTORICAL","title":"Executive Order 14110 — Safe, Secure, and Trustworthy Artificial Intelligence","statement":"User-supplied reference notes. Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","family":"EO-14110","body":{"sourceFile":"POLICY(4).md","sourceFamily":"EO-14110","sourceDate":null,"primarySourceRechecked":false,"warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","adopted":false,"enforcementVerified":false,"versionInSource":null}},{"key":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","id":"FW-LEGACY-US-AI-BUNDLE","version":"117740b358f70c6a","kind":"reference_bundle","lifecycle":"REFERENCE","title":"White House AI Executive Order \n\n*CISA’s Roadmap for Artificial Intelligence \n\n*OPM's Responsible Use of Generative Artificial Intelligence for the Federal Workforce \n\n*DOD Vision for AI","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"White House AI Executive Order \n\n*CISA’s Roadmap for Artificial Intelligence \n\n*OPM's Responsible Use of Generative Artificial Intelligence for the Federal Workforce \n\n*DOD Vision for AI","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","id":"FW-US-STATE-LAWS-BUNDLE","version":"5c9e8ddf3b769a66","kind":"reference_bundle","lifecycle":"REFERENCE","title":"US State-by-State\nAI-related legislative activities\n(Sources: Multistate.ai, ChatGPT and Perplexity)","statement":"Reference appearing in the TAIM source crosswalk.","family":"TAIM source reference","body":{"exactEditionInTitle":"US State-by-State\nAI-related legislative activities\n(Sources: Multistate.ai, ChatGPT and Perplexity)","primarySourceRechecked":false,"sourceDate":"2026-08-20","legacyOrDraftPossible":true}},{"key":"REQ-02950f8c52a65032e88d@d8b679bfd274ca7c","id":"REQ-02950f8c52a65032e88d","version":"d8b679bfd274ca7c","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 1.3","statement":"AI governance owners should document organizational goals for AI","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"organizational goals for AI","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for organizational goals for AI within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for organizational goals for AI. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-03176ecf6566459f379c@97dc9a980a45e36f","id":"REQ-03176ecf6566459f379c","version":"97dc9a980a45e36f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"p.5, appropriate use, bullet 2","statement":"employees must-not use high-risk tools","family":"Governance","body":{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 2","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must-not","action":"use","object":"high-risk tools","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"use\" for high-risk tools within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"use\" for high-risk tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-04fecf9f342191797c85@f337eac9040d6493","id":"REQ-04fecf9f342191797c85","version":"f337eac9040d6493","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 2.2","statement":"AI governance owners should document AI knowledge limitations","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI knowledge limitations","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI knowledge limitations within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI knowledge limitations. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-056c4c0f7228e3f516a3@ef1d5b4d1d4e7378","id":"REQ-056c4c0f7228e3f516a3","version":"ef1d5b4d1d4e7378","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Appendix A.1(A)(i)","statement":"Covered agency must request vendor acceptable-use policy","family":"Procurement","body":{"sourceId":"omb-m-26-04","control":"Appendix A.1(A)(i)","sourceVersion":"M-26-04","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf#page=5","actor":"Covered agency","modality":"must","action":"request","object":"vendor acceptable-use policy","condition":"Covered LLM solicitations","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"request\" for vendor acceptable-use policy within these source conditions: Covered LLM solicitations, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"request\" for vendor acceptable-use policy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-06134a67f9e4ae9a363a@4af1cfb4b135698e","id":"REQ-06134a67f9e4ae9a363a","version":"4af1cfb4b135698e","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 14(4)(c)","statement":"High-risk AI providers must enable oversight personnel to interpret AI outputs appropriately","family":"Human oversight","body":{"sourceId":"eu-ai-act","control":"Article 14(4)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"oversight personnel to interpret AI outputs appropriately","condition":"When overseeing high-risk AI","exception":"According to available tools","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to interpret AI outputs appropriately within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to interpret AI outputs appropriately while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-07177b727288ebbe340c@db87e2d16fb4d8f6","id":"REQ-07177b727288ebbe340c","version":"db87e2d16fb4d8f6","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"GV-1.4-002","statement":"AI governance owners should establish transparent GAI acceptable-use policies","family":"Transparency","body":{"sourceId":"nist-genai-profile","control":"GV-1.4-002","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"transparent GAI acceptable-use policies","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for transparent GAI acceptable-use policies within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for transparent GAI acceptable-use policies. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-0735d7721e6081064e93@38d67cbe56090db9","id":"REQ-0735d7721e6081064e93","version":"38d67cbe56090db9","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"5.1.5, p.2","statement":"agencies must disclose AI interaction","family":"Governance","body":{"sourceId":"pa-ai-2026","control":"5.1.5, p.2","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"agencies","modality":"must","action":"disclose","object":"AI interaction","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"disclose\" for AI interaction within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"disclose\" for AI interaction while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-083b66009492b287e64e@1cd525f4b6e1d977","id":"REQ-083b66009492b287e64e","version":"1cd525f4b6e1d977","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 7(3)","statement":"Data controllers must enable withdrawal of consent","family":"Governance","body":{"sourceId":"eu-gdpr","control":"Article 7(3)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"enable","object":"withdrawal of consent","condition":"Where consent is the lawful basis","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"enable\" for withdrawal of consent within these source conditions: Where consent is the lawful basis, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"enable\" for withdrawal of consent while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-0bf05af2b1254d36d95d@d30eaa162d7deae2","id":"REQ-0bf05af2b1254d36d95d","version":"d30eaa162d7deae2","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Manage 4.1","statement":"AI governance owners should implement post-deployment AI monitoring plans","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Manage 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"implement","object":"post-deployment AI monitoring plans","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"implement\" for post-deployment AI monitoring plans within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"implement\" for post-deployment AI monitoring plans. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-0d5dcfe0e9173d9da324@209a3fbda9a26078","id":"REQ-0d5dcfe0e9173d9da324","version":"209a3fbda9a26078","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"ID.IM-P4","statement":"Organization should inventory system data actions","family":"Data & IP","body":{"sourceId":"nist-privacy-1","control":"ID.IM-P4","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"system data actions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for system data actions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for system data actions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-0ddbfcb7b02544b6212b@bb224a6d769cc96d","id":"REQ-0ddbfcb7b02544b6212b","version":"bb224a6d769cc96d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"RV.1.1","statement":"Software producer should gather vulnerability reports","family":"Security","body":{"sourceId":"nist-ssdf-1-1","control":"RV.1.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=25","actor":"Software producer","modality":"should","action":"gather","object":"vulnerability reports","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"gather\" for vulnerability reports within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"gather\" for vulnerability reports. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-0f2f5de858f666011246@e48294c0d4725a29","id":"REQ-0f2f5de858f666011246","version":"e48294c0d4725a29","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 6(1)","statement":"Data controllers must identify a lawful basis for processing","family":"Governance","body":{"sourceId":"eu-gdpr","control":"Article 6(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"identify","object":"a lawful basis for processing","condition":"Before covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"identify\" for a lawful basis for processing within these source conditions: Before covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"identify\" for a lawful basis for processing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-120a7381e4c5b8772065@e9fcc61b32d4851d","id":"REQ-120a7381e4c5b8772065","version":"e9fcc61b32d4851d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 12(1)","statement":"Data controllers must provide clear privacy information","family":"Privacy","body":{"sourceId":"eu-gdpr","control":"Article 12(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"provide","object":"clear privacy information","condition":"Information to data subjects","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"provide\" for clear privacy information within these source conditions: Information to data subjects, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"provide\" for clear privacy information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-123460e487116850fce7@62fa77de470efc9f","id":"REQ-123460e487116850fce7","version":"62fa77de470efc9f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 15(4)","statement":"High-risk AI providers must ensure resilience to errors and faults","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 15(4)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"ensure","object":"resilience to errors and faults","condition":"Covered high-risk systems","exception":"Appropriate technical measures","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for resilience to errors and faults within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for resilience to errors and faults while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-12ede2e0f974afd286ca@ccebc9e5f868bd69","id":"REQ-12ede2e0f974afd286ca","version":"ccebc9e5f868bd69","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 5.1","statement":"AI governance owners should estimate likelihood and magnitude of AI impacts","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 5.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"estimate","object":"likelihood and magnitude of AI impacts","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"estimate\" for likelihood and magnitude of AI impacts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"estimate\" for likelihood and magnitude of AI impacts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-137a5e80ab9922df5589@b790c3d7ca398dd4","id":"REQ-137a5e80ab9922df5589","version":"b790c3d7ca398dd4","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 50(1)","statement":"AI providers must inform people they are interacting with AI","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 50(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI providers","modality":"must","action":"inform","object":"people they are interacting with AI","condition":"Direct interaction with natural persons","exception":"Obvious interaction and specified law-enforcement exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI providers performs the required action \"inform\" for people they are interacting with AI within these source conditions: Direct interaction with natural persons, and retains evidence.","doesNotMeetRule":"AI providers omits the required action \"inform\" for people they are interacting with AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-160c858f2ef5d65b3318@122c8a471667fc8d","id":"REQ-160c858f2ef5d65b3318","version":"122c8a471667fc8d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 5(1)(a)","statement":"AI operators must not use harmfully manipulative AI techniques","family":"Safety","body":{"sourceId":"eu-ai-act","control":"Article 5(1)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"use","object":"harmfully manipulative AI techniques","condition":"Material distortion of behavior causing or likely to cause significant harm","exception":"Statutory elements must all be assessed","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"use\" for harmfully manipulative AI techniques while these conditions apply: Material distortion of behavior causing or likely to cause significant harm.","doesNotMeetRule":"AI operators performs the prohibited action \"use\" for harmfully manipulative AI techniques while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-174d5a7bbfbd13819e2d@7fa68be56f3f92d1","id":"REQ-174d5a7bbfbd13819e2d","version":"7fa68be56f3f92d1","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 4.3","statement":"AI governance owners should enable AI incident identification","family":"Safety","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 4.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"enable","object":"AI incident identification","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"enable\" for AI incident identification within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"enable\" for AI incident identification. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-18021553f67c616cba69@611f0ce1e0c7ffbd","id":"REQ-18021553f67c616cba69","version":"611f0ce1e0c7ffbd","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 53(1)(d)","statement":"GPAI model providers must publish a training-content summary","family":"Data & IP","body":{"sourceId":"eu-ai-act","control":"Article 53(1)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"publish","object":"a training-content summary","condition":"Covered general-purpose AI models","exception":"AI Office template and transition provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"publish\" for a training-content summary within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"publish\" for a training-content summary while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-1a3621b4e8901f30a0c1@783151438967103c","id":"REQ-1a3621b4e8901f30a0c1","version":"783151438967103c","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"GV-6.1-007","statement":"AI governance owners should inventory third parties with access to organizational content","family":"Governance","body":{"sourceId":"nist-genai-profile","control":"GV-6.1-007","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"inventory","object":"third parties with access to organizational content","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for third parties with access to organizational content within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for third parties with access to organizational content. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-1a6a62c557aa93951734@a21d56cd9e4f0985","id":"REQ-1a6a62c557aa93951734","version":"a21d56cd9e4f0985","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Summary / model weights","statement":"AI deployer should restrict model-weight access","family":"Governance","body":{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Summary / model weights","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"restrict","object":"model-weight access","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"restrict\" for model-weight access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"restrict\" for model-weight access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-1aef10d35f45cb977dc3@c75b81f1244f0e4d","id":"REQ-1aef10d35f45cb977dc3","version":"c75b81f1244f0e4d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"PT-2(a)","statement":"Organization should document PII processing authority","family":"Privacy","body":{"sourceId":"nist-800-53-r5","control":"PT-2(a)","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=257","actor":"Organization","modality":"should","action":"document","object":"PII processing authority","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"document\" for PII processing authority within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"document\" for PII processing authority. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-1bda73592ba3cba8a182@27250dec3bf7b573","id":"REQ-1bda73592ba3cba8a182","version":"27250dec3bf7b573","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 4.1","statement":"AI governance owners should map legal risks of AI components","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"map","object":"legal risks of AI components","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"map\" for legal risks of AI components within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"map\" for legal risks of AI components. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-1cbedf68688bfd14fba5@d7b79e8944469257","id":"REQ-1cbedf68688bfd14fba5","version":"d7b79e8944469257","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"GV-1.3-004","statement":"AI governance owners should obtain stakeholder input on unacceptable GAI use","family":"Governance","body":{"sourceId":"nist-genai-profile","control":"GV-1.3-004","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"obtain","object":"stakeholder input on unacceptable GAI use","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"obtain\" for stakeholder input on unacceptable GAI use within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"obtain\" for stakeholder input on unacceptable GAI use. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-1dc235a72fc3ac90be1e@13b1a9368f890fbb","id":"REQ-1dc235a72fc3ac90be1e","version":"13b1a9368f890fbb","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 55(1)(b)","statement":"Systemic-risk GPAI providers must assess systemic risks","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 55(1)(b)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"assess","object":"systemic risks","condition":"Covered systemic-risk models","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"assess\" for systemic risks within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"assess\" for systemic risks while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-21dc284ae3b88e999715@61700a51c74faffb","id":"REQ-21dc284ae3b88e999715","version":"61700a51c74faffb","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 7(4)","statement":"Covered GenAI service providers must improve training-data quality","family":"Data & IP","body":{"sourceId":"cn-genai-interim","control":"Article 7(4)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"improve","object":"training-data quality","condition":"Covered training activities","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for training-data quality within these source conditions: Covered training activities, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for training-data quality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-22983301e6c9273a60e6@c927cc0480336e6c","id":"REQ-22983301e6c9273a60e6","version":"c927cc0480336e6c","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 2.3","statement":"AI governance owners should document AI experimental design considerations","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI experimental design considerations","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI experimental design considerations within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI experimental design considerations. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-22d22c422459eadfc51f@b74efdfd3e900f1a","id":"REQ-22d22c422459eadfc51f","version":"b74efdfd3e900f1a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 20(1)","statement":"High-risk AI providers must take corrective action for nonconforming AI","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 20(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"take","object":"corrective action for nonconforming AI","condition":"Reason to consider system nonconforming","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"take\" for corrective action for nonconforming AI within these source conditions: Reason to consider system nonconforming, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"take\" for corrective action for nonconforming AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-23bf5e6b970948cffdef@863eb038813e1b6b","id":"REQ-23bf5e6b970948cffdef","version":"863eb038813e1b6b","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Deployment architecture / boundaries","statement":"AI deployer should establish IT/AI boundary protections","family":"Governance","body":{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Deployment architecture / boundaries","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"establish","object":"IT/AI boundary protections","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"establish\" for IT/AI boundary protections within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"establish\" for IT/AI boundary protections. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-24868067f86e7d176fc6@1e9e21fdb3199be9","id":"REQ-24868067f86e7d176fc6","version":"1e9e21fdb3199be9","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"5.2.6.2, p.7","statement":"users must-not enter Class C data","family":"Data & IP","body":{"sourceId":"pa-ai-2026","control":"5.2.6.2, p.7","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must-not","action":"enter","object":"Class C data","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"enter\" for Class C data within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for Class C data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-250fc8e135560ff142d0@642c89bca74561e3","id":"REQ-250fc8e135560ff142d0","version":"642c89bca74561e3","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"ID.AM-01","statement":"Organization should maintain managed hardware inventory","family":"Governance","body":{"sourceId":"nist-csf-2","control":"ID.AM-01","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=23","actor":"Organization","modality":"should","action":"maintain","object":"managed hardware inventory","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"maintain\" for managed hardware inventory within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"maintain\" for managed hardware inventory. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-2605f914435bf43244cb@691df22ed6b2af71","id":"REQ-2605f914435bf43244cb","version":"691df22ed6b2af71","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 17","statement":"Covered GenAI service providers must perform required security assessments","family":"Security","body":{"sourceId":"cn-genai-interim","control":"Article 17","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"perform","object":"required security assessments","condition":"Services with public-opinion attributes or social mobilization capability","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"perform\" for required security assessments within these source conditions: Services with public-opinion attributes or social mobilization capability, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"perform\" for required security assessments while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-263c38f46459c8a626d5@e8837b96b7f366ee","id":"REQ-263c38f46459c8a626d5","version":"e8837b96b7f366ee","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Manage 2.4","statement":"AI governance owners should establish mechanisms to deactivate unsafe AI systems","family":"Safety","body":{"sourceId":"nist-ai-rmf-1","control":"Manage 2.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"mechanisms to deactivate unsafe AI systems","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for mechanisms to deactivate unsafe AI systems within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for mechanisms to deactivate unsafe AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-28f3f77520c9204560c4@aa4b99e2b6706ce4","id":"REQ-28f3f77520c9204560c4","version":"aa4b99e2b6706ce4","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"pp.6–7, AI Disclaimers","statement":"agencies must notify affected people","family":"Governance","body":{"sourceId":"va-ai-ea400","control":"pp.6–7, AI Disclaimers","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"notify","object":"affected people","condition":"citizen/business impact","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"notify\" for affected people within these source conditions: citizen/business impact, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"notify\" for affected people while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-2b38626f08e9745e834f@54b6d3ea178d83ed","id":"REQ-2b38626f08e9745e834f","version":"54b6d3ea178d83ed","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 32(1)","statement":"Data controllers must implement appropriate data security measures","family":"Security","body":{"sourceId":"eu-gdpr","control":"Article 32(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"implement","object":"appropriate data security measures","condition":"Appropriate to processing risks","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"implement\" for appropriate data security measures within these source conditions: Appropriate to processing risks, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"implement\" for appropriate data security measures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-2c8c97278a2065b3e485@9949a3a16b462abd","id":"REQ-2c8c97278a2065b3e485","version":"9949a3a16b462abd","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 1.2","statement":"AI governance owners should integrate trustworthiness characteristics into AI policies","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"integrate","object":"trustworthiness characteristics into AI policies","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"integrate\" for trustworthiness characteristics into AI policies within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"integrate\" for trustworthiness characteristics into AI policies. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-2db7c466c4751facea1d@07a343fb4018ba53","id":"REQ-2db7c466c4751facea1d","version":"07a343fb4018ba53","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"p.5, reporting, bullet 1","statement":"employees must notify AI concerns","family":"Security","body":{"sourceId":"nc-public-genai","control":"p.5, reporting, bullet 1","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"notify","object":"AI concerns","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"notify\" for AI concerns within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"notify\" for AI concerns while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-2dcd88856952895e0903@f841643c09946590","id":"REQ-2dcd88856952895e0903","version":"f841643c09946590","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"5.1.4, p.2","statement":"agencies must retain inputs","family":"Data & IP","body":{"sourceId":"pa-ai-2026","control":"5.1.4, p.2","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"agencies","modality":"must","action":"retain","object":"inputs","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"retain\" for inputs within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"retain\" for inputs while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-2f4fd8aad0a84889cf80@b7f897fd511bb6b2","id":"REQ-2f4fd8aad0a84889cf80","version":"b7f897fd511bb6b2","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 2.4","statement":"AI governance owners should monitor AI behavior in production","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 2.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"AI behavior in production","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for AI behavior in production within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for AI behavior in production. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-2f6a2a6c35e90e36d165@672157cb844aa364","id":"REQ-2f6a2a6c35e90e36d165","version":"672157cb844aa364","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 2.2","statement":"AI governance owners should apply human-subject protections in AI evaluation","family":"Human oversight","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"apply","object":"human-subject protections in AI evaluation","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"apply\" for human-subject protections in AI evaluation within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"apply\" for human-subject protections in AI evaluation. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-2f7b7da6e2946bfd9b93@e235da79fa32c16b","id":"REQ-2f7b7da6e2946bfd9b93","version":"e235da79fa32c16b","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Use, recording-app bullet","statement":"users must obtain IT approval","family":"Human oversight","body":{"sourceId":"brookline-genai","control":"Use, recording-app bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"obtain","object":"IT approval","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"obtain\" for IT approval within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for IT approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-311ad1c76a6f7e7dd90d@1a0c88239de0c53a","id":"REQ-311ad1c76a6f7e7dd90d","version":"1a0c88239de0c53a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"03.01.05(a)","statement":"Organization should permit task-necessary authorized access","family":"Governance","body":{"sourceId":"nist-800-171-r3","control":"03.01.05(a)","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=20","actor":"Organization","modality":"should","action":"permit","object":"task-necessary authorized access","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"permit\" for task-necessary authorized access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"permit\" for task-necessary authorized access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-31789f3da294b7f39345@0184a16939847f0e","id":"REQ-31789f3da294b7f39345","version":"0184a16939847f0e","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Manage 1.2","statement":"AI governance owners should prioritize treatment of documented AI risks","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Manage 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"prioritize","object":"treatment of documented AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"prioritize\" for treatment of documented AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"prioritize\" for treatment of documented AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-31e86ebfe1689669bd88@907eccf50b45941f","id":"REQ-31e86ebfe1689669bd88","version":"907eccf50b45941f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 25(1)","statement":"Data controllers must implement data protection by design","family":"Data & IP","body":{"sourceId":"eu-gdpr","control":"Article 25(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"implement","object":"data protection by design","condition":"Appropriate to processing risks","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"implement\" for data protection by design within these source conditions: Appropriate to processing risks, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"implement\" for data protection by design while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-3209a8c3b69fc27f3b80@ebb2e66372f829c3","id":"REQ-3209a8c3b69fc27f3b80","version":"ebb2e66372f829c3","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 11","statement":"Covered GenAI service providers must avoid collecting unnecessary personal information","family":"Privacy","body":{"sourceId":"cn-genai-interim","control":"Article 11","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"avoid","object":"collecting unnecessary personal information","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"avoid\" for collecting unnecessary personal information within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"avoid\" for collecting unnecessary personal information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-32ecf25eab15b50fe99b@c7800852d6532c1a","id":"REQ-32ecf25eab15b50fe99b","version":"c7800852d6532c1a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 8","statement":"Covered GenAI service providers must evaluate data-labeling quality","family":"Transparency","body":{"sourceId":"cn-genai-interim","control":"Article 8","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"evaluate","object":"data-labeling quality","condition":"Data annotation during development","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"evaluate\" for data-labeling quality within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"evaluate\" for data-labeling quality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-33b02412d23168404375@4dffec5623f99c6d","id":"REQ-33b02412d23168404375","version":"4dffec5623f99c6d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 26(5)","statement":"High-risk AI deployers must monitor AI operation in accordance with instructions","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 26(5)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"monitor","object":"AI operation in accordance with instructions","condition":"Covered high-risk AI use","exception":"Suspend and notify when statutory risk threshold is met","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"monitor\" for AI operation in accordance with instructions within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"monitor\" for AI operation in accordance with instructions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-348789e582add9620486@3dba0b769137c214","id":"REQ-348789e582add9620486","version":"3dba0b769137c214","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 55(1)(d)","statement":"Systemic-risk GPAI providers must ensure adequate cybersecurity for models","family":"Security","body":{"sourceId":"eu-ai-act","control":"Article 55(1)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"ensure","object":"adequate cybersecurity for models","condition":"Covered systemic-risk models","exception":"Including physical infrastructure","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"ensure\" for adequate cybersecurity for models within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"ensure\" for adequate cybersecurity for models while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-358238f423a0178d41b9@0a27921c00681c3a","id":"REQ-358238f423a0178d41b9","version":"0a27921c00681c3a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 4.2","statement":"AI governance owners should consider stakeholder input in trustworthiness measurements","family":"Evaluation","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"consider","object":"stakeholder input in trustworthiness measurements","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for stakeholder input in trustworthiness measurements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for stakeholder input in trustworthiness measurements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-35b7bc66ae0969aa8da0@5909e640e26cd526","id":"REQ-35b7bc66ae0969aa8da0","version":"5909e640e26cd526","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"GV-1.5-003","statement":"AI governance owners should monitor emergent GAI risks","family":"Governance","body":{"sourceId":"nist-genai-profile","control":"GV-1.5-003","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"emergent GAI risks","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for emergent GAI risks within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for emergent GAI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-36790cbc2b226390e28a@f487b4a61b9d9b4a","id":"REQ-36790cbc2b226390e28a","version":"f487b4a61b9d9b4a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"4(d)(i)","statement":"Covered agency must test proposed AI solutions","family":"Evaluation","body":{"sourceId":"omb-m-25-22","control":"4(d)(i)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=9","actor":"Covered agency","modality":"must","action":"test","object":"proposed AI solutions","condition":"During proposal evaluation; practicable extent","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"test\" for proposed AI solutions within these source conditions: During proposal evaluation; practicable extent, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"test\" for proposed AI solutions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-367f9720323a475166c7@570df929d0364f33","id":"REQ-367f9720323a475166c7","version":"570df929d0364f33","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 11","statement":"Covered GenAI service providers must protect user input and usage records","family":"Governance","body":{"sourceId":"cn-genai-interim","control":"Article 11","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"protect","object":"user input and usage records","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for user input and usage records within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for user input and usage records while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-372043fd82745a122811@94e234fccffc3d66","id":"REQ-372043fd82745a122811","version":"94e234fccffc3d66","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"p.7, Transparency Requirements","statement":"agencies must list appeal options","family":"Human oversight","body":{"sourceId":"va-ai-ea400","control":"p.7, Transparency Requirements","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"list","object":"appeal options","condition":"external decisions","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"list\" for appeal options within these source conditions: external decisions, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"list\" for appeal options while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-39be28de097cadddc21d@16e717eaaf46e3aa","id":"REQ-39be28de097cadddc21d","version":"16e717eaaf46e3aa","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 26(4)","statement":"High-risk AI deployers must ensure relevant input data","family":"Data & IP","body":{"sourceId":"eu-ai-act","control":"Article 26(4)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"ensure","object":"relevant input data","condition":"Input data under deployer control","exception":"Sufficient representativeness","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"ensure\" for relevant input data within these source conditions: Input data under deployer control, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"ensure\" for relevant input data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-3b1cc690c87818d732e6@f591072a9626501a","id":"REQ-3b1cc690c87818d732e6","version":"f591072a9626501a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 12","statement":"Covered GenAI service providers must label generated images and videos","family":"Transparency","body":{"sourceId":"cn-genai-interim","control":"Article 12","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"label","object":"generated images and videos","condition":"As required by deep-synthesis provisions","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"label\" for generated images and videos within these source conditions: As required by deep-synthesis provisions, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"label\" for generated images and videos while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-3bdab7d470592068ecff@f19a0c5512e83196","id":"REQ-3bdab7d470592068ecff","version":"f19a0c5512e83196","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"p.5, Ethical Use","statement":"agencies must document models","family":"Human oversight","body":{"sourceId":"va-ai-ea400","control":"p.5, Ethical Use","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"document","object":"models","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"document\" for models within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"document\" for models while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-3c16a9dbc3afdc05839f@59185d2567f9bea0","id":"REQ-3c16a9dbc3afdc05839f","version":"59185d2567f9bea0","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 14(1)","statement":"High-risk AI providers must enable effective human oversight","family":"Human oversight","body":{"sourceId":"eu-ai-act","control":"Article 14(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"effective human oversight","condition":"During system use","exception":"Appropriate to risks and autonomy","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for effective human oversight within these source conditions: During system use, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for effective human oversight while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-3c34dac5f16de11d0f68@aada738f18e17446","id":"REQ-3c34dac5f16de11d0f68","version":"aada738f18e17446","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 50(3)","statement":"Covered AI deployers must inform people exposed to emotion recognition","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 50(3)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Covered AI deployers","modality":"must","action":"inform","object":"people exposed to emotion recognition","condition":"Covered systems","exception":"Specific legal exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered AI deployers performs the required action \"inform\" for people exposed to emotion recognition within these source conditions: Covered systems, and retains evidence.","doesNotMeetRule":"Covered AI deployers omits the required action \"inform\" for people exposed to emotion recognition while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-3c364d7f3227affdef5c@871e26db4780821f","id":"REQ-3c364d7f3227affdef5c","version":"871e26db4780821f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Deployment governance / threat model","statement":"AI deployer should require developer threat model","family":"Governance","body":{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Deployment governance / threat model","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"require","object":"developer threat model","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"require\" for developer threat model within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"require\" for developer threat model. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-3ca339132cc9b03fcff4@fa7ea245ab1f2992","id":"REQ-3ca339132cc9b03fcff4","version":"fa7ea245ab1f2992","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Teaching and Learning, detection paragraph","statement":"instructors should-not rely detector output","family":"Governance","body":{"sourceId":"msu-genai-guidelines","control":"Teaching and Learning, detection paragraph","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"instructors","modality":"should-not","action":"rely","object":"detector output","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"instructors performs the required action \"rely\" for detector output within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"instructors omits the required action \"rely\" for detector output while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-3d10f985c754095079dc@56b168bc757bcccf","id":"REQ-3d10f985c754095079dc","version":"56b168bc757bcccf","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Manage 3.2","statement":"AI governance owners should monitor pre-trained models used in development","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Manage 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"pre-trained models used in development","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for pre-trained models used in development within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for pre-trained models used in development. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-3d95b7a5ec079babd952@c2743609cd9b0dd0","id":"REQ-3d95b7a5ec079babd952","version":"c2743609cd9b0dd0","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"p.5, appropriate use, bullet 4","statement":"employees must register state email","family":"Governance","body":{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 4","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"register","object":"state email","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"register\" for state email within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"register\" for state email while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-3e901d79e501758614d1@a2a8970829d58844","id":"REQ-3e901d79e501758614d1","version":"a2a8970829d58844","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 13(2)","statement":"High-risk AI providers must provide instructions for use","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 13(2)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"provide","object":"instructions for use","condition":"Covered high-risk systems","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"provide\" for instructions for use within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"provide\" for instructions for use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-40fae525877779a624f5@47dafd4deca0f34c","id":"REQ-40fae525877779a624f5","version":"47dafd4deca0f34c","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 10(2)(a)","statement":"High-risk AI providers must document dataset design choices","family":"Data & IP","body":{"sourceId":"eu-ai-act","control":"Article 10(2)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"document","object":"dataset design choices","condition":"Systems trained with data","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"document\" for dataset design choices within these source conditions: Systems trained with data, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"document\" for dataset design choices while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-414d82e4d19d2cf62fe9@b1fc2f4a53cfc421","id":"REQ-414d82e4d19d2cf62fe9","version":"b1fc2f4a53cfc421","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 5(1)(g)","statement":"AI operators must not categorize sensitive attributes through biometrics","family":"Privacy","body":{"sourceId":"eu-ai-act","control":"Article 5(1)(g)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"categorize","object":"sensitive attributes through biometrics","condition":"Covered biometric categorization","exception":"Specified dataset labeling and law-enforcement exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"categorize\" for sensitive attributes through biometrics while these conditions apply: Covered biometric categorization.","doesNotMeetRule":"AI operators performs the prohibited action \"categorize\" for sensitive attributes through biometrics while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-41650b18687474250b6e@c36c81693d0d9d2b","id":"REQ-41650b18687474250b6e","version":"c36c81693d0d9d2b","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"PS.1.1","statement":"Software producer should store code","family":"Governance","body":{"sourceId":"nist-ssdf-1-1","control":"PS.1.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=18","actor":"Software producer","modality":"should","action":"store","object":"code","condition":"Least-privilege access","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"store\" for code within these conditions: Least-privilege access.","doesNotMeetRule":"Software producer omits the recommended action \"store\" for code. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-422994066ef08134eb88@a08a421005ea2956","id":"REQ-422994066ef08134eb88","version":"a08a421005ea2956","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 4.1","statement":"AI governance owners should adapt AI measurements to deployment context","family":"Evaluation","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"adapt","object":"AI measurements to deployment context","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"adapt\" for AI measurements to deployment context within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"adapt\" for AI measurements to deployment context. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-44310325b2ecacecc199@833164726d8cfbea","id":"REQ-44310325b2ecacecc199","version":"833164726d8cfbea","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Review content before publishing or sharing","statement":"users should review AI material","family":"Human oversight","body":{"sourceId":"harvard-genai-guidelines","control":"Review content before publishing or sharing","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"should","action":"review","object":"AI material","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users follows the recommendation to \"review\" for AI material within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"users omits the recommended action \"review\" for AI material. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-45182d12c3135c56d3e0@0da4a9cd38e7bc23","id":"REQ-45182d12c3135c56d3e0","version":"0da4a9cd38e7bc23","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"03.01.02","statement":"Organization should enforce approved CUI access permissions","family":"Governance","body":{"sourceId":"nist-800-171-r3","control":"03.01.02","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=18","actor":"Organization","modality":"should","action":"enforce","object":"approved CUI access permissions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"enforce\" for approved CUI access permissions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"enforce\" for approved CUI access permissions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-467840673618bb9f7953@22960d5347e6ec00","id":"REQ-467840673618bb9f7953","version":"22960d5347e6ec00","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"GV-6.2-002","statement":"AI governance owners should document incidents involving third-party GAI systems","family":"Safety","body":{"sourceId":"nist-genai-profile","control":"GV-6.2-002","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"incidents involving third-party GAI systems","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for incidents involving third-party GAI systems within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for incidents involving third-party GAI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-4942cd01ca239be5b4d2@6cc7990c65a02e26","id":"REQ-4942cd01ca239be5b4d2","version":"6cc7990c65a02e26","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Use, bullet 2","statement":"users must use town credentials","family":"Governance","body":{"sourceId":"brookline-genai","control":"Use, bullet 2","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"use","object":"town credentials","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for town credentials within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for town credentials while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-4983b02c1cebf6d6aea2@58444c7567d8cb0e","id":"REQ-4983b02c1cebf6d6aea2","version":"58444c7567d8cb0e","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 5(1)(f)","statement":"AI operators must not infer emotions in workplaces or schools","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 5(1)(f)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"infer","object":"emotions in workplaces or schools","condition":"Covered emotion recognition systems","exception":"Medical or safety reasons","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"infer\" for emotions in workplaces or schools while these conditions apply: Covered emotion recognition systems.","doesNotMeetRule":"AI operators performs the prohibited action \"infer\" for emotions in workplaces or schools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-498e40d0fc895b3c3bd2@f8ddc77f4222295e","id":"REQ-498e40d0fc895b3c3bd2","version":"f8ddc77f4222295e","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 2.9","statement":"AI governance owners should explain AI outputs in their use context","family":"Transparency","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 2.9","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"explain","object":"AI outputs in their use context","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"explain\" for AI outputs in their use context within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"explain\" for AI outputs in their use context. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-4b0c1a948483c2b39dda@c8b84cbcc64277a9","id":"REQ-4b0c1a948483c2b39dda","version":"c8b84cbcc64277a9","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 17(1)","statement":"High-risk AI providers must establish a quality-management system","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 17(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"establish","object":"a quality-management system","condition":"Covered high-risk systems","exception":"Proportionate to provider size","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for a quality-management system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for a quality-management system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-4b3673ecfccce739fbb7@5c7d3c8e67a423d8","id":"REQ-4b3673ecfccce739fbb7","version":"5c7d3c8e67a423d8","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 16","statement":"Data controllers must correct inaccurate personal data","family":"Privacy","body":{"sourceId":"eu-gdpr","control":"Article 16","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"correct","object":"inaccurate personal data","condition":"On applicable data-subject request","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"correct\" for inaccurate personal data within these source conditions: On applicable data-subject request, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"correct\" for inaccurate personal data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-4b48a8df3e6a8dc85644@4755d12faba8b594","id":"REQ-4b48a8df3e6a8dc85644","version":"4755d12faba8b594","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 9(1)","statement":"High-risk AI providers must establish an AI risk-management system","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 9(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"establish","object":"an AI risk-management system","condition":"Covered high-risk systems","exception":"Applicability date and scope review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for an AI risk-management system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for an AI risk-management system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-4baa93d7db267e71b543@bd2470399ea78f2f","id":"REQ-4baa93d7db267e71b543","version":"bd2470399ea78f2f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Use, prohibited-data bullet","statement":"users must-not enter access secrets","family":"Security","body":{"sourceId":"brookline-genai","control":"Use, prohibited-data bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must-not","action":"enter","object":"access secrets","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"enter\" for access secrets within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for access secrets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-4c87ce80a824e1809d2b@a1d582a7fca4582a","id":"REQ-4c87ce80a824e1809d2b","version":"a1d582a7fca4582a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Manage 4.2","statement":"AI governance owners should integrate continual improvements into AI updates","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Manage 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"integrate","object":"continual improvements into AI updates","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"integrate\" for continual improvements into AI updates within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"integrate\" for continual improvements into AI updates. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-4de9d4350a2ae4eb5a96@3b9b45a2c61d9ece","id":"REQ-4de9d4350a2ae4eb5a96","version":"3b9b45a2c61d9ece","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"p.5, appropriate use, bullet 3","statement":"employees must use online tools","family":"Human oversight","body":{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 3","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"use","object":"online tools","condition":"state device","exception":"ESRMO-approved download","timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"use\" for online tools within these source conditions: state device, and retains evidence.","doesNotMeetRule":"employees omits the required action \"use\" for online tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-4f3a4fe2526e78705404@3d3ed4cf5b7d360f","id":"REQ-4f3a4fe2526e78705404","version":"3d3ed4cf5b7d360f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Use approved tools, bullet 3","statement":"users must obtain risk assessment","family":"Privacy","body":{"sourceId":"harvard-genai-guidelines","control":"Use approved tools, bullet 3","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"must","action":"obtain","object":"risk assessment","condition":"Harvard work","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"obtain\" for risk assessment within these source conditions: Harvard work, and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for risk assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-51022a42f5c5bbf3384c@8059bad11a3dc257","id":"REQ-51022a42f5c5bbf3384c","version":"8059bad11a3dc257","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 9(2)(a)","statement":"High-risk AI providers must identify reasonably foreseeable AI risks","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 9(2)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"identify","object":"reasonably foreseeable AI risks","condition":"Intended purpose and foreseeable misuse","exception":"Applicability date and scope review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"identify\" for reasonably foreseeable AI risks within these source conditions: Intended purpose and foreseeable misuse, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"identify\" for reasonably foreseeable AI risks while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-52c721c629da81bb73b8@783db868b3fab41a","id":"REQ-52c721c629da81bb73b8","version":"783db868b3fab41a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"GV-1.3-002","statement":"AI governance owners should establish GAI deployment approval thresholds","family":"Human oversight","body":{"sourceId":"nist-genai-profile","control":"GV-1.3-002","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"GAI deployment approval thresholds","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for GAI deployment approval thresholds within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for GAI deployment approval thresholds. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-540a5ec93d2c287c5c5c@d2504728b6b43c2f","id":"REQ-540a5ec93d2c287c5c5c","version":"d2504728b6b43c2f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 53(1)(b)","statement":"GPAI model providers must provide documentation to downstream system providers","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 53(1)(b)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"provide","object":"documentation to downstream system providers","condition":"Covered general-purpose AI models","exception":"Specified open-source exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"provide\" for documentation to downstream system providers within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"provide\" for documentation to downstream system providers while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-5442ab309dbdeaf0d695@7650f6171b372b85","id":"REQ-5442ab309dbdeaf0d695","version":"7650f6171b372b85","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 4(4)","statement":"Covered GenAI service providers must protect personal-information rights","family":"Privacy","body":{"sourceId":"cn-genai-interim","control":"Article 4(4)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"protect","object":"personal-information rights","condition":"Covered service use and provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for personal-information rights within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for personal-information rights while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-5566f52b769fb05a9808@0bd57494ca0eaae9","id":"REQ-5566f52b769fb05a9808","version":"0bd57494ca0eaae9","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 1.2","statement":"AI governance owners should assess the effectiveness of existing AI controls","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"assess","object":"the effectiveness of existing AI controls","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assess\" for the effectiveness of existing AI controls within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assess\" for the effectiveness of existing AI controls. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-55fd24dfbc339646a321@0ae1238ca3411c1a","id":"REQ-55fd24dfbc339646a321","version":"0ae1238ca3411c1a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 4.3","statement":"AI governance owners should document measurable AI performance changes","family":"Evaluation","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 4.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"measurable AI performance changes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for measurable AI performance changes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for measurable AI performance changes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-56967a1417c6c6ccf2b7@3fc6c1f3e928f9ce","id":"REQ-56967a1417c6c6ccf2b7","version":"3fc6c1f3e928f9ce","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 3.3","statement":"AI governance owners should establish mechanisms to appeal AI outcomes","family":"Human oversight","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 3.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"mechanisms to appeal AI outcomes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for mechanisms to appeal AI outcomes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for mechanisms to appeal AI outcomes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-56daf4ceb06f532d5c98@816069a426334126","id":"REQ-56daf4ceb06f532d5c98","version":"816069a426334126","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 50(2)","statement":"Synthetic-content AI providers must mark generated content in machine-readable form","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 50(2)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Synthetic-content AI providers","modality":"must","action":"mark","object":"generated content in machine-readable form","condition":"Covered synthetic text, audio, images or video","exception":"Standard editing and specified law-enforcement exceptions; transitions apply","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Synthetic-content AI providers performs the required action \"mark\" for generated content in machine-readable form within these source conditions: Covered synthetic text, audio, images or video, and retains evidence.","doesNotMeetRule":"Synthetic-content AI providers omits the required action \"mark\" for generated content in machine-readable form while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-57b2a55927ecec909b66@dfce2bd0391935e4","id":"REQ-57b2a55927ecec909b66","version":"dfce2bd0391935e4","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 72(1)","statement":"High-risk AI providers must establish a post-market monitoring system","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 72(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"establish","object":"a post-market monitoring system","condition":"Covered high-risk systems","exception":"Applicability date and scope review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for a post-market monitoring system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for a post-market monitoring system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-5a6275e7354ec46259ca@5aabc768f7c61dc6","id":"REQ-5a6275e7354ec46259ca","version":"5aabc768f7c61dc6","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"6.2.2","statement":"Responsible senior federal officials must present notices in plain language","family":"Transparency","body":{"sourceId":"ca-automated-decisions","control":"6.2.2","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"present","object":"notices in plain language","condition":"Prominently in service channels","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"present\" for notices in plain language within these source conditions: Prominently in service channels, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"present\" for notices in plain language while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-5b78b3220e4c2e155620@9c3734809f9b4f0d","id":"REQ-5b78b3220e4c2e155620","version":"9c3734809f9b4f0d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"6.2.6.1","statement":"Responsible senior federal officials must retain rights to test proprietary decision software","family":"Evaluation","body":{"sourceId":"ca-automated-decisions","control":"6.2.6.1","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"retain","object":"rights to test proprietary decision software","condition":"Audits, investigations and other specified purposes","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"retain\" for rights to test proprietary decision software within these source conditions: Audits, investigations and other specified purposes, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"retain\" for rights to test proprietary decision software while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-5cc8529e6645a60c36f4@0868c484372da460","id":"REQ-5cc8529e6645a60c36f4","version":"0868c484372da460","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Manage 4.3","statement":"AI governance owners should communicate AI incidents to affected stakeholders","family":"Safety","body":{"sourceId":"nist-ai-rmf-1","control":"Manage 4.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"communicate","object":"AI incidents to affected stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"communicate\" for AI incidents to affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"communicate\" for AI incidents to affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-5dbc16030f8514f1ccb6@57a92b094807f6ee","id":"REQ-5dbc16030f8514f1ccb6","version":"57a92b094807f6ee","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 15(1)","statement":"High-risk AI providers must achieve appropriate AI accuracy","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 15(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"achieve","object":"appropriate AI accuracy","condition":"Throughout high-risk AI lifecycle","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"achieve\" for appropriate AI accuracy within these source conditions: Throughout high-risk AI lifecycle, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"achieve\" for appropriate AI accuracy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-5e5d94ee8df3daba83f5@6a3163bafcd64d9c","id":"REQ-5e5d94ee8df3daba83f5","version":"6a3163bafcd64d9c","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 5(1)(d)","statement":"AI operators must not predict criminal offending solely from profiling","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 5(1)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"predict","object":"criminal offending solely from profiling","condition":"Individual risk assessments","exception":"Human assessments based on objective verifiable crime facts are excepted","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"predict\" for criminal offending solely from profiling while these conditions apply: Individual risk assessments.","doesNotMeetRule":"AI operators performs the prohibited action \"predict\" for criminal offending solely from profiling while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-5f456c39385a6df225bf@cb5c2c1b3190fdff","id":"REQ-5f456c39385a6df225bf","version":"cb5c2c1b3190fdff","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"5.2, p.5","statement":"users must use approved tools","family":"Governance","body":{"sourceId":"pa-ai-2026","control":"5.2, p.5","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must","action":"use","object":"approved tools","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for approved tools within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-5ff4e7ce70236b50dec4@f0213697c9831362","id":"REQ-5ff4e7ce70236b50dec4","version":"f0213697c9831362","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 13","statement":"Covered GenAI service providers must provide safe and stable GenAI services","family":"Governance","body":{"sourceId":"cn-genai-interim","control":"Article 13","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"provide","object":"safe and stable GenAI services","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"provide\" for safe and stable GenAI services within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"provide\" for safe and stable GenAI services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-6033201d3b529672237c@25f838d0d0333610","id":"REQ-6033201d3b529672237c","version":"25f838d0d0333610","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"GV-1.5-001","statement":"AI governance owners should assign responsibility for content provenance reviews","family":"Transparency","body":{"sourceId":"nist-genai-profile","control":"GV-1.5-001","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"assign","object":"responsibility for content provenance reviews","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assign\" for responsibility for content provenance reviews within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"assign\" for responsibility for content provenance reviews. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-620d6ec5be6d0047d03b@c7844ca94e10c180","id":"REQ-620d6ec5be6d0047d03b","version":"c7844ca94e10c180","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 55(1)(a)","statement":"Systemic-risk GPAI providers must perform model evaluations","family":"Evaluation","body":{"sourceId":"eu-ai-act","control":"Article 55(1)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"perform","object":"model evaluations","condition":"Covered systemic-risk models","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"perform\" for model evaluations within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"perform\" for model evaluations while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-621a2c9dc38eca145938@7dfc01b0332526fe","id":"REQ-621a2c9dc38eca145938","version":"7dfc01b0332526fe","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 30(1)","statement":"Data controllers must maintain records of processing activities","family":"Governance","body":{"sourceId":"eu-gdpr","control":"Article 30(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"maintain","object":"records of processing activities","condition":"Applicable scope and exemptions","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"maintain\" for records of processing activities within these source conditions: Applicable scope and exemptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"maintain\" for records of processing activities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-63224732018095a8089e@f43a685ff1a519e1","id":"REQ-63224732018095a8089e","version":"f43a685ff1a519e1","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 4(5)","statement":"Covered GenAI service providers must improve accuracy of generated content","family":"Governance","body":{"sourceId":"cn-genai-interim","control":"Article 4(5)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"improve","object":"accuracy of generated content","condition":"According to service characteristics","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for accuracy of generated content within these source conditions: According to service characteristics, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for accuracy of generated content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-647825a1659fb46b3eeb@e1dbdc15773b7705","id":"REQ-647825a1659fb46b3eeb","version":"e1dbdc15773b7705","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 12(1)","statement":"High-risk AI providers must enable automatic event logging","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 12(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"automatic event logging","condition":"Covered high-risk systems","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for automatic event logging within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for automatic event logging while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-66af2014a595673589f6@b1cc63832a5290cb","id":"REQ-66af2014a595673589f6","version":"b1cc63832a5290cb","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Teaching and Learning, opening paragraph","statement":"students must obtain permission","family":"Governance","body":{"sourceId":"msu-genai-guidelines","control":"Teaching and Learning, opening paragraph","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"students","modality":"must","action":"obtain","object":"permission","condition":"coursework","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"students performs the required action \"obtain\" for permission within these source conditions: coursework, and retains evidence.","doesNotMeetRule":"students omits the required action \"obtain\" for permission while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-67e37d4f836552e3a4da@29598972f69405af","id":"REQ-67e37d4f836552e3a4da","version":"29598972f69405af","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Manage 1.3","statement":"AI governance owners should plan responses to high-priority AI risks","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Manage 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"plan","object":"responses to high-priority AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for responses to high-priority AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for responses to high-priority AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-694107580ec1e8a43e8e@08c8500665acca74","id":"REQ-694107580ec1e8a43e8e","version":"08c8500665acca74","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 11(1)","statement":"High-risk AI providers must prepare technical documentation","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 11(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"prepare","object":"technical documentation","condition":"Before market placement or service","exception":"Simplified forms may apply","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"prepare\" for technical documentation within these source conditions: Before market placement or service, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"prepare\" for technical documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-69d507ba6d68cbbeba4c@35fba408ec21383d","id":"REQ-69d507ba6d68cbbeba4c","version":"35fba408ec21383d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Manage 2.3","statement":"AI governance owners should respond to previously unknown AI risks","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Manage 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"respond","object":"to previously unknown AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"respond\" for to previously unknown AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"respond\" for to previously unknown AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-6aea115e40204609bd23@6663ad09bb2d2443","id":"REQ-6aea115e40204609bd23","version":"6663ad09bb2d2443","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 9(1)","statement":"Data controllers must avoid prohibited special-category processing","family":"Governance","body":{"sourceId":"eu-gdpr","control":"Article 9(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"avoid","object":"prohibited special-category processing","condition":"Unless an Article 9 exception applies","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"avoid\" for prohibited special-category processing within these source conditions: Unless an Article 9 exception applies, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"avoid\" for prohibited special-category processing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-6e1f9a94207f264fd2eb@d45831c85d869b94","id":"REQ-6e1f9a94207f264fd2eb","version":"d45831c85d869b94","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 5.2","statement":"AI governance owners should establish regular engagement with affected stakeholders","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 5.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"regular engagement with affected stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for regular engagement with affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for regular engagement with affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-7047a2227f8ef9669b87@c11fb810291fc853","id":"REQ-7047a2227f8ef9669b87","version":"c11fb810291fc853","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Secure development / assets","statement":"AI provider should protect sensitive logs","family":"Privacy","body":{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / assets","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"protect","object":"sensitive logs","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"protect\" for sensitive logs within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"protect\" for sensitive logs. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-7062dfb2abfa0568c3c6@3be93e2fad23aabf","id":"REQ-7062dfb2abfa0568c3c6","version":"3be93e2fad23aabf","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 1.7","statement":"AI governance owners should define safe AI decommissioning procedures","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 1.7","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"safe AI decommissioning procedures","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for safe AI decommissioning procedures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for safe AI decommissioning procedures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-70b853ba6d38511bd2cc@0eb180f40b4fe6b3","id":"REQ-70b853ba6d38511bd2cc","version":"0eb180f40b4fe6b3","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Protect confidential data, paragraph 2","statement":"users must use approved tools","family":"Governance","body":{"sourceId":"harvard-genai-guidelines","control":"Protect confidential data, paragraph 2","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"must","action":"use","object":"approved tools","condition":"Harvard confidential data","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for approved tools within these source conditions: Harvard confidential data, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-71da0e5d420636e13b13@5d80bef0ae62e1fd","id":"REQ-71da0e5d420636e13b13","version":"5d80bef0ae62e1fd","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"p.5, Ethical Use","statement":"agencies must validate outcomes","family":"Fairness","body":{"sourceId":"va-ai-ea400","control":"p.5, Ethical Use","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"validate","object":"outcomes","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"validate\" for outcomes within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"validate\" for outcomes while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-72fa92f64d43dc719fd7@bef75d74d4d7c9c5","id":"REQ-72fa92f64d43dc719fd7","version":"bef75d74d4d7c9c5","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"6.2.3","statement":"Responsible senior federal officials must provide meaningful explanations of decisions","family":"Governance","body":{"sourceId":"ca-automated-decisions","control":"6.2.3","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"provide","object":"meaningful explanations of decisions","condition":"After decisions; Appendix C applies","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"provide\" for meaningful explanations of decisions within these source conditions: After decisions; Appendix C applies, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"provide\" for meaningful explanations of decisions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-73957a3b8f26816dbbb6@6a4ee8f25f2c42b4","id":"REQ-73957a3b8f26816dbbb6","version":"6a4ee8f25f2c42b4","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 11","statement":"Covered GenAI service providers must process personal-information rights requests","family":"Privacy","body":{"sourceId":"cn-genai-interim","control":"Article 11","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"process","object":"personal-information rights requests","condition":"Lawful requests for access, correction or deletion","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"process\" for personal-information rights requests within these source conditions: Lawful requests for access, correction or deletion, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"process\" for personal-information rights requests while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-73cc00af69e823ad4e6a@bed58eec4f05746a","id":"REQ-73cc00af69e823ad4e6a","version":"bed58eec4f05746a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Use approved tools, bullet 2","statement":"users should-not use meeting assistants","family":"Procurement","body":{"sourceId":"harvard-genai-guidelines","control":"Use approved tools, bullet 2","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"should-not","action":"use","object":"meeting assistants","condition":"Harvard meetings","exception":"approved protected tools","timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for meeting assistants within these source conditions: Harvard meetings, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for meeting assistants while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-746db119181e95815a8d@3aa0e02c00c6c11f","id":"REQ-746db119181e95815a8d","version":"3aa0e02c00c6c11f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"5.2.4, pp.6–7","statement":"users must disclose GenAI content","family":"Transparency","body":{"sourceId":"pa-ai-2026","control":"5.2.4, pp.6–7","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must","action":"disclose","object":"GenAI content","condition":"including partial generation","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"disclose\" for GenAI content within these source conditions: including partial generation, and retains evidence.","doesNotMeetRule":"users omits the required action \"disclose\" for GenAI content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-761207966dc1eaab9507@39d38bea515aedd3","id":"REQ-761207966dc1eaab9507","version":"39d38bea515aedd3","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 1.1","statement":"AI governance owners should select metrics for prioritized AI risks","family":"Evaluation","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"select","object":"metrics for prioritized AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"select\" for metrics for prioritized AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"select\" for metrics for prioritized AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-764d00378589ebeb1e59@dc125744ced5b60f","id":"REQ-764d00378589ebeb1e59","version":"dc125744ced5b60f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 5(1)(e)","statement":"Data controllers must limit personal-data retention","family":"Privacy","body":{"sourceId":"eu-gdpr","control":"Article 5(1)(e)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"limit","object":"personal-data retention","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"limit\" for personal-data retention within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"limit\" for personal-data retention while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-76d5c155839d60609d4e@de9fa50f8c8efeaa","id":"REQ-76d5c155839d60609d4e","version":"de9fa50f8c8efeaa","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 1.1","statement":"AI governance owners should document applicable AI legal requirements","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"applicable AI legal requirements","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for applicable AI legal requirements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for applicable AI legal requirements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-774839a06883b715ad20@30711930a22740f3","id":"REQ-774839a06883b715ad20","version":"30711930a22740f3","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"GV-1.6-001","statement":"AI governance owners should inventory organizational generative AI systems","family":"Governance","body":{"sourceId":"nist-genai-profile","control":"GV-1.6-001","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"inventory","object":"organizational generative AI systems","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for organizational generative AI systems within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for organizational generative AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-779b1a72cab2f5fe3dab@47d9ca3154303149","id":"REQ-779b1a72cab2f5fe3dab","version":"47d9ca3154303149","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 44","statement":"Data controllers must safeguard international personal-data transfers","family":"Privacy","body":{"sourceId":"eu-gdpr","control":"Article 44","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"safeguard","object":"international personal-data transfers","condition":"Covered transfers to third countries","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"safeguard\" for international personal-data transfers within these source conditions: Covered transfers to third countries, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"safeguard\" for international personal-data transfers while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-79732c610c2ebbd687a5@e0a75e7d6267c1ef","id":"REQ-79732c610c2ebbd687a5","version":"e0a75e7d6267c1ef","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"RV.1.1","statement":"Software producer should investigate credible vulnerability reports","family":"Security","body":{"sourceId":"nist-ssdf-1-1","control":"RV.1.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=25","actor":"Software producer","modality":"should","action":"investigate","object":"credible vulnerability reports","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"investigate\" for credible vulnerability reports within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"investigate\" for credible vulnerability reports. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-7a01be229a7aab66aac3@ae3ec64aff6d0ac2","id":"REQ-7a01be229a7aab66aac3","version":"ae3ec64aff6d0ac2","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 18(1)","statement":"High-risk AI providers must retain required conformity documentation","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 18(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"retain","object":"required conformity documentation","condition":"Following market placement","exception":"Retention period and amendments require review","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"retain\" for required conformity documentation within these source conditions: Following market placement, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"retain\" for required conformity documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-7aaeefa3d5e8885dbe47@22f9968b24be7363","id":"REQ-7aaeefa3d5e8885dbe47","version":"22f9968b24be7363","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 5(1)(b)","statement":"Data controllers must limit processing to specified purposes","family":"Governance","body":{"sourceId":"eu-gdpr","control":"Article 5(1)(b)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"limit","object":"processing to specified purposes","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"limit\" for processing to specified purposes within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"limit\" for processing to specified purposes while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-7b8a5464ca68b7ac7697@af9ea8771d10602f","id":"REQ-7b8a5464ca68b7ac7697","version":"af9ea8771d10602f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Secure development / documentation","statement":"AI provider should document model, dataset and prompt lifecycle","family":"Data & IP","body":{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / documentation","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"document","object":"model, dataset and prompt lifecycle","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"document\" for model, dataset and prompt lifecycle within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"document\" for model, dataset and prompt lifecycle. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-7d0684e4db13f59da9e7@dd9f79e11aa32eca","id":"REQ-7d0684e4db13f59da9e7","version":"dd9f79e11aa32eca","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 10","statement":"Covered GenAI service providers must prevent minors from overreliance on GenAI","family":"Governance","body":{"sourceId":"cn-genai-interim","control":"Article 10","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"prevent","object":"minors from overreliance on GenAI","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"prevent\" for minors from overreliance on GenAI within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"prevent\" for minors from overreliance on GenAI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-7e01c01d060b186531ba@b2acfbdcdd3d2eb3","id":"REQ-7e01c01d060b186531ba","version":"b2acfbdcdd3d2eb3","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 17(1)","statement":"Data controllers must erase personal data when required","family":"Privacy","body":{"sourceId":"eu-gdpr","control":"Article 17(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"erase","object":"personal data when required","condition":"Subject to statutory exceptions","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"erase\" for personal data when required within these source conditions: Subject to statutory exceptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"erase\" for personal data when required while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-7e6d946ac1ed8e229529@fb96ea6214fb8cdd","id":"REQ-7e6d946ac1ed8e229529","version":"fb96ea6214fb8cdd","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 4(3)","statement":"Covered GenAI service providers must respect intellectual-property rights","family":"Data & IP","body":{"sourceId":"cn-genai-interim","control":"Article 4(3)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"respect","object":"intellectual-property rights","condition":"Covered service use and provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"respect\" for intellectual-property rights within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"respect\" for intellectual-property rights while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-7ea00f6e94002269b690@46a5ade1d798a019","id":"REQ-7ea00f6e94002269b690","version":"46a5ade1d798a019","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"p.5, appropriate use, bullet 1","statement":"employees must complete training","family":"Data & IP","body":{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 1","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"complete","object":"training","condition":"before use","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"complete\" for training within these source conditions: before use, and retains evidence.","doesNotMeetRule":"employees omits the required action \"complete\" for training while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-80639893619975229fb7@f2b6696b2e20849f","id":"REQ-80639893619975229fb7","version":"f2b6696b2e20849f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 5.1","statement":"AI governance owners should collect feedback from affected stakeholders","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 5.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"collect","object":"feedback from affected stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"collect\" for feedback from affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"collect\" for feedback from affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-81f5812632ddc6a12dbc@2e384664fd98c7b2","id":"REQ-81f5812632ddc6a12dbc","version":"2e384664fd98c7b2","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 2.3","statement":"AI governance owners should assign executive accountability for AI risk decisions","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"assign","object":"executive accountability for AI risk decisions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assign\" for executive accountability for AI risk decisions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assign\" for executive accountability for AI risk decisions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-82b5365cb210d545ce8a@1f6541d2eb7dc485","id":"REQ-82b5365cb210d545ce8a","version":"1f6541d2eb7dc485","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 10(2)(f)","statement":"High-risk AI providers must examine possible biases in datasets","family":"Fairness","body":{"sourceId":"eu-ai-act","control":"Article 10(2)(f)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"examine","object":"possible biases in datasets","condition":"Training, validation and testing data","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"examine\" for possible biases in datasets within these source conditions: Training, validation and testing data, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"examine\" for possible biases in datasets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-8439f2b76fbf6e2d0ece@82f36d83fd21c7b3","id":"REQ-8439f2b76fbf6e2d0ece","version":"82f36d83fd21c7b3","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"p.6, Approval Workflow / Exemptions","statement":"agencies must obtain sequential approval","family":"Security","body":{"sourceId":"va-ai-ea400","control":"p.6, Approval Workflow / Exemptions","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"obtain","object":"sequential approval","condition":"before deployment","exception":"security defense; standard-software embedded AI; higher-education research/instruction","timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"obtain\" for sequential approval within these source conditions: before deployment, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"obtain\" for sequential approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-847e46792ed17f616fe6@399fbc5703d6fb9e","id":"REQ-847e46792ed17f616fe6","version":"399fbc5703d6fb9e","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 1.6","statement":"AI governance owners should elicit AI system requirements from stakeholders","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 1.6","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"elicit","object":"AI system requirements from stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"elicit\" for AI system requirements from stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"elicit\" for AI system requirements from stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-8555c7ac20eba054615f@28868f5211c9bb73","id":"REQ-8555c7ac20eba054615f","version":"28868f5211c9bb73","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"6.1.3","statement":"Responsible senior federal officials must update published algorithmic impact assessments","family":"Governance","body":{"sourceId":"ca-automated-decisions","control":"6.1.3","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"update","object":"published algorithmic impact assessments","condition":"Scheduled review and functionality or scope changes","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"update\" for published algorithmic impact assessments within these source conditions: Scheduled review and functionality or scope changes, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"update\" for published algorithmic impact assessments while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-8598c3a442b8d508dcae@64582f81e66b8fe5","id":"REQ-8598c3a442b8d508dcae","version":"64582f81e66b8fe5","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Secure development / assets","statement":"AI provider should maintain known-good asset recovery","family":"Safety","body":{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / assets","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"maintain","object":"known-good asset recovery","condition":"Compromise","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"maintain\" for known-good asset recovery within these conditions: Compromise.","doesNotMeetRule":"AI provider omits the recommended action \"maintain\" for known-good asset recovery. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-865366fbd2854e568a9d@496167594c70642b","id":"REQ-865366fbd2854e568a9d","version":"496167594c70642b","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"PS.2.1","statement":"Software producer should provide release-integrity verification information","family":"Governance","body":{"sourceId":"nist-ssdf-1-1","control":"PS.2.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=19","actor":"Software producer","modality":"should","action":"provide","object":"release-integrity verification information","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"provide\" for release-integrity verification information within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"provide\" for release-integrity verification information. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-87371ae5a63336fe0927@556fa73b36621b50","id":"REQ-87371ae5a63336fe0927","version":"556fa73b36621b50","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Agency Actions (a)","statement":"Covered agency must include compliance terms","family":"Fairness","body":{"sourceId":"omb-m-26-04","control":"Agency Actions (a)","sourceVersion":"M-26-04","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf#page=3","actor":"Covered agency","modality":"must","action":"include","object":"compliance terms","condition":"Covered solicitations issued after memorandum","exception":"Scope exclusions; free open-source licenses","timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"include\" for compliance terms within these source conditions: Covered solicitations issued after memorandum, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"include\" for compliance terms while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-883c3374fc9f9bfc68f6@7b681ed2f562b41e","id":"REQ-883c3374fc9f9bfc68f6","version":"7b681ed2f562b41e","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 2.3","statement":"AI governance owners should measure AI performance under deployment-like conditions","family":"Evaluation","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"measure","object":"AI performance under deployment-like conditions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"measure\" for AI performance under deployment-like conditions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"measure\" for AI performance under deployment-like conditions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-890a916d06f30a7e3518@fde4a02670c80951","id":"REQ-890a916d06f30a7e3518","version":"fde4a02670c80951","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 4","statement":"Providers and deployers must ensure appropriate AI literacy","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 4","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Providers and deployers","modality":"must","action":"ensure","object":"appropriate AI literacy","condition":"Staff and persons operating AI on their behalf","exception":"Consider technical knowledge, experience, training and context","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Providers and deployers performs the required action \"ensure\" for appropriate AI literacy within these source conditions: Staff and persons operating AI on their behalf, and retains evidence.","doesNotMeetRule":"Providers and deployers omits the required action \"ensure\" for appropriate AI literacy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-8bbce8d6e53152dac69c@2cb0e43635265660","id":"REQ-8bbce8d6e53152dac69c","version":"2cb0e43635265660","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"03.01.07(a)","statement":"Organization should prevent nonprivileged execution of privileged functions","family":"Governance","body":{"sourceId":"nist-800-171-r3","control":"03.01.07(a)","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=21","actor":"Organization","modality":"should","action":"prevent","object":"nonprivileged execution of privileged functions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"prevent\" for nonprivileged execution of privileged functions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"prevent\" for nonprivileged execution of privileged functions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-8be4c51029dd20e20d68@dd8ad91d41db054f","id":"REQ-8be4c51029dd20e20d68","version":"dd8ad91d41db054f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 3.3","statement":"AI governance owners should specify the targeted AI application scope","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 3.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"specify","object":"the targeted AI application scope","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"specify\" for the targeted AI application scope within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"specify\" for the targeted AI application scope. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-8dd61021f600dc0421de@15535c420fa7a2d4","id":"REQ-8dd61021f600dc0421de","version":"15535c420fa7a2d4","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Non-Permissible Uses, paragraph 3","statement":"users must-not enter sensitive information","family":"Privacy","body":{"sourceId":"msu-genai-guidelines","control":"Non-Permissible Uses, paragraph 3","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must-not","action":"enter","object":"sensitive information","condition":"non-MSU enterprise tools","exception":"explicit security approval","timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"enter\" for sensitive information within these source conditions: non-MSU enterprise tools, and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for sensitive information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-8e507e6a09c46f1cec03@aa2d98621f83ee92","id":"REQ-8e507e6a09c46f1cec03","version":"aa2d98621f83ee92","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Manage 1.4","statement":"AI governance owners should document negative residual AI risks","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Manage 1.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"negative residual AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for negative residual AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for negative residual AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-8e6d862191185e53d928@a5867538818dadfc","id":"REQ-8e6d862191185e53d928","version":"a5867538818dadfc","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"6.1.1","statement":"Responsible senior federal officials must publish an algorithmic impact assessment","family":"Governance","body":{"sourceId":"ca-automated-decisions","control":"6.1.1","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"publish","object":"an algorithmic impact assessment","condition":"Before production; accessible Open Government publication","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"publish\" for an algorithmic impact assessment within these source conditions: Before production; accessible Open Government publication, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"publish\" for an algorithmic impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-8fb0a1d7674de4f06a13@46fc9ba1e157750a","id":"REQ-8fb0a1d7674de4f06a13","version":"46fc9ba1e157750a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"6.2.5","statement":"Responsible senior federal officials must safeguard released versions of decision-system software","family":"Governance","body":{"sourceId":"ca-automated-decisions","control":"6.2.5","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"safeguard","object":"released versions of decision-system software","condition":"All released components","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"safeguard\" for released versions of decision-system software within these source conditions: All released components, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"safeguard\" for released versions of decision-system software while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-900ae8b1e74aec38d7b5@1cd7a44bcd50d8ec","id":"REQ-900ae8b1e74aec38d7b5","version":"1cd7a44bcd50d8ec","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 1.2","statement":"AI governance owners should involve interdisciplinary AI actors in context assessment","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"involve","object":"interdisciplinary AI actors in context assessment","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"involve\" for interdisciplinary AI actors in context assessment within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"involve\" for interdisciplinary AI actors in context assessment. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-9123110ea1dc5563c2c0@d083918612e755b7","id":"REQ-9123110ea1dc5563c2c0","version":"d083918612e755b7","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 2.1","statement":"AI governance owners should define tasks supported by the AI system","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"tasks supported by the AI system","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for tasks supported by the AI system within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for tasks supported by the AI system. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-92ada46c1fb503fa8880@722fa3a24dec97af","id":"REQ-92ada46c1fb503fa8880","version":"722fa3a24dec97af","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 10(3)","statement":"High-risk AI providers must ensure dataset representativeness","family":"Data & IP","body":{"sourceId":"eu-ai-act","control":"Article 10(3)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"ensure","object":"dataset representativeness","condition":"Intended purpose of high-risk AI","exception":"To the extent applicable","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for dataset representativeness within these source conditions: Intended purpose of high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for dataset representativeness while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-94fe18703059b98d84e6@df4f2396cc5be7fc","id":"REQ-94fe18703059b98d84e6","version":"df4f2396cc5be7fc","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 26(1)","statement":"High-risk AI deployers must follow provider instructions for use","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 26(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"follow","object":"provider instructions for use","condition":"Covered high-risk AI use","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"follow\" for provider instructions for use within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"follow\" for provider instructions for use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-953e83bcb3054c5e86c6@238f394e4891678d","id":"REQ-953e83bcb3054c5e86c6","version":"238f394e4891678d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"6.2.1","statement":"Responsible senior federal officials must provide notice of automated decision-making","family":"Transparency","body":{"sourceId":"ca-automated-decisions","control":"6.2.1","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"provide","object":"notice of automated decision-making","condition":"Before decisions; impact-level requirements apply","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"provide\" for notice of automated decision-making within these source conditions: Before decisions; impact-level requirements apply, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"provide\" for notice of automated decision-making while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-954fc0e9e2221227bec6@30549793ee6465fc","id":"REQ-954fc0e9e2221227bec6","version":"30549793ee6465fc","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"PT-2(a)","statement":"Organization should determine PII processing authority","family":"Privacy","body":{"sourceId":"nist-800-53-r5","control":"PT-2(a)","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=257","actor":"Organization","modality":"should","action":"determine","object":"PII processing authority","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"determine\" for PII processing authority within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"determine\" for PII processing authority. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-95a6fff42aa80a0adece@dce58360b28bdbd7","id":"REQ-95a6fff42aa80a0adece","version":"dce58360b28bdbd7","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 4(2)","statement":"Covered GenAI service providers must prevent discriminatory generation","family":"Fairness","body":{"sourceId":"cn-genai-interim","control":"Article 4(2)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"prevent","object":"discriminatory generation","condition":"Algorithm design, training and service provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"prevent\" for discriminatory generation within these source conditions: Algorithm design, training and service provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"prevent\" for discriminatory generation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-962a397fb1e94c50b1a4@556c58d4e3f2ca08","id":"REQ-962a397fb1e94c50b1a4","version":"556c58d4e3f2ca08","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"PR.DS-02","statement":"Organization should protect transmitted data","family":"Privacy","body":{"sourceId":"nist-csf-2","control":"PR.DS-02","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=25","actor":"Organization","modality":"should","action":"protect","object":"transmitted data","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"protect\" for transmitted data within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"protect\" for transmitted data. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-97adb8a6a224db055967@7c42a3576fa72bf2","id":"REQ-97adb8a6a224db055967","version":"7c42a3576fa72bf2","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"6.1.2","statement":"Responsible senior federal officials must apply impact-level requirements from Appendix C","family":"Governance","body":{"sourceId":"ca-automated-decisions","control":"6.1.2","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"apply","object":"impact-level requirements from Appendix C","condition":"As determined by the assessment","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"apply\" for impact-level requirements from Appendix C within these source conditions: As determined by the assessment, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"apply\" for impact-level requirements from Appendix C while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-980c8352a10bf8057860@b124d0d845b8bc48","id":"REQ-980c8352a10bf8057860","version":"b124d0d845b8bc48","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"ID.IM-P5","statement":"Organization should inventory data-action purposes","family":"Data & IP","body":{"sourceId":"nist-privacy-1","control":"ID.IM-P5","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"data-action purposes","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for data-action purposes within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for data-action purposes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-98264a78a4d42fcc9ba6@fb16c962b028817d","id":"REQ-98264a78a4d42fcc9ba6","version":"fb16c962b028817d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 4(3)","statement":"Covered GenAI service providers must protect trade secrets","family":"Security","body":{"sourceId":"cn-genai-interim","control":"Article 4(3)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"protect","object":"trade secrets","condition":"Covered service use and provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for trade secrets within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for trade secrets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-99facc01668588c1d26e@4aa43448419a697f","id":"REQ-99facc01668588c1d26e","version":"4aa43448419a697f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 9","statement":"Covered GenAI service providers must agree service rights and obligations with users","family":"Governance","body":{"sourceId":"cn-genai-interim","control":"Article 9","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"agree","object":"service rights and obligations with users","condition":"Registered service users","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"agree\" for service rights and obligations with users within these source conditions: Registered service users, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"agree\" for service rights and obligations with users while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-9a5586dab7f578ed2ae8@82b1eaf2284879a9","id":"REQ-9a5586dab7f578ed2ae8","version":"82b1eaf2284879a9","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 14(4)(e)","statement":"High-risk AI providers must enable oversight personnel to interrupt high-risk AI","family":"Human oversight","body":{"sourceId":"eu-ai-act","control":"Article 14(4)(e)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"oversight personnel to interrupt high-risk AI","condition":"When overseeing high-risk AI","exception":"Safe stop procedure","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to interrupt high-risk AI within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to interrupt high-risk AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-9a616c404019e6ec61a0@fe2c8d5f8a08d7f2","id":"REQ-9a616c404019e6ec61a0","version":"fe2c8d5f8a08d7f2","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 5(2)","statement":"Data controllers must demonstrate compliance with data-protection principles","family":"Data & IP","body":{"sourceId":"eu-gdpr","control":"Article 5(2)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"demonstrate","object":"compliance with data-protection principles","condition":"Controller accountability","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"demonstrate\" for compliance with data-protection principles within these source conditions: Controller accountability, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"demonstrate\" for compliance with data-protection principles while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-9b416d22097ea9a90ab5@bb661b26578f6cea","id":"REQ-9b416d22097ea9a90ab5","version":"bb661b26578f6cea","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 1.5","statement":"AI governance owners should plan periodic AI risk-management reviews","family":"Human oversight","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 1.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"plan","object":"periodic AI risk-management reviews","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for periodic AI risk-management reviews within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for periodic AI risk-management reviews. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-9b6d044c075f1d4b3568@2931003a3bf39a6f","id":"REQ-9b6d044c075f1d4b3568","version":"2931003a3bf39a6f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 10","statement":"Covered GenAI service providers must publish intended GenAI audiences and uses","family":"Governance","body":{"sourceId":"cn-genai-interim","control":"Article 10","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"publish","object":"intended GenAI audiences and uses","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"publish\" for intended GenAI audiences and uses within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"publish\" for intended GenAI audiences and uses while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-9befc4b9f29bdfc40e10@8e928e03e9c2737c","id":"REQ-9befc4b9f29bdfc40e10","version":"8e928e03e9c2737c","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Manage 2.2","statement":"AI governance owners should apply mechanisms to sustain deployed AI value","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Manage 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"apply","object":"mechanisms to sustain deployed AI value","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"apply\" for mechanisms to sustain deployed AI value within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"apply\" for mechanisms to sustain deployed AI value. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-9ea1e6cfe18133c933b5@156e49fdf41528a7","id":"REQ-9ea1e6cfe18133c933b5","version":"156e49fdf41528a7","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 1.4","statement":"AI governance owners should define the business value of AI use","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 1.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"the business value of AI use","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for the business value of AI use within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for the business value of AI use. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-9ebf08d4f32ee32a443c@cfc00be773345cc9","id":"REQ-9ebf08d4f32ee32a443c","version":"cfc00be773345cc9","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 26(2)","statement":"High-risk AI deployers must assign human oversight to competent personnel","family":"Human oversight","body":{"sourceId":"eu-ai-act","control":"Article 26(2)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"assign","object":"human oversight to competent personnel","condition":"Covered high-risk AI use","exception":"Necessary training and authority","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"assign\" for human oversight to competent personnel within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"assign\" for human oversight to competent personnel while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-9f98fb05c7d01c7d90c4@be8fa9d14fb716a9","id":"REQ-9f98fb05c7d01c7d90c4","version":"be8fa9d14fb716a9","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 3.1","statement":"AI governance owners should include diverse perspectives in AI risk decisions","family":"Fairness","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"include","object":"diverse perspectives in AI risk decisions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"include\" for diverse perspectives in AI risk decisions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"include\" for diverse perspectives in AI risk decisions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-9fd01009c21d518c8da0@5f02801ed31239dd","id":"REQ-9fd01009c21d518c8da0","version":"5f02801ed31239dd","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 1.6","statement":"AI governance owners should inventory organizational AI systems","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 1.6","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"inventory","object":"organizational AI systems","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for organizational AI systems within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for organizational AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-a47c8d074bf4147393f1@34750a73cf90c28b","id":"REQ-a47c8d074bf4147393f1","version":"34750a73cf90c28b","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 9(7)","statement":"High-risk AI providers must test risk-management measures","family":"Evaluation","body":{"sourceId":"eu-ai-act","control":"Article 9(7)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"test","object":"risk-management measures","condition":"Before placing high-risk systems on the market","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"test\" for risk-management measures within these source conditions: Before placing high-risk systems on the market, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"test\" for risk-management measures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-a48c27ef5d29a8fc549f@736480c134f1f07e","id":"REQ-a48c27ef5d29a8fc549f","version":"736480c134f1f07e","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Use, bullet 1","statement":"users must obtain approval","family":"Security","body":{"sourceId":"brookline-genai","control":"Use, bullet 1","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"obtain","object":"approval","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"obtain\" for approval within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-a4f022c3f1437d5fb2ad@097cc4e839b3ce9c","id":"REQ-a4f022c3f1437d5fb2ad","version":"097cc4e839b3ce9c","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Non-Permissible Uses, final paragraph","statement":"users must use enclave-approved tools","family":"Data & IP","body":{"sourceId":"msu-genai-guidelines","control":"Non-Permissible Uses, final paragraph","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must","action":"use","object":"enclave-approved tools","condition":"CUI/export-controlled data","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for enclave-approved tools within these source conditions: CUI/export-controlled data, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for enclave-approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-a59859e0c4a87606f03e@1354022f920495e5","id":"REQ-a59859e0c4a87606f03e","version":"1354022f920495e5","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 2.11","statement":"AI governance owners should evaluate AI fairness and bias","family":"Fairness","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 2.11","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"AI fairness and bias","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI fairness and bias within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI fairness and bias. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-a6857dfd2d9159dbdff0@938fe85b16b627a3","id":"REQ-a6857dfd2d9159dbdff0","version":"938fe85b16b627a3","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"4(d)(ii)(E)(I)","statement":"Covered agency must use agency-defined evaluation data","family":"Data & IP","body":{"sourceId":"omb-m-25-22","control":"4(d)(ii)(E)(I)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=10","actor":"Covered agency","modality":"must","action":"use","object":"agency-defined evaluation data","condition":"Independent evaluations","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"use\" for agency-defined evaluation data within these source conditions: Independent evaluations, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"use\" for agency-defined evaluation data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-a9ae419481302815f1d0@abdf184cba44bde4","id":"REQ-a9ae419481302815f1d0","version":"abdf184cba44bde4","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 26(7)","statement":"Employer deployers must inform affected workers of high-risk AI use","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 26(7)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Employer deployers","modality":"must","action":"inform","object":"affected workers of high-risk AI use","condition":"Before workplace use","exception":"National information rights also apply","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Employer deployers performs the required action \"inform\" for affected workers of high-risk AI use within these source conditions: Before workplace use, and retains evidence.","doesNotMeetRule":"Employer deployers omits the required action \"inform\" for affected workers of high-risk AI use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-a9f4db572f7db3709c7e@d335ef4c49dc0295","id":"REQ-a9f4db572f7db3709c7e","version":"d335ef4c49dc0295","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"3(b)(v)","statement":"Covered agency must inventory AI use cases","family":"Governance","body":{"sourceId":"omb-m-25-21","control":"3(b)(v)","sourceVersion":"M-25-21","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf#page=12","actor":"Covered agency","modality":"must","action":"inventory","object":"AI use cases","condition":"Within the source scope; assess applicability before adoption.","exception":"DoD and Intelligence Community","timing":"At least annually","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"inventory\" for AI use cases within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"inventory\" for AI use cases while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-aaddd5302a0acc74d662@8d04001e8ba5777a","id":"REQ-aaddd5302a0acc74d662","version":"8d04001e8ba5777a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 2.8","statement":"AI governance owners should examine AI transparency risks","family":"Transparency","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 2.8","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"examine","object":"AI transparency risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for AI transparency risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for AI transparency risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-abf3c145640b3dba6c72@5467a7092de6e3d3","id":"REQ-abf3c145640b3dba6c72","version":"5467a7092de6e3d3","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Manage 3.1","statement":"AI governance owners should monitor third-party AI risks","family":"Procurement","body":{"sourceId":"nist-ai-rmf-1","control":"Manage 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"third-party AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for third-party AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for third-party AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-ac653975bb55378efd48@50eb4dfc8fb1dea4","id":"REQ-ac653975bb55378efd48","version":"50eb4dfc8fb1dea4","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 55(1)(c)","statement":"Systemic-risk GPAI providers must report serious incidents to the AI Office","family":"Safety","body":{"sourceId":"eu-ai-act","control":"Article 55(1)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"report","object":"serious incidents to the AI Office","condition":"Covered systemic-risk models","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"report\" for serious incidents to the AI Office within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"report\" for serious incidents to the AI Office while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-aeb6c81679f4ddb98944@20a6b1c276d38482","id":"REQ-aeb6c81679f4ddb98944","version":"20a6b1c276d38482","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 6.1","statement":"AI governance owners should assess third-party AI supply-chain risks","family":"Procurement","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 6.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"assess","object":"third-party AI supply-chain risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assess\" for third-party AI supply-chain risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assess\" for third-party AI supply-chain risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-aec30342b786871fccc0@9d8d629bcd7582c1","id":"REQ-aec30342b786871fccc0","version":"9d8d629bcd7582c1","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 1.1","statement":"AI governance owners should document intended AI use contexts","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"intended AI use contexts","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for intended AI use contexts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for intended AI use contexts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-b0396ad7b4cee26e6b98@f9c9b8f654dd1293","id":"REQ-b0396ad7b4cee26e6b98","version":"f9c9b8f654dd1293","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 3.1","statement":"AI governance owners should document potential benefits of AI functionality","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"potential benefits of AI functionality","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for potential benefits of AI functionality within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for potential benefits of AI functionality. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-b12ae43539e29e787d6e@e2a2ba7c0133ba9a","id":"REQ-b12ae43539e29e787d6e","version":"e2a2ba7c0133ba9a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 15(5)","statement":"High-risk AI providers must ensure cybersecurity of high-risk AI","family":"Security","body":{"sourceId":"eu-ai-act","control":"Article 15(5)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"ensure","object":"cybersecurity of high-risk AI","condition":"Against unauthorized third-party alteration","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for cybersecurity of high-risk AI within these source conditions: Against unauthorized third-party alteration, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for cybersecurity of high-risk AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-b1820f781f6f9a3b7fb7@fb5d5c551fee68cd","id":"REQ-b1820f781f6f9a3b7fb7","version":"fb5d5c551fee68cd","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"p.5, data sharing, bullets 1–2","statement":"employees must share public data","family":"Data & IP","body":{"sourceId":"nc-public-genai","control":"p.5, data sharing, bullets 1–2","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"share","object":"public data","condition":"state work","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"share\" for public data within these source conditions: state work, and retains evidence.","doesNotMeetRule":"employees omits the required action \"share\" for public data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-b355790e12f878de5bf3@7c0d10cd9a0cd672","id":"REQ-b355790e12f878de5bf3","version":"7c0d10cd9a0cd672","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 22(1)","statement":"Data controllers must protect against solely automated significant decisions","family":"Governance","body":{"sourceId":"eu-gdpr","control":"Article 22(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"protect","object":"against solely automated significant decisions","condition":"Subject to Article 22 exceptions and safeguards","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"protect\" for against solely automated significant decisions within these source conditions: Subject to Article 22 exceptions and safeguards, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"protect\" for against solely automated significant decisions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-b453067b2286002fe358@ed97c41ec108e32d","id":"REQ-b453067b2286002fe358","version":"ed97c41ec108e32d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 1.5","statement":"AI governance owners should document AI risk tolerance","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 1.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI risk tolerance","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risk tolerance within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risk tolerance. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-b52ccaaf3e8e10f8c00c@2e26ffed7814b73a","id":"REQ-b52ccaaf3e8e10f8c00c","version":"2e26ffed7814b73a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 5.2","statement":"AI governance owners should incorporate adjudicated stakeholder feedback","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 5.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"incorporate","object":"adjudicated stakeholder feedback","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"incorporate\" for adjudicated stakeholder feedback within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"incorporate\" for adjudicated stakeholder feedback. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-b5a6a29354ba501a8c8a@771136426cf3b545","id":"REQ-b5a6a29354ba501a8c8a","version":"771136426cf3b545","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 3.2","statement":"AI governance owners should define human oversight responsibilities","family":"Human oversight","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"human oversight responsibilities","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for human oversight responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for human oversight responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-b7315292d173d8e00aa2@5fa3c11702567f6d","id":"REQ-b7315292d173d8e00aa2","version":"5fa3c11702567f6d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"GV-1.4-001","statement":"AI governance owners should establish controls against prohibited GAI content","family":"Governance","body":{"sourceId":"nist-genai-profile","control":"GV-1.4-001","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"controls against prohibited GAI content","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for controls against prohibited GAI content within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for controls against prohibited GAI content. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-b7a0cb40e002a7d1502a@a1a746b9237c548f","id":"REQ-b7a0cb40e002a7d1502a","version":"a1a746b9237c548f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"PR.PS-04","statement":"Organization should generate monitoring log records","family":"Governance","body":{"sourceId":"nist-csf-2","control":"PR.PS-04","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=25","actor":"Organization","modality":"should","action":"generate","object":"monitoring log records","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"generate\" for monitoring log records within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"generate\" for monitoring log records. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-b7d3b1830c19b99be4e4@bb7054070dea3d29","id":"REQ-b7d3b1830c19b99be4e4","version":"bb7054070dea3d29","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Secure development / assets","statement":"AI provider should control AI data access","family":"Data & IP","body":{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / assets","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"control","object":"AI data access","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"control\" for AI data access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"control\" for AI data access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-b8c26d63f50b6187d3d9@f56bfdfa88166293","id":"REQ-b8c26d63f50b6187d3d9","version":"f56bfdfa88166293","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 17","statement":"Covered GenAI service providers must complete required algorithm filings","family":"Governance","body":{"sourceId":"cn-genai-interim","control":"Article 17","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"complete","object":"required algorithm filings","condition":"Applicable algorithm-filing provisions","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"complete\" for required algorithm filings within these source conditions: Applicable algorithm-filing provisions, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"complete\" for required algorithm filings while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-ba24f1554e754d2c8d56@9f7dabcbd35a090d","id":"REQ-ba24f1554e754d2c8d56","version":"9f7dabcbd35a090d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Manage 1.1","statement":"AI governance owners should determine whether AI deployment should proceed","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Manage 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"determine","object":"whether AI deployment should proceed","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"determine\" for whether AI deployment should proceed within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"determine\" for whether AI deployment should proceed. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-bb97aa63367a6b4e4b15@0cbaf25e623b686a","id":"REQ-bb97aa63367a6b4e4b15","version":"0cbaf25e623b686a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"AC-6","statement":"Organization should limit authorized access","family":"Governance","body":{"sourceId":"nist-800-53-r5","control":"AC-6","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=63","actor":"Organization","modality":"should","action":"limit","object":"authorized access","condition":"Assigned task needs","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"limit\" for authorized access within these conditions: Assigned task needs.","doesNotMeetRule":"Organization omits the recommended action \"limit\" for authorized access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-bba500d608f066a97d96@35f791969523f64d","id":"REQ-bba500d608f066a97d96","version":"35f791969523f64d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 4(5)","statement":"Covered GenAI service providers must improve transparency of GenAI services","family":"Transparency","body":{"sourceId":"cn-genai-interim","control":"Article 4(5)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"improve","object":"transparency of GenAI services","condition":"According to service characteristics","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for transparency of GenAI services within these source conditions: According to service characteristics, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for transparency of GenAI services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-bbd838118adde1e3421d@e7ddb70631fec6e5","id":"REQ-bbd838118adde1e3421d","version":"e7ddb70631fec6e5","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Agency Actions (c)","statement":"Covered agency must update LLM procurement procedures","family":"Procurement","body":{"sourceId":"omb-m-26-04","control":"Agency Actions (c)","sourceVersion":"M-26-04","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf#page=3","actor":"Covered agency","modality":"must","action":"update","object":"LLM procurement procedures","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":"By 2026-03-11","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"update\" for LLM procurement procedures within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"update\" for LLM procurement procedures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-bbe7d452929d8704b256@966447278f7d29f1","id":"REQ-bbe7d452929d8704b256","version":"966447278f7d29f1","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 14","statement":"Covered GenAI service providers must report unlawful content to competent authorities","family":"Governance","body":{"sourceId":"cn-genai-interim","control":"Article 14","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"report","object":"unlawful content to competent authorities","condition":"When unlawful content is discovered","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"report\" for unlawful content to competent authorities within these source conditions: When unlawful content is discovered, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"report\" for unlawful content to competent authorities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-bd8be4f016ae42bb21a9@6a4868272521b857","id":"REQ-bd8be4f016ae42bb21a9","version":"6a4868272521b857","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"03.01.07(b)","statement":"Organization should record privileged-function execution","family":"Governance","body":{"sourceId":"nist-800-171-r3","control":"03.01.07(b)","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=21","actor":"Organization","modality":"should","action":"record","object":"privileged-function execution","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"record\" for privileged-function execution within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"record\" for privileged-function execution. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-be26153c6c755675a45d@a6a1bf3fdf49809c","id":"REQ-be26153c6c755675a45d","version":"a6a1bf3fdf49809c","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 7(3)","statement":"Covered GenAI service providers must establish a lawful basis for training on personal information","family":"Privacy","body":{"sourceId":"cn-genai-interim","control":"Article 7(3)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"establish","object":"a lawful basis for training on personal information","condition":"Consent or another legal basis","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"establish\" for a lawful basis for training on personal information within these source conditions: Consent or another legal basis, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"establish\" for a lawful basis for training on personal information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-bec4bed1b7cc111add87@2096b52819242a73","id":"REQ-bec4bed1b7cc111add87","version":"2096b52819242a73","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 2.1","statement":"AI governance owners should document AI test sets and evaluation metrics","family":"Evaluation","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI test sets and evaluation metrics","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI test sets and evaluation metrics within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI test sets and evaluation metrics. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-c09c8a39e58dbe4aa4cc@433f11fc3338fd8b","id":"REQ-c09c8a39e58dbe4aa4cc","version":"433f11fc3338fd8b","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 14(4)(d)","statement":"High-risk AI providers must enable oversight personnel to disregard AI output","family":"Human oversight","body":{"sourceId":"eu-ai-act","control":"Article 14(4)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"oversight personnel to disregard AI output","condition":"When overseeing high-risk AI","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to disregard AI output within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to disregard AI output while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-c12b030ab1c1af7e3f1e@97d0e51f4f2d575d","id":"REQ-c12b030ab1c1af7e3f1e","version":"97d0e51f4f2d575d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"6.2.4","statement":"Responsible senior federal officials must determine appropriate software licensing","family":"Data & IP","body":{"sourceId":"ca-automated-decisions","control":"6.2.4","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"determine","object":"appropriate software licensing","condition":"Including consideration of open source","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"determine\" for appropriate software licensing within these source conditions: Including consideration of open source, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"determine\" for appropriate software licensing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-c372b0edd972f16db81e@b9aff3c7a310a525","id":"REQ-c372b0edd972f16db81e","version":"b9aff3c7a310a525","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"5.2.3, p.6","statement":"users must verify outputs","family":"Human oversight","body":{"sourceId":"pa-ai-2026","control":"5.2.3, p.6","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must","action":"verify","object":"outputs","condition":"Commonwealth business","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"verify\" for outputs within these source conditions: Commonwealth business, and retains evidence.","doesNotMeetRule":"users omits the required action \"verify\" for outputs while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-c4c7d608b24e0eb29bb6@39c1582f7c224e6a","id":"REQ-c4c7d608b24e0eb29bb6","version":"39c1582f7c224e6a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 2.2","statement":"AI governance owners should train personnel in their AI risk responsibilities","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"train","object":"personnel in their AI risk responsibilities","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"train\" for personnel in their AI risk responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"train\" for personnel in their AI risk responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-c72315a9a8f4084a11c1@55b1d03043877e0d","id":"REQ-c72315a9a8f4084a11c1","version":"55b1d03043877e0d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"p.5, reporting, bullet 2","statement":"employees must follow incident protocols","family":"Safety","body":{"sourceId":"nc-public-genai","control":"p.5, reporting, bullet 2","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"follow","object":"incident protocols","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"follow\" for incident protocols within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"follow\" for incident protocols while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-c7956512fcbfa445d58f@3ee4881d79ad119a","id":"REQ-c7956512fcbfa445d58f","version":"3ee4881d79ad119a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 13(1)","statement":"High-risk AI providers must design sufficiently transparent operation","family":"Transparency","body":{"sourceId":"eu-ai-act","control":"Article 13(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"design","object":"sufficiently transparent operation","condition":"To enable deployer interpretation","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"design\" for sufficiently transparent operation within these source conditions: To enable deployer interpretation, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"design\" for sufficiently transparent operation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-c8b97f6cc2809143dfde@fecafaeececfc1c5","id":"REQ-c8b97f6cc2809143dfde","version":"fecafaeececfc1c5","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Summary / validation","statement":"AI deployer should validate AI system","family":"Evaluation","body":{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Summary / validation","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"validate","object":"AI system","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":"Before deployment","authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"validate\" for AI system within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"validate\" for AI system. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-c8f8795f03e451c41169@7963bb19d2bd5215","id":"REQ-c8f8795f03e451c41169","version":"7963bb19d2bd5215","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 4.2","statement":"AI governance owners should document AI risks and potential impacts","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI risks and potential impacts","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risks and potential impacts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risks and potential impacts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-ca05607ef6cc1788db55@08a65b9eb87ee8c6","id":"REQ-ca05607ef6cc1788db55","version":"08a65b9eb87ee8c6","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"AC-3","statement":"Organization should enforce approved logical-access permissions","family":"Governance","body":{"sourceId":"nist-800-53-r5","control":"AC-3","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=50","actor":"Organization","modality":"should","action":"enforce","object":"approved logical-access permissions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"enforce\" for approved logical-access permissions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"enforce\" for approved logical-access permissions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-ca8c2e871d2be4009911@3c2bea82e2ec5a29","id":"REQ-ca8c2e871d2be4009911","version":"3c2bea82e2ec5a29","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 73(1)","statement":"High-risk AI providers must report serious incidents to authorities","family":"Safety","body":{"sourceId":"eu-ai-act","control":"Article 73(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"report","object":"serious incidents to authorities","condition":"Covered high-risk systems","exception":"Statutory incident category and deadline review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"report\" for serious incidents to authorities within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"report\" for serious incidents to authorities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-cac385deb46224061a35@cb8709ed5fd4ce68","id":"REQ-cac385deb46224061a35","version":"cb8709ed5fd4ce68","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 2.12","statement":"AI governance owners should evaluate environmental impacts of AI training","family":"Data & IP","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 2.12","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"environmental impacts of AI training","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for environmental impacts of AI training within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for environmental impacts of AI training. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-cb5b8d47812bf23bada7@017070dd9c87316a","id":"REQ-cb5b8d47812bf23bada7","version":"017070dd9c87316a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 15(1)","statement":"Data controllers must enable data-subject access","family":"Data & IP","body":{"sourceId":"eu-gdpr","control":"Article 15(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"enable","object":"data-subject access","condition":"Subject to statutory exceptions","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"enable\" for data-subject access within these source conditions: Subject to statutory exceptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"enable\" for data-subject access while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-cbf3565a33b39d2ad2ae@756acbd55bf53954","id":"REQ-cbf3565a33b39d2ad2ae","version":"756acbd55bf53954","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"4(a)(ii)","statement":"Chief AI Officer must certify waiver continuing validity","family":"Evaluation","body":{"sourceId":"omb-m-25-21","control":"4(a)(ii)","sourceVersion":"M-25-21","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf#page=15","actor":"Chief AI Officer","modality":"must","action":"certify","object":"waiver continuing validity","condition":"In coordination with relevant officials","exception":null,"timing":"Annually","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Chief AI Officer performs the required action \"certify\" for waiver continuing validity within these source conditions: In coordination with relevant officials, and retains evidence.","doesNotMeetRule":"Chief AI Officer omits the required action \"certify\" for waiver continuing validity while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-ccb29427b3e456f0cf81@f300f2981f9d7339","id":"REQ-ccb29427b3e456f0cf81","version":"f300f2981f9d7339","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 2.5","statement":"AI governance owners should demonstrate AI validity within tested conditions","family":"Evaluation","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 2.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"demonstrate","object":"AI validity within tested conditions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"demonstrate\" for AI validity within tested conditions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"demonstrate\" for AI validity within tested conditions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-ccc1d850fa92195f850e@ce02b4de954c06c9","id":"REQ-ccc1d850fa92195f850e","version":"ce02b4de954c06c9","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 53(1)(a)","statement":"GPAI model providers must maintain model technical documentation","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 53(1)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"maintain","object":"model technical documentation","condition":"Covered general-purpose AI models","exception":"Specified open-source exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"maintain\" for model technical documentation within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"maintain\" for model technical documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-cd259338cb0ad4131831@60fddfc2c31532db","id":"REQ-cd259338cb0ad4131831","version":"60fddfc2c31532db","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 2.1","statement":"AI governance owners should document AI risk-management responsibilities","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI risk-management responsibilities","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risk-management responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risk-management responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-cda255d44215b60ea5dc@66dffb078f9d0ba0","id":"REQ-cda255d44215b60ea5dc","version":"66dffb078f9d0ba0","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 8","statement":"Covered GenAI service providers must define operable data-labeling rules","family":"Transparency","body":{"sourceId":"cn-genai-interim","control":"Article 8","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"define","object":"operable data-labeling rules","condition":"Data annotation during development","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"define\" for operable data-labeling rules within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"define\" for operable data-labeling rules while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-ce608b65a3781065cbe4@92bfafc5c0a4ebc3","id":"REQ-ce608b65a3781065cbe4","version":"92bfafc5c0a4ebc3","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 15","statement":"Covered GenAI service providers must establish complaint and reporting channels","family":"Governance","body":{"sourceId":"cn-genai-interim","control":"Article 15","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"establish","object":"complaint and reporting channels","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"establish\" for complaint and reporting channels within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"establish\" for complaint and reporting channels while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-cf1d75d38c87cdd0f602@d4b6792523755de5","id":"REQ-cf1d75d38c87cdd0f602","version":"d4b6792523755de5","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Use, transparency bullet","statement":"users must label AI content","family":"Transparency","body":{"sourceId":"brookline-genai","control":"Use, transparency bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"label","object":"AI content","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"label\" for AI content within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"label\" for AI content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-cf1d9320a4583657a8b5@ca84a4d538d41dae","id":"REQ-cf1d9320a4583657a8b5","version":"ca84a4d538d41dae","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 50(4)","statement":"AI deployers must disclose deepfake generation or manipulation","family":"Transparency","body":{"sourceId":"eu-ai-act","control":"Article 50(4)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI deployers","modality":"must","action":"disclose","object":"deepfake generation or manipulation","condition":"Covered synthetic media","exception":"Artistic and specified law-enforcement treatment applies","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployers performs the required action \"disclose\" for deepfake generation or manipulation within these source conditions: Covered synthetic media, and retains evidence.","doesNotMeetRule":"AI deployers omits the required action \"disclose\" for deepfake generation or manipulation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-cf3fa5e3c1a0ee2157da@8fc12a7b48463d5d","id":"REQ-cf3fa5e3c1a0ee2157da","version":"8fc12a7b48463d5d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 5(1)(a)","statement":"Data controllers must process personal data lawfully","family":"Privacy","body":{"sourceId":"eu-gdpr","control":"Article 5(1)(a)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"process","object":"personal data lawfully","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"process\" for personal data lawfully within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"process\" for personal data lawfully while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-cf47c0dc3943e4671d0f@197b421977c71774","id":"REQ-cf47c0dc3943e4671d0f","version":"197b421977c71774","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 14","statement":"Covered GenAI service providers must stop generation of unlawful content","family":"Governance","body":{"sourceId":"cn-genai-interim","control":"Article 14","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"stop","object":"generation of unlawful content","condition":"When unlawful content is discovered","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"stop\" for generation of unlawful content within these source conditions: When unlawful content is discovered, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"stop\" for generation of unlawful content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-d04a114d8e1c7f5ef9ad@eea8cd8d8d34b8e0","id":"REQ-d04a114d8e1c7f5ef9ad","version":"eea8cd8d8d34b8e0","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"General Expectations for Administrative Use","statement":"users must review content","family":"Human oversight","body":{"sourceId":"msu-genai-guidelines","control":"General Expectations for Administrative Use","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must","action":"review","object":"content","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"review\" for content within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"review\" for content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-d35808bd30363f52b154@bcb53f4fa874579e","id":"REQ-d35808bd30363f52b154","version":"bcb53f4fa874579e","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"ID.AM-02","statement":"Organization should maintain software, service and system inventories","family":"Governance","body":{"sourceId":"nist-csf-2","control":"ID.AM-02","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=23","actor":"Organization","modality":"should","action":"maintain","object":"software, service and system inventories","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"maintain\" for software, service and system inventories within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"maintain\" for software, service and system inventories. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-d4ec9df0706eb58bef64@b69d92ee62627b77","id":"REQ-d4ec9df0706eb58bef64","version":"b69d92ee62627b77","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 3.2","statement":"AI governance owners should examine potential costs of AI errors","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"examine","object":"potential costs of AI errors","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for potential costs of AI errors within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for potential costs of AI errors. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-d64c20159fb10d25cf0d@bdfad88bee792f8b","id":"REQ-d64c20159fb10d25cf0d","version":"bdfad88bee792f8b","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 7(1)","statement":"Covered GenAI service providers must use lawfully sourced training data","family":"Data & IP","body":{"sourceId":"cn-genai-interim","control":"Article 7(1)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"use","object":"lawfully sourced training data","condition":"Pretraining and fine-tuning","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"use\" for lawfully sourced training data within these source conditions: Pretraining and fine-tuning, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"use\" for lawfully sourced training data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-d8473a2a44914645c0a6@3881b77d3d017300","id":"REQ-d8473a2a44914645c0a6","version":"3881b77d3d017300","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 3.4","statement":"AI governance owners should define operator proficiency requirements","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 3.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"operator proficiency requirements","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for operator proficiency requirements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for operator proficiency requirements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-dbde9d758ba1c53d4f0d@6fa7a9df4256b8fe","id":"REQ-dbde9d758ba1c53d4f0d","version":"6fa7a9df4256b8fe","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 2.13","statement":"AI governance owners should evaluate the effectiveness of AI evaluation processes","family":"Evaluation","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 2.13","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"the effectiveness of AI evaluation processes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for the effectiveness of AI evaluation processes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for the effectiveness of AI evaluation processes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-dc337ed3c5db722dd55f@12b45ce509ac6abe","id":"REQ-dc337ed3c5db722dd55f","version":"12b45ce509ac6abe","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 4.1","statement":"AI governance owners should establish a safety-first AI development culture","family":"Safety","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"a safety-first AI development culture","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for a safety-first AI development culture within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for a safety-first AI development culture. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-dc669e117a26fa10a033@fa004bbe5c530eee","id":"REQ-dc669e117a26fa10a033","version":"fa004bbe5c530eee","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"ID.IM-P3","statement":"Organization should inventory affected person categories","family":"Data & IP","body":{"sourceId":"nist-privacy-1","control":"ID.IM-P3","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"affected person categories","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for affected person categories within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for affected person categories. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-dce482c09f1e24b1e76c@7673b10813241f9f","id":"REQ-dce482c09f1e24b1e76c","version":"7673b10813241f9f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 19(1)","statement":"High-risk AI providers must retain automatically generated logs under their control","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 19(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"retain","object":"automatically generated logs under their control","condition":"Covered high-risk systems","exception":"Applicable law and minimum statutory period","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"retain\" for automatically generated logs under their control within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"retain\" for automatically generated logs under their control while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-ddaaa83fe3c583de4393@43129ef1bd1a8c00","id":"REQ-ddaaa83fe3c583de4393","version":"43129ef1bd1a8c00","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 5(1)(e)","statement":"AI operators must not create facial recognition databases by untargeted scraping","family":"Data & IP","body":{"sourceId":"eu-ai-act","control":"Article 5(1)(e)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"create","object":"facial recognition databases by untargeted scraping","condition":"Internet or CCTV facial images","exception":"Assess statutory scope","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"create\" for facial recognition databases by untargeted scraping while these conditions apply: Internet or CCTV facial images.","doesNotMeetRule":"AI operators performs the prohibited action \"create\" for facial recognition databases by untargeted scraping while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-ddfeb966305e207a46d8@a90e5850a5545900","id":"REQ-ddfeb966305e207a46d8","version":"a90e5850a5545900","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 1.3","statement":"AI governance owners should determine risk-management effort based on risk tolerance","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"determine","object":"risk-management effort based on risk tolerance","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"determine\" for risk-management effort based on risk tolerance within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"determine\" for risk-management effort based on risk tolerance. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-de9ce9ced245f2a75f05@5ee36eff3af034fb","id":"REQ-de9ce9ced245f2a75f05","version":"5ee36eff3af034fb","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"4(d)(ii)(E)","statement":"Covered agency must include evaluation-enabling contract terms","family":"Procurement","body":{"sourceId":"omb-m-25-22","control":"4(d)(ii)(E)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=10","actor":"Covered agency","modality":"must","action":"include","object":"evaluation-enabling contract terms","condition":"Applicable AI contracts under §2","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"include\" for evaluation-enabling contract terms within these source conditions: Applicable AI contracts under §2, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"include\" for evaluation-enabling contract terms while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-e0036facfcedf9f2db0a@2448d1ae40a367ce","id":"REQ-e0036facfcedf9f2db0a","version":"2448d1ae40a367ce","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 5(1)(d)","statement":"Data controllers must maintain personal-data accuracy","family":"Privacy","body":{"sourceId":"eu-gdpr","control":"Article 5(1)(d)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"maintain","object":"personal-data accuracy","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"maintain\" for personal-data accuracy within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"maintain\" for personal-data accuracy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-e14de96ca3ae5833e64c@89a91e8689ebffe1","id":"REQ-e14de96ca3ae5833e64c","version":"89a91e8689ebffe1","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 28(1)","statement":"Data controllers must select processors with sufficient guarantees","family":"Governance","body":{"sourceId":"eu-gdpr","control":"Article 28(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"select","object":"processors with sufficient guarantees","condition":"Use of processing providers","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"select\" for processors with sufficient guarantees within these source conditions: Use of processing providers, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"select\" for processors with sufficient guarantees while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-e17870f951e7b6b2b401@650b253670091880","id":"REQ-e17870f951e7b6b2b401","version":"650b253670091880","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 3.2","statement":"AI governance owners should consider risk tracking for difficult-to-measure risks","family":"Evaluation","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"consider","object":"risk tracking for difficult-to-measure risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for risk tracking for difficult-to-measure risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for risk tracking for difficult-to-measure risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-e1e763b1c986693a59be@0a02076da227c914","id":"REQ-e1e763b1c986693a59be","version":"0a02076da227c914","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"ID.IM-P1","statement":"Organization should inventory data-processing systems","family":"Data & IP","body":{"sourceId":"nist-privacy-1","control":"ID.IM-P1","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"data-processing systems","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for data-processing systems within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for data-processing systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-e53bbcca689b8f323e93@46a4db01cb5635c5","id":"REQ-e53bbcca689b8f323e93","version":"46a4db01cb5635c5","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 2.6","statement":"AI governance owners should evaluate AI safety risks","family":"Safety","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 2.6","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"AI safety risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI safety risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI safety risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-e630840a32d158142e76@6c0fb79fd142c439","id":"REQ-e630840a32d158142e76","version":"6c0fb79fd142c439","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 5(1)(b)","statement":"AI operators must not exploit vulnerabilities through harmful AI manipulation","family":"Security","body":{"sourceId":"eu-ai-act","control":"Article 5(1)(b)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"exploit","object":"vulnerabilities through harmful AI manipulation","condition":"Age, disability or specific social or economic situation","exception":"Statutory harm threshold applies","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"exploit\" for vulnerabilities through harmful AI manipulation while these conditions apply: Age, disability or specific social or economic situation.","doesNotMeetRule":"AI operators performs the prohibited action \"exploit\" for vulnerabilities through harmful AI manipulation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-e68f628ba8efbc32d295@290b9772b8ec02bc","id":"REQ-e68f628ba8efbc32d295","version":"290b9772b8ec02bc","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 7(2)","statement":"Covered GenAI service providers must avoid infringing training-data intellectual property","family":"Data & IP","body":{"sourceId":"cn-genai-interim","control":"Article 7(2)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"avoid","object":"infringing training-data intellectual property","condition":"Covered training activities","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"avoid\" for infringing training-data intellectual property within these source conditions: Covered training activities, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"avoid\" for infringing training-data intellectual property while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-e840df8fa93d1494b8ad@10a1d40c8a72c5e8","id":"REQ-e840df8fa93d1494b8ad","version":"10a1d40c8a72c5e8","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"PR.PS-05","statement":"Organization should prevent unauthorized software execution","family":"Governance","body":{"sourceId":"nist-csf-2","control":"PR.PS-05","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=25","actor":"Organization","modality":"should","action":"prevent","object":"unauthorized software execution","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"prevent\" for unauthorized software execution within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"prevent\" for unauthorized software execution. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-e84ba0e6fc7bdd7b6e97@271467c6ee855455","id":"REQ-e84ba0e6fc7bdd7b6e97","version":"271467c6ee855455","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"PT-2(b)","statement":"Organization should restrict PII processing","family":"Privacy","body":{"sourceId":"nist-800-53-r5","control":"PT-2(b)","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=257","actor":"Organization","modality":"should","action":"restrict","object":"PII processing","condition":"Authorized activities","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"restrict\" for PII processing within these conditions: Authorized activities.","doesNotMeetRule":"Organization omits the recommended action \"restrict\" for PII processing. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-e8bc690daef1e401ff4f@5ffad916727c4737","id":"REQ-e8bc690daef1e401ff4f","version":"5ffad916727c4737","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 5(1)(c)","statement":"Data controllers must minimize personal data collected","family":"Privacy","body":{"sourceId":"eu-gdpr","control":"Article 5(1)(c)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"minimize","object":"personal data collected","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"minimize\" for personal data collected within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"minimize\" for personal data collected while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-e95210aad29d53fa234e@82771e923f9bf4ea","id":"REQ-e95210aad29d53fa234e","version":"82771e923f9bf4ea","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 8","statement":"Covered GenAI service providers must train data-labeling personnel","family":"Transparency","body":{"sourceId":"cn-genai-interim","control":"Article 8","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"train","object":"data-labeling personnel","condition":"Data annotation during development","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"train\" for data-labeling personnel within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"train\" for data-labeling personnel while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-e9a95beb399033f361bc@a51b015695bfc8fd","id":"REQ-e9a95beb399033f361bc","version":"a51b015695bfc8fd","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 3.1","statement":"AI governance owners should track emerging AI risks","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"track","object":"emerging AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"track\" for emerging AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"track\" for emerging AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-eb2bcc2af9e849902509@f0a7a8c5a39cbbc3","id":"REQ-eb2bcc2af9e849902509","version":"f0a7a8c5a39cbbc3","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 2.10","statement":"AI governance owners should examine AI privacy risks","family":"Privacy","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 2.10","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"examine","object":"AI privacy risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for AI privacy risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for AI privacy risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-ede42eb7a9415693e100@a72eb0e8307e3562","id":"REQ-ede42eb7a9415693e100","version":"a72eb0e8307e3562","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Use, security-review bullet","statement":"users must review responses","family":"Privacy","body":{"sourceId":"brookline-genai","control":"Use, security-review bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"review","object":"responses","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"review\" for responses within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"review\" for responses while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-f017d6e5ac967df3dad5@9ad3233d634fdde6","id":"REQ-f017d6e5ac967df3dad5","version":"9ad3233d634fdde6","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Procuring or Registering, paragraph 2","statement":"users must consult IT Services","family":"Governance","body":{"sourceId":"msu-genai-guidelines","control":"Procuring or Registering, paragraph 2","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must","action":"consult","object":"IT Services","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"consult\" for IT Services within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"consult\" for IT Services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-f056e68e74cd6129b4b5@be6395e8318bc3c9","id":"REQ-f056e68e74cd6129b4b5","version":"be6395e8318bc3c9","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"GV-1.3-007","statement":"AI governance owners should plan a halt to unacceptable-risk GAI development","family":"Safety","body":{"sourceId":"nist-genai-profile","control":"GV-1.3-007","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"plan","object":"a halt to unacceptable-risk GAI development","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for a halt to unacceptable-risk GAI development within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for a halt to unacceptable-risk GAI development. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-f1d1766ca409cb1b94ad@97d1f739e1ee6c9d","id":"REQ-f1d1766ca409cb1b94ad","version":"97d1f739e1ee6c9d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 2.7","statement":"AI governance owners should evaluate AI security and resilience","family":"Security","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 2.7","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"AI security and resilience","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI security and resilience within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI security and resilience. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-f24fc6449230da5e49fa@fb128f87d22daf5e","id":"REQ-f24fc6449230da5e49fa","version":"fb128f87d22daf5e","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 1.4","statement":"AI governance owners should establish transparent AI risk-management procedures","family":"Transparency","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 1.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"transparent AI risk-management procedures","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for transparent AI risk-management procedures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for transparent AI risk-management procedures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-f2bf54d31f77c3a259e5@bce3e2cdcdec1335","id":"REQ-f2bf54d31f77c3a259e5","version":"bce3e2cdcdec1335","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 53(1)(c)","statement":"GPAI model providers must implement a copyright-compliance policy","family":"Data & IP","body":{"sourceId":"eu-ai-act","control":"Article 53(1)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"implement","object":"a copyright-compliance policy","condition":"Covered general-purpose AI models","exception":"Including rights reservations under EU copyright law","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"implement\" for a copyright-compliance policy within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"implement\" for a copyright-compliance policy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-f2e7e3486f92cfea755b@2f568c3313743b0c","id":"REQ-f2e7e3486f92cfea755b","version":"2f568c3313743b0c","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"p.5, Ethical Use","statement":"agencies must-not use unexplainable AI","family":"Transparency","body":{"sourceId":"va-ai-ea400","control":"p.5, Ethical Use","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must-not","action":"use","object":"unexplainable AI","condition":"decision or approval","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"use\" for unexplainable AI within these source conditions: decision or approval, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"use\" for unexplainable AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-f3023c9b3830d8d83880@1d26fea4a6986df0","id":"REQ-f3023c9b3830d8d83880","version":"1d26fea4a6986df0","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Govern 6.2","statement":"AI governance owners should establish contingency procedures for third-party failures","family":"Procurement","body":{"sourceId":"nist-ai-rmf-1","control":"Govern 6.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"contingency procedures for third-party failures","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for contingency procedures for third-party failures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for contingency procedures for third-party failures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-f3f1ac33ee118f95ea90@8622e366e77e7b05","id":"REQ-f3f1ac33ee118f95ea90","version":"8622e366e77e7b05","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 4.2","statement":"AI governance owners should document internal controls for AI components","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Map 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"internal controls for AI components","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for internal controls for AI components within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for internal controls for AI components. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-f42f61e7841580753d26@11dde61b9a43868d","id":"REQ-f42f61e7841580753d26","version":"11dde61b9a43868d","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 5(1)(f)","statement":"Data controllers must protect personal-data integrity and confidentiality","family":"Privacy","body":{"sourceId":"eu-gdpr","control":"Article 5(1)(f)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"protect","object":"personal-data integrity and confidentiality","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"protect\" for personal-data integrity and confidentiality within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"protect\" for personal-data integrity and confidentiality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-f437100d0da2c6b29128@f803388d3665d05f","id":"REQ-f437100d0da2c6b29128","version":"f803388d3665d05f","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"p.5, data sharing, bullet 3","statement":"employees must obtain approval","family":"Security","body":{"sourceId":"nc-public-genai","control":"p.5, data sharing, bullet 3","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"obtain","object":"approval","condition":"code submission","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"obtain\" for approval within these source conditions: code submission, and retains evidence.","doesNotMeetRule":"employees omits the required action \"obtain\" for approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-f7127b76dffb2120156d@5c3b1bf2c0cd54c4","id":"REQ-f7127b76dffb2120156d","version":"5c3b1bf2c0cd54c4","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 27(1)","statement":"Covered high-risk AI deployers must assess fundamental rights impacts","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 27(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Covered high-risk AI deployers","modality":"must","action":"assess","object":"fundamental rights impacts","condition":"Specified public bodies and private public-service deployers","exception":"Scope exclusions and applicability date require review","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered high-risk AI deployers performs the required action \"assess\" for fundamental rights impacts within these source conditions: Specified public bodies and private public-service deployers, and retains evidence.","doesNotMeetRule":"Covered high-risk AI deployers omits the required action \"assess\" for fundamental rights impacts while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-f80f8ffa2c639482b509@77a7de8daa45def1","id":"REQ-f80f8ffa2c639482b509","version":"77a7de8daa45def1","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Map 3.5","statement":"AI governance owners should define human oversight processes","family":"Human oversight","body":{"sourceId":"nist-ai-rmf-1","control":"Map 3.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"human oversight processes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for human oversight processes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for human oversight processes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-f93a18bb1ab3c8736a53@6fe19328547cb66a","id":"REQ-f93a18bb1ab3c8736a53","version":"6fe19328547cb66a","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"4(e)(i)","statement":"Covered AI information system must receive authorization to operate","family":"Governance","body":{"sourceId":"omb-m-25-22","control":"4(e)(i)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=11","actor":"Covered AI information system","modality":"must","action":"receive","object":"authorization to operate","condition":"Operated by or for an agency","exception":null,"timing":"Before deployment","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered AI information system performs the required action \"receive\" for authorization to operate within these source conditions: Operated by or for an agency, and retains evidence.","doesNotMeetRule":"Covered AI information system omits the required action \"receive\" for authorization to operate while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-fa044b36248db1b6f637@caa218387d7a2c2b","id":"REQ-fa044b36248db1b6f637","version":"caa218387d7a2c2b","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"4(b)(ii)","statement":"Covered agency must complete AI impact assessment","family":"Governance","body":{"sourceId":"omb-m-25-21","control":"4(b)(ii)","sourceVersion":"M-25-21","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf#page=16","actor":"Covered agency","modality":"must","action":"complete","object":"AI impact assessment","condition":"High-impact use within §4 scope","exception":"Conditional pilot exemption or CAIO waiver under §4(a)","timing":"Before deployment","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"complete\" for AI impact assessment within these source conditions: High-impact use within §4 scope, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"complete\" for AI impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-fbf883a316c6cf06eecf@0daa4d98bb777bc8","id":"REQ-fbf883a316c6cf06eecf","version":"0daa4d98bb777bc8","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Measure 1.3","statement":"AI governance owners should involve independent assessors in AI evaluation","family":"Evaluation","body":{"sourceId":"nist-ai-rmf-1","control":"Measure 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"involve","object":"independent assessors in AI evaluation","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"involve\" for independent assessors in AI evaluation within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"involve\" for independent assessors in AI evaluation. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-fd275359ec250a538470@041e81073695ed14","id":"REQ-fd275359ec250a538470","version":"041e81073695ed14","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 35(1)","statement":"Data controllers must perform a data-protection impact assessment","family":"Data & IP","body":{"sourceId":"eu-gdpr","control":"Article 35(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"perform","object":"a data-protection impact assessment","condition":"Processing likely to create high risk","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"perform\" for a data-protection impact assessment within these source conditions: Processing likely to create high risk, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"perform\" for a data-protection impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-fd9615e170a4f40b43f1@fcd2dc5b2f200c16","id":"REQ-fd9615e170a4f40b43f1","version":"fcd2dc5b2f200c16","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 5(1)(c)","statement":"AI operators must not apply prohibited social scoring","family":"Governance","body":{"sourceId":"eu-ai-act","control":"Article 5(1)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"apply","object":"prohibited social scoring","condition":"Unrelated-context or unjustified adverse treatment","exception":"Statutory elements must all be assessed","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"apply\" for prohibited social scoring while these conditions apply: Unrelated-context or unjustified adverse treatment.","doesNotMeetRule":"AI operators performs the prohibited action \"apply\" for prohibited social scoring while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-fe08756799955e635df7@53ff5a10a6e86415","id":"REQ-fe08756799955e635df7","version":"53ff5a10a6e86415","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Article 33(1)","statement":"Data controllers must notify the authority of qualifying personal-data breaches","family":"Privacy","body":{"sourceId":"eu-gdpr","control":"Article 33(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"notify","object":"the authority of qualifying personal-data breaches","condition":"Without undue delay and where feasible within 72 hours","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"notify\" for the authority of qualifying personal-data breaches within these source conditions: Without undue delay and where feasible within 72 hours, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"notify\" for the authority of qualifying personal-data breaches while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"REQ-ff3f355c32e9e443122e@00b393b0a74394cb","id":"REQ-ff3f355c32e9e443122e","version":"00b393b0a74394cb","kind":"requirement","lifecycle":"LEGACY_INTERPRETATION","title":"Manage 2.1","statement":"AI governance owners should consider viable non-AI alternatives","family":"Governance","body":{"sourceId":"nist-ai-rmf-1","control":"Manage 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"consider","object":"viable non-AI alternatives","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for viable non-AI alternatives within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for viable non-AI alternatives. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}},{"key":"AIR-0029859136@3d4d358d3575ab26","id":"AIR-0029859136","version":"3d4d358d3575ab26","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Perform required security assessments","statement":"Covered GenAI service providers must perform required security assessments.","family":"Security","body":{"legacy":{"id":"AIR-0029859136","version":2,"title":"Perform required security assessments","text":"Covered GenAI service providers must perform required security assessments.","topic":"Security","intent":"perform required security assessments","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 17","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"perform","object":"required security assessments","condition":"Services with public-opinion attributes or social mobilization capability","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"perform\" for required security assessments within these source conditions: Services with public-opinion attributes or social mobilization capability, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"perform\" for required security assessments while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves required security assessments. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: perform required security assessments.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"perform\" for required security assessments within these source conditions: Services with public-opinion attributes or social mobilization capability, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"perform\" for required security assessments while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-014E35D5FC@903aba701d5fd191","id":"AIR-014E35D5FC","version":"903aba701d5fd191","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Report unlawful content to competent authorities","statement":"Covered GenAI service providers must report unlawful content to competent authorities.","family":"Governance","body":{"legacy":{"id":"AIR-014E35D5FC","version":2,"title":"Report unlawful content to competent authorities","text":"Covered GenAI service providers must report unlawful content to competent authorities.","topic":"Governance","intent":"report unlawful content to competent authorities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 14","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"report","object":"unlawful content to competent authorities","condition":"When unlawful content is discovered","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"report\" for unlawful content to competent authorities within these source conditions: When unlawful content is discovered, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"report\" for unlawful content to competent authorities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves unlawful content to competent authorities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: report unlawful content to competent authorities.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"report\" for unlawful content to competent authorities within these source conditions: When unlawful content is discovered, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"report\" for unlawful content to competent authorities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-0156EA65AB@302d0c170dbf354c","id":"AIR-0156EA65AB","version":"302d0c170dbf354c","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Protect against solely automated significant decisions","statement":"Data controllers must protect against solely automated significant decisions.","family":"Governance","body":{"legacy":{"id":"AIR-0156EA65AB","version":2,"title":"Protect against solely automated significant decisions","text":"Data controllers must protect against solely automated significant decisions.","topic":"Governance","intent":"protect against solely automated significant decisions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 22(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"protect","object":"against solely automated significant decisions","condition":"Subject to Article 22 exceptions and safeguards","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"protect\" for against solely automated significant decisions within these source conditions: Subject to Article 22 exceptions and safeguards, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"protect\" for against solely automated significant decisions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves against solely automated significant decisions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect against solely automated significant decisions.","examples":{"meetsRule":"Data controllers performs the required action \"protect\" for against solely automated significant decisions within these source conditions: Subject to Article 22 exceptions and safeguards, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"protect\" for against solely automated significant decisions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-03619CE6CD@adca6df93b142c79","id":"AIR-03619CE6CD","version":"adca6df93b142c79","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Improve accuracy of generated content","statement":"Covered GenAI service providers must improve accuracy of generated content.","family":"Governance","body":{"legacy":{"id":"AIR-03619CE6CD","version":2,"title":"Improve accuracy of generated content","text":"Covered GenAI service providers must improve accuracy of generated content.","topic":"Governance","intent":"improve accuracy of generated content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(5)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"improve","object":"accuracy of generated content","condition":"According to service characteristics","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for accuracy of generated content within these source conditions: According to service characteristics, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for accuracy of generated content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves accuracy of generated content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: improve accuracy of generated content.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for accuracy of generated content within these source conditions: According to service characteristics, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for accuracy of generated content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-0370617F00@db2749549f56e03b","id":"AIR-0370617F00","version":"db2749549f56e03b","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Examine possible biases in datasets","statement":"High-risk AI providers must examine possible biases in datasets.","family":"Fairness","body":{"legacy":{"id":"AIR-0370617F00","version":2,"title":"Examine possible biases in datasets","text":"High-risk AI providers must examine possible biases in datasets.","topic":"Fairness","intent":"examine possible biases in datasets","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 10(2)(f)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"examine","object":"possible biases in datasets","condition":"Training, validation and testing data","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"examine\" for possible biases in datasets within these source conditions: Training, validation and testing data, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"examine\" for possible biases in datasets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves possible biases in datasets. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: examine possible biases in datasets.","examples":{"meetsRule":"High-risk AI providers performs the required action \"examine\" for possible biases in datasets within these source conditions: Training, validation and testing data, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"examine\" for possible biases in datasets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-04690263D1@a422dc4de9c630fa","id":"AIR-04690263D1","version":"a422dc4de9c630fa","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Integrate continual improvements into AI updates","statement":"AI governance owners should integrate continual improvements into AI updates.","family":"Governance","body":{"legacy":{"id":"AIR-04690263D1","version":2,"title":"Integrate continual improvements into AI updates","text":"AI governance owners should integrate continual improvements into AI updates.","topic":"Governance","intent":"integrate continual improvements into ai updates","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"integrate","object":"continual improvements into AI updates","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"integrate\" for continual improvements into AI updates within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"integrate\" for continual improvements into AI updates. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves continual improvements into AI updates. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: integrate continual improvements into AI updates.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"integrate\" for continual improvements into AI updates within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"integrate\" for continual improvements into AI updates. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-04955B1030@a3bb8bd27a5794a1","id":"AIR-04955B1030","version":"a3bb8bd27a5794a1","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Include diverse perspectives in AI risk decisions","statement":"AI governance owners should include diverse perspectives in AI risk decisions.","family":"Fairness","body":{"legacy":{"id":"AIR-04955B1030","version":2,"title":"Include diverse perspectives in AI risk decisions","text":"AI governance owners should include diverse perspectives in AI risk decisions.","topic":"Fairness","intent":"include diverse perspectives in ai risk decisions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"include","object":"diverse perspectives in AI risk decisions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"include\" for diverse perspectives in AI risk decisions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"include\" for diverse perspectives in AI risk decisions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves diverse perspectives in AI risk decisions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: include diverse perspectives in AI risk decisions.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"include\" for diverse perspectives in AI risk decisions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"include\" for diverse perspectives in AI risk decisions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-04A480E942@1fad5149884758b7","id":"AIR-04A480E942","version":"1fad5149884758b7","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Erase personal data when required","statement":"Data controllers must erase personal data when required.","family":"Privacy","body":{"legacy":{"id":"AIR-04A480E942","version":2,"title":"Erase personal data when required","text":"Data controllers must erase personal data when required.","topic":"Privacy","intent":"erase personal data when required","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 17(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"erase","object":"personal data when required","condition":"Subject to statutory exceptions","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"erase\" for personal data when required within these source conditions: Subject to statutory exceptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"erase\" for personal data when required while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal data when required. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: erase personal data when required.","examples":{"meetsRule":"Data controllers performs the required action \"erase\" for personal data when required within these source conditions: Subject to statutory exceptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"erase\" for personal data when required while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-08171EB6BD@275b6e07d9f31fe3","id":"AIR-08171EB6BD","version":"275b6e07d9f31fe3","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Achieve appropriate AI accuracy","statement":"High-risk AI providers must achieve appropriate AI accuracy.","family":"Governance","body":{"legacy":{"id":"AIR-08171EB6BD","version":2,"title":"Achieve appropriate AI accuracy","text":"High-risk AI providers must achieve appropriate AI accuracy.","topic":"Governance","intent":"achieve appropriate ai accuracy","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 15(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"achieve","object":"appropriate AI accuracy","condition":"Throughout high-risk AI lifecycle","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"achieve\" for appropriate AI accuracy within these source conditions: Throughout high-risk AI lifecycle, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"achieve\" for appropriate AI accuracy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves appropriate AI accuracy. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: achieve appropriate AI accuracy.","examples":{"meetsRule":"High-risk AI providers performs the required action \"achieve\" for appropriate AI accuracy within these source conditions: Throughout high-risk AI lifecycle, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"achieve\" for appropriate AI accuracy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-0865D3E990@af385593071ea4c8","id":"AIR-0865D3E990","version":"af385593071ea4c8","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Enable oversight personnel to interrupt high-risk AI","statement":"High-risk AI providers must enable oversight personnel to interrupt high-risk AI.","family":"Human oversight","body":{"legacy":{"id":"AIR-0865D3E990","version":2,"title":"Enable oversight personnel to interrupt high-risk AI","text":"High-risk AI providers must enable oversight personnel to interrupt high-risk AI.","topic":"Human oversight","intent":"enable oversight personnel to interrupt high risk ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 14(4)(e)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"oversight personnel to interrupt high-risk AI","condition":"When overseeing high-risk AI","exception":"Safe stop procedure","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to interrupt high-risk AI within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to interrupt high-risk AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves oversight personnel to interrupt high-risk AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable oversight personnel to interrupt high-risk AI.","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to interrupt high-risk AI within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to interrupt high-risk AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-0A0DBE76B1@7670d7e907c28472","id":"AIR-0A0DBE76B1","version":"7670d7e907c28472","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Establish transparent AI risk-management procedures","statement":"AI governance owners should establish transparent AI risk-management procedures.","family":"Transparency","body":{"legacy":{"id":"AIR-0A0DBE76B1","version":2,"title":"Establish transparent AI risk-management procedures","text":"AI governance owners should establish transparent AI risk-management procedures.","topic":"Transparency","intent":"establish transparent ai risk management procedures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"transparent AI risk-management procedures","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for transparent AI risk-management procedures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for transparent AI risk-management procedures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves transparent AI risk-management procedures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish transparent AI risk-management procedures.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for transparent AI risk-management procedures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for transparent AI risk-management procedures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-0AEC8A401C@b648927da35f5f88","id":"AIR-0AEC8A401C","version":"b648927da35f5f88","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Plan periodic AI risk-management reviews","statement":"AI governance owners should plan periodic AI risk-management reviews.","family":"Human oversight","body":{"legacy":{"id":"AIR-0AEC8A401C","version":2,"title":"Plan periodic AI risk-management reviews","text":"AI governance owners should plan periodic AI risk-management reviews.","topic":"Human oversight","intent":"plan periodic ai risk management reviews","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"plan","object":"periodic AI risk-management reviews","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for periodic AI risk-management reviews within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for periodic AI risk-management reviews. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves periodic AI risk-management reviews. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: plan periodic AI risk-management reviews.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for periodic AI risk-management reviews within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for periodic AI risk-management reviews. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-0BD6CF8CF8@290628708f099b2a","id":"AIR-0BD6CF8CF8","version":"290628708f099b2a","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Update published algorithmic impact assessments","statement":"Responsible senior federal officials must update published algorithmic impact assessments.","family":"Governance","body":{"legacy":{"id":"AIR-0BD6CF8CF8","version":2,"title":"Update published algorithmic impact assessments","text":"Responsible senior federal officials must update published algorithmic impact assessments.","topic":"Governance","intent":"update published algorithmic impact assessments","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.1.3","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"update","object":"published algorithmic impact assessments","condition":"Scheduled review and functionality or scope changes","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"update\" for published algorithmic impact assessments within these source conditions: Scheduled review and functionality or scope changes, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"update\" for published algorithmic impact assessments while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves published algorithmic impact assessments. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: update published algorithmic impact assessments.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"update\" for published algorithmic impact assessments within these source conditions: Scheduled review and functionality or scope changes, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"update\" for published algorithmic impact assessments while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-0CD56857BE@bfb7684b32e64d32","id":"AIR-0CD56857BE","version":"bfb7684b32e64d32","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Evaluate data-labeling quality","statement":"Covered GenAI service providers must evaluate data-labeling quality.","family":"Transparency","body":{"legacy":{"id":"AIR-0CD56857BE","version":2,"title":"Evaluate data-labeling quality","text":"Covered GenAI service providers must evaluate data-labeling quality.","topic":"Transparency","intent":"evaluate data labeling quality","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 8","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"evaluate","object":"data-labeling quality","condition":"Data annotation during development","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"evaluate\" for data-labeling quality within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"evaluate\" for data-labeling quality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data-labeling quality. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate data-labeling quality.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"evaluate\" for data-labeling quality within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"evaluate\" for data-labeling quality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-0E39923F61@8a2f4d6b72dc1f31","id":"AIR-0E39923F61","version":"8a2f4d6b72dc1f31","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Establish a safety-first AI development culture","statement":"AI governance owners should establish a safety-first AI development culture.","family":"Safety","body":{"legacy":{"id":"AIR-0E39923F61","version":2,"title":"Establish a safety-first AI development culture","text":"AI governance owners should establish a safety-first AI development culture.","topic":"Safety","intent":"establish a safety first ai development culture","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"a safety-first AI development culture","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for a safety-first AI development culture within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for a safety-first AI development culture. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a safety-first AI development culture. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish a safety-first AI development culture.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for a safety-first AI development culture within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for a safety-first AI development culture. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-0EAF27F441@f0be17c777da998d","id":"AIR-0EAF27F441","version":"f0be17c777da998d","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Ensure dataset representativeness","statement":"High-risk AI providers must ensure dataset representativeness.","family":"Data & IP","body":{"legacy":{"id":"AIR-0EAF27F441","version":2,"title":"Ensure dataset representativeness","text":"High-risk AI providers must ensure dataset representativeness.","topic":"Data & IP","intent":"ensure dataset representativeness","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 10(3)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"ensure","object":"dataset representativeness","condition":"Intended purpose of high-risk AI","exception":"To the extent applicable","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for dataset representativeness within these source conditions: Intended purpose of high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for dataset representativeness while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves dataset representativeness. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure dataset representativeness.","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for dataset representativeness within these source conditions: Intended purpose of high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for dataset representativeness while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-1003DA2A0B@0300bded90f382ce","id":"AIR-1003DA2A0B","version":"0300bded90f382ce","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Covered AI information systems must receive agency authorization before deployment.","statement":"Covered AI information system must receive authorization to operate.","family":"Governance","body":{"legacy":{"id":"AIR-1003DA2A0B","version":2,"title":"Covered AI information systems must receive agency authorization before deployment.","text":"Covered AI information system must receive authorization to operate.","topic":"Governance","intent":"receive authorization to operate","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-22","control":"4(e)(i)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=11","actor":"Covered AI information system","modality":"must","action":"receive","object":"authorization to operate","condition":"Operated by or for an agency","exception":null,"timing":"Before deployment","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered AI information system performs the required action \"receive\" for authorization to operate within these source conditions: Operated by or for an agency, and retains evidence.","doesNotMeetRule":"Covered AI information system omits the required action \"receive\" for authorization to operate while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves authorization to operate. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: receive authorization to operate.","examples":{"meetsRule":"Covered AI information system performs the required action \"receive\" for authorization to operate within these source conditions: Operated by or for an agency, and retains evidence.","doesNotMeetRule":"Covered AI information system omits the required action \"receive\" for authorization to operate while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-10D05FADF9@6b35afe41ac0a5f4","id":"AIR-10D05FADF9","version":"6b35afe41ac0a5f4","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Plan responses to high-priority AI risks","statement":"AI governance owners should plan responses to high-priority AI risks.","family":"Governance","body":{"legacy":{"id":"AIR-10D05FADF9","version":2,"title":"Plan responses to high-priority AI risks","text":"AI governance owners should plan responses to high-priority AI risks.","topic":"Governance","intent":"plan responses to high priority ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"plan","object":"responses to high-priority AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for responses to high-priority AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for responses to high-priority AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves responses to high-priority AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: plan responses to high-priority AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for responses to high-priority AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for responses to high-priority AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-1237C81D58@059fc01b368e6947","id":"AIR-1237C81D58","version":"059fc01b368e6947","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Retain rights to test proprietary decision software","statement":"Responsible senior federal officials must retain rights to test proprietary decision software.","family":"Evaluation","body":{"legacy":{"id":"AIR-1237C81D58","version":2,"title":"Retain rights to test proprietary decision software","text":"Responsible senior federal officials must retain rights to test proprietary decision software.","topic":"Evaluation","intent":"retain rights to test proprietary decision software","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.6.1","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"retain","object":"rights to test proprietary decision software","condition":"Audits, investigations and other specified purposes","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"retain\" for rights to test proprietary decision software within these source conditions: Audits, investigations and other specified purposes, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"retain\" for rights to test proprietary decision software while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves rights to test proprietary decision software. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: retain rights to test proprietary decision software.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"retain\" for rights to test proprietary decision software within these source conditions: Audits, investigations and other specified purposes, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"retain\" for rights to test proprietary decision software while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-130AE1C465@9bfdc1d72bba8156","id":"AIR-130AE1C465","version":"9bfdc1d72bba8156","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Provide meaningful explanations of decisions","statement":"Responsible senior federal officials must provide meaningful explanations of decisions.","family":"Governance","body":{"legacy":{"id":"AIR-130AE1C465","version":2,"title":"Provide meaningful explanations of decisions","text":"Responsible senior federal officials must provide meaningful explanations of decisions.","topic":"Governance","intent":"provide meaningful explanations of decisions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.3","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"provide","object":"meaningful explanations of decisions","condition":"After decisions; Appendix C applies","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"provide\" for meaningful explanations of decisions within these source conditions: After decisions; Appendix C applies, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"provide\" for meaningful explanations of decisions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves meaningful explanations of decisions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide meaningful explanations of decisions.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"provide\" for meaningful explanations of decisions within these source conditions: After decisions; Appendix C applies, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"provide\" for meaningful explanations of decisions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-134DC94A5A@65d3e4c7bed571f0","id":"AIR-134DC94A5A","version":"65d3e4c7bed571f0","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Publish an algorithmic impact assessment","statement":"Responsible senior federal officials must publish an algorithmic impact assessment.","family":"Governance","body":{"legacy":{"id":"AIR-134DC94A5A","version":2,"title":"Publish an algorithmic impact assessment","text":"Responsible senior federal officials must publish an algorithmic impact assessment.","topic":"Governance","intent":"publish an algorithmic impact assessment","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.1.1","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"publish","object":"an algorithmic impact assessment","condition":"Before production; accessible Open Government publication","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"publish\" for an algorithmic impact assessment within these source conditions: Before production; accessible Open Government publication, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"publish\" for an algorithmic impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves an algorithmic impact assessment. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: publish an algorithmic impact assessment.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"publish\" for an algorithmic impact assessment within these source conditions: Before production; accessible Open Government publication, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"publish\" for an algorithmic impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-1394624FB2@17b1694d9f8b5889","id":"AIR-1394624FB2","version":"17b1694d9f8b5889","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Determine risk-management effort based on risk tolerance","statement":"AI governance owners should determine risk-management effort based on risk tolerance.","family":"Governance","body":{"legacy":{"id":"AIR-1394624FB2","version":2,"title":"Determine risk-management effort based on risk tolerance","text":"AI governance owners should determine risk-management effort based on risk tolerance.","topic":"Governance","intent":"determine risk management effort based on risk tolerance","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"determine","object":"risk-management effort based on risk tolerance","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"determine\" for risk-management effort based on risk tolerance within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"determine\" for risk-management effort based on risk tolerance. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves risk-management effort based on risk tolerance. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: determine risk-management effort based on risk tolerance.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"determine\" for risk-management effort based on risk tolerance within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"determine\" for risk-management effort based on risk tolerance. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-184958056C@a31940c1d965bcb1","id":"AIR-184958056C","version":"a31940c1d965bcb1","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Avoid prohibited special-category processing","statement":"Data controllers must avoid prohibited special-category processing.","family":"Governance","body":{"legacy":{"id":"AIR-184958056C","version":2,"title":"Avoid prohibited special-category processing","text":"Data controllers must avoid prohibited special-category processing.","topic":"Governance","intent":"avoid prohibited special category processing","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 9(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"avoid","object":"prohibited special-category processing","condition":"Unless an Article 9 exception applies","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"avoid\" for prohibited special-category processing within these source conditions: Unless an Article 9 exception applies, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"avoid\" for prohibited special-category processing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves prohibited special-category processing. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: avoid prohibited special-category processing.","examples":{"meetsRule":"Data controllers performs the required action \"avoid\" for prohibited special-category processing within these source conditions: Unless an Article 9 exception applies, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"avoid\" for prohibited special-category processing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-19AAD3D220@9039963c5253c129","id":"AIR-19AAD3D220","version":"9039963c5253c129","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Improve training-data quality","statement":"Covered GenAI service providers must improve training-data quality.","family":"Data & IP","body":{"legacy":{"id":"AIR-19AAD3D220","version":2,"title":"Improve training-data quality","text":"Covered GenAI service providers must improve training-data quality.","topic":"Data & IP","intent":"improve training data quality","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 7(4)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"improve","object":"training-data quality","condition":"Covered training activities","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for training-data quality within these source conditions: Covered training activities, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for training-data quality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves training-data quality. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: improve training-data quality.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for training-data quality within these source conditions: Covered training activities, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for training-data quality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-1A04293BCD@0d554e062cff5e8e","id":"AIR-1A04293BCD","version":"0d554e062cff5e8e","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Do not base academic or grading decisions solely on AI-detection output.","statement":"Instructors should-not rely detector output.","family":"Governance","body":{"legacy":{"id":"AIR-1A04293BCD","version":2,"title":"Do not base academic or grading decisions solely on AI-detection output.","text":"Instructors should-not rely detector output.","topic":"Governance","intent":"rely detector output","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"Teaching and Learning, detection paragraph","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"instructors","modality":"should-not","action":"rely","object":"detector output","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"instructors performs the required action \"rely\" for detector output within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"instructors omits the required action \"rely\" for detector output while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves detector output. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: rely detector output.","examples":{"meetsRule":"instructors performs the required action \"rely\" for detector output within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"instructors omits the required action \"rely\" for detector output while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-1AE367EE4E@f16ee6fc6066cd00","id":"AIR-1AE367EE4E","version":"f16ee6fc6066cd00","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Prevent minors from overreliance on GenAI","statement":"Covered GenAI service providers must prevent minors from overreliance on GenAI.","family":"Governance","body":{"legacy":{"id":"AIR-1AE367EE4E","version":2,"title":"Prevent minors from overreliance on GenAI","text":"Covered GenAI service providers must prevent minors from overreliance on GenAI.","topic":"Governance","intent":"prevent minors from overreliance on genai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 10","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"prevent","object":"minors from overreliance on GenAI","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"prevent\" for minors from overreliance on GenAI within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"prevent\" for minors from overreliance on GenAI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves minors from overreliance on GenAI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prevent minors from overreliance on GenAI.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"prevent\" for minors from overreliance on GenAI within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"prevent\" for minors from overreliance on GenAI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-1B927E390F@90b0968cc7bd920f","id":"AIR-1B927E390F","version":"90b0968cc7bd920f","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Retain automatically generated logs under their control","statement":"High-risk AI providers must retain automatically generated logs under their control.","family":"Governance","body":{"legacy":{"id":"AIR-1B927E390F","version":2,"title":"Retain automatically generated logs under their control","text":"High-risk AI providers must retain automatically generated logs under their control.","topic":"Governance","intent":"retain automatically generated logs under their control","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 19(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"retain","object":"automatically generated logs under their control","condition":"Covered high-risk systems","exception":"Applicable law and minimum statutory period","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"retain\" for automatically generated logs under their control within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"retain\" for automatically generated logs under their control while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves automatically generated logs under their control. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: retain automatically generated logs under their control.","examples":{"meetsRule":"High-risk AI providers performs the required action \"retain\" for automatically generated logs under their control within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"retain\" for automatically generated logs under their control while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-1BD7B65A31@f37aeab29f1a8c48","id":"AIR-1BD7B65A31","version":"f37aeab29f1a8c48","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Use town credentials for official approved-tool access.","statement":"Users must use town credentials.","family":"Governance","body":{"legacy":{"id":"AIR-1BD7B65A31","version":2,"title":"Use town credentials for official approved-tool access.","text":"Users must use town credentials.","topic":"Governance","intent":"use town credentials","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"brookline-genai","control":"Use, bullet 2","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"use","object":"town credentials","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for town credentials within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for town credentials while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves town credentials. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use town credentials.","examples":{"meetsRule":"users performs the required action \"use\" for town credentials within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for town credentials while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-1BE3C102BD@73c7232546f1b4e9","id":"AIR-1BE3C102BD","version":"73c7232546f1b4e9","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Chief AI Officers must annually certify that each minimum-practice waiver remains valid.","statement":"Chief AI Officer must certify waiver continuing validity.","family":"Evaluation","body":{"legacy":{"id":"AIR-1BE3C102BD","version":2,"title":"Chief AI Officers must annually certify that each minimum-practice waiver remains valid.","text":"Chief AI Officer must certify waiver continuing validity.","topic":"Evaluation","intent":"certify waiver continuing validity","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-21","control":"4(a)(ii)","sourceVersion":"M-25-21","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf#page=15","actor":"Chief AI Officer","modality":"must","action":"certify","object":"waiver continuing validity","condition":"In coordination with relevant officials","exception":null,"timing":"Annually","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Chief AI Officer performs the required action \"certify\" for waiver continuing validity within these source conditions: In coordination with relevant officials, and retains evidence.","doesNotMeetRule":"Chief AI Officer omits the required action \"certify\" for waiver continuing validity while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves waiver continuing validity. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: certify waiver continuing validity.","examples":{"meetsRule":"Chief AI Officer performs the required action \"certify\" for waiver continuing validity within these source conditions: In coordination with relevant officials, and retains evidence.","doesNotMeetRule":"Chief AI Officer omits the required action \"certify\" for waiver continuing validity while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-1C31FD0739@9438a27a13e45099","id":"AIR-1C31FD0739","version":"9438a27a13e45099","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should inventory categories of people whose data they process.","statement":"Organization should inventory affected person categories.","family":"Data & IP","body":{"legacy":{"id":"AIR-1C31FD0739","version":2,"title":"Organizations should inventory categories of people whose data they process.","text":"Organization should inventory affected person categories.","topic":"Data & IP","intent":"inventory affected person categories","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-privacy-1","control":"ID.IM-P3","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"affected person categories","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for affected person categories within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for affected person categories. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves affected person categories. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory affected person categories.","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for affected person categories within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for affected person categories. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-1DD5F7B4C4@6a3dcdef0815bf45","id":"AIR-1DD5F7B4C4","version":"6a3dcdef0815bf45","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Label generated images and videos","statement":"Covered GenAI service providers must label generated images and videos.","family":"Transparency","body":{"legacy":{"id":"AIR-1DD5F7B4C4","version":2,"title":"Label generated images and videos","text":"Covered GenAI service providers must label generated images and videos.","topic":"Transparency","intent":"label generated images and videos","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 12","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"label","object":"generated images and videos","condition":"As required by deep-synthesis provisions","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"label\" for generated images and videos within these source conditions: As required by deep-synthesis provisions, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"label\" for generated images and videos while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves generated images and videos. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: label generated images and videos.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"label\" for generated images and videos within these source conditions: As required by deep-synthesis provisions, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"label\" for generated images and videos while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-20C51AF468@80172ed3950e5a4e","id":"AIR-20C51AF468","version":"80172ed3950e5a4e","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Monitor AI operation in accordance with instructions","statement":"High-risk AI deployers must monitor AI operation in accordance with instructions.","family":"Governance","body":{"legacy":{"id":"AIR-20C51AF468","version":2,"title":"Monitor AI operation in accordance with instructions","text":"High-risk AI deployers must monitor AI operation in accordance with instructions.","topic":"Governance","intent":"monitor ai operation in accordance with instructions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 26(5)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"monitor","object":"AI operation in accordance with instructions","condition":"Covered high-risk AI use","exception":"Suspend and notify when statutory risk threshold is met","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"monitor\" for AI operation in accordance with instructions within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"monitor\" for AI operation in accordance with instructions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI operation in accordance with instructions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: monitor AI operation in accordance with instructions.","examples":{"meetsRule":"High-risk AI deployers performs the required action \"monitor\" for AI operation in accordance with instructions within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"monitor\" for AI operation in accordance with instructions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-21AFA15D02@a7811294bc65a07f","id":"AIR-21AFA15D02","version":"a7811294bc65a07f","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Covered agencies must update procurement procedures to include the required LLM terms.","statement":"Covered agency must update LLM procurement procedures.","family":"Procurement","body":{"legacy":{"id":"AIR-21AFA15D02","version":2,"title":"Covered agencies must update procurement procedures to include the required LLM terms.","text":"Covered agency must update LLM procurement procedures.","topic":"Procurement","intent":"update llm procurement procedures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-26-04","control":"Agency Actions (c)","sourceVersion":"M-26-04","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf#page=3","actor":"Covered agency","modality":"must","action":"update","object":"LLM procurement procedures","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":"By 2026-03-11","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"update\" for LLM procurement procedures within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"update\" for LLM procurement procedures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves LLM procurement procedures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: update LLM procurement procedures.","examples":{"meetsRule":"Covered agency performs the required action \"update\" for LLM procurement procedures within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"update\" for LLM procurement procedures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-22E9FC8F8B@0dadc34a046b3598","id":"AIR-22E9FC8F8B","version":"0dadc34a046b3598","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Establish complaint and reporting channels","statement":"Covered GenAI service providers must establish complaint and reporting channels.","family":"Governance","body":{"legacy":{"id":"AIR-22E9FC8F8B","version":2,"title":"Establish complaint and reporting channels","text":"Covered GenAI service providers must establish complaint and reporting channels.","topic":"Governance","intent":"establish complaint and reporting channels","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 15","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"establish","object":"complaint and reporting channels","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"establish\" for complaint and reporting channels within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"establish\" for complaint and reporting channels while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves complaint and reporting channels. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish complaint and reporting channels.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"establish\" for complaint and reporting channels within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"establish\" for complaint and reporting channels while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-231E86FCF1@f84f67f595b58984","id":"AIR-231E86FCF1","version":"f84f67f595b58984","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Establish a lawful basis for training on personal information","statement":"Covered GenAI service providers must establish a lawful basis for training on personal information.","family":"Privacy","body":{"legacy":{"id":"AIR-231E86FCF1","version":2,"title":"Establish a lawful basis for training on personal information","text":"Covered GenAI service providers must establish a lawful basis for training on personal information.","topic":"Privacy","intent":"establish a lawful basis for training on personal information","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 7(3)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"establish","object":"a lawful basis for training on personal information","condition":"Consent or another legal basis","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"establish\" for a lawful basis for training on personal information within these source conditions: Consent or another legal basis, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"establish\" for a lawful basis for training on personal information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a lawful basis for training on personal information. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish a lawful basis for training on personal information.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"establish\" for a lawful basis for training on personal information within these source conditions: Consent or another legal basis, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"establish\" for a lawful basis for training on personal information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-239800B9C4@ae7e87dc03c931ad","id":"AIR-239800B9C4","version":"ae7e87dc03c931ad","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should generate log records for continuous monitoring.","statement":"Organization should generate monitoring log records.","family":"Governance","body":{"legacy":{"id":"AIR-239800B9C4","version":2,"title":"Organizations should generate log records for continuous monitoring.","text":"Organization should generate monitoring log records.","topic":"Governance","intent":"generate monitoring log records","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-csf-2","control":"PR.PS-04","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=25","actor":"Organization","modality":"should","action":"generate","object":"monitoring log records","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"generate\" for monitoring log records within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"generate\" for monitoring log records. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves monitoring log records. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: generate monitoring log records.","examples":{"meetsRule":"Organization follows the recommendation to \"generate\" for monitoring log records within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"generate\" for monitoring log records. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-242001C9D0@d5bb3a8f15cc4543","id":"AIR-242001C9D0","version":"d5bb3a8f15cc4543","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Consult IT Services before using MSU credentials for AI products, including free tools.","statement":"Users must consult IT Services.","family":"Governance","body":{"legacy":{"id":"AIR-242001C9D0","version":2,"title":"Consult IT Services before using MSU credentials for AI products, including free tools.","text":"Users must consult IT Services.","topic":"Governance","intent":"consult it services","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"Procuring or Registering, paragraph 2","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must","action":"consult","object":"IT Services","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"consult\" for IT Services within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"consult\" for IT Services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves IT Services. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: consult IT Services.","examples":{"meetsRule":"users performs the required action \"consult\" for IT Services within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"consult\" for IT Services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-260ECC7519@acfa461478a2370b","id":"AIR-260ECC7519","version":"acfa461478a2370b","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Define the business value of AI use","statement":"AI governance owners should define the business value of AI use.","family":"Governance","body":{"legacy":{"id":"AIR-260ECC7519","version":2,"title":"Define the business value of AI use","text":"AI governance owners should define the business value of AI use.","topic":"Governance","intent":"define the business value of ai use","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"the business value of AI use","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for the business value of AI use within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for the business value of AI use. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves the business value of AI use. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define the business value of AI use.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for the business value of AI use within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for the business value of AI use. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-2711651405@ad3986b7b3466500","id":"AIR-2711651405","version":"ad3986b7b3466500","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should prevent nonprivileged users from performing privileged functions.","statement":"Organization should prevent nonprivileged execution of privileged functions.","family":"Governance","body":{"legacy":{"id":"AIR-2711651405","version":2,"title":"Organizations should prevent nonprivileged users from performing privileged functions.","text":"Organization should prevent nonprivileged execution of privileged functions.","topic":"Governance","intent":"prevent nonprivileged execution of privileged functions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-171-r3","control":"03.01.07(a)","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=21","actor":"Organization","modality":"should","action":"prevent","object":"nonprivileged execution of privileged functions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"prevent\" for nonprivileged execution of privileged functions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"prevent\" for nonprivileged execution of privileged functions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves nonprivileged execution of privileged functions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prevent nonprivileged execution of privileged functions.","examples":{"meetsRule":"Organization follows the recommendation to \"prevent\" for nonprivileged execution of privileged functions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"prevent\" for nonprivileged execution of privileged functions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-29043D921A@228d236f393a3d58","id":"AIR-29043D921A","version":"228d236f393a3d58","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Assign executive accountability for AI risk decisions","statement":"AI governance owners should assign executive accountability for AI risk decisions.","family":"Governance","body":{"legacy":{"id":"AIR-29043D921A","version":2,"title":"Assign executive accountability for AI risk decisions","text":"AI governance owners should assign executive accountability for AI risk decisions.","topic":"Governance","intent":"assign executive accountability for ai risk decisions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"assign","object":"executive accountability for AI risk decisions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assign\" for executive accountability for AI risk decisions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assign\" for executive accountability for AI risk decisions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves executive accountability for AI risk decisions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assign executive accountability for AI risk decisions.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assign\" for executive accountability for AI risk decisions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assign\" for executive accountability for AI risk decisions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-2ABDCD7376@06f5b6a210731a85","id":"AIR-2ABDCD7376","version":"06f5b6a210731a85","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Respect intellectual-property rights","statement":"Covered GenAI service providers must respect intellectual-property rights.","family":"Data & IP","body":{"legacy":{"id":"AIR-2ABDCD7376","version":2,"title":"Respect intellectual-property rights","text":"Covered GenAI service providers must respect intellectual-property rights.","topic":"Data & IP","intent":"respect intellectual property rights","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(3)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"respect","object":"intellectual-property rights","condition":"Covered service use and provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"respect\" for intellectual-property rights within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"respect\" for intellectual-property rights while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves intellectual-property rights. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: respect intellectual-property rights.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"respect\" for intellectual-property rights within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"respect\" for intellectual-property rights while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-2C5DD821EE@53e9a115afca361b","id":"AIR-2C5DD821EE","version":"53e9a115afca361b","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Apply mechanisms to sustain deployed AI value","statement":"AI governance owners should apply mechanisms to sustain deployed AI value.","family":"Governance","body":{"legacy":{"id":"AIR-2C5DD821EE","version":2,"title":"Apply mechanisms to sustain deployed AI value","text":"AI governance owners should apply mechanisms to sustain deployed AI value.","topic":"Governance","intent":"apply mechanisms to sustain deployed ai value","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"apply","object":"mechanisms to sustain deployed AI value","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"apply\" for mechanisms to sustain deployed AI value within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"apply\" for mechanisms to sustain deployed AI value. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves mechanisms to sustain deployed AI value. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: apply mechanisms to sustain deployed AI value.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"apply\" for mechanisms to sustain deployed AI value within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"apply\" for mechanisms to sustain deployed AI value. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-2C63EF342D@baf1d5a6e6a95322","id":"AIR-2C63EF342D","version":"baf1d5a6e6a95322","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Establish transparent GAI acceptable-use policies","statement":"AI governance owners should establish transparent GAI acceptable-use policies.","family":"Transparency","body":{"legacy":{"id":"AIR-2C63EF342D","version":2,"title":"Establish transparent GAI acceptable-use policies","text":"AI governance owners should establish transparent GAI acceptable-use policies.","topic":"Transparency","intent":"establish transparent gai acceptable use policies","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.4-002","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"transparent GAI acceptable-use policies","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for transparent GAI acceptable-use policies within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for transparent GAI acceptable-use policies. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves transparent GAI acceptable-use policies. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish transparent GAI acceptable-use policies.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for transparent GAI acceptable-use policies within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for transparent GAI acceptable-use policies. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-2D2E913625@fed32907e88d1244","id":"AIR-2D2E913625","version":"fed32907e88d1244","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Examine AI transparency risks","statement":"AI governance owners should examine AI transparency risks.","family":"Transparency","body":{"legacy":{"id":"AIR-2D2E913625","version":2,"title":"Examine AI transparency risks","text":"AI governance owners should examine AI transparency risks.","topic":"Transparency","intent":"examine ai transparency risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.8","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"examine","object":"AI transparency risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for AI transparency risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for AI transparency risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI transparency risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: examine AI transparency risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for AI transparency risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for AI transparency risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-2D3230CFEA@db9d6234e0c4c651","id":"AIR-2D3230CFEA","version":"db9d6234e0c4c651","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Ensure relevant input data","statement":"High-risk AI deployers must ensure relevant input data.","family":"Data & IP","body":{"legacy":{"id":"AIR-2D3230CFEA","version":2,"title":"Ensure relevant input data","text":"High-risk AI deployers must ensure relevant input data.","topic":"Data & IP","intent":"ensure relevant input data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 26(4)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"ensure","object":"relevant input data","condition":"Input data under deployer control","exception":"Sufficient representativeness","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"ensure\" for relevant input data within these source conditions: Input data under deployer control, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"ensure\" for relevant input data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves relevant input data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure relevant input data.","examples":{"meetsRule":"High-risk AI deployers performs the required action \"ensure\" for relevant input data within these source conditions: Input data under deployer control, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"ensure\" for relevant input data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-2D3F66EE87@a9f992bc13c78b6e","id":"AIR-2D3F66EE87","version":"a9f992bc13c78b6e","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Establish a quality-management system","statement":"High-risk AI providers must establish a quality-management system.","family":"Governance","body":{"legacy":{"id":"AIR-2D3F66EE87","version":2,"title":"Establish a quality-management system","text":"High-risk AI providers must establish a quality-management system.","topic":"Governance","intent":"establish a quality management system","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 17(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"establish","object":"a quality-management system","condition":"Covered high-risk systems","exception":"Proportionate to provider size","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for a quality-management system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for a quality-management system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a quality-management system. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish a quality-management system.","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for a quality-management system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for a quality-management system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-2EBCC14EEF@f8cd4a247e9eb702","id":"AIR-2EBCC14EEF","version":"f8cd4a247e9eb702","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Select metrics for prioritized AI risks","statement":"AI governance owners should select metrics for prioritized AI risks.","family":"Evaluation","body":{"legacy":{"id":"AIR-2EBCC14EEF","version":2,"title":"Select metrics for prioritized AI risks","text":"AI governance owners should select metrics for prioritized AI risks.","topic":"Evaluation","intent":"select metrics for prioritized ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"select","object":"metrics for prioritized AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"select\" for metrics for prioritized AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"select\" for metrics for prioritized AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves metrics for prioritized AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: select metrics for prioritized AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"select\" for metrics for prioritized AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"select\" for metrics for prioritized AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-2FB9BEA395@a3db1a2847eee5bc","id":"AIR-2FB9BEA395","version":"a3db1a2847eee5bc","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Define human oversight responsibilities","statement":"AI governance owners should define human oversight responsibilities.","family":"Human oversight","body":{"legacy":{"id":"AIR-2FB9BEA395","version":2,"title":"Define human oversight responsibilities","text":"AI governance owners should define human oversight responsibilities.","topic":"Human oversight","intent":"define human oversight responsibilities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"human oversight responsibilities","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for human oversight responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for human oversight responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves human oversight responsibilities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define human oversight responsibilities.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for human oversight responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for human oversight responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-32A014BA72@80809bb2d11324b7","id":"AIR-32A014BA72","version":"80809bb2d11324b7","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should inventory systems that process data.","statement":"Organization should inventory data-processing systems.","family":"Data & IP","body":{"legacy":{"id":"AIR-32A014BA72","version":2,"title":"Organizations should inventory systems that process data.","text":"Organization should inventory data-processing systems.","topic":"Data & IP","intent":"inventory data processing systems","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-privacy-1","control":"ID.IM-P1","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"data-processing systems","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for data-processing systems within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for data-processing systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data-processing systems. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory data-processing systems.","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for data-processing systems within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for data-processing systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-32BF4E5A3E@f2cce8e56cb500cf","id":"AIR-32BF4E5A3E","version":"f2cce8e56cb500cf","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Use only approved Commonwealth enterprise GenAI tools.","statement":"Users must use approved tools.","family":"Governance","body":{"legacy":{"id":"AIR-32BF4E5A3E","version":2,"title":"Use only approved Commonwealth enterprise GenAI tools.","text":"Users must use approved tools.","topic":"Governance","intent":"use approved tools","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.2, p.5","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must","action":"use","object":"approved tools","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for approved tools within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}},{"sourceId":"harvard-genai-guidelines","control":"Protect confidential data, paragraph 2","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"must","action":"use","object":"approved tools","condition":"Harvard confidential data","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for approved tools within these source conditions: Harvard confidential data, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves approved tools. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use approved tools.","examples":{"meetsRule":"users performs the required action \"use\" for approved tools within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-3307E11EB9@2700a775f8da9b21","id":"AIR-3307E11EB9","version":"2700a775f8da9b21","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"AI deployers should establish protections between the IT environment and AI system.","statement":"AI deployer should establish IT/AI boundary protections.","family":"Governance","body":{"legacy":{"id":"AIR-3307E11EB9","version":2,"title":"AI deployers should establish protections between the IT environment and AI system.","text":"AI deployer should establish IT/AI boundary protections.","topic":"Governance","intent":"establish it ai boundary protections","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Deployment architecture / boundaries","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"establish","object":"IT/AI boundary protections","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"establish\" for IT/AI boundary protections within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"establish\" for IT/AI boundary protections. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves IT/AI boundary protections. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish IT/AI boundary protections.","examples":{"meetsRule":"AI deployer follows the recommendation to \"establish\" for IT/AI boundary protections within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"establish\" for IT/AI boundary protections. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-33B04C2296@841ed4850964440b","id":"AIR-33B04C2296","version":"841ed4850964440b","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Demonstrate AI validity within tested conditions","statement":"AI governance owners should demonstrate AI validity within tested conditions.","family":"Evaluation","body":{"legacy":{"id":"AIR-33B04C2296","version":2,"title":"Demonstrate AI validity within tested conditions","text":"AI governance owners should demonstrate AI validity within tested conditions.","topic":"Evaluation","intent":"demonstrate ai validity within tested conditions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"demonstrate","object":"AI validity within tested conditions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"demonstrate\" for AI validity within tested conditions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"demonstrate\" for AI validity within tested conditions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI validity within tested conditions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: demonstrate AI validity within tested conditions.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"demonstrate\" for AI validity within tested conditions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"demonstrate\" for AI validity within tested conditions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-342C0977BB@761e80b20f52373a","id":"AIR-342C0977BB","version":"761e80b20f52373a","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Apply prohibited social scoring","statement":"AI operators must not apply prohibited social scoring.","family":"Governance","body":{"legacy":{"id":"AIR-342C0977BB","version":2,"title":"Apply prohibited social scoring","text":"AI operators must not apply prohibited social scoring.","topic":"Governance","intent":"apply prohibited social scoring","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"apply","object":"prohibited social scoring","condition":"Unrelated-context or unjustified adverse treatment","exception":"Statutory elements must all be assessed","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"apply\" for prohibited social scoring while these conditions apply: Unrelated-context or unjustified adverse treatment.","doesNotMeetRule":"AI operators performs the prohibited action \"apply\" for prohibited social scoring while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves prohibited social scoring. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: apply prohibited social scoring.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"apply\" for prohibited social scoring while these conditions apply: Unrelated-context or unjustified adverse treatment.","doesNotMeetRule":"AI operators performs the prohibited action \"apply\" for prohibited social scoring while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-347AC3B548@e04bac9bfaafb68a","id":"AIR-347AC3B548","version":"e04bac9bfaafb68a","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Establish mechanisms to deactivate unsafe AI systems","statement":"AI governance owners should establish mechanisms to deactivate unsafe AI systems.","family":"Safety","body":{"legacy":{"id":"AIR-347AC3B548","version":2,"title":"Establish mechanisms to deactivate unsafe AI systems","text":"AI governance owners should establish mechanisms to deactivate unsafe AI systems.","topic":"Safety","intent":"establish mechanisms to deactivate unsafe ai systems","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 2.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"mechanisms to deactivate unsafe AI systems","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for mechanisms to deactivate unsafe AI systems within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for mechanisms to deactivate unsafe AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves mechanisms to deactivate unsafe AI systems. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish mechanisms to deactivate unsafe AI systems.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for mechanisms to deactivate unsafe AI systems within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for mechanisms to deactivate unsafe AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-36FDB9AAD2@1e225e4043da0e0f","id":"AIR-36FDB9AAD2","version":"1e225e4043da0e0f","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Create facial recognition databases by untargeted scraping","statement":"AI operators must not create facial recognition databases by untargeted scraping.","family":"Data & IP","body":{"legacy":{"id":"AIR-36FDB9AAD2","version":2,"title":"Create facial recognition databases by untargeted scraping","text":"AI operators must not create facial recognition databases by untargeted scraping.","topic":"Data & IP","intent":"create facial recognition databases by untargeted scraping","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(e)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"create","object":"facial recognition databases by untargeted scraping","condition":"Internet or CCTV facial images","exception":"Assess statutory scope","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"create\" for facial recognition databases by untargeted scraping while these conditions apply: Internet or CCTV facial images.","doesNotMeetRule":"AI operators performs the prohibited action \"create\" for facial recognition databases by untargeted scraping while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves facial recognition databases by untargeted scraping. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: create facial recognition databases by untargeted scraping.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"create\" for facial recognition databases by untargeted scraping while these conditions apply: Internet or CCTV facial images.","doesNotMeetRule":"AI operators performs the prohibited action \"create\" for facial recognition databases by untargeted scraping while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-3867F71ADB@b352f8f186701b7b","id":"AIR-3867F71ADB","version":"b352f8f186701b7b","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Evaluate environmental impacts of AI training","statement":"AI governance owners should evaluate environmental impacts of AI training.","family":"Data & IP","body":{"legacy":{"id":"AIR-3867F71ADB","version":2,"title":"Evaluate environmental impacts of AI training","text":"AI governance owners should evaluate environmental impacts of AI training.","topic":"Data & IP","intent":"evaluate environmental impacts of ai training","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.12","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"environmental impacts of AI training","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for environmental impacts of AI training within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for environmental impacts of AI training. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves environmental impacts of AI training. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate environmental impacts of AI training.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for environmental impacts of AI training within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for environmental impacts of AI training. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-386B595FB5@7ef261ecda593467","id":"AIR-386B595FB5","version":"7ef261ecda593467","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Process personal data lawfully","statement":"Data controllers must process personal data lawfully.","family":"Privacy","body":{"legacy":{"id":"AIR-386B595FB5","version":2,"title":"Process personal data lawfully","text":"Data controllers must process personal data lawfully.","topic":"Privacy","intent":"process personal data lawfully","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(a)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"process","object":"personal data lawfully","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"process\" for personal data lawfully within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"process\" for personal data lawfully while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal data lawfully. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: process personal data lawfully.","examples":{"meetsRule":"Data controllers performs the required action \"process\" for personal data lawfully within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"process\" for personal data lawfully while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-3A61647692@f0f14c77d6718ec7","id":"AIR-3A61647692","version":"f0f14c77d6718ec7","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Assess third-party AI supply-chain risks","statement":"AI governance owners should assess third-party AI supply-chain risks.","family":"Procurement","body":{"legacy":{"id":"AIR-3A61647692","version":2,"title":"Assess third-party AI supply-chain risks","text":"AI governance owners should assess third-party AI supply-chain risks.","topic":"Procurement","intent":"assess third party ai supply chain risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 6.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"assess","object":"third-party AI supply-chain risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assess\" for third-party AI supply-chain risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assess\" for third-party AI supply-chain risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves third-party AI supply-chain risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assess third-party AI supply-chain risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assess\" for third-party AI supply-chain risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assess\" for third-party AI supply-chain risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-3B0B09F1A3@11413c778a47cf3c","id":"AIR-3B0B09F1A3","version":"11413c778a47cf3c","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Complete required algorithm filings","statement":"Covered GenAI service providers must complete required algorithm filings.","family":"Governance","body":{"legacy":{"id":"AIR-3B0B09F1A3","version":2,"title":"Complete required algorithm filings","text":"Covered GenAI service providers must complete required algorithm filings.","topic":"Governance","intent":"complete required algorithm filings","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 17","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"complete","object":"required algorithm filings","condition":"Applicable algorithm-filing provisions","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"complete\" for required algorithm filings within these source conditions: Applicable algorithm-filing provisions, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"complete\" for required algorithm filings while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves required algorithm filings. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: complete required algorithm filings.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"complete\" for required algorithm filings within these source conditions: Applicable algorithm-filing provisions, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"complete\" for required algorithm filings while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-3E2FF36AEB@c549587bacfe6983","id":"AIR-3E2FF36AEB","version":"c549587bacfe6983","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Provide instructions for use","statement":"High-risk AI providers must provide instructions for use.","family":"Governance","body":{"legacy":{"id":"AIR-3E2FF36AEB","version":2,"title":"Provide instructions for use","text":"High-risk AI providers must provide instructions for use.","topic":"Governance","intent":"provide instructions for use","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 13(2)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"provide","object":"instructions for use","condition":"Covered high-risk systems","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"provide\" for instructions for use within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"provide\" for instructions for use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves instructions for use. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide instructions for use.","examples":{"meetsRule":"High-risk AI providers performs the required action \"provide\" for instructions for use within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"provide\" for instructions for use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-4045E1AF90@0676fdd2f6b2d7dc","id":"AIR-4045E1AF90","version":"0676fdd2f6b2d7dc","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"List available appeal options for external AI decisions.","statement":"Agencies must list appeal options.","family":"Human oversight","body":{"legacy":{"id":"AIR-4045E1AF90","version":2,"title":"List available appeal options for external AI decisions.","text":"Agencies must list appeal options.","topic":"Human oversight","intent":"list appeal options","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"p.7, Transparency Requirements","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"list","object":"appeal options","condition":"external decisions","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"list\" for appeal options within these source conditions: external decisions, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"list\" for appeal options while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves appeal options. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: list appeal options.","examples":{"meetsRule":"agencies performs the required action \"list\" for appeal options within these source conditions: external decisions, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"list\" for appeal options while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-40C4A84CA0@d8e76ecbac03e5a2","id":"AIR-40C4A84CA0","version":"d8e76ecbac03e5a2","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Limit personal-data retention","statement":"Data controllers must limit personal-data retention.","family":"Privacy","body":{"legacy":{"id":"AIR-40C4A84CA0","version":2,"title":"Limit personal-data retention","text":"Data controllers must limit personal-data retention.","topic":"Privacy","intent":"limit personal data retention","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(e)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"limit","object":"personal-data retention","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"limit\" for personal-data retention within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"limit\" for personal-data retention while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal-data retention. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: limit personal-data retention.","examples":{"meetsRule":"Data controllers performs the required action \"limit\" for personal-data retention within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"limit\" for personal-data retention while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-413925FF98@6b2df5091a42ef9a","id":"AIR-413925FF98","version":"6b2df5091a42ef9a","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Map legal risks of AI components","statement":"AI governance owners should map legal risks of AI components.","family":"Governance","body":{"legacy":{"id":"AIR-413925FF98","version":2,"title":"Map legal risks of AI components","text":"AI governance owners should map legal risks of AI components.","topic":"Governance","intent":"map legal risks of ai components","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"map","object":"legal risks of AI components","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"map\" for legal risks of AI components within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"map\" for legal risks of AI components. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves legal risks of AI components. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: map legal risks of AI components.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"map\" for legal risks of AI components within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"map\" for legal risks of AI components. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-41D9F2CC95@665332b2581266bc","id":"AIR-41D9F2CC95","version":"665332b2581266bc","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Enter CUI/export-controlled data only into tools formally approved within the research enclave.","statement":"Users must use enclave-approved tools.","family":"Data & IP","body":{"legacy":{"id":"AIR-41D9F2CC95","version":2,"title":"Enter CUI/export-controlled data only into tools formally approved within the research enclave.","text":"Users must use enclave-approved tools.","topic":"Data & IP","intent":"use enclave approved tools","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"Non-Permissible Uses, final paragraph","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must","action":"use","object":"enclave-approved tools","condition":"CUI/export-controlled data","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for enclave-approved tools within these source conditions: CUI/export-controlled data, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for enclave-approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves enclave-approved tools. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use enclave-approved tools.","examples":{"meetsRule":"users performs the required action \"use\" for enclave-approved tools within these source conditions: CUI/export-controlled data, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for enclave-approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-423A77F29F@614fa00dae363777","id":"AIR-423A77F29F","version":"614fa00dae363777","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Maintain model technical documentation","statement":"GPAI model providers must maintain model technical documentation.","family":"Governance","body":{"legacy":{"id":"AIR-423A77F29F","version":2,"title":"Maintain model technical documentation","text":"GPAI model providers must maintain model technical documentation.","topic":"Governance","intent":"maintain model technical documentation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 53(1)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"maintain","object":"model technical documentation","condition":"Covered general-purpose AI models","exception":"Specified open-source exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"maintain\" for model technical documentation within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"maintain\" for model technical documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves model technical documentation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain model technical documentation.","examples":{"meetsRule":"GPAI model providers performs the required action \"maintain\" for model technical documentation within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"maintain\" for model technical documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-4306CEE8C8@b0544a675ee7f8b8","id":"AIR-4306CEE8C8","version":"b0544a675ee7f8b8","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document potential benefits of AI functionality","statement":"AI governance owners should document potential benefits of AI functionality.","family":"Governance","body":{"legacy":{"id":"AIR-4306CEE8C8","version":2,"title":"Document potential benefits of AI functionality","text":"AI governance owners should document potential benefits of AI functionality.","topic":"Governance","intent":"document potential benefits of ai functionality","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"potential benefits of AI functionality","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for potential benefits of AI functionality within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for potential benefits of AI functionality. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves potential benefits of AI functionality. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document potential benefits of AI functionality.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for potential benefits of AI functionality within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for potential benefits of AI functionality. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-4483D77189@872494c580e8a595","id":"AIR-4483D77189","version":"872494c580e8a595","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Prevent discriminatory generation","statement":"Covered GenAI service providers must prevent discriminatory generation.","family":"Fairness","body":{"legacy":{"id":"AIR-4483D77189","version":2,"title":"Prevent discriminatory generation","text":"Covered GenAI service providers must prevent discriminatory generation.","topic":"Fairness","intent":"prevent discriminatory generation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(2)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"prevent","object":"discriminatory generation","condition":"Algorithm design, training and service provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"prevent\" for discriminatory generation within these source conditions: Algorithm design, training and service provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"prevent\" for discriminatory generation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves discriminatory generation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prevent discriminatory generation.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"prevent\" for discriminatory generation within these source conditions: Algorithm design, training and service provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"prevent\" for discriminatory generation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-471437DC20@654377fb15657e58","id":"AIR-471437DC20","version":"654377fb15657e58","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Correct inaccurate personal data","statement":"Data controllers must correct inaccurate personal data.","family":"Privacy","body":{"legacy":{"id":"AIR-471437DC20","version":2,"title":"Correct inaccurate personal data","text":"Data controllers must correct inaccurate personal data.","topic":"Privacy","intent":"correct inaccurate personal data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 16","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"correct","object":"inaccurate personal data","condition":"On applicable data-subject request","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"correct\" for inaccurate personal data within these source conditions: On applicable data-subject request, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"correct\" for inaccurate personal data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves inaccurate personal data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: correct inaccurate personal data.","examples":{"meetsRule":"Data controllers performs the required action \"correct\" for inaccurate personal data within these source conditions: On applicable data-subject request, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"correct\" for inaccurate personal data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-4849919367@1edcc23cf35b43e4","id":"AIR-4849919367","version":"1edcc23cf35b43e4","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Complete state and agency GenAI training.","statement":"Employees must complete training.","family":"Data & IP","body":{"legacy":{"id":"AIR-4849919367","version":2,"title":"Complete state and agency GenAI training.","text":"Employees must complete training.","topic":"Data & IP","intent":"complete training","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 1","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"complete","object":"training","condition":"before use","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"complete\" for training within these source conditions: before use, and retains evidence.","doesNotMeetRule":"employees omits the required action \"complete\" for training while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves training. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: complete training.","examples":{"meetsRule":"employees performs the required action \"complete\" for training within these source conditions: before use, and retains evidence.","doesNotMeetRule":"employees omits the required action \"complete\" for training while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-48A3BA0A96@b263653f0a99c7ad","id":"AIR-48A3BA0A96","version":"b263653f0a99c7ad","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Select processors with sufficient guarantees","statement":"Data controllers must select processors with sufficient guarantees.","family":"Governance","body":{"legacy":{"id":"AIR-48A3BA0A96","version":2,"title":"Select processors with sufficient guarantees","text":"Data controllers must select processors with sufficient guarantees.","topic":"Governance","intent":"select processors with sufficient guarantees","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 28(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"select","object":"processors with sufficient guarantees","condition":"Use of processing providers","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"select\" for processors with sufficient guarantees within these source conditions: Use of processing providers, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"select\" for processors with sufficient guarantees while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves processors with sufficient guarantees. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: select processors with sufficient guarantees.","examples":{"meetsRule":"Data controllers performs the required action \"select\" for processors with sufficient guarantees within these source conditions: Use of processing providers, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"select\" for processors with sufficient guarantees while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-49A6A9BEE4@a4d44b5353204e1b","id":"AIR-49A6A9BEE4","version":"a4d44b5353204e1b","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Never enter passwords, API keys, or system-access secrets into GenAI.","statement":"Users must-not enter access secrets.","family":"Security","body":{"legacy":{"id":"AIR-49A6A9BEE4","version":2,"title":"Never enter passwords, API keys, or system-access secrets into GenAI.","text":"Users must-not enter access secrets.","topic":"Security","intent":"enter access secrets","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"brookline-genai","control":"Use, prohibited-data bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must-not","action":"enter","object":"access secrets","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"enter\" for access secrets within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for access secrets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves access secrets. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enter access secrets.","examples":{"meetsRule":"users performs the required action \"enter\" for access secrets within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for access secrets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-4AD720A286@fc42372987a55441","id":"AIR-4AD720A286","version":"fc42372987a55441","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Covered agencies must complete an impact assessment before deploying high-impact AI.","statement":"Covered agency must complete AI impact assessment.","family":"Governance","body":{"legacy":{"id":"AIR-4AD720A286","version":2,"title":"Covered agencies must complete an impact assessment before deploying high-impact AI.","text":"Covered agency must complete AI impact assessment.","topic":"Governance","intent":"complete ai impact assessment","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-21","control":"4(b)(ii)","sourceVersion":"M-25-21","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf#page=16","actor":"Covered agency","modality":"must","action":"complete","object":"AI impact assessment","condition":"High-impact use within §4 scope","exception":"Conditional pilot exemption or CAIO waiver under §4(a)","timing":"Before deployment","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"complete\" for AI impact assessment within these source conditions: High-impact use within §4 scope, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"complete\" for AI impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI impact assessment. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: complete AI impact assessment.","examples":{"meetsRule":"Covered agency performs the required action \"complete\" for AI impact assessment within these source conditions: High-impact use within §4 scope, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"complete\" for AI impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-4D850F7FFA@e43b05ce5986a37b","id":"AIR-4D850F7FFA","version":"e43b05ce5986a37b","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document AI models for review.","statement":"Agencies must document models.","family":"Human oversight","body":{"legacy":{"id":"AIR-4D850F7FFA","version":2,"title":"Document AI models for review.","text":"Agencies must document models.","topic":"Human oversight","intent":"document models","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"p.5, Ethical Use","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"document","object":"models","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"document\" for models within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"document\" for models while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves models. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document models.","examples":{"meetsRule":"agencies performs the required action \"document\" for models within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"document\" for models while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-4DC94000A9@1d5863420bba9e58","id":"AIR-4DC94000A9","version":"1d5863420bba9e58","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"AI providers should control the data their AI systems can access.","statement":"AI provider should control AI data access.","family":"Data & IP","body":{"legacy":{"id":"AIR-4DC94000A9","version":2,"title":"AI providers should control the data their AI systems can access.","text":"AI provider should control AI data access.","topic":"Data & IP","intent":"control ai data access","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / assets","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"control","object":"AI data access","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"control\" for AI data access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"control\" for AI data access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI data access. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: control AI data access.","examples":{"meetsRule":"AI provider follows the recommendation to \"control\" for AI data access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"control\" for AI data access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-4EA78BC0D9@790ae68a9c089b79","id":"AIR-4EA78BC0D9","version":"790ae68a9c089b79","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Assess the effectiveness of existing AI controls","statement":"AI governance owners should assess the effectiveness of existing AI controls.","family":"Governance","body":{"legacy":{"id":"AIR-4EA78BC0D9","version":2,"title":"Assess the effectiveness of existing AI controls","text":"AI governance owners should assess the effectiveness of existing AI controls.","topic":"Governance","intent":"assess the effectiveness of existing ai controls","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"assess","object":"the effectiveness of existing AI controls","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assess\" for the effectiveness of existing AI controls within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assess\" for the effectiveness of existing AI controls. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves the effectiveness of existing AI controls. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assess the effectiveness of existing AI controls.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assess\" for the effectiveness of existing AI controls within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assess\" for the effectiveness of existing AI controls. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-4EB0C43D04@c2e0b8c3781c5053","id":"AIR-4EB0C43D04","version":"c2e0b8c3781c5053","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Communicate AI incidents to affected stakeholders","statement":"AI governance owners should communicate AI incidents to affected stakeholders.","family":"Safety","body":{"legacy":{"id":"AIR-4EB0C43D04","version":2,"title":"Communicate AI incidents to affected stakeholders","text":"AI governance owners should communicate AI incidents to affected stakeholders.","topic":"Safety","intent":"communicate ai incidents to affected stakeholders","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 4.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"communicate","object":"AI incidents to affected stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"communicate\" for AI incidents to affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"communicate\" for AI incidents to affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI incidents to affected stakeholders. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: communicate AI incidents to affected stakeholders.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"communicate\" for AI incidents to affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"communicate\" for AI incidents to affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-4EE1F0E0DF@12b3a10bf8dfe8e7","id":"AIR-4EE1F0E0DF","version":"12b3a10bf8dfe8e7","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Report serious incidents to authorities","statement":"High-risk AI providers must report serious incidents to authorities.","family":"Safety","body":{"legacy":{"id":"AIR-4EE1F0E0DF","version":2,"title":"Report serious incidents to authorities","text":"High-risk AI providers must report serious incidents to authorities.","topic":"Safety","intent":"report serious incidents to authorities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 73(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"report","object":"serious incidents to authorities","condition":"Covered high-risk systems","exception":"Statutory incident category and deadline review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"report\" for serious incidents to authorities within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"report\" for serious incidents to authorities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves serious incidents to authorities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: report serious incidents to authorities.","examples":{"meetsRule":"High-risk AI providers performs the required action \"report\" for serious incidents to authorities within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"report\" for serious incidents to authorities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-4FA53D5DDD@6bd3ff49f43409cc","id":"AIR-4FA53D5DDD","version":"6bd3ff49f43409cc","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Publish a training-content summary","statement":"GPAI model providers must publish a training-content summary.","family":"Data & IP","body":{"legacy":{"id":"AIR-4FA53D5DDD","version":2,"title":"Publish a training-content summary","text":"GPAI model providers must publish a training-content summary.","topic":"Data & IP","intent":"publish a training content summary","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 53(1)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"publish","object":"a training-content summary","condition":"Covered general-purpose AI models","exception":"AI Office template and transition provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"publish\" for a training-content summary within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"publish\" for a training-content summary while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a training-content summary. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: publish a training-content summary.","examples":{"meetsRule":"GPAI model providers performs the required action \"publish\" for a training-content summary within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"publish\" for a training-content summary while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-50088C8736@1fd711dd4abe9f75","id":"AIR-50088C8736","version":"1fd711dd4abe9f75","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Use lawfully sourced training data","statement":"Covered GenAI service providers must use lawfully sourced training data.","family":"Data & IP","body":{"legacy":{"id":"AIR-50088C8736","version":2,"title":"Use lawfully sourced training data","text":"Covered GenAI service providers must use lawfully sourced training data.","topic":"Data & IP","intent":"use lawfully sourced training data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 7(1)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"use","object":"lawfully sourced training data","condition":"Pretraining and fine-tuning","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"use\" for lawfully sourced training data within these source conditions: Pretraining and fine-tuning, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"use\" for lawfully sourced training data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves lawfully sourced training data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use lawfully sourced training data.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"use\" for lawfully sourced training data within these source conditions: Pretraining and fine-tuning, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"use\" for lawfully sourced training data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-504A6F5FAE@a53448cc80e7901a","id":"AIR-504A6F5FAE","version":"a53448cc80e7901a","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Protect user input and usage records","statement":"Covered GenAI service providers must protect user input and usage records.","family":"Governance","body":{"legacy":{"id":"AIR-504A6F5FAE","version":2,"title":"Protect user input and usage records","text":"Covered GenAI service providers must protect user input and usage records.","topic":"Governance","intent":"protect user input and usage records","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 11","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"protect","object":"user input and usage records","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for user input and usage records within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for user input and usage records while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves user input and usage records. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect user input and usage records.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for user input and usage records within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for user input and usage records while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-50B746363D@36a623ea31f9bbda","id":"AIR-50B746363D","version":"36a623ea31f9bbda","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Have humans validate outcomes for bias and unintended consequences.","statement":"Agencies must validate outcomes.","family":"Fairness","body":{"legacy":{"id":"AIR-50B746363D","version":2,"title":"Have humans validate outcomes for bias and unintended consequences.","text":"Agencies must validate outcomes.","topic":"Fairness","intent":"validate outcomes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"p.5, Ethical Use","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"validate","object":"outcomes","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"validate\" for outcomes within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"validate\" for outcomes while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves outcomes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: validate outcomes.","examples":{"meetsRule":"agencies performs the required action \"validate\" for outcomes within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"validate\" for outcomes while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-50E6F7AEC2@782d3ec5f5a25e1c","id":"AIR-50E6F7AEC2","version":"782d3ec5f5a25e1c","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Register proposed AI and obtain AITR/ISO, VITA/CIO, then Administration Secretary approval.","statement":"Agencies must obtain sequential approval.","family":"Security","body":{"legacy":{"id":"AIR-50E6F7AEC2","version":2,"title":"Register proposed AI and obtain AITR/ISO, VITA/CIO, then Administration Secretary approval.","text":"Agencies must obtain sequential approval.","topic":"Security","intent":"obtain sequential approval","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"p.6, Approval Workflow / Exemptions","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"obtain","object":"sequential approval","condition":"before deployment","exception":"security defense; standard-software embedded AI; higher-education research/instruction","timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"obtain\" for sequential approval within these source conditions: before deployment, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"obtain\" for sequential approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves sequential approval. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain sequential approval.","examples":{"meetsRule":"agencies performs the required action \"obtain\" for sequential approval within these source conditions: before deployment, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"obtain\" for sequential approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-54647B2218@04ec7c174b09443f","id":"AIR-54647B2218","version":"04ec7c174b09443f","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Perform a data-protection impact assessment","statement":"Data controllers must perform a data-protection impact assessment.","family":"Data & IP","body":{"legacy":{"id":"AIR-54647B2218","version":2,"title":"Perform a data-protection impact assessment","text":"Data controllers must perform a data-protection impact assessment.","topic":"Data & IP","intent":"perform a data protection impact assessment","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 35(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"perform","object":"a data-protection impact assessment","condition":"Processing likely to create high risk","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"perform\" for a data-protection impact assessment within these source conditions: Processing likely to create high risk, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"perform\" for a data-protection impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a data-protection impact assessment. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: perform a data-protection impact assessment.","examples":{"meetsRule":"Data controllers performs the required action \"perform\" for a data-protection impact assessment within these source conditions: Processing likely to create high risk, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"perform\" for a data-protection impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-584850ADDF@237be1194f0adc35","id":"AIR-584850ADDF","version":"237be1194f0adc35","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Enable data-subject access","statement":"Data controllers must enable data-subject access.","family":"Data & IP","body":{"legacy":{"id":"AIR-584850ADDF","version":2,"title":"Enable data-subject access","text":"Data controllers must enable data-subject access.","topic":"Data & IP","intent":"enable data subject access","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 15(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"enable","object":"data-subject access","condition":"Subject to statutory exceptions","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"enable\" for data-subject access within these source conditions: Subject to statutory exceptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"enable\" for data-subject access while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data-subject access. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable data-subject access.","examples":{"meetsRule":"Data controllers performs the required action \"enable\" for data-subject access within these source conditions: Subject to statutory exceptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"enable\" for data-subject access while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-587EDFB2DD@b8810ad503621000","id":"AIR-587EDFB2DD","version":"b8810ad503621000","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Consider risk tracking for difficult-to-measure risks","statement":"AI governance owners should consider risk tracking for difficult-to-measure risks.","family":"Evaluation","body":{"legacy":{"id":"AIR-587EDFB2DD","version":2,"title":"Consider risk tracking for difficult-to-measure risks","text":"AI governance owners should consider risk tracking for difficult-to-measure risks.","topic":"Evaluation","intent":"consider risk tracking for difficult to measure risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"consider","object":"risk tracking for difficult-to-measure risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for risk tracking for difficult-to-measure risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for risk tracking for difficult-to-measure risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves risk tracking for difficult-to-measure risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: consider risk tracking for difficult-to-measure risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for risk tracking for difficult-to-measure risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for risk tracking for difficult-to-measure risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-599AAF4DAB@1720a88a3cae6692","id":"AIR-599AAF4DAB","version":"1720a88a3cae6692","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Agree service rights and obligations with users","statement":"Covered GenAI service providers must agree service rights and obligations with users.","family":"Governance","body":{"legacy":{"id":"AIR-599AAF4DAB","version":2,"title":"Agree service rights and obligations with users","text":"Covered GenAI service providers must agree service rights and obligations with users.","topic":"Governance","intent":"agree service rights and obligations with users","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 9","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"agree","object":"service rights and obligations with users","condition":"Registered service users","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"agree\" for service rights and obligations with users within these source conditions: Registered service users, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"agree\" for service rights and obligations with users while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves service rights and obligations with users. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: agree service rights and obligations with users.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"agree\" for service rights and obligations with users within these source conditions: Registered service users, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"agree\" for service rights and obligations with users while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-59B6D94E34@f9b40f179c9acbff","id":"AIR-59B6D94E34","version":"f9b40f179c9acbff","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Software producers should gather vulnerability reports from users, acquirers and public sources.","statement":"Software producer should gather vulnerability reports.","family":"Security","body":{"legacy":{"id":"AIR-59B6D94E34","version":2,"title":"Software producers should gather vulnerability reports from users, acquirers and public sources.","text":"Software producer should gather vulnerability reports.","topic":"Security","intent":"gather vulnerability reports","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ssdf-1-1","control":"RV.1.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=25","actor":"Software producer","modality":"should","action":"gather","object":"vulnerability reports","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"gather\" for vulnerability reports within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"gather\" for vulnerability reports. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves vulnerability reports. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: gather vulnerability reports.","examples":{"meetsRule":"Software producer follows the recommendation to \"gather\" for vulnerability reports within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"gather\" for vulnerability reports. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-5C041B0CCA@7ea28a695e4aad1a","id":"AIR-5C041B0CCA","version":"7ea28a695e4aad1a","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document applicable AI legal requirements","statement":"AI governance owners should document applicable AI legal requirements.","family":"Governance","body":{"legacy":{"id":"AIR-5C041B0CCA","version":2,"title":"Document applicable AI legal requirements","text":"AI governance owners should document applicable AI legal requirements.","topic":"Governance","intent":"document applicable ai legal requirements","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"applicable AI legal requirements","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for applicable AI legal requirements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for applicable AI legal requirements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves applicable AI legal requirements. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document applicable AI legal requirements.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for applicable AI legal requirements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for applicable AI legal requirements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-5C638CD3DB@7aa35edd30765d47","id":"AIR-5C638CD3DB","version":"7aa35edd30765d47","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Maintain personal-data accuracy","statement":"Data controllers must maintain personal-data accuracy.","family":"Privacy","body":{"legacy":{"id":"AIR-5C638CD3DB","version":2,"title":"Maintain personal-data accuracy","text":"Data controllers must maintain personal-data accuracy.","topic":"Privacy","intent":"maintain personal data accuracy","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(d)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"maintain","object":"personal-data accuracy","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"maintain\" for personal-data accuracy within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"maintain\" for personal-data accuracy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal-data accuracy. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain personal-data accuracy.","examples":{"meetsRule":"Data controllers performs the required action \"maintain\" for personal-data accuracy within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"maintain\" for personal-data accuracy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-5C96C1D94B@47902f34b3a364f5","id":"AIR-5C96C1D94B","version":"47902f34b3a364f5","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Mark generated content in machine-readable form","statement":"Synthetic-content AI providers must mark generated content in machine-readable form.","family":"Governance","body":{"legacy":{"id":"AIR-5C96C1D94B","version":2,"title":"Mark generated content in machine-readable form","text":"Synthetic-content AI providers must mark generated content in machine-readable form.","topic":"Governance","intent":"mark generated content in machine readable form","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 50(2)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Synthetic-content AI providers","modality":"must","action":"mark","object":"generated content in machine-readable form","condition":"Covered synthetic text, audio, images or video","exception":"Standard editing and specified law-enforcement exceptions; transitions apply","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Synthetic-content AI providers performs the required action \"mark\" for generated content in machine-readable form within these source conditions: Covered synthetic text, audio, images or video, and retains evidence.","doesNotMeetRule":"Synthetic-content AI providers omits the required action \"mark\" for generated content in machine-readable form while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves generated content in machine-readable form. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: mark generated content in machine-readable form.","examples":{"meetsRule":"Synthetic-content AI providers performs the required action \"mark\" for generated content in machine-readable form within these source conditions: Covered synthetic text, audio, images or video, and retains evidence.","doesNotMeetRule":"Synthetic-content AI providers omits the required action \"mark\" for generated content in machine-readable form while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-5CE518437C@c4b0b36befd2d652","id":"AIR-5CE518437C","version":"c4b0b36befd2d652","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Improve transparency of GenAI services","statement":"Covered GenAI service providers must improve transparency of GenAI services.","family":"Transparency","body":{"legacy":{"id":"AIR-5CE518437C","version":2,"title":"Improve transparency of GenAI services","text":"Covered GenAI service providers must improve transparency of GenAI services.","topic":"Transparency","intent":"improve transparency of genai services","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(5)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"improve","object":"transparency of GenAI services","condition":"According to service characteristics","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for transparency of GenAI services within these source conditions: According to service characteristics, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for transparency of GenAI services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves transparency of GenAI services. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: improve transparency of GenAI services.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for transparency of GenAI services within these source conditions: According to service characteristics, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for transparency of GenAI services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-5D6EB58CC1@99e40328d1f59817","id":"AIR-5D6EB58CC1","version":"99e40328d1f59817","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Exploit vulnerabilities through harmful AI manipulation","statement":"AI operators must not exploit vulnerabilities through harmful AI manipulation.","family":"Security","body":{"legacy":{"id":"AIR-5D6EB58CC1","version":2,"title":"Exploit vulnerabilities through harmful AI manipulation","text":"AI operators must not exploit vulnerabilities through harmful AI manipulation.","topic":"Security","intent":"exploit vulnerabilities through harmful ai manipulation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(b)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"exploit","object":"vulnerabilities through harmful AI manipulation","condition":"Age, disability or specific social or economic situation","exception":"Statutory harm threshold applies","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"exploit\" for vulnerabilities through harmful AI manipulation while these conditions apply: Age, disability or specific social or economic situation.","doesNotMeetRule":"AI operators performs the prohibited action \"exploit\" for vulnerabilities through harmful AI manipulation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves vulnerabilities through harmful AI manipulation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: exploit vulnerabilities through harmful AI manipulation.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"exploit\" for vulnerabilities through harmful AI manipulation while these conditions apply: Age, disability or specific social or economic situation.","doesNotMeetRule":"AI operators performs the prohibited action \"exploit\" for vulnerabilities through harmful AI manipulation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-5D8AD7CDE4@25322c901b420703","id":"AIR-5D8AD7CDE4","version":"25322c901b420703","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Protect personal-information rights","statement":"Covered GenAI service providers must protect personal-information rights.","family":"Privacy","body":{"legacy":{"id":"AIR-5D8AD7CDE4","version":2,"title":"Protect personal-information rights","text":"Covered GenAI service providers must protect personal-information rights.","topic":"Privacy","intent":"protect personal information rights","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(4)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"protect","object":"personal-information rights","condition":"Covered service use and provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for personal-information rights within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for personal-information rights while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal-information rights. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect personal-information rights.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for personal-information rights within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for personal-information rights while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-5DE52C1C2C@b8589288940671eb","id":"AIR-5DE52C1C2C","version":"b8589288940671eb","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Minimize personal data collected","statement":"Data controllers must minimize personal data collected.","family":"Privacy","body":{"legacy":{"id":"AIR-5DE52C1C2C","version":2,"title":"Minimize personal data collected","text":"Data controllers must minimize personal data collected.","topic":"Privacy","intent":"minimize personal data collected","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(c)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"minimize","object":"personal data collected","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"minimize\" for personal data collected within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"minimize\" for personal data collected while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal data collected. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: minimize personal data collected.","examples":{"meetsRule":"Data controllers performs the required action \"minimize\" for personal data collected within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"minimize\" for personal data collected while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-5E618A5099@99b7ad5ea4ffbf96","id":"AIR-5E618A5099","version":"99b7ad5ea4ffbf96","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Provide safe and stable GenAI services","statement":"Covered GenAI service providers must provide safe and stable GenAI services.","family":"Governance","body":{"legacy":{"id":"AIR-5E618A5099","version":2,"title":"Provide safe and stable GenAI services","text":"Covered GenAI service providers must provide safe and stable GenAI services.","topic":"Governance","intent":"provide safe and stable genai services","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 13","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"provide","object":"safe and stable GenAI services","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"provide\" for safe and stable GenAI services within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"provide\" for safe and stable GenAI services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves safe and stable GenAI services. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide safe and stable GenAI services.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"provide\" for safe and stable GenAI services within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"provide\" for safe and stable GenAI services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-5EF003576B@fd8937807d4dd124","id":"AIR-5EF003576B","version":"fd8937807d4dd124","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Avoid meeting assistants except approved tools with contractual protections.","statement":"Users should-not use meeting assistants.","family":"Procurement","body":{"legacy":{"id":"AIR-5EF003576B","version":2,"title":"Avoid meeting assistants except approved tools with contractual protections.","text":"Users should-not use meeting assistants.","topic":"Procurement","intent":"use meeting assistants","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"harvard-genai-guidelines","control":"Use approved tools, bullet 2","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"should-not","action":"use","object":"meeting assistants","condition":"Harvard meetings","exception":"approved protected tools","timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for meeting assistants within these source conditions: Harvard meetings, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for meeting assistants while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves meeting assistants. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use meeting assistants.","examples":{"meetsRule":"users performs the required action \"use\" for meeting assistants within these source conditions: Harvard meetings, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for meeting assistants while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-5F6922C679@da9d666ec3ecbe6e","id":"AIR-5F6922C679","version":"da9d666ec3ecbe6e","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Use GenAI for coursework only with instructor permission.","statement":"Students must obtain permission.","family":"Governance","body":{"legacy":{"id":"AIR-5F6922C679","version":2,"title":"Use GenAI for coursework only with instructor permission.","text":"Students must obtain permission.","topic":"Governance","intent":"obtain permission","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"Teaching and Learning, opening paragraph","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"students","modality":"must","action":"obtain","object":"permission","condition":"coursework","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"students performs the required action \"obtain\" for permission within these source conditions: coursework, and retains evidence.","doesNotMeetRule":"students omits the required action \"obtain\" for permission while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves permission. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain permission.","examples":{"meetsRule":"students performs the required action \"obtain\" for permission within these source conditions: coursework, and retains evidence.","doesNotMeetRule":"students omits the required action \"obtain\" for permission while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-601E866E1A@caf69c88ed9bf9fc","id":"AIR-601E866E1A","version":"caf69c88ed9bf9fc","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Establish controls against prohibited GAI content","statement":"AI governance owners should establish controls against prohibited GAI content.","family":"Governance","body":{"legacy":{"id":"AIR-601E866E1A","version":2,"title":"Establish controls against prohibited GAI content","text":"AI governance owners should establish controls against prohibited GAI content.","topic":"Governance","intent":"establish controls against prohibited gai content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.4-001","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"controls against prohibited GAI content","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for controls against prohibited GAI content within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for controls against prohibited GAI content. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves controls against prohibited GAI content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish controls against prohibited GAI content.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for controls against prohibited GAI content within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for controls against prohibited GAI content. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-602BA32576@a69c70a20564200e","id":"AIR-602BA32576","version":"a69c70a20564200e","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"AI deployers should restrict access to model weights.","statement":"AI deployer should restrict model-weight access.","family":"Governance","body":{"legacy":{"id":"AIR-602BA32576","version":2,"title":"AI deployers should restrict access to model weights.","text":"AI deployer should restrict model-weight access.","topic":"Governance","intent":"restrict model weight access","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Summary / model weights","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"restrict","object":"model-weight access","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"restrict\" for model-weight access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"restrict\" for model-weight access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves model-weight access. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: restrict model-weight access.","examples":{"meetsRule":"AI deployer follows the recommendation to \"restrict\" for model-weight access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"restrict\" for model-weight access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-604F1B8C71@46ee19ff4fd8682a","id":"AIR-604F1B8C71","version":"46ee19ff4fd8682a","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Do not use state-designated high-risk GenAI tools.","statement":"Employees must-not use high-risk tools.","family":"Governance","body":{"legacy":{"id":"AIR-604F1B8C71","version":2,"title":"Do not use state-designated high-risk GenAI tools.","text":"Employees must-not use high-risk tools.","topic":"Governance","intent":"use high risk tools","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 2","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must-not","action":"use","object":"high-risk tools","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"use\" for high-risk tools within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"use\" for high-risk tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves high-risk tools. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use high-risk tools.","examples":{"meetsRule":"employees performs the required action \"use\" for high-risk tools within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"use\" for high-risk tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-63476788C2@c32c1f927a34ffb2","id":"AIR-63476788C2","version":"c32c1f927a34ffb2","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Ensure cybersecurity of high-risk AI","statement":"High-risk AI providers must ensure cybersecurity of high-risk AI.","family":"Security","body":{"legacy":{"id":"AIR-63476788C2","version":2,"title":"Ensure cybersecurity of high-risk AI","text":"High-risk AI providers must ensure cybersecurity of high-risk AI.","topic":"Security","intent":"ensure cybersecurity of high risk ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 15(5)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"ensure","object":"cybersecurity of high-risk AI","condition":"Against unauthorized third-party alteration","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for cybersecurity of high-risk AI within these source conditions: Against unauthorized third-party alteration, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for cybersecurity of high-risk AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves cybersecurity of high-risk AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure cybersecurity of high-risk AI.","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for cybersecurity of high-risk AI within these source conditions: Against unauthorized third-party alteration, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for cybersecurity of high-risk AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-634CB1FAE6@9c443d797f303d0a","id":"AIR-634CB1FAE6","version":"9c443d797f303d0a","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Train data-labeling personnel","statement":"Covered GenAI service providers must train data-labeling personnel.","family":"Transparency","body":{"legacy":{"id":"AIR-634CB1FAE6","version":2,"title":"Train data-labeling personnel","text":"Covered GenAI service providers must train data-labeling personnel.","topic":"Transparency","intent":"train data labeling personnel","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 8","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"train","object":"data-labeling personnel","condition":"Data annotation during development","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"train\" for data-labeling personnel within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"train\" for data-labeling personnel while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data-labeling personnel. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: train data-labeling personnel.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"train\" for data-labeling personnel within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"train\" for data-labeling personnel while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-635250368A@6c55b8ae37092884","id":"AIR-635250368A","version":"6c55b8ae37092884","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Stop generation of unlawful content","statement":"Covered GenAI service providers must stop generation of unlawful content.","family":"Governance","body":{"legacy":{"id":"AIR-635250368A","version":2,"title":"Stop generation of unlawful content","text":"Covered GenAI service providers must stop generation of unlawful content.","topic":"Governance","intent":"stop generation of unlawful content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 14","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"stop","object":"generation of unlawful content","condition":"When unlawful content is discovered","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"stop\" for generation of unlawful content within these source conditions: When unlawful content is discovered, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"stop\" for generation of unlawful content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves generation of unlawful content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: stop generation of unlawful content.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"stop\" for generation of unlawful content within these source conditions: When unlawful content is discovered, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"stop\" for generation of unlawful content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-64615EE538@7d73fe15bcc48eb4","id":"AIR-64615EE538","version":"7d73fe15bcc48eb4","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should keep their managed hardware inventory current.","statement":"Organization should maintain managed hardware inventory.","family":"Governance","body":{"legacy":{"id":"AIR-64615EE538","version":2,"title":"Organizations should keep their managed hardware inventory current.","text":"Organization should maintain managed hardware inventory.","topic":"Governance","intent":"maintain managed hardware inventory","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-csf-2","control":"ID.AM-01","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=23","actor":"Organization","modality":"should","action":"maintain","object":"managed hardware inventory","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"maintain\" for managed hardware inventory within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"maintain\" for managed hardware inventory. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves managed hardware inventory. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain managed hardware inventory.","examples":{"meetsRule":"Organization follows the recommendation to \"maintain\" for managed hardware inventory within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"maintain\" for managed hardware inventory. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-6486E8DBA4@a977535adfe8c5f9","id":"AIR-6486E8DBA4","version":"a977535adfe8c5f9","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should protect the confidentiality, integrity and availability of transmitted data.","statement":"Organization should protect transmitted data.","family":"Privacy","body":{"legacy":{"id":"AIR-6486E8DBA4","version":2,"title":"Organizations should protect the confidentiality, integrity and availability of transmitted data.","text":"Organization should protect transmitted data.","topic":"Privacy","intent":"protect transmitted data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-csf-2","control":"PR.DS-02","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=25","actor":"Organization","modality":"should","action":"protect","object":"transmitted data","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"protect\" for transmitted data within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"protect\" for transmitted data. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves transmitted data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect transmitted data.","examples":{"meetsRule":"Organization follows the recommendation to \"protect\" for transmitted data within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"protect\" for transmitted data. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-65283B4BFC@0734a37af474e127","id":"AIR-65283B4BFC","version":"0734a37af474e127","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Determine whether AI deployment should proceed","statement":"AI governance owners should determine whether AI deployment should proceed.","family":"Governance","body":{"legacy":{"id":"AIR-65283B4BFC","version":2,"title":"Determine whether AI deployment should proceed","text":"AI governance owners should determine whether AI deployment should proceed.","topic":"Governance","intent":"determine whether ai deployment should proceed","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"determine","object":"whether AI deployment should proceed","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"determine\" for whether AI deployment should proceed within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"determine\" for whether AI deployment should proceed. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves whether AI deployment should proceed. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: determine whether AI deployment should proceed.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"determine\" for whether AI deployment should proceed within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"determine\" for whether AI deployment should proceed. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-653ED4C38B@a19421791b38bd15","id":"AIR-653ED4C38B","version":"a19421791b38bd15","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Determine appropriate software licensing","statement":"Responsible senior federal officials must determine appropriate software licensing.","family":"Data & IP","body":{"legacy":{"id":"AIR-653ED4C38B","version":2,"title":"Determine appropriate software licensing","text":"Responsible senior federal officials must determine appropriate software licensing.","topic":"Data & IP","intent":"determine appropriate software licensing","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.4","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"determine","object":"appropriate software licensing","condition":"Including consideration of open source","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"determine\" for appropriate software licensing within these source conditions: Including consideration of open source, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"determine\" for appropriate software licensing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves appropriate software licensing. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: determine appropriate software licensing.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"determine\" for appropriate software licensing within these source conditions: Including consideration of open source, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"determine\" for appropriate software licensing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-65595252CE@0e47a820c6f27347","id":"AIR-65595252CE","version":"0e47a820c6f27347","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Keep sensitive information out of third-party tools unless MSU security explicitly approves.","statement":"Users must-not enter sensitive information.","family":"Privacy","body":{"legacy":{"id":"AIR-65595252CE","version":2,"title":"Keep sensitive information out of third-party tools unless MSU security explicitly approves.","text":"Users must-not enter sensitive information.","topic":"Privacy","intent":"enter sensitive information","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"Non-Permissible Uses, paragraph 3","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must-not","action":"enter","object":"sensitive information","condition":"non-MSU enterprise tools","exception":"explicit security approval","timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"enter\" for sensitive information within these source conditions: non-MSU enterprise tools, and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for sensitive information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves sensitive information. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enter sensitive information.","examples":{"meetsRule":"users performs the required action \"enter\" for sensitive information within these source conditions: non-MSU enterprise tools, and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for sensitive information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-6630D57F8E@2e89ffefec328e15","id":"AIR-6630D57F8E","version":"2e89ffefec328e15","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Ensure appropriate AI literacy","statement":"Providers and deployers must ensure appropriate AI literacy.","family":"Governance","body":{"legacy":{"id":"AIR-6630D57F8E","version":2,"title":"Ensure appropriate AI literacy","text":"Providers and deployers must ensure appropriate AI literacy.","topic":"Governance","intent":"ensure appropriate ai literacy","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 4","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Providers and deployers","modality":"must","action":"ensure","object":"appropriate AI literacy","condition":"Staff and persons operating AI on their behalf","exception":"Consider technical knowledge, experience, training and context","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Providers and deployers performs the required action \"ensure\" for appropriate AI literacy within these source conditions: Staff and persons operating AI on their behalf, and retains evidence.","doesNotMeetRule":"Providers and deployers omits the required action \"ensure\" for appropriate AI literacy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves appropriate AI literacy. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure appropriate AI literacy.","examples":{"meetsRule":"Providers and deployers performs the required action \"ensure\" for appropriate AI literacy within these source conditions: Staff and persons operating AI on their behalf, and retains evidence.","doesNotMeetRule":"Providers and deployers omits the required action \"ensure\" for appropriate AI literacy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-66E5FC0789@4a2300431d80ddac","id":"AIR-66E5FC0789","version":"4a2300431d80ddac","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Label town-used AI content conspicuously, describing review and editing.","statement":"Users must label AI content.","family":"Transparency","body":{"legacy":{"id":"AIR-66E5FC0789","version":2,"title":"Label town-used AI content conspicuously, describing review and editing.","text":"Users must label AI content.","topic":"Transparency","intent":"label ai content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"brookline-genai","control":"Use, transparency bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"label","object":"AI content","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"label\" for AI content within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"label\" for AI content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: label AI content.","examples":{"meetsRule":"users performs the required action \"label\" for AI content within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"label\" for AI content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-685E3BDEA7@f7b18353a9f38d68","id":"AIR-685E3BDEA7","version":"f7b18353a9f38d68","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Process personal-information rights requests","statement":"Covered GenAI service providers must process personal-information rights requests.","family":"Privacy","body":{"legacy":{"id":"AIR-685E3BDEA7","version":2,"title":"Process personal-information rights requests","text":"Covered GenAI service providers must process personal-information rights requests.","topic":"Privacy","intent":"process personal information rights requests","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 11","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"process","object":"personal-information rights requests","condition":"Lawful requests for access, correction or deletion","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"process\" for personal-information rights requests within these source conditions: Lawful requests for access, correction or deletion, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"process\" for personal-information rights requests while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal-information rights requests. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: process personal-information rights requests.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"process\" for personal-information rights requests within these source conditions: Lawful requests for access, correction or deletion, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"process\" for personal-information rights requests while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-687C1F2AA0@c86677a938736f82","id":"AIR-687C1F2AA0","version":"c86677a938736f82","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Publish intended GenAI audiences and uses","statement":"Covered GenAI service providers must publish intended GenAI audiences and uses.","family":"Governance","body":{"legacy":{"id":"AIR-687C1F2AA0","version":2,"title":"Publish intended GenAI audiences and uses","text":"Covered GenAI service providers must publish intended GenAI audiences and uses.","topic":"Governance","intent":"publish intended genai audiences and uses","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 10","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"publish","object":"intended GenAI audiences and uses","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"publish\" for intended GenAI audiences and uses within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"publish\" for intended GenAI audiences and uses while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves intended GenAI audiences and uses. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: publish intended GenAI audiences and uses.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"publish\" for intended GenAI audiences and uses within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"publish\" for intended GenAI audiences and uses while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-689F104CE2@0bd6e76036538bf1","id":"AIR-689F104CE2","version":"0bd6e76036538bf1","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Maintain records of processing activities","statement":"Data controllers must maintain records of processing activities.","family":"Governance","body":{"legacy":{"id":"AIR-689F104CE2","version":2,"title":"Maintain records of processing activities","text":"Data controllers must maintain records of processing activities.","topic":"Governance","intent":"maintain records of processing activities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 30(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"maintain","object":"records of processing activities","condition":"Applicable scope and exemptions","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"maintain\" for records of processing activities within these source conditions: Applicable scope and exemptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"maintain\" for records of processing activities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves records of processing activities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain records of processing activities.","examples":{"meetsRule":"Data controllers performs the required action \"maintain\" for records of processing activities within these source conditions: Applicable scope and exemptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"maintain\" for records of processing activities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-692200D867@2cf95dc9e58cedd1","id":"AIR-692200D867","version":"2cf95dc9e58cedd1","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document organizational goals for AI","statement":"AI governance owners should document organizational goals for AI.","family":"Governance","body":{"legacy":{"id":"AIR-692200D867","version":2,"title":"Document organizational goals for AI","text":"AI governance owners should document organizational goals for AI.","topic":"Governance","intent":"document organizational goals for ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"organizational goals for AI","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for organizational goals for AI within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for organizational goals for AI. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves organizational goals for AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document organizational goals for AI.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for organizational goals for AI within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for organizational goals for AI. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-69B1D0BD8A@60600a5b89d7c7bd","id":"AIR-69B1D0BD8A","version":"60600a5b89d7c7bd","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"AI providers should maintain the ability to restore assets to a known-good state.","statement":"AI provider should maintain known-good asset recovery.","family":"Safety","body":{"legacy":{"id":"AIR-69B1D0BD8A","version":2,"title":"AI providers should maintain the ability to restore assets to a known-good state.","text":"AI provider should maintain known-good asset recovery.","topic":"Safety","intent":"maintain known good asset recovery","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / assets","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"maintain","object":"known-good asset recovery","condition":"Compromise","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"maintain\" for known-good asset recovery within these conditions: Compromise.","doesNotMeetRule":"AI provider omits the recommended action \"maintain\" for known-good asset recovery. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves known-good asset recovery. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain known-good asset recovery.","examples":{"meetsRule":"AI provider follows the recommendation to \"maintain\" for known-good asset recovery within these conditions: Compromise.","doesNotMeetRule":"AI provider omits the recommended action \"maintain\" for known-good asset recovery. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-6A21A315BB@d5897846efcefb70","id":"AIR-6A21A315BB","version":"d5897846efcefb70","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document AI experimental design considerations","statement":"AI governance owners should document AI experimental design considerations.","family":"Governance","body":{"legacy":{"id":"AIR-6A21A315BB","version":2,"title":"Document AI experimental design considerations","text":"AI governance owners should document AI experimental design considerations.","topic":"Governance","intent":"document ai experimental design considerations","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI experimental design considerations","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI experimental design considerations within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI experimental design considerations. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI experimental design considerations. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI experimental design considerations.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI experimental design considerations within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI experimental design considerations. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-6BBD510385@c5d5a0a2782a143b","id":"AIR-6BBD510385","version":"c5d5a0a2782a143b","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Implement data protection by design","statement":"Data controllers must implement data protection by design.","family":"Data & IP","body":{"legacy":{"id":"AIR-6BBD510385","version":2,"title":"Implement data protection by design","text":"Data controllers must implement data protection by design.","topic":"Data & IP","intent":"implement data protection by design","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 25(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"implement","object":"data protection by design","condition":"Appropriate to processing risks","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"implement\" for data protection by design within these source conditions: Appropriate to processing risks, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"implement\" for data protection by design while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data protection by design. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: implement data protection by design.","examples":{"meetsRule":"Data controllers performs the required action \"implement\" for data protection by design within these source conditions: Appropriate to processing risks, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"implement\" for data protection by design while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-6C1ECA98A1@79971c442fa84f2e","id":"AIR-6C1ECA98A1","version":"79971c442fa84f2e","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Prepare technical documentation","statement":"High-risk AI providers must prepare technical documentation.","family":"Governance","body":{"legacy":{"id":"AIR-6C1ECA98A1","version":2,"title":"Prepare technical documentation","text":"High-risk AI providers must prepare technical documentation.","topic":"Governance","intent":"prepare technical documentation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 11(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"prepare","object":"technical documentation","condition":"Before market placement or service","exception":"Simplified forms may apply","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"prepare\" for technical documentation within these source conditions: Before market placement or service, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"prepare\" for technical documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves technical documentation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prepare technical documentation.","examples":{"meetsRule":"High-risk AI providers performs the required action \"prepare\" for technical documentation within these source conditions: Before market placement or service, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"prepare\" for technical documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-6CFD9FC4BD@f48d56c08a6188da","id":"AIR-6CFD9FC4BD","version":"f48d56c08a6188da","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should keep inventories of managed software, services and systems current.","statement":"Organization should maintain software, service and system inventories.","family":"Governance","body":{"legacy":{"id":"AIR-6CFD9FC4BD","version":2,"title":"Organizations should keep inventories of managed software, services and systems current.","text":"Organization should maintain software, service and system inventories.","topic":"Governance","intent":"maintain software service and system inventories","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-csf-2","control":"ID.AM-02","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=23","actor":"Organization","modality":"should","action":"maintain","object":"software, service and system inventories","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"maintain\" for software, service and system inventories within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"maintain\" for software, service and system inventories. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves software, service and system inventories. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain software, service and system inventories.","examples":{"meetsRule":"Organization follows the recommendation to \"maintain\" for software, service and system inventories within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"maintain\" for software, service and system inventories. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-6DAA5CD4FD@ec0680416b29fb99","id":"AIR-6DAA5CD4FD","version":"ec0680416b29fb99","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Inventory organizational generative AI systems","statement":"AI governance owners should inventory organizational generative AI systems.","family":"Governance","body":{"legacy":{"id":"AIR-6DAA5CD4FD","version":2,"title":"Inventory organizational generative AI systems","text":"AI governance owners should inventory organizational generative AI systems.","topic":"Governance","intent":"inventory organizational generative ai systems","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.6-001","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"inventory","object":"organizational generative AI systems","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for organizational generative AI systems within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for organizational generative AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves organizational generative AI systems. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory organizational generative AI systems.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for organizational generative AI systems within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for organizational generative AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-6E435F72F8@4d22d944b760bee5","id":"AIR-6E435F72F8","version":"4d22d944b760bee5","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"AI deployers should validate the AI system before deployment.","statement":"AI deployer should validate AI system.","family":"Evaluation","body":{"legacy":{"id":"AIR-6E435F72F8","version":2,"title":"AI deployers should validate the AI system before deployment.","text":"AI deployer should validate AI system.","topic":"Evaluation","intent":"validate ai system","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Summary / validation","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"validate","object":"AI system","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":"Before deployment","authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"validate\" for AI system within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"validate\" for AI system. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI system. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: validate AI system.","examples":{"meetsRule":"AI deployer follows the recommendation to \"validate\" for AI system within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"validate\" for AI system. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-6E499BCE84@df500105ee99c8b7","id":"AIR-6E499BCE84","version":"df500105ee99c8b7","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Establish mechanisms to appeal AI outcomes","statement":"AI governance owners should establish mechanisms to appeal AI outcomes.","family":"Human oversight","body":{"legacy":{"id":"AIR-6E499BCE84","version":2,"title":"Establish mechanisms to appeal AI outcomes","text":"AI governance owners should establish mechanisms to appeal AI outcomes.","topic":"Human oversight","intent":"establish mechanisms to appeal ai outcomes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 3.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"mechanisms to appeal AI outcomes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for mechanisms to appeal AI outcomes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for mechanisms to appeal AI outcomes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves mechanisms to appeal AI outcomes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish mechanisms to appeal AI outcomes.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for mechanisms to appeal AI outcomes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for mechanisms to appeal AI outcomes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-6F2EEB6462@e739d9d7e4daf8e5","id":"AIR-6F2EEB6462","version":"e739d9d7e4daf8e5","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Establish regular engagement with affected stakeholders","statement":"AI governance owners should establish regular engagement with affected stakeholders.","family":"Governance","body":{"legacy":{"id":"AIR-6F2EEB6462","version":2,"title":"Establish regular engagement with affected stakeholders","text":"AI governance owners should establish regular engagement with affected stakeholders.","topic":"Governance","intent":"establish regular engagement with affected stakeholders","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 5.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"regular engagement with affected stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for regular engagement with affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for regular engagement with affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves regular engagement with affected stakeholders. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish regular engagement with affected stakeholders.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for regular engagement with affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for regular engagement with affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-6F83A570B6@c5a86b6e888d1e7e","id":"AIR-6F83A570B6","version":"c5a86b6e888d1e7e","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"AI providers should protect sensitive logs against unauthorized access.","statement":"AI provider should protect sensitive logs.","family":"Privacy","body":{"legacy":{"id":"AIR-6F83A570B6","version":2,"title":"AI providers should protect sensitive logs against unauthorized access.","text":"AI provider should protect sensitive logs.","topic":"Privacy","intent":"protect sensitive logs","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / assets","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"protect","object":"sensitive logs","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"protect\" for sensitive logs within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"protect\" for sensitive logs. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves sensitive logs. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect sensitive logs.","examples":{"meetsRule":"AI provider follows the recommendation to \"protect\" for sensitive logs within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"protect\" for sensitive logs. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-70303212C7@78ebdd02d253a65e","id":"AIR-70303212C7","version":"78ebdd02d253a65e","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should document their authority to process personal information.","statement":"Organization should document PII processing authority.","family":"Privacy","body":{"legacy":{"id":"AIR-70303212C7","version":2,"title":"Organizations should document their authority to process personal information.","text":"Organization should document PII processing authority.","topic":"Privacy","intent":"document pii processing authority","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-53-r5","control":"PT-2(a)","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=257","actor":"Organization","modality":"should","action":"document","object":"PII processing authority","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"document\" for PII processing authority within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"document\" for PII processing authority. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves PII processing authority. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document PII processing authority.","examples":{"meetsRule":"Organization follows the recommendation to \"document\" for PII processing authority within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"document\" for PII processing authority. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-7265A37732@017a7c56129fae99","id":"AIR-7265A37732","version":"017a7c56129fae99","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should inventory the data actions performed by their systems.","statement":"Organization should inventory system data actions.","family":"Data & IP","body":{"legacy":{"id":"AIR-7265A37732","version":2,"title":"Organizations should inventory the data actions performed by their systems.","text":"Organization should inventory system data actions.","topic":"Data & IP","intent":"inventory system data actions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-privacy-1","control":"ID.IM-P4","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"system data actions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for system data actions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for system data actions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves system data actions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory system data actions.","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for system data actions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for system data actions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-727F5459C2@05d7396f20ccf349","id":"AIR-727F5459C2","version":"05d7396f20ccf349","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Covered agencies must use agency-defined data for independent AI evaluations.","statement":"Covered agency must use agency-defined evaluation data.","family":"Data & IP","body":{"legacy":{"id":"AIR-727F5459C2","version":2,"title":"Covered agencies must use agency-defined data for independent AI evaluations.","text":"Covered agency must use agency-defined evaluation data.","topic":"Data & IP","intent":"use agency defined evaluation data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-22","control":"4(d)(ii)(E)(I)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=10","actor":"Covered agency","modality":"must","action":"use","object":"agency-defined evaluation data","condition":"Independent evaluations","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"use\" for agency-defined evaluation data within these source conditions: Independent evaluations, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"use\" for agency-defined evaluation data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves agency-defined evaluation data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use agency-defined evaluation data.","examples":{"meetsRule":"Covered agency performs the required action \"use\" for agency-defined evaluation data within these source conditions: Independent evaluations, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"use\" for agency-defined evaluation data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-72DBAB9908@83ef03fd64caec83","id":"AIR-72DBAB9908","version":"83ef03fd64caec83","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Enable oversight personnel to interpret AI outputs appropriately","statement":"High-risk AI providers must enable oversight personnel to interpret AI outputs appropriately.","family":"Human oversight","body":{"legacy":{"id":"AIR-72DBAB9908","version":2,"title":"Enable oversight personnel to interpret AI outputs appropriately","text":"High-risk AI providers must enable oversight personnel to interpret AI outputs appropriately.","topic":"Human oversight","intent":"enable oversight personnel to interpret ai outputs appropriately","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 14(4)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"oversight personnel to interpret AI outputs appropriately","condition":"When overseeing high-risk AI","exception":"According to available tools","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to interpret AI outputs appropriately within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to interpret AI outputs appropriately while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves oversight personnel to interpret AI outputs appropriately. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable oversight personnel to interpret AI outputs appropriately.","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to interpret AI outputs appropriately within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to interpret AI outputs appropriately while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-746FA0104C@5f1458d4a3aacef2","id":"AIR-746FA0104C","version":"5f1458d4a3aacef2","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Monitor third-party AI risks","statement":"AI governance owners should monitor third-party AI risks.","family":"Procurement","body":{"legacy":{"id":"AIR-746FA0104C","version":2,"title":"Monitor third-party AI risks","text":"AI governance owners should monitor third-party AI risks.","topic":"Procurement","intent":"monitor third party ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"third-party AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for third-party AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for third-party AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves third-party AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: monitor third-party AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for third-party AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for third-party AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-75F300981F@dbac33d943ce135d","id":"AIR-75F300981F","version":"dbac33d943ce135d","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should determine their authority to process personal information.","statement":"Organization should determine PII processing authority.","family":"Privacy","body":{"legacy":{"id":"AIR-75F300981F","version":2,"title":"Organizations should determine their authority to process personal information.","text":"Organization should determine PII processing authority.","topic":"Privacy","intent":"determine pii processing authority","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-53-r5","control":"PT-2(a)","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=257","actor":"Organization","modality":"should","action":"determine","object":"PII processing authority","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"determine\" for PII processing authority within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"determine\" for PII processing authority. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves PII processing authority. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: determine PII processing authority.","examples":{"meetsRule":"Organization follows the recommendation to \"determine\" for PII processing authority within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"determine\" for PII processing authority. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-7899BD6734@a456d1f9da1f7505","id":"AIR-7899BD6734","version":"a456d1f9da1f7505","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Review and verify all GenAI output with relevant subject expertise.","statement":"Users must verify outputs.","family":"Human oversight","body":{"legacy":{"id":"AIR-7899BD6734","version":2,"title":"Review and verify all GenAI output with relevant subject expertise.","text":"Users must verify outputs.","topic":"Human oversight","intent":"verify outputs","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.2.3, p.6","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must","action":"verify","object":"outputs","condition":"Commonwealth business","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"verify\" for outputs within these source conditions: Commonwealth business, and retains evidence.","doesNotMeetRule":"users omits the required action \"verify\" for outputs while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves outputs. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: verify outputs.","examples":{"meetsRule":"users performs the required action \"verify\" for outputs within these source conditions: Commonwealth business, and retains evidence.","doesNotMeetRule":"users omits the required action \"verify\" for outputs while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-7939E9BF07@9a167fc297fb8774","id":"AIR-7939E9BF07","version":"9a167fc297fb8774","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Covered agencies must inventory AI use cases at least annually.","statement":"Covered agency must inventory AI use cases.","family":"Governance","body":{"legacy":{"id":"AIR-7939E9BF07","version":2,"title":"Covered agencies must inventory AI use cases at least annually.","text":"Covered agency must inventory AI use cases.","topic":"Governance","intent":"inventory ai use cases","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-21","control":"3(b)(v)","sourceVersion":"M-25-21","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf#page=12","actor":"Covered agency","modality":"must","action":"inventory","object":"AI use cases","condition":"Within the source scope; assess applicability before adoption.","exception":"DoD and Intelligence Community","timing":"At least annually","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"inventory\" for AI use cases within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"inventory\" for AI use cases while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI use cases. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory AI use cases.","examples":{"meetsRule":"Covered agency performs the required action \"inventory\" for AI use cases within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"inventory\" for AI use cases while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-79A1D26388@51c5488b7e041703","id":"AIR-79A1D26388","version":"51c5488b7e041703","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should enforce approved access permissions for CUI and system resources.","statement":"Organization should enforce approved CUI access permissions.","family":"Governance","body":{"legacy":{"id":"AIR-79A1D26388","version":2,"title":"Organizations should enforce approved access permissions for CUI and system resources.","text":"Organization should enforce approved CUI access permissions.","topic":"Governance","intent":"enforce approved cui access permissions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-171-r3","control":"03.01.02","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=18","actor":"Organization","modality":"should","action":"enforce","object":"approved CUI access permissions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"enforce\" for approved CUI access permissions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"enforce\" for approved CUI access permissions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves approved CUI access permissions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enforce approved CUI access permissions.","examples":{"meetsRule":"Organization follows the recommendation to \"enforce\" for approved CUI access permissions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"enforce\" for approved CUI access permissions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-7AA947C3E4@118c7450b632ede7","id":"AIR-7AA947C3E4","version":"118c7450b632ede7","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Software producers should store code with access limited by least privilege.","statement":"Software producer should store code.","family":"Governance","body":{"legacy":{"id":"AIR-7AA947C3E4","version":2,"title":"Software producers should store code with access limited by least privilege.","text":"Software producer should store code.","topic":"Governance","intent":"store code","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ssdf-1-1","control":"PS.1.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=18","actor":"Software producer","modality":"should","action":"store","object":"code","condition":"Least-privilege access","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"store\" for code within these conditions: Least-privilege access.","doesNotMeetRule":"Software producer omits the recommended action \"store\" for code. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves code. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: store code.","examples":{"meetsRule":"Software producer follows the recommendation to \"store\" for code within these conditions: Least-privilege access.","doesNotMeetRule":"Software producer omits the recommended action \"store\" for code. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-7B1A838FFF@e020695aeaedbd45","id":"AIR-7B1A838FFF","version":"e020695aeaedbd45","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document AI knowledge limitations","statement":"AI governance owners should document AI knowledge limitations.","family":"Governance","body":{"legacy":{"id":"AIR-7B1A838FFF","version":2,"title":"Document AI knowledge limitations","text":"AI governance owners should document AI knowledge limitations.","topic":"Governance","intent":"document ai knowledge limitations","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI knowledge limitations","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI knowledge limitations within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI knowledge limitations. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI knowledge limitations. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI knowledge limitations.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI knowledge limitations within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI knowledge limitations. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-7C668908A8@78cf8740a649a0f3","id":"AIR-7C668908A8","version":"78cf8740a649a0f3","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Software producers should give acquirers information for verifying release integrity.","statement":"Software producer should provide release-integrity verification information.","family":"Governance","body":{"legacy":{"id":"AIR-7C668908A8","version":2,"title":"Software producers should give acquirers information for verifying release integrity.","text":"Software producer should provide release-integrity verification information.","topic":"Governance","intent":"provide release integrity verification information","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ssdf-1-1","control":"PS.2.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=19","actor":"Software producer","modality":"should","action":"provide","object":"release-integrity verification information","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"provide\" for release-integrity verification information within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"provide\" for release-integrity verification information. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves release-integrity verification information. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide release-integrity verification information.","examples":{"meetsRule":"Software producer follows the recommendation to \"provide\" for release-integrity verification information within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"provide\" for release-integrity verification information. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-7F4EB9435F@004c59994b3cf4b5","id":"AIR-7F4EB9435F","version":"004c59994b3cf4b5","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Follow provider instructions for use","statement":"High-risk AI deployers must follow provider instructions for use.","family":"Governance","body":{"legacy":{"id":"AIR-7F4EB9435F","version":2,"title":"Follow provider instructions for use","text":"High-risk AI deployers must follow provider instructions for use.","topic":"Governance","intent":"follow provider instructions for use","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 26(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"follow","object":"provider instructions for use","condition":"Covered high-risk AI use","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"follow\" for provider instructions for use within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"follow\" for provider instructions for use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves provider instructions for use. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: follow provider instructions for use.","examples":{"meetsRule":"High-risk AI deployers performs the required action \"follow\" for provider instructions for use within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"follow\" for provider instructions for use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-7F72121E8B@b050cce0ee004acb","id":"AIR-7F72121E8B","version":"b050cce0ee004acb","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Present notices in plain language","statement":"Responsible senior federal officials must present notices in plain language.","family":"Transparency","body":{"legacy":{"id":"AIR-7F72121E8B","version":2,"title":"Present notices in plain language","text":"Responsible senior federal officials must present notices in plain language.","topic":"Transparency","intent":"present notices in plain language","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.2","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"present","object":"notices in plain language","condition":"Prominently in service channels","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"present\" for notices in plain language within these source conditions: Prominently in service channels, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"present\" for notices in plain language while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves notices in plain language. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: present notices in plain language.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"present\" for notices in plain language within these source conditions: Prominently in service channels, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"present\" for notices in plain language while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-8014471E79@cd2299a5772a4c71","id":"AIR-8014471E79","version":"cd2299a5772a4c71","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should prevent unauthorized software execution.","statement":"Organization should prevent unauthorized software execution.","family":"Governance","body":{"legacy":{"id":"AIR-8014471E79","version":2,"title":"Organizations should prevent unauthorized software execution.","text":"Organization should prevent unauthorized software execution.","topic":"Governance","intent":"prevent unauthorized software execution","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-csf-2","control":"PR.PS-05","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=25","actor":"Organization","modality":"should","action":"prevent","object":"unauthorized software execution","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"prevent\" for unauthorized software execution within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"prevent\" for unauthorized software execution. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves unauthorized software execution. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prevent unauthorized software execution.","examples":{"meetsRule":"Organization follows the recommendation to \"prevent\" for unauthorized software execution within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"prevent\" for unauthorized software execution. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-80606F42F7@b2d872cf597227e9","id":"AIR-80606F42F7","version":"b2d872cf597227e9","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Implement appropriate data security measures","statement":"Data controllers must implement appropriate data security measures.","family":"Security","body":{"legacy":{"id":"AIR-80606F42F7","version":2,"title":"Implement appropriate data security measures","text":"Data controllers must implement appropriate data security measures.","topic":"Security","intent":"implement appropriate data security measures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 32(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"implement","object":"appropriate data security measures","condition":"Appropriate to processing risks","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"implement\" for appropriate data security measures within these source conditions: Appropriate to processing risks, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"implement\" for appropriate data security measures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves appropriate data security measures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: implement appropriate data security measures.","examples":{"meetsRule":"Data controllers performs the required action \"implement\" for appropriate data security measures within these source conditions: Appropriate to processing risks, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"implement\" for appropriate data security measures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-8312DD76DB@0295ab913e4e3e62","id":"AIR-8312DD76DB","version":"0295ab913e4e3e62","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Establish contingency procedures for third-party failures","statement":"AI governance owners should establish contingency procedures for third-party failures.","family":"Procurement","body":{"legacy":{"id":"AIR-8312DD76DB","version":2,"title":"Establish contingency procedures for third-party failures","text":"AI governance owners should establish contingency procedures for third-party failures.","topic":"Procurement","intent":"establish contingency procedures for third party failures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 6.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"contingency procedures for third-party failures","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for contingency procedures for third-party failures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for contingency procedures for third-party failures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves contingency procedures for third-party failures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish contingency procedures for third-party failures.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for contingency procedures for third-party failures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for contingency procedures for third-party failures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-837D00B454@58d1236be88d2c69","id":"AIR-837D00B454","version":"58d1236be88d2c69","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Provide documentation to downstream system providers","statement":"GPAI model providers must provide documentation to downstream system providers.","family":"Governance","body":{"legacy":{"id":"AIR-837D00B454","version":2,"title":"Provide documentation to downstream system providers","text":"GPAI model providers must provide documentation to downstream system providers.","topic":"Governance","intent":"provide documentation to downstream system providers","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 53(1)(b)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"provide","object":"documentation to downstream system providers","condition":"Covered general-purpose AI models","exception":"Specified open-source exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"provide\" for documentation to downstream system providers within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"provide\" for documentation to downstream system providers while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves documentation to downstream system providers. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide documentation to downstream system providers.","examples":{"meetsRule":"GPAI model providers performs the required action \"provide\" for documentation to downstream system providers within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"provide\" for documentation to downstream system providers while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-8530787112@ba8fd4d18125f749","id":"AIR-8530787112","version":"ba8fd4d18125f749","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Disclose deepfake generation or manipulation","statement":"AI deployers must disclose deepfake generation or manipulation.","family":"Transparency","body":{"legacy":{"id":"AIR-8530787112","version":2,"title":"Disclose deepfake generation or manipulation","text":"AI deployers must disclose deepfake generation or manipulation.","topic":"Transparency","intent":"disclose deepfake generation or manipulation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 50(4)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI deployers","modality":"must","action":"disclose","object":"deepfake generation or manipulation","condition":"Covered synthetic media","exception":"Artistic and specified law-enforcement treatment applies","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployers performs the required action \"disclose\" for deepfake generation or manipulation within these source conditions: Covered synthetic media, and retains evidence.","doesNotMeetRule":"AI deployers omits the required action \"disclose\" for deepfake generation or manipulation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves deepfake generation or manipulation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: disclose deepfake generation or manipulation.","examples":{"meetsRule":"AI deployers performs the required action \"disclose\" for deepfake generation or manipulation within these source conditions: Covered synthetic media, and retains evidence.","doesNotMeetRule":"AI deployers omits the required action \"disclose\" for deepfake generation or manipulation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-8566190520@7d33916dd6f567ff","id":"AIR-8566190520","version":"7d33916dd6f567ff","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"AI deployers should require a threat model from the primary developer.","statement":"AI deployer should require developer threat model.","family":"Governance","body":{"legacy":{"id":"AIR-8566190520","version":2,"title":"AI deployers should require a threat model from the primary developer.","text":"AI deployer should require developer threat model.","topic":"Governance","intent":"require developer threat model","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Deployment governance / threat model","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"require","object":"developer threat model","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"require\" for developer threat model within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"require\" for developer threat model. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves developer threat model. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: require developer threat model.","examples":{"meetsRule":"AI deployer follows the recommendation to \"require\" for developer threat model within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"require\" for developer threat model. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-86AF529571@ccb86427e4aadc8a","id":"AIR-86AF529571","version":"ccb86427e4aadc8a","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Inform people they are interacting with AI","statement":"AI providers must inform people they are interacting with AI.","family":"Governance","body":{"legacy":{"id":"AIR-86AF529571","version":2,"title":"Inform people they are interacting with AI","text":"AI providers must inform people they are interacting with AI.","topic":"Governance","intent":"inform people they are interacting with ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 50(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI providers","modality":"must","action":"inform","object":"people they are interacting with AI","condition":"Direct interaction with natural persons","exception":"Obvious interaction and specified law-enforcement exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI providers performs the required action \"inform\" for people they are interacting with AI within these source conditions: Direct interaction with natural persons, and retains evidence.","doesNotMeetRule":"AI providers omits the required action \"inform\" for people they are interacting with AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves people they are interacting with AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inform people they are interacting with AI.","examples":{"meetsRule":"AI providers performs the required action \"inform\" for people they are interacting with AI within these source conditions: Direct interaction with natural persons, and retains evidence.","doesNotMeetRule":"AI providers omits the required action \"inform\" for people they are interacting with AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-87BEC56E72@d70d49b2d92c4378","id":"AIR-87BEC56E72","version":"d70d49b2d92c4378","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Explain AI outputs in their use context","statement":"AI governance owners should explain AI outputs in their use context.","family":"Transparency","body":{"legacy":{"id":"AIR-87BEC56E72","version":2,"title":"Explain AI outputs in their use context","text":"AI governance owners should explain AI outputs in their use context.","topic":"Transparency","intent":"explain ai outputs in their use context","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.9","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"explain","object":"AI outputs in their use context","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"explain\" for AI outputs in their use context within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"explain\" for AI outputs in their use context. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI outputs in their use context. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: explain AI outputs in their use context.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"explain\" for AI outputs in their use context within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"explain\" for AI outputs in their use context. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-8822957DD8@04ee6dbcff4c4b33","id":"AIR-8822957DD8","version":"04ee6dbcff4c4b33","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document AI risk-management responsibilities","statement":"AI governance owners should document AI risk-management responsibilities.","family":"Governance","body":{"legacy":{"id":"AIR-8822957DD8","version":2,"title":"Document AI risk-management responsibilities","text":"AI governance owners should document AI risk-management responsibilities.","topic":"Governance","intent":"document ai risk management responsibilities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI risk-management responsibilities","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risk-management responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risk-management responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI risk-management responsibilities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI risk-management responsibilities.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risk-management responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risk-management responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-8B497F4F74@731ecfa0018c376a","id":"AIR-8B497F4F74","version":"731ecfa0018c376a","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Prioritize treatment of documented AI risks","statement":"AI governance owners should prioritize treatment of documented AI risks.","family":"Governance","body":{"legacy":{"id":"AIR-8B497F4F74","version":2,"title":"Prioritize treatment of documented AI risks","text":"AI governance owners should prioritize treatment of documented AI risks.","topic":"Governance","intent":"prioritize treatment of documented ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"prioritize","object":"treatment of documented AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"prioritize\" for treatment of documented AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"prioritize\" for treatment of documented AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves treatment of documented AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prioritize treatment of documented AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"prioritize\" for treatment of documented AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"prioritize\" for treatment of documented AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-8B82635DEA@1d78eb894fae8a0f","id":"AIR-8B82635DEA","version":"1d78eb894fae8a0f","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Apply impact-level requirements from Appendix C","statement":"Responsible senior federal officials must apply impact-level requirements from Appendix C.","family":"Governance","body":{"legacy":{"id":"AIR-8B82635DEA","version":2,"title":"Apply impact-level requirements from Appendix C","text":"Responsible senior federal officials must apply impact-level requirements from Appendix C.","topic":"Governance","intent":"apply impact level requirements from appendix c","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.1.2","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"apply","object":"impact-level requirements from Appendix C","condition":"As determined by the assessment","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"apply\" for impact-level requirements from Appendix C within these source conditions: As determined by the assessment, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"apply\" for impact-level requirements from Appendix C while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves impact-level requirements from Appendix C. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: apply impact-level requirements from Appendix C.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"apply\" for impact-level requirements from Appendix C within these source conditions: As determined by the assessment, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"apply\" for impact-level requirements from Appendix C while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-8D76274A01@40d42229a0510505","id":"AIR-8D76274A01","version":"40d42229a0510505","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Obtain CIO and security-liaison approval before submitting existing state or proprietary code.","statement":"Employees must obtain approval.","family":"Security","body":{"legacy":{"id":"AIR-8D76274A01","version":2,"title":"Obtain CIO and security-liaison approval before submitting existing state or proprietary code.","text":"Employees must obtain approval.","topic":"Security","intent":"obtain approval","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, data sharing, bullet 3","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"obtain","object":"approval","condition":"code submission","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"obtain\" for approval within these source conditions: code submission, and retains evidence.","doesNotMeetRule":"employees omits the required action \"obtain\" for approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}},{"sourceId":"brookline-genai","control":"Use, bullet 1","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"obtain","object":"approval","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"obtain\" for approval within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves approval. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain approval.","examples":{"meetsRule":"employees performs the required action \"obtain\" for approval within these source conditions: code submission, and retains evidence.","doesNotMeetRule":"employees omits the required action \"obtain\" for approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-8E3444C5DD@24c0145c2464366a","id":"AIR-8E3444C5DD","version":"24c0145c2464366a","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Demonstrate compliance with data-protection principles","statement":"Data controllers must demonstrate compliance with data-protection principles.","family":"Data & IP","body":{"legacy":{"id":"AIR-8E3444C5DD","version":2,"title":"Demonstrate compliance with data-protection principles","text":"Data controllers must demonstrate compliance with data-protection principles.","topic":"Data & IP","intent":"demonstrate compliance with data protection principles","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(2)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"demonstrate","object":"compliance with data-protection principles","condition":"Controller accountability","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"demonstrate\" for compliance with data-protection principles within these source conditions: Controller accountability, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"demonstrate\" for compliance with data-protection principles while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves compliance with data-protection principles. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: demonstrate compliance with data-protection principles.","examples":{"meetsRule":"Data controllers performs the required action \"demonstrate\" for compliance with data-protection principles within these source conditions: Controller accountability, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"demonstrate\" for compliance with data-protection principles while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-8E51985BF0@1e5d0cfb9d125308","id":"AIR-8E51985BF0","version":"1e5d0cfb9d125308","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Inform people before AI makes decisions about them.","statement":"Agencies must notify affected people.","family":"Governance","body":{"legacy":{"id":"AIR-8E51985BF0","version":2,"title":"Inform people before AI makes decisions about them.","text":"Agencies must notify affected people.","topic":"Governance","intent":"notify affected people","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"pp.6–7, AI Disclaimers","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"notify","object":"affected people","condition":"citizen/business impact","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"notify\" for affected people within these source conditions: citizen/business impact, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"notify\" for affected people while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves affected people. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: notify affected people.","examples":{"meetsRule":"agencies performs the required action \"notify\" for affected people within these source conditions: citizen/business impact, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"notify\" for affected people while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-8EB0EC219E@b40bbbac8f211201","id":"AIR-8EB0EC219E","version":"b40bbbac8f211201","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Define operator proficiency requirements","statement":"AI governance owners should define operator proficiency requirements.","family":"Governance","body":{"legacy":{"id":"AIR-8EB0EC219E","version":2,"title":"Define operator proficiency requirements","text":"AI governance owners should define operator proficiency requirements.","topic":"Governance","intent":"define operator proficiency requirements","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 3.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"operator proficiency requirements","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for operator proficiency requirements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for operator proficiency requirements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves operator proficiency requirements. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define operator proficiency requirements.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for operator proficiency requirements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for operator proficiency requirements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-8EDD597B2C@f5caafd8854d2856","id":"AIR-8EDD597B2C","version":"f5caafd8854d2856","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Provide clear privacy information","statement":"Data controllers must provide clear privacy information.","family":"Privacy","body":{"legacy":{"id":"AIR-8EDD597B2C","version":2,"title":"Provide clear privacy information","text":"Data controllers must provide clear privacy information.","topic":"Privacy","intent":"provide clear privacy information","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 12(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"provide","object":"clear privacy information","condition":"Information to data subjects","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"provide\" for clear privacy information within these source conditions: Information to data subjects, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"provide\" for clear privacy information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves clear privacy information. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide clear privacy information.","examples":{"meetsRule":"Data controllers performs the required action \"provide\" for clear privacy information within these source conditions: Information to data subjects, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"provide\" for clear privacy information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-8F9AE0F269@a1d23a19bcf73815","id":"AIR-8F9AE0F269","version":"a1d23a19bcf73815","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Examine potential costs of AI errors","statement":"AI governance owners should examine potential costs of AI errors.","family":"Governance","body":{"legacy":{"id":"AIR-8F9AE0F269","version":2,"title":"Examine potential costs of AI errors","text":"AI governance owners should examine potential costs of AI errors.","topic":"Governance","intent":"examine potential costs of ai errors","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"examine","object":"potential costs of AI errors","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for potential costs of AI errors within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for potential costs of AI errors. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves potential costs of AI errors. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: examine potential costs of AI errors.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for potential costs of AI errors within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for potential costs of AI errors. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-8FFA25BD3B@f5e87ca6e56ca7ed","id":"AIR-8FFA25BD3B","version":"f5e87ca6e56ca7ed","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Obtain stakeholder input on unacceptable GAI use","statement":"AI governance owners should obtain stakeholder input on unacceptable GAI use.","family":"Governance","body":{"legacy":{"id":"AIR-8FFA25BD3B","version":2,"title":"Obtain stakeholder input on unacceptable GAI use","text":"AI governance owners should obtain stakeholder input on unacceptable GAI use.","topic":"Governance","intent":"obtain stakeholder input on unacceptable gai use","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.3-004","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"obtain","object":"stakeholder input on unacceptable GAI use","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"obtain\" for stakeholder input on unacceptable GAI use within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"obtain\" for stakeholder input on unacceptable GAI use. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves stakeholder input on unacceptable GAI use. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain stakeholder input on unacceptable GAI use.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"obtain\" for stakeholder input on unacceptable GAI use within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"obtain\" for stakeholder input on unacceptable GAI use. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-91B7104B7C@1ca75582d8a75712","id":"AIR-91B7104B7C","version":"1ca75582d8a75712","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Monitor emergent GAI risks","statement":"AI governance owners should monitor emergent GAI risks.","family":"Governance","body":{"legacy":{"id":"AIR-91B7104B7C","version":2,"title":"Monitor emergent GAI risks","text":"AI governance owners should monitor emergent GAI risks.","topic":"Governance","intent":"monitor emergent gai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.5-003","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"emergent GAI risks","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for emergent GAI risks within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for emergent GAI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves emergent GAI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: monitor emergent GAI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for emergent GAI risks within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for emergent GAI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-9365A6ADE2@20d6eb8a48ebd2d4","id":"AIR-9365A6ADE2","version":"20d6eb8a48ebd2d4","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Inventory organizational AI systems","statement":"AI governance owners should inventory organizational AI systems.","family":"Governance","body":{"legacy":{"id":"AIR-9365A6ADE2","version":2,"title":"Inventory organizational AI systems","text":"AI governance owners should inventory organizational AI systems.","topic":"Governance","intent":"inventory organizational ai systems","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.6","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"inventory","object":"organizational AI systems","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for organizational AI systems within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for organizational AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves organizational AI systems. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory organizational AI systems.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for organizational AI systems within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for organizational AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-93CD199B6D@eebad49411512bd1","id":"AIR-93CD199B6D","version":"eebad49411512bd1","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should record execution of privileged functions.","statement":"Organization should record privileged-function execution.","family":"Governance","body":{"legacy":{"id":"AIR-93CD199B6D","version":2,"title":"Organizations should record execution of privileged functions.","text":"Organization should record privileged-function execution.","topic":"Governance","intent":"record privileged function execution","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-171-r3","control":"03.01.07(b)","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=21","actor":"Organization","modality":"should","action":"record","object":"privileged-function execution","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"record\" for privileged-function execution within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"record\" for privileged-function execution. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves privileged-function execution. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: record privileged-function execution.","examples":{"meetsRule":"Organization follows the recommendation to \"record\" for privileged-function execution within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"record\" for privileged-function execution. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-957F5E0FE9@cff4ebef1d4cca10","id":"AIR-957F5E0FE9","version":"cff4ebef1d4cca10","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should limit authorized access to what assigned tasks require.","statement":"Organization should limit authorized access.","family":"Governance","body":{"legacy":{"id":"AIR-957F5E0FE9","version":2,"title":"Organizations should limit authorized access to what assigned tasks require.","text":"Organization should limit authorized access.","topic":"Governance","intent":"limit authorized access","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-53-r5","control":"AC-6","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=63","actor":"Organization","modality":"should","action":"limit","object":"authorized access","condition":"Assigned task needs","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"limit\" for authorized access within these conditions: Assigned task needs.","doesNotMeetRule":"Organization omits the recommended action \"limit\" for authorized access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves authorized access. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: limit authorized access.","examples":{"meetsRule":"Organization follows the recommendation to \"limit\" for authorized access within these conditions: Assigned task needs.","doesNotMeetRule":"Organization omits the recommended action \"limit\" for authorized access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-95915B3947@e69e1136b78ff50b","id":"AIR-95915B3947","version":"e69e1136b78ff50b","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Perform model evaluations","statement":"Systemic-risk GPAI providers must perform model evaluations.","family":"Evaluation","body":{"legacy":{"id":"AIR-95915B3947","version":2,"title":"Perform model evaluations","text":"Systemic-risk GPAI providers must perform model evaluations.","topic":"Evaluation","intent":"perform model evaluations","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 55(1)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"perform","object":"model evaluations","condition":"Covered systemic-risk models","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"perform\" for model evaluations within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"perform\" for model evaluations while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves model evaluations. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: perform model evaluations.","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"perform\" for model evaluations within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"perform\" for model evaluations while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-95F550699A@ee442d9172f563a6","id":"AIR-95F550699A","version":"ee442d9172f563a6","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Notify supervisors and the agency security liaison about AI concerns.","statement":"Employees must notify AI concerns.","family":"Security","body":{"legacy":{"id":"AIR-95F550699A","version":2,"title":"Notify supervisors and the agency security liaison about AI concerns.","text":"Employees must notify AI concerns.","topic":"Security","intent":"notify ai concerns","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, reporting, bullet 1","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"notify","object":"AI concerns","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"notify\" for AI concerns within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"notify\" for AI concerns while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI concerns. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: notify AI concerns.","examples":{"meetsRule":"employees performs the required action \"notify\" for AI concerns within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"notify\" for AI concerns while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-96F8E30D4E@554a9bdfd5daf88b","id":"AIR-96F8E30D4E","version":"554a9bdfd5daf88b","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Establish a post-market monitoring system","statement":"High-risk AI providers must establish a post-market monitoring system.","family":"Governance","body":{"legacy":{"id":"AIR-96F8E30D4E","version":2,"title":"Establish a post-market monitoring system","text":"High-risk AI providers must establish a post-market monitoring system.","topic":"Governance","intent":"establish a post market monitoring system","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 72(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"establish","object":"a post-market monitoring system","condition":"Covered high-risk systems","exception":"Applicability date and scope review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for a post-market monitoring system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for a post-market monitoring system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a post-market monitoring system. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish a post-market monitoring system.","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for a post-market monitoring system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for a post-market monitoring system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-972D7C9D89@f58f1a8cded65e60","id":"AIR-972D7C9D89","version":"f58f1a8cded65e60","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Establish an AI risk-management system","statement":"High-risk AI providers must establish an AI risk-management system.","family":"Governance","body":{"legacy":{"id":"AIR-972D7C9D89","version":2,"title":"Establish an AI risk-management system","text":"High-risk AI providers must establish an AI risk-management system.","topic":"Governance","intent":"establish an ai risk management system","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 9(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"establish","object":"an AI risk-management system","condition":"Covered high-risk systems","exception":"Applicability date and scope review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for an AI risk-management system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for an AI risk-management system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves an AI risk-management system. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish an AI risk-management system.","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for an AI risk-management system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for an AI risk-management system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-974125D9F2@87ea56034db7850c","id":"AIR-974125D9F2","version":"87ea56034db7850c","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Safeguard international personal-data transfers","statement":"Data controllers must safeguard international personal-data transfers.","family":"Privacy","body":{"legacy":{"id":"AIR-974125D9F2","version":2,"title":"Safeguard international personal-data transfers","text":"Data controllers must safeguard international personal-data transfers.","topic":"Privacy","intent":"safeguard international personal data transfers","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 44","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"safeguard","object":"international personal-data transfers","condition":"Covered transfers to third countries","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"safeguard\" for international personal-data transfers within these source conditions: Covered transfers to third countries, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"safeguard\" for international personal-data transfers while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves international personal-data transfers. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: safeguard international personal-data transfers.","examples":{"meetsRule":"Data controllers performs the required action \"safeguard\" for international personal-data transfers within these source conditions: Covered transfers to third countries, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"safeguard\" for international personal-data transfers while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-9752AE9F94@6b370d1498673bd2","id":"AIR-9752AE9F94","version":"6b370d1498673bd2","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Obtain information-security/privacy risk assessment before vendor GenAI use.","statement":"Users must obtain risk assessment.","family":"Privacy","body":{"legacy":{"id":"AIR-9752AE9F94","version":2,"title":"Obtain information-security/privacy risk assessment before vendor GenAI use.","text":"Users must obtain risk assessment.","topic":"Privacy","intent":"obtain risk assessment","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"harvard-genai-guidelines","control":"Use approved tools, bullet 3","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"must","action":"obtain","object":"risk assessment","condition":"Harvard work","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"obtain\" for risk assessment within these source conditions: Harvard work, and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for risk assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves risk assessment. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain risk assessment.","examples":{"meetsRule":"users performs the required action \"obtain\" for risk assessment within these source conditions: Harvard work, and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for risk assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-98C41762F1@537bb60241a02d70","id":"AIR-98C41762F1","version":"537bb60241a02d70","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document negative residual AI risks","statement":"AI governance owners should document negative residual AI risks.","family":"Governance","body":{"legacy":{"id":"AIR-98C41762F1","version":2,"title":"Document negative residual AI risks","text":"AI governance owners should document negative residual AI risks.","topic":"Governance","intent":"document negative residual ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 1.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"negative residual AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for negative residual AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for negative residual AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves negative residual AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document negative residual AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for negative residual AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for negative residual AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-99485B54FC@def03c1901e63f94","id":"AIR-99485B54FC","version":"def03c1901e63f94","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Carefully review AI responses in security-sensitive situations.","statement":"Users must review responses.","family":"Privacy","body":{"legacy":{"id":"AIR-99485B54FC","version":2,"title":"Carefully review AI responses in security-sensitive situations.","text":"Users must review responses.","topic":"Privacy","intent":"review responses","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"brookline-genai","control":"Use, security-review bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"review","object":"responses","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"review\" for responses within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"review\" for responses while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves responses. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: review responses.","examples":{"meetsRule":"users performs the required action \"review\" for responses within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"review\" for responses while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-9958F2923D@5b9a621c5b466bec","id":"AIR-9958F2923D","version":"5b9a621c5b466bec","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Evaluate AI fairness and bias","statement":"AI governance owners should evaluate AI fairness and bias.","family":"Fairness","body":{"legacy":{"id":"AIR-9958F2923D","version":2,"title":"Evaluate AI fairness and bias","text":"AI governance owners should evaluate AI fairness and bias.","topic":"Fairness","intent":"evaluate ai fairness and bias","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.11","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"AI fairness and bias","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI fairness and bias within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI fairness and bias. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI fairness and bias. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate AI fairness and bias.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI fairness and bias within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI fairness and bias. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-9987CCC485@6df1dc002d91d472","id":"AIR-9987CCC485","version":"6df1dc002d91d472","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Review AI material before publishing or sharing it.","statement":"Users should review AI material.","family":"Human oversight","body":{"legacy":{"id":"AIR-9987CCC485","version":2,"title":"Review AI material before publishing or sharing it.","text":"Users should review AI material.","topic":"Human oversight","intent":"review ai material","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"harvard-genai-guidelines","control":"Review content before publishing or sharing","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"should","action":"review","object":"AI material","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users follows the recommendation to \"review\" for AI material within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"users omits the recommended action \"review\" for AI material. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI material. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: review AI material.","examples":{"meetsRule":"users follows the recommendation to \"review\" for AI material within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"users omits the recommended action \"review\" for AI material. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-9A5BD1A87A@0e29409bc678f694","id":"AIR-9A5BD1A87A","version":"0e29409bc678f694","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Implement a copyright-compliance policy","statement":"GPAI model providers must implement a copyright-compliance policy.","family":"Data & IP","body":{"legacy":{"id":"AIR-9A5BD1A87A","version":2,"title":"Implement a copyright-compliance policy","text":"GPAI model providers must implement a copyright-compliance policy.","topic":"Data & IP","intent":"implement a copyright compliance policy","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 53(1)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"implement","object":"a copyright-compliance policy","condition":"Covered general-purpose AI models","exception":"Including rights reservations under EU copyright law","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"implement\" for a copyright-compliance policy within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"implement\" for a copyright-compliance policy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a copyright-compliance policy. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: implement a copyright-compliance policy.","examples":{"meetsRule":"GPAI model providers performs the required action \"implement\" for a copyright-compliance policy within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"implement\" for a copyright-compliance policy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-9B0903C354@7f143d94576da7f6","id":"AIR-9B0903C354","version":"7f143d94576da7f6","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Define operable data-labeling rules","statement":"Covered GenAI service providers must define operable data-labeling rules.","family":"Transparency","body":{"legacy":{"id":"AIR-9B0903C354","version":2,"title":"Define operable data-labeling rules","text":"Covered GenAI service providers must define operable data-labeling rules.","topic":"Transparency","intent":"define operable data labeling rules","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 8","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"define","object":"operable data-labeling rules","condition":"Data annotation during development","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"define\" for operable data-labeling rules within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"define\" for operable data-labeling rules while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves operable data-labeling rules. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define operable data-labeling rules.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"define\" for operable data-labeling rules within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"define\" for operable data-labeling rules while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-9B67275315@16e7d7f05ae6bbb2","id":"AIR-9B67275315","version":"16e7d7f05ae6bbb2","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Adapt AI measurements to deployment context","statement":"AI governance owners should adapt AI measurements to deployment context.","family":"Evaluation","body":{"legacy":{"id":"AIR-9B67275315","version":2,"title":"Adapt AI measurements to deployment context","text":"AI governance owners should adapt AI measurements to deployment context.","topic":"Evaluation","intent":"adapt ai measurements to deployment context","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"adapt","object":"AI measurements to deployment context","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"adapt\" for AI measurements to deployment context within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"adapt\" for AI measurements to deployment context. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI measurements to deployment context. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: adapt AI measurements to deployment context.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"adapt\" for AI measurements to deployment context within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"adapt\" for AI measurements to deployment context. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-9E0C4702D4@e3f3f142eb8523dc","id":"AIR-9E0C4702D4","version":"e3f3f142eb8523dc","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Implement post-deployment AI monitoring plans","statement":"AI governance owners should implement post-deployment AI monitoring plans.","family":"Governance","body":{"legacy":{"id":"AIR-9E0C4702D4","version":2,"title":"Implement post-deployment AI monitoring plans","text":"AI governance owners should implement post-deployment AI monitoring plans.","topic":"Governance","intent":"implement post deployment ai monitoring plans","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"implement","object":"post-deployment AI monitoring plans","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"implement\" for post-deployment AI monitoring plans within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"implement\" for post-deployment AI monitoring plans. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves post-deployment AI monitoring plans. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: implement post-deployment AI monitoring plans.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"implement\" for post-deployment AI monitoring plans within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"implement\" for post-deployment AI monitoring plans. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-9E7F166E73@602687ff4895a4e9","id":"AIR-9E7F166E73","version":"602687ff4895a4e9","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Assess systemic risks","statement":"Systemic-risk GPAI providers must assess systemic risks.","family":"Governance","body":{"legacy":{"id":"AIR-9E7F166E73","version":2,"title":"Assess systemic risks","text":"Systemic-risk GPAI providers must assess systemic risks.","topic":"Governance","intent":"assess systemic risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 55(1)(b)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"assess","object":"systemic risks","condition":"Covered systemic-risk models","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"assess\" for systemic risks within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"assess\" for systemic risks while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves systemic risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assess systemic risks.","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"assess\" for systemic risks within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"assess\" for systemic risks while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-9EC219543F@ebf1af41b7a47c54","id":"AIR-9EC219543F","version":"ebf1af41b7a47c54","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Enable withdrawal of consent","statement":"Data controllers must enable withdrawal of consent.","family":"Governance","body":{"legacy":{"id":"AIR-9EC219543F","version":2,"title":"Enable withdrawal of consent","text":"Data controllers must enable withdrawal of consent.","topic":"Governance","intent":"enable withdrawal of consent","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 7(3)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"enable","object":"withdrawal of consent","condition":"Where consent is the lawful basis","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"enable\" for withdrawal of consent within these source conditions: Where consent is the lawful basis, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"enable\" for withdrawal of consent while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves withdrawal of consent. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable withdrawal of consent.","examples":{"meetsRule":"Data controllers performs the required action \"enable\" for withdrawal of consent within these source conditions: Where consent is the lawful basis, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"enable\" for withdrawal of consent while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-9EE4AB873B@619363766d1fff2c","id":"AIR-9EE4AB873B","version":"619363766d1fff2c","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document AI risk tolerance","statement":"AI governance owners should document AI risk tolerance.","family":"Governance","body":{"legacy":{"id":"AIR-9EE4AB873B","version":2,"title":"Document AI risk tolerance","text":"AI governance owners should document AI risk tolerance.","topic":"Governance","intent":"document ai risk tolerance","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI risk tolerance","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risk tolerance within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risk tolerance. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI risk tolerance. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI risk tolerance.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risk tolerance within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risk tolerance. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-9F0606F820@5012763ddf10c824","id":"AIR-9F0606F820","version":"5012763ddf10c824","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Enable effective human oversight","statement":"High-risk AI providers must enable effective human oversight.","family":"Human oversight","body":{"legacy":{"id":"AIR-9F0606F820","version":2,"title":"Enable effective human oversight","text":"High-risk AI providers must enable effective human oversight.","topic":"Human oversight","intent":"enable effective human oversight","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 14(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"effective human oversight","condition":"During system use","exception":"Appropriate to risks and autonomy","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for effective human oversight within these source conditions: During system use, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for effective human oversight while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves effective human oversight. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable effective human oversight.","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for effective human oversight within these source conditions: During system use, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for effective human oversight while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-9F12707A1E@3404b8d82f57c69f","id":"AIR-9F12707A1E","version":"3404b8d82f57c69f","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Provide notice of automated decision-making","statement":"Responsible senior federal officials must provide notice of automated decision-making.","family":"Transparency","body":{"legacy":{"id":"AIR-9F12707A1E","version":2,"title":"Provide notice of automated decision-making","text":"Responsible senior federal officials must provide notice of automated decision-making.","topic":"Transparency","intent":"provide notice of automated decision making","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.1","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"provide","object":"notice of automated decision-making","condition":"Before decisions; impact-level requirements apply","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"provide\" for notice of automated decision-making within these source conditions: Before decisions; impact-level requirements apply, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"provide\" for notice of automated decision-making while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves notice of automated decision-making. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide notice of automated decision-making.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"provide\" for notice of automated decision-making within these source conditions: Before decisions; impact-level requirements apply, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"provide\" for notice of automated decision-making while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-A0754F863D@ff197327de98039f","id":"AIR-A0754F863D","version":"ff197327de98039f","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should inventory purposes for data actions.","statement":"Organization should inventory data-action purposes.","family":"Data & IP","body":{"legacy":{"id":"AIR-A0754F863D","version":2,"title":"Organizations should inventory purposes for data actions.","text":"Organization should inventory data-action purposes.","topic":"Data & IP","intent":"inventory data action purposes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-privacy-1","control":"ID.IM-P5","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"data-action purposes","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for data-action purposes within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for data-action purposes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data-action purposes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory data-action purposes.","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for data-action purposes within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for data-action purposes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-A271230967@6c27fb177bb45d30","id":"AIR-A271230967","version":"6c27fb177bb45d30","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document measurable AI performance changes","statement":"AI governance owners should document measurable AI performance changes.","family":"Evaluation","body":{"legacy":{"id":"AIR-A271230967","version":2,"title":"Document measurable AI performance changes","text":"AI governance owners should document measurable AI performance changes.","topic":"Evaluation","intent":"document measurable ai performance changes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 4.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"measurable AI performance changes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for measurable AI performance changes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for measurable AI performance changes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves measurable AI performance changes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document measurable AI performance changes.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for measurable AI performance changes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for measurable AI performance changes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-A31D302A1B@e7538e87b5117430","id":"AIR-A31D302A1B","version":"e7538e87b5117430","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Retain prompts and input data under records-management requirements.","statement":"Agencies must retain inputs.","family":"Data & IP","body":{"legacy":{"id":"AIR-A31D302A1B","version":2,"title":"Retain prompts and input data under records-management requirements.","text":"Agencies must retain inputs.","topic":"Data & IP","intent":"retain inputs","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.1.4, p.2","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"agencies","modality":"must","action":"retain","object":"inputs","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"retain\" for inputs within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"retain\" for inputs while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves inputs. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: retain inputs.","examples":{"meetsRule":"agencies performs the required action \"retain\" for inputs within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"retain\" for inputs while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-A3EACF1A4E@bdfcce3127b14f2e","id":"AIR-A3EACF1A4E","version":"bdfcce3127b14f2e","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Respond to previously unknown AI risks","statement":"AI governance owners should respond to previously unknown AI risks.","family":"Governance","body":{"legacy":{"id":"AIR-A3EACF1A4E","version":2,"title":"Respond to previously unknown AI risks","text":"AI governance owners should respond to previously unknown AI risks.","topic":"Governance","intent":"respond to previously unknown ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"respond","object":"to previously unknown AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"respond\" for to previously unknown AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"respond\" for to previously unknown AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves to previously unknown AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: respond to previously unknown AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"respond\" for to previously unknown AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"respond\" for to previously unknown AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-A7714C60EE@d62d0078bc9e65e1","id":"AIR-A7714C60EE","version":"d62d0078bc9e65e1","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Incorporate adjudicated stakeholder feedback","statement":"AI governance owners should incorporate adjudicated stakeholder feedback.","family":"Governance","body":{"legacy":{"id":"AIR-A7714C60EE","version":2,"title":"Incorporate adjudicated stakeholder feedback","text":"AI governance owners should incorporate adjudicated stakeholder feedback.","topic":"Governance","intent":"incorporate adjudicated stakeholder feedback","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 5.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"incorporate","object":"adjudicated stakeholder feedback","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"incorporate\" for adjudicated stakeholder feedback within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"incorporate\" for adjudicated stakeholder feedback. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves adjudicated stakeholder feedback. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: incorporate adjudicated stakeholder feedback.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"incorporate\" for adjudicated stakeholder feedback within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"incorporate\" for adjudicated stakeholder feedback. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-A80EF3B4B0@98587c97b69b08d7","id":"AIR-A80EF3B4B0","version":"98587c97b69b08d7","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Covered agencies must request the vendor’s acceptable-use policy in LLM solicitations.","statement":"Covered agency must request vendor acceptable-use policy.","family":"Procurement","body":{"legacy":{"id":"AIR-A80EF3B4B0","version":2,"title":"Covered agencies must request the vendor’s acceptable-use policy in LLM solicitations.","text":"Covered agency must request vendor acceptable-use policy.","topic":"Procurement","intent":"request vendor acceptable use policy","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-26-04","control":"Appendix A.1(A)(i)","sourceVersion":"M-26-04","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf#page=5","actor":"Covered agency","modality":"must","action":"request","object":"vendor acceptable-use policy","condition":"Covered LLM solicitations","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"request\" for vendor acceptable-use policy within these source conditions: Covered LLM solicitations, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"request\" for vendor acceptable-use policy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves vendor acceptable-use policy. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: request vendor acceptable-use policy.","examples":{"meetsRule":"Covered agency performs the required action \"request\" for vendor acceptable-use policy within these source conditions: Covered LLM solicitations, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"request\" for vendor acceptable-use policy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-A98A489B02@5a563fee90bb52f1","id":"AIR-A98A489B02","version":"5a563fee90bb52f1","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Register with a state employee email address.","statement":"Employees must register state email.","family":"Governance","body":{"legacy":{"id":"AIR-A98A489B02","version":2,"title":"Register with a state employee email address.","text":"Employees must register state email.","topic":"Governance","intent":"register state email","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 4","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"register","object":"state email","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"register\" for state email within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"register\" for state email while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves state email. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: register state email.","examples":{"meetsRule":"employees performs the required action \"register\" for state email within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"register\" for state email while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-AA1B934A14@623aa668561d8032","id":"AIR-AA1B934A14","version":"623aa668561d8032","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Covered agencies must include Unbiased AI Principles compliance terms in new LLM solicitations.","statement":"Covered agency must include compliance terms.","family":"Fairness","body":{"legacy":{"id":"AIR-AA1B934A14","version":2,"title":"Covered agencies must include Unbiased AI Principles compliance terms in new LLM solicitations.","text":"Covered agency must include compliance terms.","topic":"Fairness","intent":"include compliance terms","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-26-04","control":"Agency Actions (a)","sourceVersion":"M-26-04","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf#page=3","actor":"Covered agency","modality":"must","action":"include","object":"compliance terms","condition":"Covered solicitations issued after memorandum","exception":"Scope exclusions; free open-source licenses","timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"include\" for compliance terms within these source conditions: Covered solicitations issued after memorandum, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"include\" for compliance terms while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves compliance terms. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: include compliance terms.","examples":{"meetsRule":"Covered agency performs the required action \"include\" for compliance terms within these source conditions: Covered solicitations issued after memorandum, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"include\" for compliance terms while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-AA8C667747@e811992389077596","id":"AIR-AA8C667747","version":"e811992389077596","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Do not enter Class C data into GenAI.","statement":"Users must-not enter Class C data.","family":"Data & IP","body":{"legacy":{"id":"AIR-AA8C667747","version":2,"title":"Do not enter Class C data into GenAI.","text":"Users must-not enter Class C data.","topic":"Data & IP","intent":"enter class c data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.2.6.2, p.7","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must-not","action":"enter","object":"Class C data","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"enter\" for Class C data within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for Class C data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves Class C data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enter Class C data.","examples":{"meetsRule":"users performs the required action \"enter\" for Class C data within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for Class C data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-AB2476BBAB@130c3fac51082d54","id":"AIR-AB2476BBAB","version":"130c3fac51082d54","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"AI providers should document the lifecycle of models, datasets and system prompts.","statement":"AI provider should document model, dataset and prompt lifecycle.","family":"Data & IP","body":{"legacy":{"id":"AIR-AB2476BBAB","version":2,"title":"AI providers should document the lifecycle of models, datasets and system prompts.","text":"AI provider should document model, dataset and prompt lifecycle.","topic":"Data & IP","intent":"document model dataset and prompt lifecycle","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / documentation","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"document","object":"model, dataset and prompt lifecycle","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"document\" for model, dataset and prompt lifecycle within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"document\" for model, dataset and prompt lifecycle. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves model, dataset and prompt lifecycle. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document model, dataset and prompt lifecycle.","examples":{"meetsRule":"AI provider follows the recommendation to \"document\" for model, dataset and prompt lifecycle within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"document\" for model, dataset and prompt lifecycle. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-ABAA5F0412@a224b4705d19abd7","id":"AIR-ABAA5F0412","version":"a224b4705d19abd7","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document dataset design choices","statement":"High-risk AI providers must document dataset design choices.","family":"Data & IP","body":{"legacy":{"id":"AIR-ABAA5F0412","version":2,"title":"Document dataset design choices","text":"High-risk AI providers must document dataset design choices.","topic":"Data & IP","intent":"document dataset design choices","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 10(2)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"document","object":"dataset design choices","condition":"Systems trained with data","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"document\" for dataset design choices within these source conditions: Systems trained with data, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"document\" for dataset design choices while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves dataset design choices. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document dataset design choices.","examples":{"meetsRule":"High-risk AI providers performs the required action \"document\" for dataset design choices within these source conditions: Systems trained with data, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"document\" for dataset design choices while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-ABF5BBD0E9@0328d6d72be161a1","id":"AIR-ABF5BBD0E9","version":"0328d6d72be161a1","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Test risk-management measures","statement":"High-risk AI providers must test risk-management measures.","family":"Evaluation","body":{"legacy":{"id":"AIR-ABF5BBD0E9","version":2,"title":"Test risk-management measures","text":"High-risk AI providers must test risk-management measures.","topic":"Evaluation","intent":"test risk management measures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 9(7)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"test","object":"risk-management measures","condition":"Before placing high-risk systems on the market","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"test\" for risk-management measures within these source conditions: Before placing high-risk systems on the market, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"test\" for risk-management measures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves risk-management measures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: test risk-management measures.","examples":{"meetsRule":"High-risk AI providers performs the required action \"test\" for risk-management measures within these source conditions: Before placing high-risk systems on the market, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"test\" for risk-management measures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-AC38374E07@f4b6ff20ba87b97b","id":"AIR-AC38374E07","version":"f4b6ff20ba87b97b","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Assess fundamental rights impacts","statement":"Covered high-risk AI deployers must assess fundamental rights impacts.","family":"Governance","body":{"legacy":{"id":"AIR-AC38374E07","version":2,"title":"Assess fundamental rights impacts","text":"Covered high-risk AI deployers must assess fundamental rights impacts.","topic":"Governance","intent":"assess fundamental rights impacts","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 27(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Covered high-risk AI deployers","modality":"must","action":"assess","object":"fundamental rights impacts","condition":"Specified public bodies and private public-service deployers","exception":"Scope exclusions and applicability date require review","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered high-risk AI deployers performs the required action \"assess\" for fundamental rights impacts within these source conditions: Specified public bodies and private public-service deployers, and retains evidence.","doesNotMeetRule":"Covered high-risk AI deployers omits the required action \"assess\" for fundamental rights impacts while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves fundamental rights impacts. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assess fundamental rights impacts.","examples":{"meetsRule":"Covered high-risk AI deployers performs the required action \"assess\" for fundamental rights impacts within these source conditions: Specified public bodies and private public-service deployers, and retains evidence.","doesNotMeetRule":"Covered high-risk AI deployers omits the required action \"assess\" for fundamental rights impacts while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-AC404254CF@fdd21907e0626ce6","id":"AIR-AC404254CF","version":"fdd21907e0626ce6","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document internal controls for AI components","statement":"AI governance owners should document internal controls for AI components.","family":"Governance","body":{"legacy":{"id":"AIR-AC404254CF","version":2,"title":"Document internal controls for AI components","text":"AI governance owners should document internal controls for AI components.","topic":"Governance","intent":"document internal controls for ai components","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"internal controls for AI components","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for internal controls for AI components within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for internal controls for AI components. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves internal controls for AI components. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document internal controls for AI components.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for internal controls for AI components within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for internal controls for AI components. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-AD7B04DC9D@04e3ca392f0df072","id":"AIR-AD7B04DC9D","version":"04e3ca392f0df072","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Evaluate the effectiveness of AI evaluation processes","statement":"AI governance owners should evaluate the effectiveness of AI evaluation processes.","family":"Evaluation","body":{"legacy":{"id":"AIR-AD7B04DC9D","version":2,"title":"Evaluate the effectiveness of AI evaluation processes","text":"AI governance owners should evaluate the effectiveness of AI evaluation processes.","topic":"Evaluation","intent":"evaluate the effectiveness of ai evaluation processes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.13","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"the effectiveness of AI evaluation processes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for the effectiveness of AI evaluation processes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for the effectiveness of AI evaluation processes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves the effectiveness of AI evaluation processes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate the effectiveness of AI evaluation processes.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for the effectiveness of AI evaluation processes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for the effectiveness of AI evaluation processes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-AEFB7467B3@e26b3eb75ade016c","id":"AIR-AEFB7467B3","version":"e26b3eb75ade016c","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Safeguard released versions of decision-system software","statement":"Responsible senior federal officials must safeguard released versions of decision-system software.","family":"Governance","body":{"legacy":{"id":"AIR-AEFB7467B3","version":2,"title":"Safeguard released versions of decision-system software","text":"Responsible senior federal officials must safeguard released versions of decision-system software.","topic":"Governance","intent":"safeguard released versions of decision system software","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.5","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"safeguard","object":"released versions of decision-system software","condition":"All released components","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"safeguard\" for released versions of decision-system software within these source conditions: All released components, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"safeguard\" for released versions of decision-system software while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves released versions of decision-system software. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: safeguard released versions of decision-system software.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"safeguard\" for released versions of decision-system software within these source conditions: All released components, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"safeguard\" for released versions of decision-system software while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-B098FE0267@9c690d85f3bff28c","id":"AIR-B098FE0267","version":"9c690d85f3bff28c","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Define safe AI decommissioning procedures","statement":"AI governance owners should define safe AI decommissioning procedures.","family":"Governance","body":{"legacy":{"id":"AIR-B098FE0267","version":2,"title":"Define safe AI decommissioning procedures","text":"AI governance owners should define safe AI decommissioning procedures.","topic":"Governance","intent":"define safe ai decommissioning procedures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.7","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"safe AI decommissioning procedures","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for safe AI decommissioning procedures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for safe AI decommissioning procedures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves safe AI decommissioning procedures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define safe AI decommissioning procedures.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for safe AI decommissioning procedures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for safe AI decommissioning procedures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-B1B0E054D0@9ce679f11b6245e3","id":"AIR-B1B0E054D0","version":"9ce679f11b6245e3","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Share only public data with public GenAI.","statement":"Employees must share public data.","family":"Data & IP","body":{"legacy":{"id":"AIR-B1B0E054D0","version":2,"title":"Share only public data with public GenAI.","text":"Employees must share public data.","topic":"Data & IP","intent":"share public data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, data sharing, bullets 1–2","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"share","object":"public data","condition":"state work","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"share\" for public data within these source conditions: state work, and retains evidence.","doesNotMeetRule":"employees omits the required action \"share\" for public data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves public data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: share public data.","examples":{"meetsRule":"employees performs the required action \"share\" for public data within these source conditions: state work, and retains evidence.","doesNotMeetRule":"employees omits the required action \"share\" for public data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-B39B348823@0bbd2c78b730d31a","id":"AIR-B39B348823","version":"0bbd2c78b730d31a","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should restrict personal-information processing to authorized activities.","statement":"Organization should restrict PII processing.","family":"Privacy","body":{"legacy":{"id":"AIR-B39B348823","version":2,"title":"Organizations should restrict personal-information processing to authorized activities.","text":"Organization should restrict PII processing.","topic":"Privacy","intent":"restrict pii processing","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-53-r5","control":"PT-2(b)","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=257","actor":"Organization","modality":"should","action":"restrict","object":"PII processing","condition":"Authorized activities","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"restrict\" for PII processing within these conditions: Authorized activities.","doesNotMeetRule":"Organization omits the recommended action \"restrict\" for PII processing. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves PII processing. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: restrict PII processing.","examples":{"meetsRule":"Organization follows the recommendation to \"restrict\" for PII processing within these conditions: Authorized activities.","doesNotMeetRule":"Organization omits the recommended action \"restrict\" for PII processing. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-B43991A570@e07dc0ac83da75fe","id":"AIR-B43991A570","version":"e07dc0ac83da75fe","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Inventory third parties with access to organizational content","statement":"AI governance owners should inventory third parties with access to organizational content.","family":"Governance","body":{"legacy":{"id":"AIR-B43991A570","version":2,"title":"Inventory third parties with access to organizational content","text":"AI governance owners should inventory third parties with access to organizational content.","topic":"Governance","intent":"inventory third parties with access to organizational content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-6.1-007","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"inventory","object":"third parties with access to organizational content","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for third parties with access to organizational content within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for third parties with access to organizational content. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves third parties with access to organizational content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory third parties with access to organizational content.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for third parties with access to organizational content within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for third parties with access to organizational content. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-B4750175C0@149648d306b67ce5","id":"AIR-B4750175C0","version":"149648d306b67ce5","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Consider stakeholder input in trustworthiness measurements","statement":"AI governance owners should consider stakeholder input in trustworthiness measurements.","family":"Evaluation","body":{"legacy":{"id":"AIR-B4750175C0","version":2,"title":"Consider stakeholder input in trustworthiness measurements","text":"AI governance owners should consider stakeholder input in trustworthiness measurements.","topic":"Evaluation","intent":"consider stakeholder input in trustworthiness measurements","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"consider","object":"stakeholder input in trustworthiness measurements","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for stakeholder input in trustworthiness measurements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for stakeholder input in trustworthiness measurements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves stakeholder input in trustworthiness measurements. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: consider stakeholder input in trustworthiness measurements.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for stakeholder input in trustworthiness measurements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for stakeholder input in trustworthiness measurements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-B8A087CCC2@0f50cbbae66bbfd9","id":"AIR-B8A087CCC2","version":"0f50cbbae66bbfd9","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Design sufficiently transparent operation","statement":"High-risk AI providers must design sufficiently transparent operation.","family":"Transparency","body":{"legacy":{"id":"AIR-B8A087CCC2","version":2,"title":"Design sufficiently transparent operation","text":"High-risk AI providers must design sufficiently transparent operation.","topic":"Transparency","intent":"design sufficiently transparent operation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 13(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"design","object":"sufficiently transparent operation","condition":"To enable deployer interpretation","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"design\" for sufficiently transparent operation within these source conditions: To enable deployer interpretation, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"design\" for sufficiently transparent operation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves sufficiently transparent operation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: design sufficiently transparent operation.","examples":{"meetsRule":"High-risk AI providers performs the required action \"design\" for sufficiently transparent operation within these source conditions: To enable deployer interpretation, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"design\" for sufficiently transparent operation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-B8B189C1E1@00ac86f13ce23247","id":"AIR-B8B189C1E1","version":"00ac86f13ce23247","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Evaluate AI security and resilience","statement":"AI governance owners should evaluate AI security and resilience.","family":"Security","body":{"legacy":{"id":"AIR-B8B189C1E1","version":2,"title":"Evaluate AI security and resilience","text":"AI governance owners should evaluate AI security and resilience.","topic":"Security","intent":"evaluate ai security and resilience","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.7","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"AI security and resilience","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI security and resilience within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI security and resilience. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI security and resilience. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate AI security and resilience.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI security and resilience within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI security and resilience. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-B9CECE710F@c4f81501268171a4","id":"AIR-B9CECE710F","version":"c4f81501268171a4","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Inform people exposed to emotion recognition","statement":"Covered AI deployers must inform people exposed to emotion recognition.","family":"Governance","body":{"legacy":{"id":"AIR-B9CECE710F","version":2,"title":"Inform people exposed to emotion recognition","text":"Covered AI deployers must inform people exposed to emotion recognition.","topic":"Governance","intent":"inform people exposed to emotion recognition","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 50(3)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Covered AI deployers","modality":"must","action":"inform","object":"people exposed to emotion recognition","condition":"Covered systems","exception":"Specific legal exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered AI deployers performs the required action \"inform\" for people exposed to emotion recognition within these source conditions: Covered systems, and retains evidence.","doesNotMeetRule":"Covered AI deployers omits the required action \"inform\" for people exposed to emotion recognition while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves people exposed to emotion recognition. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inform people exposed to emotion recognition.","examples":{"meetsRule":"Covered AI deployers performs the required action \"inform\" for people exposed to emotion recognition within these source conditions: Covered systems, and retains evidence.","doesNotMeetRule":"Covered AI deployers omits the required action \"inform\" for people exposed to emotion recognition while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-BB06F70AC1@ff157b8672270cb8","id":"AIR-BB06F70AC1","version":"ff157b8672270cb8","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Ensure adequate cybersecurity for models","statement":"Systemic-risk GPAI providers must ensure adequate cybersecurity for models.","family":"Security","body":{"legacy":{"id":"AIR-BB06F70AC1","version":2,"title":"Ensure adequate cybersecurity for models","text":"Systemic-risk GPAI providers must ensure adequate cybersecurity for models.","topic":"Security","intent":"ensure adequate cybersecurity for models","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 55(1)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"ensure","object":"adequate cybersecurity for models","condition":"Covered systemic-risk models","exception":"Including physical infrastructure","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"ensure\" for adequate cybersecurity for models within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"ensure\" for adequate cybersecurity for models while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves adequate cybersecurity for models. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure adequate cybersecurity for models.","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"ensure\" for adequate cybersecurity for models within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"ensure\" for adequate cybersecurity for models while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-BC2EBDF815@ba5cacc272d0c8ff","id":"AIR-BC2EBDF815","version":"ba5cacc272d0c8ff","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Software producers should investigate credible vulnerability reports.","statement":"Software producer should investigate credible vulnerability reports.","family":"Security","body":{"legacy":{"id":"AIR-BC2EBDF815","version":2,"title":"Software producers should investigate credible vulnerability reports.","text":"Software producer should investigate credible vulnerability reports.","topic":"Security","intent":"investigate credible vulnerability reports","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ssdf-1-1","control":"RV.1.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=25","actor":"Software producer","modality":"should","action":"investigate","object":"credible vulnerability reports","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"investigate\" for credible vulnerability reports within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"investigate\" for credible vulnerability reports. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves credible vulnerability reports. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: investigate credible vulnerability reports.","examples":{"meetsRule":"Software producer follows the recommendation to \"investigate\" for credible vulnerability reports within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"investigate\" for credible vulnerability reports. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-BDE09E3088@51e3e0c4ac111b76","id":"AIR-BDE09E3088","version":"51e3e0c4ac111b76","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Exclude unexplainable AI from decisions and approvals.","statement":"Agencies must-not use unexplainable AI.","family":"Transparency","body":{"legacy":{"id":"AIR-BDE09E3088","version":2,"title":"Exclude unexplainable AI from decisions and approvals.","text":"Agencies must-not use unexplainable AI.","topic":"Transparency","intent":"use unexplainable ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"p.5, Ethical Use","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must-not","action":"use","object":"unexplainable AI","condition":"decision or approval","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"use\" for unexplainable AI within these source conditions: decision or approval, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"use\" for unexplainable AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves unexplainable AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use unexplainable AI.","examples":{"meetsRule":"agencies performs the required action \"use\" for unexplainable AI within these source conditions: decision or approval, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"use\" for unexplainable AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-BF19955A9B@735005e86bd3475f","id":"AIR-BF19955A9B","version":"735005e86bd3475f","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Enable oversight personnel to disregard AI output","statement":"High-risk AI providers must enable oversight personnel to disregard AI output.","family":"Human oversight","body":{"legacy":{"id":"AIR-BF19955A9B","version":2,"title":"Enable oversight personnel to disregard AI output","text":"High-risk AI providers must enable oversight personnel to disregard AI output.","topic":"Human oversight","intent":"enable oversight personnel to disregard ai output","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 14(4)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"oversight personnel to disregard AI output","condition":"When overseeing high-risk AI","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to disregard AI output within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to disregard AI output while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves oversight personnel to disregard AI output. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable oversight personnel to disregard AI output.","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to disregard AI output within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to disregard AI output while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-C1F74ECF84@7dc33a77a8d3a773","id":"AIR-C1F74ECF84","version":"7dc33a77a8d3a773","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Identify a lawful basis for processing","statement":"Data controllers must identify a lawful basis for processing.","family":"Governance","body":{"legacy":{"id":"AIR-C1F74ECF84","version":2,"title":"Identify a lawful basis for processing","text":"Data controllers must identify a lawful basis for processing.","topic":"Governance","intent":"identify a lawful basis for processing","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 6(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"identify","object":"a lawful basis for processing","condition":"Before covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"identify\" for a lawful basis for processing within these source conditions: Before covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"identify\" for a lawful basis for processing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a lawful basis for processing. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: identify a lawful basis for processing.","examples":{"meetsRule":"Data controllers performs the required action \"identify\" for a lawful basis for processing within these source conditions: Before covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"identify\" for a lawful basis for processing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-C25C44E28B@2731fcfc158e2fa1","id":"AIR-C25C44E28B","version":"2731fcfc158e2fa1","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Specify the targeted AI application scope","statement":"AI governance owners should specify the targeted AI application scope.","family":"Governance","body":{"legacy":{"id":"AIR-C25C44E28B","version":2,"title":"Specify the targeted AI application scope","text":"AI governance owners should specify the targeted AI application scope.","topic":"Governance","intent":"specify the targeted ai application scope","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 3.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"specify","object":"the targeted AI application scope","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"specify\" for the targeted AI application scope within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"specify\" for the targeted AI application scope. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves the targeted AI application scope. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: specify the targeted AI application scope.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"specify\" for the targeted AI application scope within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"specify\" for the targeted AI application scope. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-C4036FF921@7b5c70c24f9fb8b6","id":"AIR-C4036FF921","version":"7b5c70c24f9fb8b6","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Examine AI privacy risks","statement":"AI governance owners should examine AI privacy risks.","family":"Privacy","body":{"legacy":{"id":"AIR-C4036FF921","version":2,"title":"Examine AI privacy risks","text":"AI governance owners should examine AI privacy risks.","topic":"Privacy","intent":"examine ai privacy risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.10","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"examine","object":"AI privacy risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for AI privacy risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for AI privacy risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI privacy risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: examine AI privacy risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for AI privacy risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for AI privacy risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-C57A5D1D72@dc7e31aaa4a56cf2","id":"AIR-C57A5D1D72","version":"dc7e31aaa4a56cf2","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Enable automatic event logging","statement":"High-risk AI providers must enable automatic event logging.","family":"Governance","body":{"legacy":{"id":"AIR-C57A5D1D72","version":2,"title":"Enable automatic event logging","text":"High-risk AI providers must enable automatic event logging.","topic":"Governance","intent":"enable automatic event logging","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 12(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"automatic event logging","condition":"Covered high-risk systems","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for automatic event logging within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for automatic event logging while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves automatic event logging. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable automatic event logging.","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for automatic event logging within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for automatic event logging while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-C8E01637B6@c05d05ad9a3b2910","id":"AIR-C8E01637B6","version":"c05d05ad9a3b2910","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Tell customers when they interact with agency AI.","statement":"Agencies must disclose AI interaction.","family":"Governance","body":{"legacy":{"id":"AIR-C8E01637B6","version":2,"title":"Tell customers when they interact with agency AI.","text":"Agencies must disclose AI interaction.","topic":"Governance","intent":"disclose ai interaction","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.1.5, p.2","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"agencies","modality":"must","action":"disclose","object":"AI interaction","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"disclose\" for AI interaction within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"disclose\" for AI interaction while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI interaction. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: disclose AI interaction.","examples":{"meetsRule":"agencies performs the required action \"disclose\" for AI interaction within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"disclose\" for AI interaction while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-CC0117ACB7@a39157a66d3ab446","id":"AIR-CC0117ACB7","version":"a39157a66d3ab446","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Protect personal-data integrity and confidentiality","statement":"Data controllers must protect personal-data integrity and confidentiality.","family":"Privacy","body":{"legacy":{"id":"AIR-CC0117ACB7","version":2,"title":"Protect personal-data integrity and confidentiality","text":"Data controllers must protect personal-data integrity and confidentiality.","topic":"Privacy","intent":"protect personal data integrity and confidentiality","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(f)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"protect","object":"personal-data integrity and confidentiality","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"protect\" for personal-data integrity and confidentiality within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"protect\" for personal-data integrity and confidentiality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal-data integrity and confidentiality. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect personal-data integrity and confidentiality.","examples":{"meetsRule":"Data controllers performs the required action \"protect\" for personal-data integrity and confidentiality within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"protect\" for personal-data integrity and confidentiality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-CFAE0A69A5@e49fa223cd0cb762","id":"AIR-CFAE0A69A5","version":"e49fa223cd0cb762","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Covered agencies must test proposed AI solutions to the greatest practicable extent.","statement":"Covered agency must test proposed AI solutions.","family":"Evaluation","body":{"legacy":{"id":"AIR-CFAE0A69A5","version":2,"title":"Covered agencies must test proposed AI solutions to the greatest practicable extent.","text":"Covered agency must test proposed AI solutions.","topic":"Evaluation","intent":"test proposed ai solutions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-22","control":"4(d)(i)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=9","actor":"Covered agency","modality":"must","action":"test","object":"proposed AI solutions","condition":"During proposal evaluation; practicable extent","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"test\" for proposed AI solutions within these source conditions: During proposal evaluation; practicable extent, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"test\" for proposed AI solutions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves proposed AI solutions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: test proposed AI solutions.","examples":{"meetsRule":"Covered agency performs the required action \"test\" for proposed AI solutions within these source conditions: During proposal evaluation; practicable extent, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"test\" for proposed AI solutions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-D151BEE055@3af1ed44d6ed4b52","id":"AIR-D151BEE055","version":"3af1ed44d6ed4b52","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should enforce approved logical-access permissions.","statement":"Organization should enforce approved logical-access permissions.","family":"Governance","body":{"legacy":{"id":"AIR-D151BEE055","version":2,"title":"Organizations should enforce approved logical-access permissions.","text":"Organization should enforce approved logical-access permissions.","topic":"Governance","intent":"enforce approved logical access permissions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-53-r5","control":"AC-3","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=50","actor":"Organization","modality":"should","action":"enforce","object":"approved logical-access permissions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"enforce\" for approved logical-access permissions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"enforce\" for approved logical-access permissions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves approved logical-access permissions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enforce approved logical-access permissions.","examples":{"meetsRule":"Organization follows the recommendation to \"enforce\" for approved logical-access permissions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"enforce\" for approved logical-access permissions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-D1EC03300E@ff3e30b28afc2253","id":"AIR-D1EC03300E","version":"ff3e30b28afc2253","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Involve interdisciplinary AI actors in context assessment","statement":"AI governance owners should involve interdisciplinary AI actors in context assessment.","family":"Governance","body":{"legacy":{"id":"AIR-D1EC03300E","version":2,"title":"Involve interdisciplinary AI actors in context assessment","text":"AI governance owners should involve interdisciplinary AI actors in context assessment.","topic":"Governance","intent":"involve interdisciplinary ai actors in context assessment","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"involve","object":"interdisciplinary AI actors in context assessment","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"involve\" for interdisciplinary AI actors in context assessment within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"involve\" for interdisciplinary AI actors in context assessment. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves interdisciplinary AI actors in context assessment. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: involve interdisciplinary AI actors in context assessment.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"involve\" for interdisciplinary AI actors in context assessment within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"involve\" for interdisciplinary AI actors in context assessment. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-D1FFF5F35C@a4bcaf0acdb8196c","id":"AIR-D1FFF5F35C","version":"a4bcaf0acdb8196c","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Use harmfully manipulative AI techniques","statement":"AI operators must not use harmfully manipulative AI techniques.","family":"Safety","body":{"legacy":{"id":"AIR-D1FFF5F35C","version":2,"title":"Use harmfully manipulative AI techniques","text":"AI operators must not use harmfully manipulative AI techniques.","topic":"Safety","intent":"use harmfully manipulative ai techniques","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"use","object":"harmfully manipulative AI techniques","condition":"Material distortion of behavior causing or likely to cause significant harm","exception":"Statutory elements must all be assessed","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"use\" for harmfully manipulative AI techniques while these conditions apply: Material distortion of behavior causing or likely to cause significant harm.","doesNotMeetRule":"AI operators performs the prohibited action \"use\" for harmfully manipulative AI techniques while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves harmfully manipulative AI techniques. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use harmfully manipulative AI techniques.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"use\" for harmfully manipulative AI techniques while these conditions apply: Material distortion of behavior causing or likely to cause significant harm.","doesNotMeetRule":"AI operators performs the prohibited action \"use\" for harmfully manipulative AI techniques while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-D4E3A56AB8@aec3865ec09bb78e","id":"AIR-D4E3A56AB8","version":"aec3865ec09bb78e","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Estimate likelihood and magnitude of AI impacts","statement":"AI governance owners should estimate likelihood and magnitude of AI impacts.","family":"Governance","body":{"legacy":{"id":"AIR-D4E3A56AB8","version":2,"title":"Estimate likelihood and magnitude of AI impacts","text":"AI governance owners should estimate likelihood and magnitude of AI impacts.","topic":"Governance","intent":"estimate likelihood and magnitude of ai impacts","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 5.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"estimate","object":"likelihood and magnitude of AI impacts","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"estimate\" for likelihood and magnitude of AI impacts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"estimate\" for likelihood and magnitude of AI impacts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves likelihood and magnitude of AI impacts. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: estimate likelihood and magnitude of AI impacts.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"estimate\" for likelihood and magnitude of AI impacts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"estimate\" for likelihood and magnitude of AI impacts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-D5475CA27F@94cb73d4ed08239d","id":"AIR-D5475CA27F","version":"94cb73d4ed08239d","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Obtain IT approval for public meeting-recording or email/calendar-connecting apps.","statement":"Users must obtain IT approval.","family":"Human oversight","body":{"legacy":{"id":"AIR-D5475CA27F","version":2,"title":"Obtain IT approval for public meeting-recording or email/calendar-connecting apps.","text":"Users must obtain IT approval.","topic":"Human oversight","intent":"obtain it approval","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"brookline-genai","control":"Use, recording-app bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"obtain","object":"IT approval","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"obtain\" for IT approval within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for IT approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves IT approval. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain IT approval.","examples":{"meetsRule":"users performs the required action \"obtain\" for IT approval within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for IT approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-D67362ED3A@462abb625892a08e","id":"AIR-D67362ED3A","version":"462abb625892a08e","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Protect trade secrets","statement":"Covered GenAI service providers must protect trade secrets.","family":"Security","body":{"legacy":{"id":"AIR-D67362ED3A","version":2,"title":"Protect trade secrets","text":"Covered GenAI service providers must protect trade secrets.","topic":"Security","intent":"protect trade secrets","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(3)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"protect","object":"trade secrets","condition":"Covered service use and provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for trade secrets within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for trade secrets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves trade secrets. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect trade secrets.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for trade secrets within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for trade secrets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-D711D2E5E0@0561cd3d226d57ce","id":"AIR-D711D2E5E0","version":"0561cd3d226d57ce","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Report serious incidents to the AI Office","statement":"Systemic-risk GPAI providers must report serious incidents to the AI Office.","family":"Safety","body":{"legacy":{"id":"AIR-D711D2E5E0","version":2,"title":"Report serious incidents to the AI Office","text":"Systemic-risk GPAI providers must report serious incidents to the AI Office.","topic":"Safety","intent":"report serious incidents to the ai office","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 55(1)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"report","object":"serious incidents to the AI Office","condition":"Covered systemic-risk models","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"report\" for serious incidents to the AI Office within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"report\" for serious incidents to the AI Office while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves serious incidents to the AI Office. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: report serious incidents to the AI Office.","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"report\" for serious incidents to the AI Office within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"report\" for serious incidents to the AI Office while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-D8BE1AA186@1b20bfcc68fa1712","id":"AIR-D8BE1AA186","version":"1b20bfcc68fa1712","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Avoid collecting unnecessary personal information","statement":"Covered GenAI service providers must avoid collecting unnecessary personal information.","family":"Privacy","body":{"legacy":{"id":"AIR-D8BE1AA186","version":2,"title":"Avoid collecting unnecessary personal information","text":"Covered GenAI service providers must avoid collecting unnecessary personal information.","topic":"Privacy","intent":"avoid collecting unnecessary personal information","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 11","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"avoid","object":"collecting unnecessary personal information","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"avoid\" for collecting unnecessary personal information within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"avoid\" for collecting unnecessary personal information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves collecting unnecessary personal information. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: avoid collecting unnecessary personal information.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"avoid\" for collecting unnecessary personal information within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"avoid\" for collecting unnecessary personal information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-D8C5075D47@d84ddd521abe79d6","id":"AIR-D8C5075D47","version":"d84ddd521abe79d6","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Ensure resilience to errors and faults","statement":"High-risk AI providers must ensure resilience to errors and faults.","family":"Governance","body":{"legacy":{"id":"AIR-D8C5075D47","version":2,"title":"Ensure resilience to errors and faults","text":"High-risk AI providers must ensure resilience to errors and faults.","topic":"Governance","intent":"ensure resilience to errors and faults","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 15(4)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"ensure","object":"resilience to errors and faults","condition":"Covered high-risk systems","exception":"Appropriate technical measures","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for resilience to errors and faults within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for resilience to errors and faults while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves resilience to errors and faults. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure resilience to errors and faults.","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for resilience to errors and faults within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for resilience to errors and faults while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-DA02521292@fb0f442688ba560a","id":"AIR-DA02521292","version":"fb0f442688ba560a","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Avoid infringing training-data intellectual property","statement":"Covered GenAI service providers must avoid infringing training-data intellectual property.","family":"Data & IP","body":{"legacy":{"id":"AIR-DA02521292","version":2,"title":"Avoid infringing training-data intellectual property","text":"Covered GenAI service providers must avoid infringing training-data intellectual property.","topic":"Data & IP","intent":"avoid infringing training data intellectual property","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 7(2)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"avoid","object":"infringing training-data intellectual property","condition":"Covered training activities","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"avoid\" for infringing training-data intellectual property within these source conditions: Covered training activities, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"avoid\" for infringing training-data intellectual property while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves infringing training-data intellectual property. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: avoid infringing training-data intellectual property.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"avoid\" for infringing training-data intellectual property within these source conditions: Covered training activities, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"avoid\" for infringing training-data intellectual property while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-DA110B3EF2@5fb47f8a5be1b724","id":"AIR-DA110B3EF2","version":"5fb47f8a5be1b724","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Take corrective action for nonconforming AI","statement":"High-risk AI providers must take corrective action for nonconforming AI.","family":"Governance","body":{"legacy":{"id":"AIR-DA110B3EF2","version":2,"title":"Take corrective action for nonconforming AI","text":"High-risk AI providers must take corrective action for nonconforming AI.","topic":"Governance","intent":"take corrective action for nonconforming ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 20(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"take","object":"corrective action for nonconforming AI","condition":"Reason to consider system nonconforming","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"take\" for corrective action for nonconforming AI within these source conditions: Reason to consider system nonconforming, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"take\" for corrective action for nonconforming AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves corrective action for nonconforming AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: take corrective action for nonconforming AI.","examples":{"meetsRule":"High-risk AI providers performs the required action \"take\" for corrective action for nonconforming AI within these source conditions: Reason to consider system nonconforming, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"take\" for corrective action for nonconforming AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-DCFE285C28@80f8b54157b055cf","id":"AIR-DCFE285C28","version":"80f8b54157b055cf","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Use online tools on state devices; downloading requires ESRMO special approval.","statement":"Employees must use online tools.","family":"Human oversight","body":{"legacy":{"id":"AIR-DCFE285C28","version":2,"title":"Use online tools on state devices; downloading requires ESRMO special approval.","text":"Employees must use online tools.","topic":"Human oversight","intent":"use online tools","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 3","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"use","object":"online tools","condition":"state device","exception":"ESRMO-approved download","timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"use\" for online tools within these source conditions: state device, and retains evidence.","doesNotMeetRule":"employees omits the required action \"use\" for online tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves online tools. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use online tools.","examples":{"meetsRule":"employees performs the required action \"use\" for online tools within these source conditions: state device, and retains evidence.","doesNotMeetRule":"employees omits the required action \"use\" for online tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-DD41393A6A@130e2fc97601e5c6","id":"AIR-DD41393A6A","version":"130e2fc97601e5c6","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Elicit AI system requirements from stakeholders","statement":"AI governance owners should elicit AI system requirements from stakeholders.","family":"Governance","body":{"legacy":{"id":"AIR-DD41393A6A","version":2,"title":"Elicit AI system requirements from stakeholders","text":"AI governance owners should elicit AI system requirements from stakeholders.","topic":"Governance","intent":"elicit ai system requirements from stakeholders","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.6","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"elicit","object":"AI system requirements from stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"elicit\" for AI system requirements from stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"elicit\" for AI system requirements from stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI system requirements from stakeholders. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: elicit AI system requirements from stakeholders.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"elicit\" for AI system requirements from stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"elicit\" for AI system requirements from stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-DD72BC62FE@e9b55167d1115092","id":"AIR-DD72BC62FE","version":"e9b55167d1115092","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Organizations should permit only authorized access needed for assigned tasks.","statement":"Organization should permit task-necessary authorized access.","family":"Governance","body":{"legacy":{"id":"AIR-DD72BC62FE","version":2,"title":"Organizations should permit only authorized access needed for assigned tasks.","text":"Organization should permit task-necessary authorized access.","topic":"Governance","intent":"permit task necessary authorized access","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-171-r3","control":"03.01.05(a)","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=20","actor":"Organization","modality":"should","action":"permit","object":"task-necessary authorized access","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"permit\" for task-necessary authorized access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"permit\" for task-necessary authorized access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves task-necessary authorized access. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: permit task-necessary authorized access.","examples":{"meetsRule":"Organization follows the recommendation to \"permit\" for task-necessary authorized access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"permit\" for task-necessary authorized access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-DDC1AF69E8@e01ae87beaf929ab","id":"AIR-DDC1AF69E8","version":"e01ae87beaf929ab","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Predict criminal offending solely from profiling","statement":"AI operators must not predict criminal offending solely from profiling.","family":"Governance","body":{"legacy":{"id":"AIR-DDC1AF69E8","version":2,"title":"Predict criminal offending solely from profiling","text":"AI operators must not predict criminal offending solely from profiling.","topic":"Governance","intent":"predict criminal offending solely from profiling","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"predict","object":"criminal offending solely from profiling","condition":"Individual risk assessments","exception":"Human assessments based on objective verifiable crime facts are excepted","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"predict\" for criminal offending solely from profiling while these conditions apply: Individual risk assessments.","doesNotMeetRule":"AI operators performs the prohibited action \"predict\" for criminal offending solely from profiling while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves criminal offending solely from profiling. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: predict criminal offending solely from profiling.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"predict\" for criminal offending solely from profiling while these conditions apply: Individual risk assessments.","doesNotMeetRule":"AI operators performs the prohibited action \"predict\" for criminal offending solely from profiling while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-DFA60F69C7@34d1f2384eaff36b","id":"AIR-DFA60F69C7","version":"34d1f2384eaff36b","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Involve independent assessors in AI evaluation","statement":"AI governance owners should involve independent assessors in AI evaluation.","family":"Evaluation","body":{"legacy":{"id":"AIR-DFA60F69C7","version":2,"title":"Involve independent assessors in AI evaluation","text":"AI governance owners should involve independent assessors in AI evaluation.","topic":"Evaluation","intent":"involve independent assessors in ai evaluation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"involve","object":"independent assessors in AI evaluation","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"involve\" for independent assessors in AI evaluation within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"involve\" for independent assessors in AI evaluation. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves independent assessors in AI evaluation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: involve independent assessors in AI evaluation.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"involve\" for independent assessors in AI evaluation within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"involve\" for independent assessors in AI evaluation. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-E05F392822@de62189c90557ced","id":"AIR-E05F392822","version":"de62189c90557ced","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Covered agencies must include contract terms enabling regular AI performance evaluation.","statement":"Covered agency must include evaluation-enabling contract terms.","family":"Procurement","body":{"legacy":{"id":"AIR-E05F392822","version":2,"title":"Covered agencies must include contract terms enabling regular AI performance evaluation.","text":"Covered agency must include evaluation-enabling contract terms.","topic":"Procurement","intent":"include evaluation enabling contract terms","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-22","control":"4(d)(ii)(E)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=10","actor":"Covered agency","modality":"must","action":"include","object":"evaluation-enabling contract terms","condition":"Applicable AI contracts under §2","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"include\" for evaluation-enabling contract terms within these source conditions: Applicable AI contracts under §2, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"include\" for evaluation-enabling contract terms while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves evaluation-enabling contract terms. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: include evaluation-enabling contract terms.","examples":{"meetsRule":"Covered agency performs the required action \"include\" for evaluation-enabling contract terms within these source conditions: Applicable AI contracts under §2, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"include\" for evaluation-enabling contract terms while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-E069B1B813@d0e787d52df48a64","id":"AIR-E069B1B813","version":"d0e787d52df48a64","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Define tasks supported by the AI system","statement":"AI governance owners should define tasks supported by the AI system.","family":"Governance","body":{"legacy":{"id":"AIR-E069B1B813","version":2,"title":"Define tasks supported by the AI system","text":"AI governance owners should define tasks supported by the AI system.","topic":"Governance","intent":"define tasks supported by the ai system","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"tasks supported by the AI system","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for tasks supported by the AI system within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for tasks supported by the AI system. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves tasks supported by the AI system. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define tasks supported by the AI system.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for tasks supported by the AI system within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for tasks supported by the AI system. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-E0CAD3FF88@228493a9f6f40dd7","id":"AIR-E0CAD3FF88","version":"228493a9f6f40dd7","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Establish GAI deployment approval thresholds","statement":"AI governance owners should establish GAI deployment approval thresholds.","family":"Human oversight","body":{"legacy":{"id":"AIR-E0CAD3FF88","version":2,"title":"Establish GAI deployment approval thresholds","text":"AI governance owners should establish GAI deployment approval thresholds.","topic":"Human oversight","intent":"establish gai deployment approval thresholds","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.3-002","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"GAI deployment approval thresholds","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for GAI deployment approval thresholds within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for GAI deployment approval thresholds. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves GAI deployment approval thresholds. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish GAI deployment approval thresholds.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for GAI deployment approval thresholds within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for GAI deployment approval thresholds. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-E28075A396@c05f72a406998f94","id":"AIR-E28075A396","version":"c05f72a406998f94","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Prominently disclose externally shared GenAI content, identifying system and version.","statement":"Users must disclose GenAI content.","family":"Transparency","body":{"legacy":{"id":"AIR-E28075A396","version":2,"title":"Prominently disclose externally shared GenAI content, identifying system and version.","text":"Users must disclose GenAI content.","topic":"Transparency","intent":"disclose genai content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.2.4, pp.6–7","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must","action":"disclose","object":"GenAI content","condition":"including partial generation","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"disclose\" for GenAI content within these source conditions: including partial generation, and retains evidence.","doesNotMeetRule":"users omits the required action \"disclose\" for GenAI content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves GenAI content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: disclose GenAI content.","examples":{"meetsRule":"users performs the required action \"disclose\" for GenAI content within these source conditions: including partial generation, and retains evidence.","doesNotMeetRule":"users omits the required action \"disclose\" for GenAI content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-E358CEFA41@80b6874b881ca2de","id":"AIR-E358CEFA41","version":"80b6874b881ca2de","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Enable AI incident identification","statement":"AI governance owners should enable AI incident identification.","family":"Safety","body":{"legacy":{"id":"AIR-E358CEFA41","version":2,"title":"Enable AI incident identification","text":"AI governance owners should enable AI incident identification.","topic":"Safety","intent":"enable ai incident identification","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 4.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"enable","object":"AI incident identification","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"enable\" for AI incident identification within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"enable\" for AI incident identification. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI incident identification. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable AI incident identification.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"enable\" for AI incident identification within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"enable\" for AI incident identification. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-E3E35C8AE8@d9113f51a24ef8f6","id":"AIR-E3E35C8AE8","version":"d9113f51a24ef8f6","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Integrate trustworthiness characteristics into AI policies","statement":"AI governance owners should integrate trustworthiness characteristics into AI policies.","family":"Governance","body":{"legacy":{"id":"AIR-E3E35C8AE8","version":2,"title":"Integrate trustworthiness characteristics into AI policies","text":"AI governance owners should integrate trustworthiness characteristics into AI policies.","topic":"Governance","intent":"integrate trustworthiness characteristics into ai policies","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"integrate","object":"trustworthiness characteristics into AI policies","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"integrate\" for trustworthiness characteristics into AI policies within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"integrate\" for trustworthiness characteristics into AI policies. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves trustworthiness characteristics into AI policies. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: integrate trustworthiness characteristics into AI policies.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"integrate\" for trustworthiness characteristics into AI policies within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"integrate\" for trustworthiness characteristics into AI policies. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-E477C3290A@a1d566c6c34de5c9","id":"AIR-E477C3290A","version":"a1d566c6c34de5c9","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document AI risks and potential impacts","statement":"AI governance owners should document AI risks and potential impacts.","family":"Governance","body":{"legacy":{"id":"AIR-E477C3290A","version":2,"title":"Document AI risks and potential impacts","text":"AI governance owners should document AI risks and potential impacts.","topic":"Governance","intent":"document ai risks and potential impacts","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI risks and potential impacts","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risks and potential impacts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risks and potential impacts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI risks and potential impacts. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI risks and potential impacts.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risks and potential impacts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risks and potential impacts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-E4C9EA7E18@d8c85f5cc0d70f15","id":"AIR-E4C9EA7E18","version":"d8c85f5cc0d70f15","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Track emerging AI risks","statement":"AI governance owners should track emerging AI risks.","family":"Governance","body":{"legacy":{"id":"AIR-E4C9EA7E18","version":2,"title":"Track emerging AI risks","text":"AI governance owners should track emerging AI risks.","topic":"Governance","intent":"track emerging ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"track","object":"emerging AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"track\" for emerging AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"track\" for emerging AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves emerging AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: track emerging AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"track\" for emerging AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"track\" for emerging AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-E528E1DA42@48d256608f07f2b5","id":"AIR-E528E1DA42","version":"48d256608f07f2b5","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Train personnel in their AI risk responsibilities","statement":"AI governance owners should train personnel in their AI risk responsibilities.","family":"Governance","body":{"legacy":{"id":"AIR-E528E1DA42","version":2,"title":"Train personnel in their AI risk responsibilities","text":"AI governance owners should train personnel in their AI risk responsibilities.","topic":"Governance","intent":"train personnel in their ai risk responsibilities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"train","object":"personnel in their AI risk responsibilities","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"train\" for personnel in their AI risk responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"train\" for personnel in their AI risk responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personnel in their AI risk responsibilities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: train personnel in their AI risk responsibilities.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"train\" for personnel in their AI risk responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"train\" for personnel in their AI risk responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-E59A08E459@33c8b38759b2908d","id":"AIR-E59A08E459","version":"33c8b38759b2908d","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Assign human oversight to competent personnel","statement":"High-risk AI deployers must assign human oversight to competent personnel.","family":"Human oversight","body":{"legacy":{"id":"AIR-E59A08E459","version":2,"title":"Assign human oversight to competent personnel","text":"High-risk AI deployers must assign human oversight to competent personnel.","topic":"Human oversight","intent":"assign human oversight to competent personnel","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 26(2)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"assign","object":"human oversight to competent personnel","condition":"Covered high-risk AI use","exception":"Necessary training and authority","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"assign\" for human oversight to competent personnel within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"assign\" for human oversight to competent personnel while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves human oversight to competent personnel. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assign human oversight to competent personnel.","examples":{"meetsRule":"High-risk AI deployers performs the required action \"assign\" for human oversight to competent personnel within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"assign\" for human oversight to competent personnel while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-E7F9A07274@453678b2d8eb8b8e","id":"AIR-E7F9A07274","version":"453678b2d8eb8b8e","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Collect feedback from affected stakeholders","statement":"AI governance owners should collect feedback from affected stakeholders.","family":"Governance","body":{"legacy":{"id":"AIR-E7F9A07274","version":2,"title":"Collect feedback from affected stakeholders","text":"AI governance owners should collect feedback from affected stakeholders.","topic":"Governance","intent":"collect feedback from affected stakeholders","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 5.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"collect","object":"feedback from affected stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"collect\" for feedback from affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"collect\" for feedback from affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves feedback from affected stakeholders. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: collect feedback from affected stakeholders.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"collect\" for feedback from affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"collect\" for feedback from affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-E80EDA7CD6@036513630d55f1a6","id":"AIR-E80EDA7CD6","version":"036513630d55f1a6","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Measure AI performance under deployment-like conditions","statement":"AI governance owners should measure AI performance under deployment-like conditions.","family":"Evaluation","body":{"legacy":{"id":"AIR-E80EDA7CD6","version":2,"title":"Measure AI performance under deployment-like conditions","text":"AI governance owners should measure AI performance under deployment-like conditions.","topic":"Evaluation","intent":"measure ai performance under deployment like conditions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"measure","object":"AI performance under deployment-like conditions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"measure\" for AI performance under deployment-like conditions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"measure\" for AI performance under deployment-like conditions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI performance under deployment-like conditions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: measure AI performance under deployment-like conditions.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"measure\" for AI performance under deployment-like conditions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"measure\" for AI performance under deployment-like conditions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-E86C054724@9a8c36635cd43279","id":"AIR-E86C054724","version":"9a8c36635cd43279","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Monitor pre-trained models used in development","statement":"AI governance owners should monitor pre-trained models used in development.","family":"Governance","body":{"legacy":{"id":"AIR-E86C054724","version":2,"title":"Monitor pre-trained models used in development","text":"AI governance owners should monitor pre-trained models used in development.","topic":"Governance","intent":"monitor pre trained models used in development","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"pre-trained models used in development","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for pre-trained models used in development within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for pre-trained models used in development. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves pre-trained models used in development. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: monitor pre-trained models used in development.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for pre-trained models used in development within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for pre-trained models used in development. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-E89D3740A1@1bbda13ba2404d8d","id":"AIR-E89D3740A1","version":"1bbda13ba2404d8d","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Categorize sensitive attributes through biometrics","statement":"AI operators must not categorize sensitive attributes through biometrics.","family":"Privacy","body":{"legacy":{"id":"AIR-E89D3740A1","version":2,"title":"Categorize sensitive attributes through biometrics","text":"AI operators must not categorize sensitive attributes through biometrics.","topic":"Privacy","intent":"categorize sensitive attributes through biometrics","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(g)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"categorize","object":"sensitive attributes through biometrics","condition":"Covered biometric categorization","exception":"Specified dataset labeling and law-enforcement exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"categorize\" for sensitive attributes through biometrics while these conditions apply: Covered biometric categorization.","doesNotMeetRule":"AI operators performs the prohibited action \"categorize\" for sensitive attributes through biometrics while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves sensitive attributes through biometrics. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: categorize sensitive attributes through biometrics.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"categorize\" for sensitive attributes through biometrics while these conditions apply: Covered biometric categorization.","doesNotMeetRule":"AI operators performs the prohibited action \"categorize\" for sensitive attributes through biometrics while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-E98925E526@6bd2395b938c69d4","id":"AIR-E98925E526","version":"6bd2395b938c69d4","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Define human oversight processes","statement":"AI governance owners should define human oversight processes.","family":"Human oversight","body":{"legacy":{"id":"AIR-E98925E526","version":2,"title":"Define human oversight processes","text":"AI governance owners should define human oversight processes.","topic":"Human oversight","intent":"define human oversight processes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 3.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"human oversight processes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for human oversight processes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for human oversight processes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves human oversight processes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define human oversight processes.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for human oversight processes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for human oversight processes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-EB5574CE22@27c89c0bee804f65","id":"AIR-EB5574CE22","version":"27c89c0bee804f65","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document incidents involving third-party GAI systems","statement":"AI governance owners should document incidents involving third-party GAI systems.","family":"Safety","body":{"legacy":{"id":"AIR-EB5574CE22","version":2,"title":"Document incidents involving third-party GAI systems","text":"AI governance owners should document incidents involving third-party GAI systems.","topic":"Safety","intent":"document incidents involving third party gai systems","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-6.2-002","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"incidents involving third-party GAI systems","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for incidents involving third-party GAI systems within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for incidents involving third-party GAI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves incidents involving third-party GAI systems. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document incidents involving third-party GAI systems.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for incidents involving third-party GAI systems within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for incidents involving third-party GAI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-EBC5423CFD@2d0f74d7690e4f19","id":"AIR-EBC5423CFD","version":"2d0f74d7690e4f19","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Follow incident protocols for suspected breaches or data-protection violations.","statement":"Employees must follow incident protocols.","family":"Safety","body":{"legacy":{"id":"AIR-EBC5423CFD","version":2,"title":"Follow incident protocols for suspected breaches or data-protection violations.","text":"Employees must follow incident protocols.","topic":"Safety","intent":"follow incident protocols","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, reporting, bullet 2","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"follow","object":"incident protocols","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"follow\" for incident protocols within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"follow\" for incident protocols while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves incident protocols. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: follow incident protocols.","examples":{"meetsRule":"employees performs the required action \"follow\" for incident protocols within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"follow\" for incident protocols while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-F027EE41CE@d677a0372296b2c9","id":"AIR-F027EE41CE","version":"d677a0372296b2c9","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Limit processing to specified purposes","statement":"Data controllers must limit processing to specified purposes.","family":"Governance","body":{"legacy":{"id":"AIR-F027EE41CE","version":2,"title":"Limit processing to specified purposes","text":"Data controllers must limit processing to specified purposes.","topic":"Governance","intent":"limit processing to specified purposes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(b)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"limit","object":"processing to specified purposes","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"limit\" for processing to specified purposes within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"limit\" for processing to specified purposes while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves processing to specified purposes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: limit processing to specified purposes.","examples":{"meetsRule":"Data controllers performs the required action \"limit\" for processing to specified purposes within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"limit\" for processing to specified purposes while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-F1A3CFC876@379e3e5f01416194","id":"AIR-F1A3CFC876","version":"379e3e5f01416194","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document AI test sets and evaluation metrics","statement":"AI governance owners should document AI test sets and evaluation metrics.","family":"Evaluation","body":{"legacy":{"id":"AIR-F1A3CFC876","version":2,"title":"Document AI test sets and evaluation metrics","text":"AI governance owners should document AI test sets and evaluation metrics.","topic":"Evaluation","intent":"document ai test sets and evaluation metrics","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI test sets and evaluation metrics","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI test sets and evaluation metrics within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI test sets and evaluation metrics. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI test sets and evaluation metrics. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI test sets and evaluation metrics.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI test sets and evaluation metrics within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI test sets and evaluation metrics. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-F24F48122C@cabc825842e76334","id":"AIR-F24F48122C","version":"cabc825842e76334","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Plan a halt to unacceptable-risk GAI development","statement":"AI governance owners should plan a halt to unacceptable-risk GAI development.","family":"Safety","body":{"legacy":{"id":"AIR-F24F48122C","version":2,"title":"Plan a halt to unacceptable-risk GAI development","text":"AI governance owners should plan a halt to unacceptable-risk GAI development.","topic":"Safety","intent":"plan a halt to unacceptable risk gai development","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.3-007","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"plan","object":"a halt to unacceptable-risk GAI development","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for a halt to unacceptable-risk GAI development within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for a halt to unacceptable-risk GAI development. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a halt to unacceptable-risk GAI development. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: plan a halt to unacceptable-risk GAI development.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for a halt to unacceptable-risk GAI development within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for a halt to unacceptable-risk GAI development. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-F306231C79@caf52b00cf41c374","id":"AIR-F306231C79","version":"caf52b00cf41c374","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Infer emotions in workplaces or schools","statement":"AI operators must not infer emotions in workplaces or schools.","family":"Governance","body":{"legacy":{"id":"AIR-F306231C79","version":2,"title":"Infer emotions in workplaces or schools","text":"AI operators must not infer emotions in workplaces or schools.","topic":"Governance","intent":"infer emotions in workplaces or schools","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(f)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"infer","object":"emotions in workplaces or schools","condition":"Covered emotion recognition systems","exception":"Medical or safety reasons","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"infer\" for emotions in workplaces or schools while these conditions apply: Covered emotion recognition systems.","doesNotMeetRule":"AI operators performs the prohibited action \"infer\" for emotions in workplaces or schools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves emotions in workplaces or schools. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: infer emotions in workplaces or schools.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"infer\" for emotions in workplaces or schools while these conditions apply: Covered emotion recognition systems.","doesNotMeetRule":"AI operators performs the prohibited action \"infer\" for emotions in workplaces or schools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-F3D285541D@bc96e432e51bf4d2","id":"AIR-F3D285541D","version":"bc96e432e51bf4d2","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Consider viable non-AI alternatives","statement":"AI governance owners should consider viable non-AI alternatives.","family":"Governance","body":{"legacy":{"id":"AIR-F3D285541D","version":2,"title":"Consider viable non-AI alternatives","text":"AI governance owners should consider viable non-AI alternatives.","topic":"Governance","intent":"consider viable non ai alternatives","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"consider","object":"viable non-AI alternatives","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for viable non-AI alternatives within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for viable non-AI alternatives. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves viable non-AI alternatives. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: consider viable non-AI alternatives.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for viable non-AI alternatives within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for viable non-AI alternatives. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-F52DD6D81F@f56b78a67bafc8d2","id":"AIR-F52DD6D81F","version":"f56b78a67bafc8d2","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Assign responsibility for content provenance reviews","statement":"AI governance owners should assign responsibility for content provenance reviews.","family":"Transparency","body":{"legacy":{"id":"AIR-F52DD6D81F","version":2,"title":"Assign responsibility for content provenance reviews","text":"AI governance owners should assign responsibility for content provenance reviews.","topic":"Transparency","intent":"assign responsibility for content provenance reviews","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.5-001","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"assign","object":"responsibility for content provenance reviews","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assign\" for responsibility for content provenance reviews within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"assign\" for responsibility for content provenance reviews. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves responsibility for content provenance reviews. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assign responsibility for content provenance reviews.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assign\" for responsibility for content provenance reviews within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"assign\" for responsibility for content provenance reviews. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-F61F6AC2CB@56d05301885c6e58","id":"AIR-F61F6AC2CB","version":"56d05301885c6e58","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Document intended AI use contexts","statement":"AI governance owners should document intended AI use contexts.","family":"Governance","body":{"legacy":{"id":"AIR-F61F6AC2CB","version":2,"title":"Document intended AI use contexts","text":"AI governance owners should document intended AI use contexts.","topic":"Governance","intent":"document intended ai use contexts","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"intended AI use contexts","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for intended AI use contexts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for intended AI use contexts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves intended AI use contexts. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document intended AI use contexts.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for intended AI use contexts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for intended AI use contexts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-F6290E21EB@f19e8c0b437c9d53","id":"AIR-F6290E21EB","version":"f19e8c0b437c9d53","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Monitor AI behavior in production","statement":"AI governance owners should monitor AI behavior in production.","family":"Governance","body":{"legacy":{"id":"AIR-F6290E21EB","version":2,"title":"Monitor AI behavior in production","text":"AI governance owners should monitor AI behavior in production.","topic":"Governance","intent":"monitor ai behavior in production","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"AI behavior in production","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for AI behavior in production within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for AI behavior in production. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI behavior in production. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: monitor AI behavior in production.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for AI behavior in production within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for AI behavior in production. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-FBD73FD1D8@fcebf6c55b97a17c","id":"AIR-FBD73FD1D8","version":"fcebf6c55b97a17c","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Inform affected workers of high-risk AI use","statement":"Employer deployers must inform affected workers of high-risk AI use.","family":"Governance","body":{"legacy":{"id":"AIR-FBD73FD1D8","version":2,"title":"Inform affected workers of high-risk AI use","text":"Employer deployers must inform affected workers of high-risk AI use.","topic":"Governance","intent":"inform affected workers of high risk ai use","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 26(7)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Employer deployers","modality":"must","action":"inform","object":"affected workers of high-risk AI use","condition":"Before workplace use","exception":"National information rights also apply","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Employer deployers performs the required action \"inform\" for affected workers of high-risk AI use within these source conditions: Before workplace use, and retains evidence.","doesNotMeetRule":"Employer deployers omits the required action \"inform\" for affected workers of high-risk AI use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves affected workers of high-risk AI use. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inform affected workers of high-risk AI use.","examples":{"meetsRule":"Employer deployers performs the required action \"inform\" for affected workers of high-risk AI use within these source conditions: Before workplace use, and retains evidence.","doesNotMeetRule":"Employer deployers omits the required action \"inform\" for affected workers of high-risk AI use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-FC4DFA8060@27a742230b44339c","id":"AIR-FC4DFA8060","version":"27a742230b44339c","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Evaluate AI safety risks","statement":"AI governance owners should evaluate AI safety risks.","family":"Safety","body":{"legacy":{"id":"AIR-FC4DFA8060","version":2,"title":"Evaluate AI safety risks","text":"AI governance owners should evaluate AI safety risks.","topic":"Safety","intent":"evaluate ai safety risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.6","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"AI safety risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI safety risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI safety risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI safety risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate AI safety risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI safety risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI safety risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-FC504B8B3E@44396d3a1667e971","id":"AIR-FC504B8B3E","version":"44396d3a1667e971","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Retain required conformity documentation","statement":"High-risk AI providers must retain required conformity documentation.","family":"Governance","body":{"legacy":{"id":"AIR-FC504B8B3E","version":2,"title":"Retain required conformity documentation","text":"High-risk AI providers must retain required conformity documentation.","topic":"Governance","intent":"retain required conformity documentation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 18(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"retain","object":"required conformity documentation","condition":"Following market placement","exception":"Retention period and amendments require review","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"retain\" for required conformity documentation within these source conditions: Following market placement, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"retain\" for required conformity documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves required conformity documentation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: retain required conformity documentation.","examples":{"meetsRule":"High-risk AI providers performs the required action \"retain\" for required conformity documentation within these source conditions: Following market placement, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"retain\" for required conformity documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-FD9E9E9724@1012ed2a7988dabb","id":"AIR-FD9E9E9724","version":"1012ed2a7988dabb","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Identify reasonably foreseeable AI risks","statement":"High-risk AI providers must identify reasonably foreseeable AI risks.","family":"Governance","body":{"legacy":{"id":"AIR-FD9E9E9724","version":2,"title":"Identify reasonably foreseeable AI risks","text":"High-risk AI providers must identify reasonably foreseeable AI risks.","topic":"Governance","intent":"identify reasonably foreseeable ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 9(2)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"identify","object":"reasonably foreseeable AI risks","condition":"Intended purpose and foreseeable misuse","exception":"Applicability date and scope review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"identify\" for reasonably foreseeable AI risks within these source conditions: Intended purpose and foreseeable misuse, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"identify\" for reasonably foreseeable AI risks while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves reasonably foreseeable AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: identify reasonably foreseeable AI risks.","examples":{"meetsRule":"High-risk AI providers performs the required action \"identify\" for reasonably foreseeable AI risks within these source conditions: Intended purpose and foreseeable misuse, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"identify\" for reasonably foreseeable AI risks while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-FED5F6D978@b3cf26d93229f90e","id":"AIR-FED5F6D978","version":"b3cf26d93229f90e","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Apply human-subject protections in AI evaluation","statement":"AI governance owners should apply human-subject protections in AI evaluation.","family":"Human oversight","body":{"legacy":{"id":"AIR-FED5F6D978","version":2,"title":"Apply human-subject protections in AI evaluation","text":"AI governance owners should apply human-subject protections in AI evaluation.","topic":"Human oversight","intent":"apply human subject protections in ai evaluation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"apply","object":"human-subject protections in AI evaluation","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"apply\" for human-subject protections in AI evaluation within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"apply\" for human-subject protections in AI evaluation. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves human-subject protections in AI evaluation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: apply human-subject protections in AI evaluation.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"apply\" for human-subject protections in AI evaluation within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"apply\" for human-subject protections in AI evaluation. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-FED6DB2BF6@171f97503ad3de30","id":"AIR-FED6DB2BF6","version":"171f97503ad3de30","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Notify the authority of qualifying personal-data breaches","statement":"Data controllers must notify the authority of qualifying personal-data breaches.","family":"Privacy","body":{"legacy":{"id":"AIR-FED6DB2BF6","version":2,"title":"Notify the authority of qualifying personal-data breaches","text":"Data controllers must notify the authority of qualifying personal-data breaches.","topic":"Privacy","intent":"notify the authority of qualifying personal data breaches","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 33(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"notify","object":"the authority of qualifying personal-data breaches","condition":"Without undue delay and where feasible within 72 hours","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"notify\" for the authority of qualifying personal-data breaches within these source conditions: Without undue delay and where feasible within 72 hours, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"notify\" for the authority of qualifying personal-data breaches while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves the authority of qualifying personal-data breaches. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: notify the authority of qualifying personal-data breaches.","examples":{"meetsRule":"Data controllers performs the required action \"notify\" for the authority of qualifying personal-data breaches within these source conditions: Without undue delay and where feasible within 72 hours, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"notify\" for the authority of qualifying personal-data breaches while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"AIR-FEDC04B3F1@f043d388f59ae1c8","id":"AIR-FEDC04B3F1","version":"f043d388f59ae1c8","kind":"rule","lifecycle":"LEGACY_PUBLISHED","title":"Review administrative AI content for accuracy, tone, and appropriateness.","statement":"Users must review content.","family":"Human oversight","body":{"legacy":{"id":"AIR-FEDC04B3F1","version":2,"title":"Review administrative AI content for accuracy, tone, and appropriateness.","text":"Users must review content.","topic":"Human oversight","intent":"review content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"General Expectations for Administrative Use","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must","action":"review","object":"content","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"review\" for content within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"review\" for content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: review content.","examples":{"meetsRule":"users performs the required action \"review\" for content within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"review\" for content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},"sourceRelease":"2026-10-03.2","adopted":false,"machineExecutable":false}},{"key":"MS-CAND-NEW-001@509512b407ba323f","id":"MS-CAND-NEW-001","version":"509512b407ba323f","kind":"rule","lifecycle":"DRAFT","title":"Additionally, these goals will strengthen North Carolina’s economy by empowering our…","statement":"Additionally, these goals will strengthen North Carolina’s economy by empowering  our workforce and businesses to deploy AI tools responsibly, supporting innovation and economic competitiveness, and  preparing communities for the economy of the future.","family":"Governance","body":{"sourceId":"NEW-001","decisionLogic":"Additionally, these goals will strengthen North Carolina’s economy by empowering  our workforce and businesses to deploy AI tools responsibly, supporting innovation and economic competitiveness, and  preparing communities for the economy of the future.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-002@dd7cd2c2185cb3be","id":"MS-CAND-NEW-002","version":"dd7cd2c2185cb3be","kind":"rule","lifecycle":"DRAFT","title":"To successfully implement most of the recommendations, the State will need…","statement":"To successfully implement most of the recommendations, the State will need to realign its existing funding, and in  other cases, seek more resources from governmental and non-governmental sources.","family":"Output and Use","body":{"sourceId":"NEW-002","decisionLogic":"To successfully implement most of the recommendations, the State will need to realign its existing funding, and in  other cases, seek more resources from governmental and non-governmental sources.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-003@7f66b26f02e70247","id":"MS-CAND-NEW-003","version":"7f66b26f02e70247","kind":"rule","lifecycle":"DRAFT","title":"General Assembly shares our desire to safeguard public trust and empower…","statement":"General Assembly shares our desire to safeguard public trust and empower the  workforce, and NCGA support will be crucial.","family":"Governance","body":{"sourceId":"NEW-003","decisionLogic":"General Assembly shares our desire to safeguard public trust and empower the  workforce, and NCGA support will be crucial.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-004@1f7783b7dfd1c8f0","id":"MS-CAND-NEW-004","version":"1f7783b7dfd1c8f0","kind":"rule","lifecycle":"DRAFT","title":"To realize this ambitious vision, North Carolina state agencies will collaborate…","statement":"To realize this ambitious vision, North Carolina state agencies will collaborate with higher education institutions, private employers,  nonprofits, and workforce partners to create pathways for success in an AI-driven future.","family":"Governance","body":{"sourceId":"NEW-004","decisionLogic":"To realize this ambitious vision, North Carolina state agencies will collaborate with higher education institutions, private employers,  nonprofits, and workforce partners to create pathways for success in an AI-driven future.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-005@661eef265a01d387","id":"MS-CAND-NEW-005","version":"661eef265a01d387","kind":"rule","lifecycle":"DRAFT","title":"Through these collective efforts, the state seeks to ensure that every…","statement":"Through these collective efforts, the  state seeks to ensure that every North Carolinian has the opportunity to thrive in a landscape that will be shaped by advanced  technology.","family":"Operations","body":{"sourceId":"NEW-005","decisionLogic":"Through these collective efforts, the  state seeks to ensure that every North Carolinian has the opportunity to thrive in a landscape that will be shaped by advanced  technology.","defaultMode":"Detect / log","automationTier":"E1 — observe","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Event / log","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-006@2b402714e7447ef9","id":"MS-CAND-NEW-006","version":"2b402714e7447ef9","kind":"rule","lifecycle":"DRAFT","title":"Workforce Empowerment Ensure technology augments rather than replaces the workforce by…","statement":"Workforce Empowerment  Ensure technology augments rather than replaces the workforce by preparing workers in all industries, including state  government, for an AI-enabled economy by upskilling, reskilling, and strengthening the worker safety net.","family":"Operations","body":{"sourceId":"NEW-006","decisionLogic":"Workforce Empowerment  Ensure technology augments rather than replaces the workforce by preparing workers in all industries, including state  government, for an AI-enabled economy by upskilling, reskilling, and strengthening the worker safety net.","defaultMode":"Detect / log","automationTier":"E1 — observe","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Event / log","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-007@1968c0b4da07c794","id":"MS-CAND-NEW-007","version":"1968c0b4da07c794","kind":"rule","lifecycle":"DRAFT","title":"Also must respect personal autonomy and dignity, maintaining people’s freedom to…","statement":"Systems also must respect personal autonomy and  dignity, maintaining people’s freedom to think, choose, and act independently, and systems must prevent manipulation or restriction of choices.","family":"Governance","body":{"sourceId":"NEW-007","decisionLogic":"Systems also must respect personal autonomy and  dignity, maintaining people’s freedom to think, choose, and act independently, and systems must prevent manipulation or restriction of choices.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-008@7f5e7d46a2aad819","id":"MS-CAND-NEW-008","version":"7f5e7d46a2aad819","kind":"rule","lifecycle":"DRAFT","title":"Since the creation of the Executive Order, the Council has been…","statement":"Since the creation of the  Executive Order, the Council has been focused on creating informed recommendations on policy, governance, ethics, and literacy to ensure the safe, transparent,  and fair adoption of artificial intelligence across the state and to develop recommendations to address the potential impact of AI on the workforce.","family":"Governance","body":{"sourceId":"NEW-008","decisionLogic":"Since the creation of the  Executive Order, the Council has been focused on creating informed recommendations on policy, governance, ethics, and literacy to ensure the safe, transparent,  and fair adoption of artificial intelligence across the state and to develop recommendations to address the potential impact of AI on the workforce.","defaultMode":"Require evidence","automationTier":"E0 — evidence","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Policy / training / approval","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-009@dc38476b6ec92927","id":"MS-CAND-NEW-009","version":"dc38476b6ec92927","kind":"rule","lifecycle":"DRAFT","title":"The goals are grouped into three categories to ensure a clear…","statement":"The  goals are grouped into three categories to ensure a clear and actionable framework that supports statewide safety, opportunity, and innovation:  1)   Protect   focuses on safeguarding North Carolina residents through responsible AI use and strong risk mitigation practices.","family":"Governance","body":{"sourceId":"NEW-009","decisionLogic":"The  goals are grouped into three categories to ensure a clear and actionable framework that supports statewide safety, opportunity, and innovation:  1)   Protect   focuses on safeguarding North Carolina residents through responsible AI use and strong risk mitigation practices.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-010@1f0aa4ed22f3b974","id":"MS-CAND-NEW-010","version":"1f0aa4ed22f3b974","kind":"rule","lifecycle":"DRAFT","title":"Each of these recommendations has been created with an implementation plan…","statement":"Each of these recommendations has been created with an implementation plan and timeline, recognizing that work will progress and be shared as it is  available.","family":"Governance","body":{"sourceId":"NEW-010","decisionLogic":"Each of these recommendations has been created with an implementation plan and timeline, recognizing that work will progress and be shared as it is  available.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-011@eb8c525f119b2451","id":"MS-CAND-NEW-011","version":"eb8c525f119b2451","kind":"rule","lifecycle":"DRAFT","title":"The recommendations below were identified by the Council to improve AI…","statement":"The recommendations below were identified by the Council to improve  AI policy, governance, ethics, and literacy for the state with the understanding that AI will continue to evolve.","family":"Governance","body":{"sourceId":"NEW-011","decisionLogic":"The recommendations below were identified by the Council to improve  AI policy, governance, ethics, and literacy for the state with the understanding that AI will continue to evolve.","defaultMode":"Require evidence","automationTier":"E0 — evidence","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Policy / training / approval","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-012@63aeb4ef30b9a5ea","id":"MS-CAND-NEW-012","version":"63aeb4ef30b9a5ea","kind":"rule","lifecycle":"DRAFT","title":"Details: As AI continues to reshape society, the state will explore…","statement":"Details:   As AI continues to reshape society, the state will explore a package of statewide policies that address numerous  concerns enabled by AI technologies, including child safety and mental health, lack of privacy protections, and senior  citizen fraud and abuse.","family":"Data Protection","body":{"sourceId":"NEW-012","decisionLogic":"Details:   As AI continues to reshape society, the state will explore a package of statewide policies that address numerous  concerns enabled by AI technologies, including child safety and mental health, lack of privacy protections, and senior  citizen fraud and abuse.","defaultMode":"Detect / log","automationTier":"E1 — observe","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Event / log","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-013@4a78d015b8aed3b2","id":"MS-CAND-NEW-013","version":"4a78d015b8aed3b2","kind":"rule","lifecycle":"DRAFT","title":"Child safety components will focus on foundational safety requirements that encourage…","statement":"Child safety components will focus on foundational safety requirements that encourage non-  addictive designs and establish a standard duty of care.","family":"Input and Content","body":{"sourceId":"NEW-013","decisionLogic":"Child safety components will focus on foundational safety requirements that encourage non-  addictive designs and establish a standard duty of care.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-014@a900830f86017334","id":"MS-CAND-NEW-014","version":"a900830f86017334","kind":"rule","lifecycle":"DRAFT","title":"By 2029, approximately half of US jobs will be transformed by…","statement":"By 2029, approximately half of US jobs will be   transformed by AI .","family":"Governance","body":{"sourceId":"NEW-014","decisionLogic":"By 2029, approximately half of US jobs will be   transformed by AI .","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-015@059ceef5f7f28f3e","id":"MS-CAND-NEW-015","version":"059ceef5f7f28f3e","kind":"rule","lifecycle":"DRAFT","title":"Details: North Carolina must proactively provide accessible pathways back into high-demand,…","statement":"Details:   North Carolina must proactively provide accessible pathways back into high-demand, sustainable careers.","family":"Governance","body":{"sourceId":"NEW-015","decisionLogic":"Details:   North Carolina must proactively provide accessible pathways back into high-demand, sustainable careers.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-016@a111ada45bf38256","id":"MS-CAND-NEW-016","version":"a111ada45bf38256","kind":"rule","lifecycle":"DRAFT","title":"This will be accomplished through identifying and supporting workers in roles…","statement":"This will be accomplished through identifying and supporting workers in roles most vulnerable to automation and  partnering with employers, Commerce’s Labor and Economic Analysis Division, community colleges, local workforce  development boards, and NCWorks Career Centers to track labor-market signals and pinpoint high-risk areas of AI-driven  displacement.","family":"Access and Use","body":{"sourceId":"NEW-016","decisionLogic":"This will be accomplished through identifying and supporting workers in roles most vulnerable to automation and  partnering with employers, Commerce’s Labor and Economic Analysis Division, community colleges, local workforce  development boards, and NCWorks Career Centers to track labor-market signals and pinpoint high-risk areas of AI-driven  displacement.","defaultMode":"Require evidence","automationTier":"E0 — evidence","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Policy / training / approval","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-017@b5e5161410a8d580","id":"MS-CAND-NEW-017","version":"b5e5161410a8d580","kind":"rule","lifecycle":"DRAFT","title":"Embedding work-based learning opportunities and direct employer connections will accelerate reentry…","statement":"Embedding work-based  learning opportunities and direct employer connections will accelerate reentry into private- and public-sector roles.","family":"Access and Use","body":{"sourceId":"NEW-017","decisionLogic":"Embedding work-based  learning opportunities and direct employer connections will accelerate reentry into private- and public-sector roles.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-018@54f9a4e37a671e7a","id":"MS-CAND-NEW-018","version":"54f9a4e37a671e7a","kind":"rule","lifecycle":"DRAFT","title":"Using displacement data and worker feedback will support the design of…","statement":"Using  displacement data and worker feedback will support the design of career transition tracks tailored to the needs and  experiences of AI-impacted workers to avoid long-term unemployment.","family":"Governance","body":{"sourceId":"NEW-018","decisionLogic":"Using  displacement data and worker feedback will support the design of career transition tracks tailored to the needs and  experiences of AI-impacted workers to avoid long-term unemployment.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-019@cfda8bff95bda54a","id":"MS-CAND-NEW-019","version":"cfda8bff95bda54a","kind":"rule","lifecycle":"DRAFT","title":"Additionally, tracking the re-skilling programs that successfully lead to meaningful employment…","statement":"Additionally, tracking the re-skilling programs that  successfully lead to meaningful employment will help improve other reskilling tracks.","family":"Governance","body":{"sourceId":"NEW-019","decisionLogic":"Additionally, tracking the re-skilling programs that  successfully lead to meaningful employment will help improve other reskilling tracks.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-020@49217c323c1ec189","id":"MS-CAND-NEW-020","version":"49217c323c1ec189","kind":"rule","lifecycle":"DRAFT","title":"Details: North Carolina must be ready to detect and respond to…","statement":"Details:   North Carolina must be ready to detect and respond to AI-driven labor disruptions early to stabilize the workforce.","family":"Governance","body":{"sourceId":"NEW-020","decisionLogic":"Details:   North Carolina must be ready to detect and respond to AI-driven labor disruptions early to stabilize the workforce.","defaultMode":"Detect / log","automationTier":"E1 — observe","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Event / log","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-021@acf75b35650aad9b","id":"MS-CAND-NEW-021","version":"acf75b35650aad9b","kind":"rule","lifecycle":"DRAFT","title":"This effort will be advanced through advocating for legislation to counteract…","statement":"This effort will be advanced through advocating for legislation to counteract potential AI-driven labor disruptions and  to prepare for any such disruptions.","family":"Governance","body":{"sourceId":"NEW-021","decisionLogic":"This effort will be advanced through advocating for legislation to counteract potential AI-driven labor disruptions and  to prepare for any such disruptions.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-022@2d639205a30919ff","id":"MS-CAND-NEW-022","version":"2d639205a30919ff","kind":"rule","lifecycle":"DRAFT","title":"Worker Adjustment and Retraining Notification (WARN) data collection processes will help…","statement":"Worker Adjustment and Retraining Notification  (WARN) data collection processes will help to explicitly capture AI-related job losses and use these insights to inform  retraining opportunities to avoid long-term unemployment.","family":"Operations","body":{"sourceId":"NEW-022","decisionLogic":"Worker Adjustment and Retraining Notification  (WARN) data collection processes will help to explicitly capture AI-related job losses and use these insights to inform  retraining opportunities to avoid long-term unemployment.","defaultMode":"Require evidence","automationTier":"E0 — evidence","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Policy / training / approval","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-023@2359834ed0531f83","id":"MS-CAND-NEW-023","version":"2359834ed0531f83","kind":"rule","lifecycle":"DRAFT","title":"In parallel, partnering with higher education institutions will allow the collection…","statement":"In parallel, partnering with higher education institutions will  allow the collection of more granular unemployment and program-enrollment data that can signal emerging displacement  trends and inform rapid intervention strategies to improve early detection and response.","family":"Governance","body":{"sourceId":"NEW-023","decisionLogic":"In parallel, partnering with higher education institutions will  allow the collection of more granular unemployment and program-enrollment data that can signal emerging displacement  trends and inform rapid intervention strategies to improve early detection and response.","defaultMode":"Detect / log","automationTier":"E1 — observe","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Event / log","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-024@bbb6556715869f07","id":"MS-CAND-NEW-024","version":"bbb6556715869f07","kind":"rule","lifecycle":"DRAFT","title":"General Assembly Timeline: March 2027 Goal 3: Account for Resource Demands…","statement":"General Assembly  Timeline:   March 2027  Goal 3: Account for Resource Demands and Impacts  Ensure appropriate environmental stewardship that balances community needs and public trust with the  demands that AI creates on land, water, and energy.","family":"Governance","body":{"sourceId":"NEW-024","decisionLogic":"General Assembly  Timeline:   March 2027  Goal 3: Account for Resource Demands and Impacts  Ensure appropriate environmental stewardship that balances community needs and public trust with the  demands that AI creates on land, water, and energy.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-025@b5f600cff2931a26","id":"MS-CAND-NEW-025","version":"b5f600cff2931a26","kind":"rule","lifecycle":"DRAFT","title":"These facilities serve as the backbone of AI, and as AI…","statement":"These  facilities serve as the backbone of AI, and as AI continues to advance, the demand for data centers will only increase.","family":"Governance","body":{"sourceId":"NEW-025","decisionLogic":"These  facilities serve as the backbone of AI, and as AI continues to advance, the demand for data centers will only increase.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-026@3215de61044934fd","id":"MS-CAND-NEW-026","version":"3215de61044934fd","kind":"rule","lifecycle":"DRAFT","title":"It is essential for states to thoroughly assess the economic opportunities…","statement":"It is essential for states to thoroughly assess the economic opportunities data centers  bring alongside the impact these facilities have on communities to maximize benefits and reduce data center challenges.","family":"Governance","body":{"sourceId":"NEW-026","decisionLogic":"It is essential for states to thoroughly assess the economic opportunities data centers  bring alongside the impact these facilities have on communities to maximize benefits and reduce data center challenges.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-027@75eb3c7b5cd5ffbf","id":"MS-CAND-NEW-027","version":"75eb3c7b5cd5ffbf","kind":"rule","lifecycle":"DRAFT","title":"8 Recommendation: Monitor and publicly disclose impacts of AI infrastructure on…","statement":"8  Recommendation:  Monitor and publicly disclose impacts of AI infrastructure on communities using third-party evaluations.","family":"Operations","body":{"sourceId":"NEW-027","decisionLogic":"8  Recommendation:  Monitor and publicly disclose impacts of AI infrastructure on communities using third-party evaluations.","defaultMode":"Detect / log","automationTier":"E1 — observe","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Event / log","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-028@0bc326f2a1492a55","id":"MS-CAND-NEW-028","version":"0bc326f2a1492a55","kind":"rule","lifecycle":"DRAFT","title":"This recommendation calls for a resource monitoring program that uses independent,…","statement":"This recommendation  calls for a resource monitoring program that uses independent, third-party evaluators to assess and publicly report the  environmental and community impacts of AI-related infrastructure, with a focus on land, water, energy, and public health  concerns.","family":"Governance","body":{"sourceId":"NEW-028","decisionLogic":"This recommendation  calls for a resource monitoring program that uses independent, third-party evaluators to assess and publicly report the  environmental and community impacts of AI-related infrastructure, with a focus on land, water, energy, and public health  concerns.","defaultMode":"Detect / log","automationTier":"E1 — observe","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Event / log","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-029@e06b2e60826dc541","id":"MS-CAND-NEW-029","version":"e06b2e60826dc541","kind":"rule","lifecycle":"DRAFT","title":"Legislation would strengthen this effort by requiring standardized disclosure of environmental,…","statement":"Legislation would strengthen this effort by requiring standardized disclosure of environmental, energy, and other baseline  consumption metrics from all AI data center developers and operators to ensure transparent and consistent tracking of  resource utilization.","family":"Output and Use","body":{"sourceId":"NEW-029","decisionLogic":"Legislation would strengthen this effort by requiring standardized disclosure of environmental, energy, and other baseline  consumption metrics from all AI data center developers and operators to ensure transparent and consistent tracking of  resource utilization.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-030@97f8b2f2a700caa5","id":"MS-CAND-NEW-030","version":"97f8b2f2a700caa5","kind":"rule","lifecycle":"DRAFT","title":"General Assembly, Local Governments Timeline: June 2027 Goal 4: Reduce Fraud,…","statement":"General Assembly, Local Governments  Timeline:   June 2027  Goal 4: Reduce Fraud, Manipulation, and Deception  Ensure 100% of state government-produced content abides by a content authenticity standard.","family":"Governance","body":{"sourceId":"NEW-030","decisionLogic":"General Assembly, Local Governments  Timeline:   June 2027  Goal 4: Reduce Fraud, Manipulation, and Deception  Ensure 100% of state government-produced content abides by a content authenticity standard.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-031@898c23d1d41d6929","id":"MS-CAND-NEW-031","version":"898c23d1d41d6929","kind":"rule","lifecycle":"DRAFT","title":"Details: To ensure public confidence in official government communications, all state…","statement":"Details:   To ensure public confidence in official government communications, all state agencies should verify the  authenticity of their communications with clear tracing of their origins.","family":"Governance","body":{"sourceId":"NEW-031","decisionLogic":"Details:   To ensure public confidence in official government communications, all state agencies should verify the  authenticity of their communications with clear tracing of their origins.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-032@e78704005029c4c5","id":"MS-CAND-NEW-032","version":"e78704005029c4c5","kind":"rule","lifecycle":"DRAFT","title":"Implementing a statewide content verification standard will strengthen public trust by…","statement":"Implementing a statewide content verification  standard will strengthen public trust by assuring residents content is authentic, especially in times of emergency.","family":"Governance","body":{"sourceId":"NEW-032","decisionLogic":"Implementing a statewide content verification  standard will strengthen public trust by assuring residents content is authentic, especially in times of emergency.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-033@09f4aaa7beb703f8","id":"MS-CAND-NEW-033","version":"09f4aaa7beb703f8","kind":"rule","lifecycle":"DRAFT","title":"When AI is used to help generate official content, the standard…","statement":"When AI is used to help generate official content, the standard  should also disclose how it was used to ensure transparency.","family":"Governance","body":{"sourceId":"NEW-033","decisionLogic":"When AI is used to help generate official content, the standard  should also disclose how it was used to ensure transparency.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-034@fc985e372c91fbe4","id":"MS-CAND-NEW-034","version":"fc985e372c91fbe4","kind":"rule","lifecycle":"DRAFT","title":"Community upskilling efforts, via the Advancing Community Upskilling goal later in…","statement":"Community upskilling efforts, via the Advancing Community  Upskilling goal later in this framework, will include education on how to recognize verified content from government  sources.","family":"Output and Use","body":{"sourceId":"NEW-034","decisionLogic":"Community upskilling efforts, via the Advancing Community  Upskilling goal later in this framework, will include education on how to recognize verified content from government  sources.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-035@30e918c1ae393723","id":"MS-CAND-NEW-035","version":"30e918c1ae393723","kind":"rule","lifecycle":"DRAFT","title":"This upskilling plan will target all skill levels, including senior citizens,…","statement":"This upskilling plan will target all skill levels, including senior citizens, students, and rural communities.","family":"Governance","body":{"sourceId":"NEW-035","decisionLogic":"This upskilling plan will target all skill levels, including senior citizens, students, and rural communities.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-036@a37923d38786c3fa","id":"MS-CAND-NEW-036","version":"a37923d38786c3fa","kind":"rule","lifecycle":"DRAFT","title":"With the state government’s support and backing, local governments and private…","statement":"With the  state government’s support and backing, local governments and private sector organizations will also be encouraged to  adopt such standards, reducing the potential for misinformation campaigns.","family":"Input and Content","body":{"sourceId":"NEW-036","decisionLogic":"With the  state government’s support and backing, local governments and private sector organizations will also be encouraged to  adopt such standards, reducing the potential for misinformation campaigns.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-037@bf9ef6fc19602a76","id":"MS-CAND-NEW-037","version":"bf9ef6fc19602a76","kind":"rule","lifecycle":"DRAFT","title":"Some states publish all AI systems in their inventory, while others…","statement":"Some states publish all AI systems in their inventory, while others focus  only on   high-risk systems .","family":"Operations","body":{"sourceId":"NEW-037","decisionLogic":"Some states publish all AI systems in their inventory, while others focus  only on   high-risk systems .","defaultMode":"Detect / log","automationTier":"E1 — observe","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Event / log","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-038@4decd1c8f441e4ba","id":"MS-CAND-NEW-038","version":"4decd1c8f441e4ba","kind":"rule","lifecycle":"DRAFT","title":"The state’s 2025 Executive Order 24 also requires the AI Accelerator…","statement":"The state’s 2025   Executive Order 24   also requires the AI Accelerator to disclose all high-risk AI  use cases   to the public .","family":"Governance","body":{"sourceId":"NEW-038","decisionLogic":"The state’s 2025   Executive Order 24   also requires the AI Accelerator to disclose all high-risk AI  use cases   to the public .","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-039@7695f412051bd33a","id":"MS-CAND-NEW-039","version":"7695f412051bd33a","kind":"rule","lifecycle":"DRAFT","title":"24: Advancing Trustworthy Artificial Intelligence That Benefits All North Carolinians requires…","statement":"24: Advancing Trustworthy Artificial Intelligence That Benefits All North Carolinians  requires the disclosure of high-risk AI use cases throughout state government, this initiative will strengthen public trust  by disclosing additional public-facing AI use.","family":"Output and Use","body":{"sourceId":"NEW-039","decisionLogic":"24: Advancing Trustworthy Artificial Intelligence That Benefits All North Carolinians  requires the disclosure of high-risk AI use cases throughout state government, this initiative will strengthen public trust  by disclosing additional public-facing AI use.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"High","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-040@b23f7245c8e57ed5","id":"MS-CAND-NEW-040","version":"b23f7245c8e57ed5","kind":"rule","lifecycle":"DRAFT","title":"Dynamic dashboards will ensure transparency across state government by providing as…","statement":"Dynamic dashboards will ensure transparency across state government  by providing as much information as possible to the public while maintaining the security and integrity of systems.","family":"Governance","body":{"sourceId":"NEW-040","decisionLogic":"Dynamic dashboards will ensure transparency across state government  by providing as much information as possible to the public while maintaining the security and integrity of systems.","defaultMode":"Require evidence","automationTier":"E0 — evidence","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Policy / training / approval","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-041@5627d6c42d034b72","id":"MS-CAND-NEW-041","version":"5627d6c42d034b72","kind":"rule","lifecycle":"DRAFT","title":"Dashboards will be updated regularly to reflect the most current information…","statement":"Dashboards will be updated regularly to reflect the most current information related to AI tools and will be accessible, with  information presented in plain language to promote transparency.","family":"Governance","body":{"sourceId":"NEW-041","decisionLogic":"Dashboards will be updated regularly to reflect the most current information related to AI tools and will be accessible, with  information presented in plain language to promote transparency.","defaultMode":"Require evidence","automationTier":"E0 — evidence","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Policy / training / approval","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-042@09aa4b4698159abd","id":"MS-CAND-NEW-042","version":"09aa4b4698159abd","kind":"rule","lifecycle":"DRAFT","title":"Feedback mechanisms will be available to measure public sentiment and improve…","statement":"Feedback mechanisms will be available to measure  public sentiment and improve tools based on input.","family":"Input and Content","body":{"sourceId":"NEW-042","decisionLogic":"Feedback mechanisms will be available to measure  public sentiment and improve tools based on input.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-043@9bdbd1939cb002c5","id":"MS-CAND-NEW-043","version":"9bdbd1939cb002c5","kind":"rule","lifecycle":"DRAFT","title":"Department of Information Technology, Agency AI Oversight Committees Timeline: December 2026…","statement":"Department of Information Technology, Agency AI Oversight Committees  Timeline:   December 2026  Recommendation:  Maintain transparency, traceability, and human oversight for any use of AI in the administration of government benefits programs,  ensuring AI systems do not make final benefits determinations.","family":"Operations","body":{"sourceId":"NEW-043","decisionLogic":"Department of Information Technology, Agency AI Oversight Committees  Timeline:   December 2026  Recommendation:  Maintain transparency, traceability, and human oversight for any use of AI in the administration of government benefits programs,  ensuring AI systems do not make final benefits determinations.","defaultMode":"Require evidence","automationTier":"E0 — evidence","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Policy / training / approval","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-044@18c14a883f78168e","id":"MS-CAND-NEW-044","version":"18c14a883f78168e","kind":"rule","lifecycle":"DRAFT","title":"This recommendation calls for disclosure of AI utilization as any part…","statement":"This recommendation calls for disclosure of AI utilization  as any part of a benefits eligibility process and guardrails to ensure that final benefits determination decisions are not  made by AI systems.","family":"Output and Use","body":{"sourceId":"NEW-044","decisionLogic":"This recommendation calls for disclosure of AI utilization  as any part of a benefits eligibility process and guardrails to ensure that final benefits determination decisions are not  made by AI systems.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-045@1acab126fb11a883","id":"MS-CAND-NEW-045","version":"1acab126fb11a883","kind":"rule","lifecycle":"DRAFT","title":"Additionally, residents should be given the opportunity to opt out of…","statement":"Additionally, residents should be given the opportunity to opt out of their data being shared or used  in AI models beyond where required for program participation.","family":"Governance","body":{"sourceId":"NEW-045","decisionLogic":"Additionally, residents should be given the opportunity to opt out of their data being shared or used  in AI models beyond where required for program participation.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-046@8cbd72430eb7e76f","id":"MS-CAND-NEW-046","version":"8cbd72430eb7e76f","kind":"rule","lifecycle":"DRAFT","title":"This initiative will ensure that the state can continue delivering vital…","statement":"This initiative will ensure that the state  can continue delivering vital services to residents by defining and prioritizing critical statewide systems that use AI in the  event of system outages, failures, or attacks.","family":"Governance","body":{"sourceId":"NEW-046","decisionLogic":"This initiative will ensure that the state  can continue delivering vital services to residents by defining and prioritizing critical statewide systems that use AI in the  event of system outages, failures, or attacks.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Critical","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-047@f2cca3acb9056674","id":"MS-CAND-NEW-047","version":"f2cca3acb9056674","kind":"rule","lifecycle":"DRAFT","title":"The state will work in collaboration with utilities, security, and emergency…","statement":"The state will work in collaboration with utilities, security, and emergency  response teams to design a plan to recover those systems, including through redundant architectures, where possible.","family":"Governance","body":{"sourceId":"NEW-047","decisionLogic":"The state will work in collaboration with utilities, security, and emergency  response teams to design a plan to recover those systems, including through redundant architectures, where possible.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-048@469fd8f52e815ef3","id":"MS-CAND-NEW-048","version":"469fd8f52e815ef3","kind":"rule","lifecycle":"DRAFT","title":"Clear procedures must be documented for enabling, bypassing, or overriding AI…","statement":"Clear procedures must be documented for enabling, bypassing, or overriding AI systems, and staff should be trained to  manually operate critical processes without AI assistance during outages.","family":"Governance","body":{"sourceId":"NEW-048","decisionLogic":"Clear procedures must be documented for enabling, bypassing, or overriding AI systems, and staff should be trained to  manually operate critical processes without AI assistance during outages.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Critical","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-049@414ff7309da7ef76","id":"MS-CAND-NEW-049","version":"414ff7309da7ef76","kind":"rule","lifecycle":"DRAFT","title":"Recommendation: Monitor, detect, and analyze ongoing AI threats and create a…","statement":"Recommendation:  Monitor, detect, and analyze ongoing AI threats and create a mechanism to share risk landscape with trusted AI and cyber liaisons  in local government, as well as federal, peer state, and private sector partners.","family":"Operations","body":{"sourceId":"NEW-049","decisionLogic":"Recommendation:  Monitor, detect, and analyze ongoing AI threats and create a mechanism to share risk landscape with trusted AI and cyber liaisons  in local government, as well as federal, peer state, and private sector partners.","defaultMode":"Detect / log","automationTier":"E1 — observe","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Event / log","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-050@e471430a56ad2ef1","id":"MS-CAND-NEW-050","version":"e471430a56ad2ef1","kind":"rule","lifecycle":"DRAFT","title":"Details: This initiative will build on existing continuous monitoring and threat…","statement":"Details:   This initiative will build on existing continuous monitoring and threat detection programs across state government  to identify emerging AI-related risks and alert trusted liaisons in state and local governments to act.","family":"Operations","body":{"sourceId":"NEW-050","decisionLogic":"Details:   This initiative will build on existing continuous monitoring and threat detection programs across state government  to identify emerging AI-related risks and alert trusted liaisons in state and local governments to act.","defaultMode":"Detect / log","automationTier":"E1 — observe","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Event / log","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-051@de412e97cc5acfc0","id":"MS-CAND-NEW-051","version":"de412e97cc5acfc0","kind":"rule","lifecycle":"DRAFT","title":"Agencies will implement a software bill of materials for deployed AI…","statement":"Agencies will  implement a software bill   of materials for deployed AI solutions that   map lineage of models, data,   and code to ensure  swift remediation.","family":"Governance","body":{"sourceId":"NEW-051","decisionLogic":"Agencies will  implement a software bill   of materials for deployed AI solutions that   map lineage of models, data,   and code to ensure  swift remediation.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-052@3ff507cc0cd5b18d","id":"MS-CAND-NEW-052","version":"3ff507cc0cd5b18d","kind":"rule","lifecycle":"DRAFT","title":"Additionally, the state will distribute vetted AI frameworks and training modules…","statement":"Additionally, the state will distribute vetted AI frameworks and training modules to local government partners to guarantee  proven, safe, and transparent AI security practices are leveraged statewide, including privacy by design.","family":"Data Protection","body":{"sourceId":"NEW-052","decisionLogic":"Additionally, the state will distribute vetted AI frameworks and training modules to local government partners to guarantee  proven, safe, and transparent AI security practices are leveraged statewide, including privacy by design.","defaultMode":"Require evidence","automationTier":"E0 — evidence","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Policy / training / approval","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-053@d278701e70ca567c","id":"MS-CAND-NEW-053","version":"d278701e70ca567c","kind":"rule","lifecycle":"DRAFT","title":"National Guard, Local Governments Timeline: June 2027 Goal 8: Ensure Responsible…","statement":"National Guard, Local  Governments  Timeline:   June 2027  Goal 8: Ensure Responsible Government AI Usage  Ensure AI systems used by state agencies meet standardized internal safety, privacy, security, reliability,  fairness, and explainability requirements.","family":"Data Protection","body":{"sourceId":"NEW-053","decisionLogic":"National Guard, Local  Governments  Timeline:   June 2027  Goal 8: Ensure Responsible Government AI Usage  Ensure AI systems used by state agencies meet standardized internal safety, privacy, security, reliability,  fairness, and explainability requirements.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"High","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-054@5ae3dd8f9a5e0458","id":"MS-CAND-NEW-054","version":"5ae3dd8f9a5e0458","kind":"rule","lifecycle":"DRAFT","title":"Recommendation: Establish minimum statewide trustworthy AI standards for all AI-enabled tools…","statement":"Recommendation:  Establish minimum statewide trustworthy AI standards for all AI-enabled tools and systems that must be met before agencies","family":"Governance","body":{"sourceId":"NEW-054","decisionLogic":"Recommendation:  Establish minimum statewide trustworthy AI standards for all AI-enabled tools and systems that must be met before agencies","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-055@fc1ce4188d8e37fb","id":"MS-CAND-NEW-055","version":"fc1ce4188d8e37fb","kind":"rule","lifecycle":"DRAFT","title":"However, AI presents fundamentally different challenges that these existing frameworks do…","statement":"However, AI  presents fundamentally different challenges that these existing frameworks do not account for.","family":"Access and Use","body":{"sourceId":"NEW-055","decisionLogic":"However, AI  presents fundamentally different challenges that these existing frameworks do not account for.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-056@d3cbeb5b80268736","id":"MS-CAND-NEW-056","version":"d3cbeb5b80268736","kind":"rule","lifecycle":"DRAFT","title":"This initiative will create and implement a tiered governance model specific…","statement":"This initiative will create  and implement a tiered governance model specific to AI, with tailored mitigation plans according to risk level that address  safety concerns including bias, accuracy, model degradation, and more.","family":"Output and Use","body":{"sourceId":"NEW-056","decisionLogic":"This initiative will create  and implement a tiered governance model specific to AI, with tailored mitigation plans according to risk level that address  safety concerns including bias, accuracy, model degradation, and more.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"High","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-057@bb3ae2030b306c3a","id":"MS-CAND-NEW-057","version":"bb3ae2030b306c3a","kind":"rule","lifecycle":"DRAFT","title":"Regardless of risk level, mitigation plans will include ongoing monitoring requirements…","statement":"Regardless of risk level, mitigation plans will  include ongoing monitoring requirements and accountability mechanisms for all AI-enabled systems.","family":"Access and Use","body":{"sourceId":"NEW-057","decisionLogic":"Regardless of risk level, mitigation plans will  include ongoing monitoring requirements and accountability mechanisms for all AI-enabled systems.","defaultMode":"Detect / log","automationTier":"E1 — observe","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Event / log","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-058@c89dff651b4042aa","id":"MS-CAND-NEW-058","version":"c89dff651b4042aa","kind":"rule","lifecycle":"DRAFT","title":"Recurring security testing of products will be conducted to check for…","statement":"Recurring security  testing of products will be conducted to check for emerging threats and defend against vulnerabilities.","family":"Governance","body":{"sourceId":"NEW-058","decisionLogic":"Recurring security  testing of products will be conducted to check for emerging threats and defend against vulnerabilities.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-059@ebad9ea249c278c2","id":"MS-CAND-NEW-059","version":"ebad9ea249c278c2","kind":"rule","lifecycle":"DRAFT","title":"These liaisons must be given a sufficient level of authority to…","statement":"These liaisons must  be given a sufficient level of authority to create accountability mechanisms to enforce the standards and governance  mechanisms established in the previous recommendation for this goal.","family":"Access and Use","body":{"sourceId":"NEW-059","decisionLogic":"These liaisons must  be given a sufficient level of authority to create accountability mechanisms to enforce the standards and governance  mechanisms established in the previous recommendation for this goal.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-060@64c6f48b85080ba2","id":"MS-CAND-NEW-060","version":"64c6f48b85080ba2","kind":"rule","lifecycle":"DRAFT","title":"They will also be the main point of contact for all…","statement":"They will also be the main point of contact for all  accountability escalation.","family":"Access and Use","body":{"sourceId":"NEW-060","decisionLogic":"They will also be the main point of contact for all  accountability escalation.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-061@f9099cd979d61a91","id":"MS-CAND-NEW-061","version":"f9099cd979d61a91","kind":"rule","lifecycle":"DRAFT","title":"They will uphold whistleblower protections and coordinate across agencies in the…","statement":"They will uphold   whistleblower protections   and coordinate  across agencies in the event of an emergency related to or impacting AI use.","family":"Governance","body":{"sourceId":"NEW-061","decisionLogic":"They will uphold   whistleblower protections   and coordinate  across agencies in the event of an emergency related to or impacting AI use.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-062@df513b7c6e9ed060","id":"MS-CAND-NEW-062","version":"df513b7c6e9ed060","kind":"rule","lifecycle":"DRAFT","title":"This role will ensure shared learning, avoid wasted resources, and proactively…","statement":"This role will ensure shared learning,  avoid wasted resources, and proactively address AI related threats and opportunities.","family":"Access and Use","body":{"sourceId":"NEW-062","decisionLogic":"This role will ensure shared learning,  avoid wasted resources, and proactively address AI related threats and opportunities.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-063@4bd59069df557c8c","id":"MS-CAND-NEW-063","version":"4bd59069df557c8c","kind":"rule","lifecycle":"DRAFT","title":"Across the United States, communities are using various methods to ensure…","statement":"Across the United States, communities are using various methods to ensure their members are AI literate.","family":"Governance","body":{"sourceId":"NEW-063","decisionLogic":"Across the United States, communities are using various methods to ensure their members are AI literate.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-064@5dfca2afdff3ee98","id":"MS-CAND-NEW-064","version":"5dfca2afdff3ee98","kind":"rule","lifecycle":"DRAFT","title":"The regional curriculum will be informed by community input","statement":"The regional curriculum will be informed by  community input.","family":"Access and Use","body":{"sourceId":"NEW-064","decisionLogic":"The regional curriculum will be informed by  community input.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-065@96266b06cc2a95a8","id":"MS-CAND-NEW-065","version":"96266b06cc2a95a8","kind":"rule","lifecycle":"DRAFT","title":"This effort will be achieved through collaborations with NCWorks Career Centers,…","statement":"This effort will be achieved through collaborations with NCWorks Career Centers, community colleges,  public libraries, community centers, and other community anchor institutions and deployed in a phased approach to reach  all regions of the state.","family":"Access and Use","body":{"sourceId":"NEW-065","decisionLogic":"This effort will be achieved through collaborations with NCWorks Career Centers, community colleges,  public libraries, community centers, and other community anchor institutions and deployed in a phased approach to reach  all regions of the state.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-066@79bc2d38ab7a3aa6","id":"MS-CAND-NEW-066","version":"79bc2d38ab7a3aa6","kind":"rule","lifecycle":"DRAFT","title":"This training will help residents build practical understanding of AI concepts,…","statement":"This training  will help residents build practical understanding of AI concepts, everyday digital tools, online safety, scam awareness, and  responsible AI use.","family":"Operations","body":{"sourceId":"NEW-066","decisionLogic":"This training  will help residents build practical understanding of AI concepts, everyday digital tools, online safety, scam awareness, and  responsible AI use.","defaultMode":"Require evidence","automationTier":"E0 — evidence","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Policy / training / approval","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-067@71285db4258481c7","id":"MS-CAND-NEW-067","version":"71285db4258481c7","kind":"rule","lifecycle":"DRAFT","title":"A feedback loop using hiring outcomes, employer demand, and worker feedback…","statement":"A feedback loop using hiring outcomes, employer demand, and worker feedback will allow  for continuous review and updates, keeping entry-level expectations current and strengthening the employment pipeline  from higher education to private sector.","family":"Governance","body":{"sourceId":"NEW-067","decisionLogic":"A feedback loop using hiring outcomes, employer demand, and worker feedback will allow  for continuous review and updates, keeping entry-level expectations current and strengthening the employment pipeline  from higher education to private sector.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-068@4403f2bfe20d8ecc","id":"MS-CAND-NEW-068","version":"4403f2bfe20d8ecc","kind":"rule","lifecycle":"DRAFT","title":"This mutually beneficial program would allow the private sector to help…","statement":"This mutually beneficial program  would allow the private sector to help tailor   higher education toward the skillsets required in their workforces and create  direct   pipelines to hire for those skills.","family":"Governance","body":{"sourceId":"NEW-068","decisionLogic":"This mutually beneficial program  would allow the private sector to help tailor   higher education toward the skillsets required in their workforces and create  direct   pipelines to hire for those skills.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-CAND-NEW-069@f233806372e80118","id":"MS-CAND-NEW-069","version":"f233806372e80118","kind":"rule","lifecycle":"DRAFT","title":"Partnering with N.C. higher education institutions, the state will coordinate AI…","statement":"Partnering with N.C. higher education institutions, the state will coordinate AI education and  exposure across all levels of education so that students graduate with the competencies needed for public sector careers.","family":"Governance","body":{"sourceId":"NEW-069","decisionLogic":"Partnering with N.C. higher education institutions, the state will coordinate AI education and  exposure across all levels of education so that students graduate with the competencies needed for public sector careers.","defaultMode":"Warn / require","automationTier":"E2 — govern","enforcementPoint":"Determine during design","reportedSupport":"Proposed","evidence":"Workflow / policy","severity":"Medium","policyDependency":"Proposed policy mapping","minimumTest":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","applicability":"Derived from uploaded corpus","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"warning":"Prototype-generated candidate; source directive and semantic match require review."}},{"key":"MS-RULE-AG-01@e6aee1767c267990","id":"MS-RULE-AG-01","version":"e6aee1767c267990","kind":"rule","lifecycle":"EXTRACTED","title":"Allowlisted tools and connectors only","statement":"Permit only approved tools, MCP servers, plugins, APIs and connector operations for the use case and role.","family":"Agentic Controls","body":{"sourceId":"AG-01","decisionLogic":"Permit only approved tools, MCP servers, plugins, APIs and connector operations for the use case and role.","defaultMode":"Block","automationTier":"E3","enforcementPoint":"Agent tool gateway","reportedSupport":"Roadmap","evidence":"Tool-policy decision","severity":"Critical","policyDependency":"Agentic AI and Connectors","minimumTest":"Attempt unknown, renamed and newly installed tools.","applicability":"Agentic systems.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AG-02@d4d178c0433fd6d4","id":"MS-RULE-AG-02","version":"d4d178c0433fd6d4","kind":"rule","lifecycle":"EXTRACTED","title":"Enforce least privilege for agents","statement":"Issue short-lived, scoped credentials; restrict data, action, tenant and environment permissions to the minimum necessary.","family":"Agentic Controls","body":{"sourceId":"AG-02","decisionLogic":"Issue short-lived, scoped credentials; restrict data, action, tenant and environment permissions to the minimum necessary.","defaultMode":"Block","automationTier":"E3","enforcementPoint":"Identity + tool gateway","reportedSupport":"Roadmap","evidence":"Credential scope + decision","severity":"Critical","policyDependency":"Agentic AI and Connectors","minimumTest":"Test privilege escalation, stale tokens and cross-environment access.","applicability":"Agentic systems.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AG-03@20aa3c90fa880f0d","id":"MS-RULE-AG-03","version":"20aa3c90fa880f0d","kind":"rule","lifecycle":"EXTRACTED","title":"Require approval for high-impact or irreversible actions","statement":"Require step-up human confirmation before payments, submissions, deletions, permission changes, production actions or legal commitments.","family":"Agentic Controls","body":{"sourceId":"AG-03","decisionLogic":"Require step-up human confirmation before payments, submissions, deletions, permission changes, production actions or legal commitments.","defaultMode":"Hold for approval","automationTier":"E2/E3","enforcementPoint":"Tool call","reportedSupport":"Roadmap","evidence":"Action preview + approver + result","severity":"Critical","policyDependency":"Agentic AI and Connectors","minimumTest":"Test each irreversible action and approval replay prevention.","applicability":"Agentic systems.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AG-04@c7af717b1d68045e","id":"MS-RULE-AG-04","version":"c7af717b1d68045e","kind":"rule","lifecycle":"EXTRACTED","title":"Prohibit autonomous consequential decisions","statement":"Prevent agents from making final employment, credit, housing, education, healthcare, legal or similarly consequential decisions without authorized human determination.","family":"Agentic Controls","body":{"sourceId":"AG-04","decisionLogic":"Prevent agents from making final employment, credit, housing, education, healthcare, legal or similarly consequential decisions without authorized human determination.","defaultMode":"Block / hold","automationTier":"E2/E3","enforcementPoint":"Decision + tool call","reportedSupport":"Roadmap","evidence":"Human decision record","severity":"Critical","policyDependency":"High-Impact AI and Human Oversight","minimumTest":"Test indirect actions and recommendation-to-decision handoffs.","applicability":"High-impact domains.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AG-05@8829d873310f18f9","id":"MS-RULE-AG-05","version":"8829d873310f18f9","kind":"rule","lifecycle":"EXTRACTED","title":"Approve external communications","statement":"Require approval before an agent sends email, messages, posts, tickets or other external communications in designated contexts.","family":"Agentic Controls","body":{"sourceId":"AG-05","decisionLogic":"Require approval before an agent sends email, messages, posts, tickets or other external communications in designated contexts.","defaultMode":"Hold for approval","automationTier":"E2/E3","enforcementPoint":"Tool call","reportedSupport":"Roadmap","evidence":"Preview + approver + sent artifact","severity":"High","policyDependency":"Agentic AI and Connectors","minimumTest":"Test wrong recipient, sensitive content and reply-all scenarios.","applicability":"Configure trusted low-risk automations separately.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AG-06@6371f819b40b0d97","id":"MS-RULE-AG-06","version":"6371f819b40b0d97","kind":"rule","lifecycle":"EXTRACTED","title":"Approve destructive and permission-changing actions","statement":"Require approval and recoverability before delete, overwrite, access-control, security-setting or production-change actions.","family":"Agentic Controls","body":{"sourceId":"AG-06","decisionLogic":"Require approval and recoverability before delete, overwrite, access-control, security-setting or production-change actions.","defaultMode":"Hold / block","automationTier":"E2/E3","enforcementPoint":"Tool call","reportedSupport":"Roadmap","evidence":"Diff/preview + approval + rollback reference","severity":"Critical","policyDependency":"Agentic AI and Connectors","minimumTest":"Test deletion scope, permission escalation and rollback.","applicability":"Agentic systems.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AG-07@c2fb36c556cb8a62","id":"MS-RULE-AG-07","version":"c2fb36c556cb8a62","kind":"rule","lifecycle":"EXTRACTED","title":"Enforce transaction and autonomy limits","statement":"Apply amount, volume, recipient, duration, recursion, environment and cumulative-risk limits to agent actions.","family":"Agentic Controls","body":{"sourceId":"AG-07","decisionLogic":"Apply amount, volume, recipient, duration, recursion, environment and cumulative-risk limits to agent actions.","defaultMode":"Block / throttle","automationTier":"E3/E4","enforcementPoint":"Agent runtime","reportedSupport":"Roadmap","evidence":"Meter + limit decision","severity":"Critical","policyDependency":"Agentic AI and Connectors","minimumTest":"Test single and cumulative limit evasion.","applicability":"Agentic systems.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AG-08@b98e349c6e27f319","id":"MS-RULE-AG-08","version":"b98e349c6e27f319","kind":"rule","lifecycle":"EXTRACTED","title":"Enforce tenant and context isolation","statement":"Prevent retrieval, memory, cache, prompt or tool results from crossing user, customer, tenant, case or security boundaries.","family":"Agentic Controls","body":{"sourceId":"AG-08","decisionLogic":"Prevent retrieval, memory, cache, prompt or tool results from crossing user, customer, tenant, case or security boundaries.","defaultMode":"Block","automationTier":"E3","enforcementPoint":"Retrieval + memory + tool gateway","reportedSupport":"Roadmap","evidence":"Isolation test + decision","severity":"Critical","policyDependency":"Data, Model and RAG Supply Chain","minimumTest":"Run cross-tenant canaries and confused-deputy tests.","applicability":"Multi-tenant and multi-case systems.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AG-09@2bd07e82a72d4f2e","id":"MS-RULE-AG-09","version":"2bd07e82a72d4f2e","kind":"rule","lifecycle":"EXTRACTED","title":"Govern agent memory writes","statement":"Validate, minimize and approve durable memory; prevent secrets, poisoned instructions and sensitive data from persistence.","family":"Agentic Controls","body":{"sourceId":"AG-09","decisionLogic":"Validate, minimize and approve durable memory; prevent secrets, poisoned instructions and sensitive data from persistence.","defaultMode":"Block / approve","automationTier":"E2/E3","enforcementPoint":"Memory write","reportedSupport":"Roadmap","evidence":"Memory diff + provenance + decision","severity":"High","policyDependency":"Agentic AI and Connectors","minimumTest":"Test poisoned memory, sensitive persistence and deletion.","applicability":"Systems with persistent memory.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AG-10@41b899de0bf0744b","id":"MS-RULE-AG-10","version":"41b899de0bf0744b","kind":"rule","lifecycle":"EXTRACTED","title":"Verify tool and package supply chain","statement":"Pin, sign, scan and monitor model, tool, connector, MCP server, package and prompt dependencies; block untrusted versions.","family":"Agentic Controls","body":{"sourceId":"AG-10","decisionLogic":"Pin, sign, scan and monitor model, tool, connector, MCP server, package and prompt dependencies; block untrusted versions.","defaultMode":"Block / quarantine","automationTier":"E3/E4","enforcementPoint":"Build + runtime","reportedSupport":"Roadmap","evidence":"SBOM/provenance + verification event","severity":"Critical","policyDependency":"Data, Model and RAG Supply Chain","minimumTest":"Test tampered package, changed tool schema and revoked publisher.","applicability":"Applications and agents.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AG-11@f9288b5977523607","id":"MS-RULE-AG-11","version":"f9288b5977523607","kind":"rule","lifecycle":"DRAFT","title":"Require dual authorization for coercive public-sector actions","statement":"An AI agent may not execute detention, enforcement, benefits termination, sanction or comparable coercive action without two qualified, accountable authorizations.","family":"Agentic Controls","body":{"sourceId":"AG-11","defaultMode":"Block / require approval","automationTier":"E3","enforcementPoint":"Tool call + transaction","severity":"Critical","evidence":"Two approvals + action log + scope","reportedDisposition":"Proposed new canonical","reportedApproval":"Proposed — review required","linkedPolicies":["POL-29"],"frameworkDrivers":["OMB-M25-21","NIST-800-53","CJIS-6.1","SECTION-508","EU-AI-ACT"],"admissionTest":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission.","reviewerNotes":null,"sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AU-01@32b7d4ac14b06f7b","id":"MS-RULE-AU-01","version":"32b7d4ac14b06f7b","kind":"rule","lifecycle":"EXTRACTED","title":"Allow sanctioned AI services only","statement":"Detect and block or redirect unapproved AI domains, desktop apps, APIs and embedded assistants.","family":"Authorized Use","body":{"sourceId":"AU-01","decisionLogic":"Detect and block or redirect unapproved AI domains, desktop apps, APIs and embedded assistants.","defaultMode":"Block / redirect","automationTier":"E3","enforcementPoint":"Network + browser + endpoint","reportedSupport":"Partial","evidence":"Discovery and enforcement event","severity":"Critical","policyDependency":"Approved AI Tools and Shadow AI","minimumTest":"Attempt use through approved and unapproved domains, aliases and API endpoints.","applicability":"Requires complete inventory and egress coverage.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AU-02@1a166eaeb8f7f1ad","id":"MS-RULE-AU-02","version":"1a166eaeb8f7f1ad","kind":"rule","lifecycle":"EXTRACTED","title":"Require strong authentication","statement":"Require enterprise identity and MFA before sensitive AI use; deny unmanaged or anonymous sessions.","family":"Authorized Use","body":{"sourceId":"AU-02","decisionLogic":"Require enterprise identity and MFA before sensitive AI use; deny unmanaged or anonymous sessions.","defaultMode":"Block","automationTier":"E3","enforcementPoint":"Identity + session","reportedSupport":"Roadmap","evidence":"IdP/config assertion + decision","severity":"Critical","policyDependency":"Approved AI Tools and Shadow AI","minimumTest":"Test unmanaged device, personal account and MFA-bypass paths.","applicability":"Not provable from a policy document alone.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AU-03@ece0c972ca2c62e1","id":"MS-RULE-AU-03","version":"ece0c972ca2c62e1","kind":"rule","lifecycle":"EXTRACTED","title":"Enforce role and data-class authorization","statement":"Permit AI systems, models, data classes and capabilities only to authorized roles and groups.","family":"Authorized Use","body":{"sourceId":"AU-03","decisionLogic":"Permit AI systems, models, data classes and capabilities only to authorized roles and groups.","defaultMode":"Block","automationTier":"E3","enforcementPoint":"Identity + policy engine","reportedSupport":"Roadmap","evidence":"Decision + entitlement snapshot","severity":"Critical","policyDependency":"Approved AI Tools and Shadow AI","minimumTest":"Test role changes, leavers and restricted data classes.","applicability":"Requires identity and directory integration.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AU-04@d51101a040857487","id":"MS-RULE-AU-04","version":"d51101a040857487","kind":"rule","lifecycle":"EXTRACTED","title":"Allow approved use cases and models only","statement":"Bind each high-risk use case to approved model/version, purpose, owner, data classes and risk decision.","family":"Authorized Use","body":{"sourceId":"AU-04","decisionLogic":"Bind each high-risk use case to approved model/version, purpose, owner, data classes and risk decision.","defaultMode":"Block / approve","automationTier":"E2/E3","enforcementPoint":"Use-case registry + gateway","reportedSupport":"Roadmap","evidence":"Use-case approval + runtime context","severity":"Critical","policyDependency":"AI Governance and Accountability","minimumTest":"Test unregistered purpose, model substitution and scope drift.","applicability":"All high-impact and regulated use cases.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AU-05@7c58fddd6817f607","id":"MS-RULE-AU-05","version":"7c58fddd6817f607","kind":"rule","lifecycle":"EXTRACTED","title":"Route by residency and retention constraints","statement":"Block or reroute data when model region, storage, retention or subprocessors conflict with approved requirements.","family":"Authorized Use","body":{"sourceId":"AU-05","decisionLogic":"Block or reroute data when model region, storage, retention or subprocessors conflict with approved requirements.","defaultMode":"Block / route","automationTier":"E3/E4","enforcementPoint":"Gateway + vendor metadata","reportedSupport":"Roadmap","evidence":"Routing decision + vendor configuration","severity":"High","policyDependency":"Vendor and AI Procurement","minimumTest":"Test region mismatch, retention settings and vendor changes.","applicability":"Jurisdiction- and contract-specific.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AU-06@e8c8f3b771054fbc","id":"MS-RULE-AU-06","version":"e8c8f3b771054fbc","kind":"rule","lifecycle":"EXTRACTED","title":"Prevent provider training on enterprise content","statement":"Require a contracted enterprise service and verified setting prohibiting provider training or secondary use where policy demands it.","family":"Authorized Use","body":{"sourceId":"AU-06","decisionLogic":"Require a contracted enterprise service and verified setting prohibiting provider training or secondary use where policy demands it.","defaultMode":"Block","automationTier":"E3","enforcementPoint":"Vendor config + session","reportedSupport":"Roadmap","evidence":"Contract + configuration assertion","severity":"Critical","policyDependency":"Vendor and AI Procurement","minimumTest":"Test personal versus enterprise tenant and setting drift.","applicability":"Depends on provider contract and configuration.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AU-07@989c3a6787fc6689","id":"MS-RULE-AU-07","version":"989c3a6787fc6689","kind":"rule","lifecycle":"EXTRACTED","title":"Prohibit account sharing","statement":"Detect and prevent shared credentials, concurrent anomalous access and use of another person’s AI account.","family":"Authorized Use","body":{"sourceId":"AU-07","decisionLogic":"Detect and prevent shared credentials, concurrent anomalous access and use of another person’s AI account.","defaultMode":"Block / alert","automationTier":"E2/E3","enforcementPoint":"Identity + session analytics","reportedSupport":"Roadmap","evidence":"Authentication and anomaly event","severity":"High","policyDependency":"Approved AI Tools and Shadow AI","minimumTest":"Test shared-account and revoked-user scenarios.","applicability":"Requires identity telemetry.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AU-08@4eda0a221f3ef380","id":"MS-RULE-AU-08","version":"4eda0a221f3ef380","kind":"rule","lifecycle":"EXTRACTED","title":"Detect shadow AI and unmanaged plugins","statement":"Continuously inventory AI web apps, APIs, browser extensions, connectors and plugins; alert on unknown services.","family":"Authorized Use","body":{"sourceId":"AU-08","decisionLogic":"Continuously inventory AI web apps, APIs, browser extensions, connectors and plugins; alert on unknown services.","defaultMode":"Detect / block","automationTier":"E1/E3","enforcementPoint":"Browser + endpoint + network","reportedSupport":"Partial","evidence":"Inventory and alert","severity":"High","policyDependency":"Approved AI Tools and Shadow AI","minimumTest":"Compare observed use to registry and test newly introduced domains.","applicability":"Current code sees only nine configured web surfaces.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AU-09@204573caad930259","id":"MS-RULE-AU-09","version":"204573caad930259","kind":"rule","lifecycle":"DRAFT","title":"Enforce sector-purpose and disclosure authorization","statement":"Attach purpose, recipient and use labels to specially regulated records and block processing outside the authorized sector workflow.","family":"Authorized Use","body":{"sourceId":"AU-09","defaultMode":"Block / require approval","automationTier":"E3","enforcementPoint":"Prompt + upload + retrieval + tool call","severity":"Critical","evidence":"Authorization context + decision log","reportedDisposition":"Proposed new canonical","reportedApproval":"Proposed — review required","linkedPolicies":["POL-30"],"frameworkDrivers":["NIST-800-171","CMMC","CJIS-6.1","IRS-1075","HHS-PART2","EAR"],"admissionTest":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission.","reviewerNotes":null,"sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-AU-10@7f425f52b685ce44","id":"MS-RULE-AU-10","version":"7f425f52b685ce44","kind":"rule","lifecycle":"DRAFT","title":"Restrict cross-border bulk-sensitive-data transactions","statement":"Screen counterparty, country, data category and volume; block prohibited transfers and require security conditions for restricted transactions.","family":"Authorized Use","body":{"sourceId":"AU-10","defaultMode":"Block / require approval","automationTier":"E3/E4","enforcementPoint":"Provider routing + export + support access","severity":"Critical","evidence":"Screening + threshold calculation + transfer decision","reportedDisposition":"Proposed new canonical","reportedApproval":"Proposed — review required","linkedPolicies":["POL-32"],"frameworkDrivers":["GDPR","UK-DP-AI","BR-LGPD","AU-PRIVACY-AI","DOJ-DSP","EAR"],"admissionTest":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission.","reviewerNotes":null,"sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-01@82066dbd9b9a4f14","id":"MS-RULE-DP-01","version":"82066dbd9b9a4f14","kind":"rule","lifecycle":"EXTRACTED","title":"Block credentials and secrets","statement":"Block or mask passwords, API keys, access tokens, private keys, signing secrets, and connection strings before transfer to an AI service.","family":"Data Protection","body":{"sourceId":"DP-01","decisionLogic":"Block or mask passwords, API keys, access tokens, private keys, signing secrets, and connection strings before transfer to an AI service.","defaultMode":"Block","automationTier":"E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Partial","evidence":"Decision log + redacted match","severity":"Critical","policyDependency":"Data Classification for AI","minimumTest":"Seed test secrets plus obfuscated variants; require zero raw secret in destination.","applicability":"All systems; allow only designated secret-management workflows.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-02@d20cd6810e42f858","id":"MS-RULE-DP-02","version":"d20cd6810e42f858","kind":"rule","lifecycle":"EXTRACTED","title":"Block passwords and authentication answers","statement":"Block passwords, passphrases, recovery codes, one-time codes, and authentication answers.","family":"Data Protection","body":{"sourceId":"DP-02","decisionLogic":"Block passwords, passphrases, recovery codes, one-time codes, and authentication answers.","defaultMode":"Block","automationTier":"E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Partial","evidence":"Decision log + redacted match","severity":"Critical","policyDependency":"Data Classification for AI","minimumTest":"Test common and generated password formats without storing live credentials.","applicability":"All systems.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-03@4cbb47b109e98f4a","id":"MS-RULE-DP-03","version":"4cbb47b109e98f4a","kind":"rule","lifecycle":"EXTRACTED","title":"Block payment card numbers","statement":"Block full PAN; optionally mask to last four only in approved support workflows.","family":"Data Protection","body":{"sourceId":"DP-03","decisionLogic":"Block full PAN; optionally mask to last four only in approved support workflows.","defaultMode":"Block / mask","automationTier":"E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Partial","evidence":"Decision log + masked value","severity":"Critical","policyDependency":"Data Classification for AI","minimumTest":"Use valid and invalid Luhn samples; test separators and OCR variants.","applicability":"Card data; PCI scope.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-04@13c6ba85197d9a69","id":"MS-RULE-DP-04","version":"13c6ba85197d9a69","kind":"rule","lifecycle":"EXTRACTED","title":"Block CVV, CVC and PIN","statement":"Block sensitive authentication data, including CVV/CVC, PIN and PIN blocks.","family":"Data Protection","body":{"sourceId":"DP-04","decisionLogic":"Block sensitive authentication data, including CVV/CVC, PIN and PIN blocks.","defaultMode":"Block","automationTier":"E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Partial","evidence":"Decision log","severity":"Critical","policyDependency":"Data Classification for AI","minimumTest":"Test label/value pairs and contextual variants.","applicability":"Payment workflows.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-05@30a7a6fc8d2d373f","id":"MS-RULE-DP-05","version":"30a7a6fc8d2d373f","kind":"rule","lifecycle":"EXTRACTED","title":"Block national identifiers","statement":"Block SSN and other configured national or government identifiers unless an approved regulated workflow explicitly permits them.","family":"Data Protection","body":{"sourceId":"DP-05","decisionLogic":"Block SSN and other configured national or government identifiers unless an approved regulated workflow explicitly permits them.","defaultMode":"Block","automationTier":"E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Partial","evidence":"Decision log + redacted match","severity":"Critical","policyDependency":"Privacy and Personal Data","minimumTest":"Test formatted, unformatted, and OCR variants; measure false positives.","applicability":"Configure by jurisdiction.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-06@af062b3863346b41","id":"MS-RULE-DP-06","version":"af062b3863346b41","kind":"rule","lifecycle":"EXTRACTED","title":"Block bank-account data","statement":"Block bank account, routing, IBAN, SWIFT and similar financial account identifiers unless approved and protected.","family":"Data Protection","body":{"sourceId":"DP-06","decisionLogic":"Block bank account, routing, IBAN, SWIFT and similar financial account identifiers unless approved and protected.","defaultMode":"Block","automationTier":"E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Partial","evidence":"Decision log + redacted match","severity":"Critical","policyDependency":"Privacy and Personal Data","minimumTest":"Test domestic routing/account formats in addition to IBAN.","applicability":"Financial services and payment workflows.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-07@94c870d43e4286ab","id":"MS-RULE-DP-07","version":"94c870d43e4286ab","kind":"rule","lifecycle":"EXTRACTED","title":"Restrict protected health information","statement":"Block PHI in unapproved AI; allow only minimum-necessary, authorized processing on a contracted and configured service.","family":"Data Protection","body":{"sourceId":"DP-07","decisionLogic":"Block PHI in unapproved AI; allow only minimum-necessary, authorized processing on a contracted and configured service.","defaultMode":"Conditional block","automationTier":"E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Partial","evidence":"Decision + approved context + BAA evidence","severity":"Critical","policyDependency":"Privacy and Personal Data","minimumTest":"Test identifiers plus diagnosis/treatment context and de-identified cases.","applicability":"HIPAA workflows; context-sensitive, not a blanket ‘no PII’ rule.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-08@f94b476097640eb3","id":"MS-RULE-DP-08","version":"f94b476097640eb3","kind":"rule","lifecycle":"EXTRACTED","title":"Restrict education records","statement":"Block grades, transcripts, discipline records and student identifiers in unapproved AI; require authorized purpose and disclosure basis.","family":"Data Protection","body":{"sourceId":"DP-08","decisionLogic":"Block grades, transcripts, discipline records and student identifiers in unapproved AI; require authorized purpose and disclosure basis.","defaultMode":"Conditional block","automationTier":"E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Partial","evidence":"Decision + authorization record","severity":"High","policyDependency":"Privacy and Personal Data","minimumTest":"Test student-record narratives and directory-information exceptions.","applicability":"Educational institutions.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-09@e32553c4840951b3","id":"MS-RULE-DP-09","version":"e32553c4840951b3","kind":"rule","lifecycle":"EXTRACTED","title":"Protect contact information","statement":"Warn or block email, phone and postal address based on data classification, purpose, volume and approved service.","family":"Data Protection","body":{"sourceId":"DP-09","decisionLogic":"Warn or block email, phone and postal address based on data classification, purpose, volume and approved service.","defaultMode":"Conditional warn/block","automationTier":"E2/E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Partial","evidence":"Decision + context","severity":"High","policyDependency":"Privacy and Personal Data","minimumTest":"Test single business contact, bulk lists, and sensitive-context combinations.","applicability":"Contextual; a single public business email may be permitted.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-10@fc6f0a161d4f201f","id":"MS-RULE-DP-10","version":"fc6f0a161d4f201f","kind":"rule","lifecycle":"EXTRACTED","title":"Block biometric identifiers","statement":"Block face templates, voiceprints, fingerprints, iris data and other biometric identifiers outside approved use.","family":"Data Protection","body":{"sourceId":"DP-10","decisionLogic":"Block face templates, voiceprints, fingerprints, iris data and other biometric identifiers outside approved use.","defaultMode":"Block","automationTier":"E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Roadmap","evidence":"Decision log","severity":"Critical","policyDependency":"Privacy and Personal Data","minimumTest":"Test text references and supported image/audio metadata.","applicability":"High-risk personal data.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-11@b7d96f7e1501e4ed","id":"MS-RULE-DP-11","version":"b7d96f7e1501e4ed","kind":"rule","lifecycle":"EXTRACTED","title":"Protect precise location","statement":"Warn or block precise geolocation and sensitive movement history unless purpose, consent and service are approved.","family":"Data Protection","body":{"sourceId":"DP-11","decisionLogic":"Warn or block precise geolocation and sensitive movement history unless purpose, consent and service are approved.","defaultMode":"Conditional warn/block","automationTier":"E2/E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Roadmap","evidence":"Decision + approved purpose","severity":"High","policyDependency":"Privacy and Personal Data","minimumTest":"Test coordinates, addresses, routes and location narratives.","applicability":"Configure precision and context thresholds.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-12@4ae51c2523134e28","id":"MS-RULE-DP-12","version":"4ae51c2523134e28","kind":"rule","lifecycle":"EXTRACTED","title":"Block classified, CUI and FCI","statement":"Block classified information, CUI/FCI markings and designated government data from unauthorized AI channels.","family":"Data Protection","body":{"sourceId":"DP-12","decisionLogic":"Block classified information, CUI/FCI markings and designated government data from unauthorized AI channels.","defaultMode":"Block","automationTier":"E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Partial","evidence":"Decision log + classification match","severity":"Critical","policyDependency":"Data Classification for AI","minimumTest":"Test markings, portion labels, headers, and contextual descriptions.","applicability":"Government and contractors.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-13@1299bbf89c50bd1a","id":"MS-RULE-DP-13","version":"1299bbf89c50bd1a","kind":"rule","lifecycle":"EXTRACTED","title":"Protect export-controlled and national-security data","statement":"Block ITAR/EAR-controlled technical data and designated national-security information from unauthorized models, regions and persons.","family":"Data Protection","body":{"sourceId":"DP-13","decisionLogic":"Block ITAR/EAR-controlled technical data and designated national-security information from unauthorized models, regions and persons.","defaultMode":"Conditional block","automationTier":"E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Roadmap","evidence":"Decision + jurisdiction + authorization","severity":"Critical","policyDependency":"Data Classification for AI","minimumTest":"Test project codes, markings and controlled technical narratives.","applicability":"Requires enterprise classifications and jurisdiction rules.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-14@7b898303f53ec49b","id":"MS-RULE-DP-14","version":"7b898303f53ec49b","kind":"rule","lifecycle":"EXTRACTED","title":"Protect trade secrets and source code","statement":"Block or require approval for proprietary algorithms, source code, product roadmaps and trade secrets sent to unapproved AI.","family":"Data Protection","body":{"sourceId":"DP-14","decisionLogic":"Block or require approval for proprietary algorithms, source code, product roadmaps and trade secrets sent to unapproved AI.","defaultMode":"Conditional block/approve","automationTier":"E2/E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Partial","evidence":"Decision + repository/project context","severity":"High","policyDependency":"IP, Copyright and Confidentiality","minimumTest":"Test code, design documents and organization-specific codewords.","applicability":"Enterprise-specific classification is required.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false,"semanticNeighbors":[{"ruleId":"AIR-D67362ED3A","score":0.5,"status":"UNREVIEWED_NEIGHBOR"}]}},{"key":"MS-RULE-DP-15@208a0f796d79405e","id":"MS-RULE-DP-15","version":"208a0f796d79405e","kind":"rule","lifecycle":"EXTRACTED","title":"Protect architecture and vulnerability details","statement":"Warn or block internal topology, system configuration, exploit paths, audit findings and unpatched vulnerabilities.","family":"Data Protection","body":{"sourceId":"DP-15","decisionLogic":"Warn or block internal topology, system configuration, exploit paths, audit findings and unpatched vulnerabilities.","defaultMode":"Conditional warn/block","automationTier":"E2/E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Partial","evidence":"Decision + recipient/service context","severity":"High","policyDependency":"AI Security and Prompt Injection","minimumTest":"Test IPs, diagrams, vulnerabilities, findings and obfuscation.","applicability":"Permit approved remediation use on sanctioned systems.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-16@d0dca88853814a51","id":"MS-RULE-DP-16","version":"d0dca88853814a51","kind":"rule","lifecycle":"EXTRACTED","title":"Protect customer confidential data","statement":"Block or approve customer records, contracts, support cases and tenant data according to contract, classification and purpose.","family":"Data Protection","body":{"sourceId":"DP-16","decisionLogic":"Block or approve customer records, contracts, support cases and tenant data according to contract, classification and purpose.","defaultMode":"Conditional block/approve","automationTier":"E2/E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Partial","evidence":"Decision + customer/tenant context","severity":"High","policyDependency":"IP, Copyright and Confidentiality","minimumTest":"Test structured and narrative customer data, including multi-record uploads.","applicability":"Requires customer and tenant identifiers.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-17@d1c8e0c542b0a6f6","id":"MS-RULE-DP-17","version":"d1c8e0c542b0a6f6","kind":"rule","lifecycle":"EXTRACTED","title":"Block MNPI and unreleased financials","statement":"Block material nonpublic information, unreleased earnings, transactions and forecasts from external AI unless specifically authorized.","family":"Data Protection","body":{"sourceId":"DP-17","decisionLogic":"Block material nonpublic information, unreleased earnings, transactions and forecasts from external AI unless specifically authorized.","defaultMode":"Block","automationTier":"E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Partial","evidence":"Decision + matter code","severity":"Critical","policyDependency":"IP, Copyright and Confidentiality","minimumTest":"Test earnings, M&A and deal narratives with organization codewords.","applicability":"Public companies and regulated financial workflows.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-18@082a5a202e1a48ef","id":"MS-RULE-DP-18","version":"082a5a202e1a48ef","kind":"rule","lifecycle":"EXTRACTED","title":"Protect privilege and investigations","statement":"Warn or block attorney-client privileged material, work product, investigations, employee matters and protected audit content.","family":"Data Protection","body":{"sourceId":"DP-18","decisionLogic":"Warn or block attorney-client privileged material, work product, investigations, employee matters and protected audit content.","defaultMode":"Conditional block/approve","automationTier":"E2/E3","enforcementPoint":"Prompt + upload + response","reportedSupport":"Roadmap","evidence":"Decision + matter authorization","severity":"High","policyDependency":"IP, Copyright and Confidentiality","minimumTest":"Test privilege legends, matter numbers and investigation narratives.","applicability":"Legal and HR workflows.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-DP-19@40fb41ffda35d9a3","id":"MS-RULE-DP-19","version":"40fb41ffda35d9a3","kind":"rule","lifecycle":"DRAFT","title":"Enforce age, consent and parental authorization","statement":"Before collecting or disclosing youth data, verify the applicable age rule, capture valid consent, enforce purpose limits, and honor revocation and deletion.","family":"Data Protection","body":{"sourceId":"DP-19","defaultMode":"Block / require approval","automationTier":"E2/E3","enforcementPoint":"Intake + prompt + upload + data store","severity":"Critical","evidence":"Consent decision + age band + deletion event","reportedDisposition":"Proposed new canonical","reportedApproval":"Proposed — review required","linkedPolicies":["POL-28"],"frameworkDrivers":["COPPA","FERPA","EU-AI-ACT"],"admissionTest":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission.","reviewerNotes":null,"sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-IN-01@e4fe11be1a20f12f","id":"MS-RULE-IN-01","version":"e4fe11be1a20f12f","kind":"rule","lifecycle":"EXTRACTED","title":"Detect direct prompt injection and jailbreaks","statement":"Block or isolate instructions that attempt to override policy, reveal hidden context or bypass safeguards.","family":"Input Security","body":{"sourceId":"IN-01","decisionLogic":"Block or isolate instructions that attempt to override policy, reveal hidden context or bypass safeguards.","defaultMode":"Block","automationTier":"E3","enforcementPoint":"Prompt","reportedSupport":"Partial","evidence":"Decision + attack class","severity":"Critical","policyDependency":"AI Security and Prompt Injection","minimumTest":"Run multilingual, role-play, encoded and multi-turn attack suites.","applicability":"Tune to use case; preserve legitimate security testing in sandboxes.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-IN-02@dbb47a84e8a96c05","id":"MS-RULE-IN-02","version":"dbb47a84e8a96c05","kind":"rule","lifecycle":"EXTRACTED","title":"Detect indirect prompt injection","statement":"Treat files, web pages, email, RAG content and tool results as untrusted; block hidden instructions from driving actions.","family":"Input Security","body":{"sourceId":"IN-02","decisionLogic":"Treat files, web pages, email, RAG content and tool results as untrusted; block hidden instructions from driving actions.","defaultMode":"Block / isolate","automationTier":"E3","enforcementPoint":"Upload + retrieval + tool result","reportedSupport":"Roadmap","evidence":"Decision + source provenance","severity":"Critical","policyDependency":"AI Security and Prompt Injection","minimumTest":"Test poisoned documents, web pages and retrieved chunks.","applicability":"Critical for RAG and agents.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-IN-03@900d1ac2806dab1c","id":"MS-RULE-IN-03","version":"900d1ac2806dab1c","kind":"rule","lifecycle":"EXTRACTED","title":"Detect obfuscated and multimodal attacks","statement":"Normalize Unicode, encodings, invisible text, images, audio and document structure before rule evaluation.","family":"Input Security","body":{"sourceId":"IN-03","decisionLogic":"Normalize Unicode, encodings, invisible text, images, audio and document structure before rule evaluation.","defaultMode":"Block / isolate","automationTier":"E3","enforcementPoint":"All inputs","reportedSupport":"Roadmap","evidence":"Normalization and decision log","severity":"High","policyDependency":"AI Security and Prompt Injection","minimumTest":"Test homoglyphs, zero-width text, base64, OCR and image-based injection.","applicability":"Requires modality-specific extraction.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-IN-04@40341d186f0bd606","id":"MS-RULE-IN-04","version":"40341d186f0bd606","kind":"rule","lifecycle":"EXTRACTED","title":"Restrict harmful cyber requests","statement":"Block malicious requests for credential theft, destructive exploitation or unauthorized access; route approved defensive testing to a controlled mode.","family":"Input Security","body":{"sourceId":"IN-04","decisionLogic":"Block malicious requests for credential theft, destructive exploitation or unauthorized access; route approved defensive testing to a controlled mode.","defaultMode":"Conditional block","automationTier":"E3","enforcementPoint":"Prompt + tool call","reportedSupport":"Roadmap","evidence":"Decision + approved test context","severity":"Critical","policyDependency":"AI Security and Prompt Injection","minimumTest":"Test dual-use boundaries and approved red-team contexts.","applicability":"Context- and authorization-sensitive.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-IN-05@8dff43ab30881e3f","id":"MS-RULE-IN-05","version":"8dff43ab30881e3f","kind":"rule","lifecycle":"EXTRACTED","title":"Quarantine unsafe files and malware","statement":"Scan attachments for malware, active content, archive bombs and prohibited formats; block or quarantine before AI ingestion.","family":"Input Security","body":{"sourceId":"IN-05","decisionLogic":"Scan attachments for malware, active content, archive bombs and prohibited formats; block or quarantine before AI ingestion.","defaultMode":"Block / quarantine","automationTier":"E3/E4","enforcementPoint":"Upload","reportedSupport":"Roadmap","evidence":"Scan result + quarantine event","severity":"Critical","policyDependency":"AI Security and Prompt Injection","minimumTest":"Test malware simulators, macros, encrypted archives and oversize files.","applicability":"Current build scans only readable text files ≤1 MB and does not prevent upload.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-IN-06@478a04da335c1e7f","id":"MS-RULE-IN-06","version":"478a04da335c1e7f","kind":"rule","lifecycle":"EXTRACTED","title":"Prevent RAG and data poisoning","statement":"Validate provenance, authorization and integrity before documents, embeddings, feedback or fine-tuning data enter an AI corpus.","family":"Input Security","body":{"sourceId":"IN-06","decisionLogic":"Validate provenance, authorization and integrity before documents, embeddings, feedback or fine-tuning data enter an AI corpus.","defaultMode":"Block / quarantine","automationTier":"E3/E4","enforcementPoint":"Ingestion pipeline","reportedSupport":"Roadmap","evidence":"Provenance + integrity + decision","severity":"Critical","policyDependency":"Data, Model and RAG Supply Chain","minimumTest":"Inject conflicting, malicious and unauthorized content; verify rejection and rollback.","applicability":"RAG, training, fine-tuning and memory stores.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-IN-07@31e317962beaeb5b","id":"MS-RULE-IN-07","version":"31e317962beaeb5b","kind":"rule","lifecycle":"EXTRACTED","title":"Enforce allowed intent and scope","statement":"Constrain requests to the approved business purpose, user role and system capability; warn or block out-of-scope use.","family":"Input Security","body":{"sourceId":"IN-07","decisionLogic":"Constrain requests to the approved business purpose, user role and system capability; warn or block out-of-scope use.","defaultMode":"Warn / block","automationTier":"E2/E3","enforcementPoint":"Prompt + use-case context","reportedSupport":"Roadmap","evidence":"Decision + policy context","severity":"High","policyDependency":"AI Acceptable Use","minimumTest":"Test plausible scope drift and role mismatch.","applicability":"Requires use-case and role context.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-IN-08@94324ccfd3a491ef","id":"MS-RULE-IN-08","version":"94324ccfd3a491ef","kind":"rule","lifecycle":"EXTRACTED","title":"Limit resource consumption","statement":"Enforce prompt, token, file, query, rate, recursion and spend limits; stop runaway loops.","family":"Input Security","body":{"sourceId":"IN-08","decisionLogic":"Enforce prompt, token, file, query, rate, recursion and spend limits; stop runaway loops.","defaultMode":"Block / throttle","automationTier":"E3/E4","enforcementPoint":"Gateway + agent runtime","reportedSupport":"Roadmap","evidence":"Usage meter + throttle event","severity":"High","policyDependency":"Agentic AI and Connectors","minimumTest":"Stress test long context, retries, tool loops and parallel calls.","applicability":"All paid or resource-constrained AI.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-01@ce84968e8045ef9e","id":"MS-RULE-OP-01","version":"ce84968e8045ef9e","kind":"rule","lifecycle":"EXTRACTED","title":"Log AI interactions and control decisions","statement":"Record approved prompt/response metadata, rule outcomes, user/system, model/version, use case, time and action with privacy-aware minimization.","family":"Operations","body":{"sourceId":"OP-01","decisionLogic":"Record approved prompt/response metadata, rule outcomes, user/system, model/version, use case, time and action with privacy-aware minimization.","defaultMode":"Log","automationTier":"E1","enforcementPoint":"All enforcement points","reportedSupport":"Partial","evidence":"Tamper-evident audit event","severity":"High","policyDependency":"AI Monitoring and Logging","minimumTest":"Verify completeness, integrity, access, retention and redaction.","applicability":"All governed systems; log content only where lawful and necessary.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-02@7147e78f71e89fcb","id":"MS-RULE-OP-02","version":"7147e78f71e89fcb","kind":"rule","lifecycle":"EXTRACTED","title":"Capture provenance and citations","statement":"Preserve model/version, source documents, retrieval identifiers, tool calls and transformations for decisions and published content.","family":"Operations","body":{"sourceId":"OP-02","decisionLogic":"Preserve model/version, source documents, retrieval identifiers, tool calls and transformations for decisions and published content.","defaultMode":"Log / require","automationTier":"E1/E3","enforcementPoint":"Response + workflow","reportedSupport":"Roadmap","evidence":"Provenance record","severity":"High","policyDependency":"Transparency, Disclosure and Provenance","minimumTest":"Trace a sample output end-to-end and validate source integrity.","applicability":"High-impact, factual and published outputs.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-03@410599212edc432e","id":"MS-RULE-OP-03","version":"410599212edc432e","kind":"rule","lifecycle":"EXTRACTED","title":"Monitor control efficacy and model drift","statement":"Measure precision, recall, bypass rate, false-positive burden, model/output drift and control coverage against thresholds.","family":"Operations","body":{"sourceId":"OP-03","decisionLogic":"Measure precision, recall, bypass rate, false-positive burden, model/output drift and control coverage against thresholds.","defaultMode":"Monitor / gate","automationTier":"E1/E3","enforcementPoint":"Evaluation + production telemetry","reportedSupport":"Roadmap","evidence":"Metric series + threshold event","severity":"Critical","policyDependency":"Evaluation, Red Team and Benchmarking","minimumTest":"Use labeled tests and production samples; investigate threshold breaches.","applicability":"All critical rules.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-04@63fbf478664e5e99","id":"MS-RULE-OP-04","version":"63fbf478664e5e99","kind":"rule","lifecycle":"EXTRACTED","title":"Escalate AI incidents","statement":"Create and route incidents for critical blocks, suspected leakage, harmful output, control failure and policy evasion; preserve evidence.","family":"Operations","body":{"sourceId":"OP-04","decisionLogic":"Create and route incidents for critical blocks, suspected leakage, harmful output, control failure and policy evasion; preserve evidence.","defaultMode":"Alert / case","automationTier":"E1/E4","enforcementPoint":"Runtime + SOC workflow","reportedSupport":"Partial","evidence":"Incident/case record","severity":"Critical","policyDependency":"AI Incident Response and Kill Switch","minimumTest":"Run tabletop and technical drills from detection through closure.","applicability":"All governed systems.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-05@98df9a80a2151ad4","id":"MS-RULE-OP-05","version":"98df9a80a2151ad4","kind":"rule","lifecycle":"EXTRACTED","title":"Provide kill switch and fail-safe","statement":"Disable a model, connector, use case, rule exception or autonomous action path quickly; default safely when critical controls fail.","family":"Operations","body":{"sourceId":"OP-05","decisionLogic":"Disable a model, connector, use case, rule exception or autonomous action path quickly; default safely when critical controls fail.","defaultMode":"Block / disable","automationTier":"E4","enforcementPoint":"Gateway + admin plane","reportedSupport":"Roadmap","evidence":"Kill event + authorization + recovery","severity":"Critical","policyDependency":"AI Incident Response and Kill Switch","minimumTest":"Test scoped and global shutdown, fail-closed behavior and restoration.","applicability":"Critical and high-impact systems.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-06@6ecbeba4e14a59af","id":"MS-RULE-OP-06","version":"6ecbeba4e14a59af","kind":"rule","lifecycle":"EXTRACTED","title":"Reassess on material change","statement":"Trigger tests, impact assessment and approval when model, data, prompt, tool, vendor, law, use case or risk profile changes.","family":"Operations","body":{"sourceId":"OP-06","decisionLogic":"Trigger tests, impact assessment and approval when model, data, prompt, tool, vendor, law, use case or risk profile changes.","defaultMode":"Hold release","automationTier":"E2/E3","enforcementPoint":"Change pipeline","reportedSupport":"Roadmap","evidence":"Change record + reassessment","severity":"High","policyDependency":"AI Secure Development Lifecycle","minimumTest":"Change each dependency and verify the gate activates.","applicability":"All production AI.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-07@f1df2cbcb724af3b","id":"MS-RULE-OP-07","version":"f1df2cbcb724af3b","kind":"rule","lifecycle":"EXTRACTED","title":"Time-bound exceptions and waivers","statement":"Require scope, owner, rationale, compensating controls, approval, expiry and automatic revocation for every exception.","family":"Operations","body":{"sourceId":"OP-07","decisionLogic":"Require scope, owner, rationale, compensating controls, approval, expiry and automatic revocation for every exception.","defaultMode":"Approve / expire","automationTier":"E2/E4","enforcementPoint":"Policy engine + workflow","reportedSupport":"Roadmap","evidence":"Exception record + expiry event","severity":"High","policyDependency":"Exceptions, Appeals and Risk Acceptance","minimumTest":"Create expired, overbroad and missing-owner exceptions; verify rejection.","applicability":"All rule families.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-08@a38dff87950aa40f","id":"MS-RULE-OP-08","version":"a38dff87950aa40f","kind":"rule","lifecycle":"EXTRACTED","title":"Support feedback, appeal and override","statement":"Provide affected users and operators a documented route to contest, correct, override or escalate AI decisions without retaliation.","family":"Operations","body":{"sourceId":"OP-08","decisionLogic":"Provide affected users and operators a documented route to contest, correct, override or escalate AI decisions without retaliation.","defaultMode":"Workflow","automationTier":"E2","enforcementPoint":"User experience + case management","reportedSupport":"Roadmap","evidence":"Appeal + resolution record","severity":"High","policyDependency":"Exceptions, Appeals and Risk Acceptance","minimumTest":"Test accessibility, timeliness and traceability of appeals.","applicability":"Consequential and user-facing AI.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-09@ec587343b8220a51","id":"MS-RULE-OP-09","version":"ec587343b8220a51","kind":"rule","lifecycle":"EXTRACTED","title":"Maintain AI inventory and ownership","statement":"Continuously inventory AI systems, models, versions, use cases, owners, users, data, vendors, risk tier and status.","family":"Operations","body":{"sourceId":"OP-09","decisionLogic":"Continuously inventory AI systems, models, versions, use cases, owners, users, data, vendors, risk tier and status.","defaultMode":"Detect / require","automationTier":"E1/E3","enforcementPoint":"Discovery + registry","reportedSupport":"Partial","evidence":"Inventory record + reconciliation","severity":"Critical","policyDependency":"AI Governance and Accountability","minimumTest":"Reconcile browser, endpoint, network, procurement and API observations.","applicability":"Enterprise-wide.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-10@8c831bc5659a4340","id":"MS-RULE-OP-10","version":"8c831bc5659a4340","kind":"rule","lifecycle":"EXTRACTED","title":"Monitor vendor and model supply chain","statement":"Track vendor/model changes, subprocessors, incidents, terms, data use, performance and end-of-life; reassess affected rules.","family":"Operations","body":{"sourceId":"OP-10","decisionLogic":"Track vendor/model changes, subprocessors, incidents, terms, data use, performance and end-of-life; reassess affected rules.","defaultMode":"Monitor / gate","automationTier":"E1/E3","enforcementPoint":"Vendor management + runtime","reportedSupport":"Roadmap","evidence":"Vendor evidence + change event","severity":"High","policyDependency":"Vendor and AI Procurement","minimumTest":"Simulate model version, term and subprocessor change.","applicability":"Third-party AI.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-11@a024a5509524bfa2","id":"MS-RULE-OP-11","version":"a024a5509524bfa2","kind":"rule","lifecycle":"EXTRACTED","title":"Decommission safely and delete data","statement":"Revoke access, export required records, delete prompts/files/embeddings/memory, terminate connectors and document residual risk.","family":"Operations","body":{"sourceId":"OP-11","decisionLogic":"Revoke access, export required records, delete prompts/files/embeddings/memory, terminate connectors and document residual risk.","defaultMode":"Automate / verify","automationTier":"E4","enforcementPoint":"Admin + data lifecycle","reportedSupport":"Roadmap","evidence":"Deletion certificate + access revocation","severity":"High","policyDependency":"AI Decommissioning and Data Lifecycle","minimumTest":"Test deletion across primary, cache, backup and vendor scopes.","applicability":"Retired systems and use cases.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-12@04d0287d10225094","id":"MS-RULE-OP-12","version":"04d0287d10225094","kind":"rule","lifecycle":"EXTRACTED","title":"Require predeployment evaluation and red team","statement":"Do not release until required privacy, security, fairness, robustness, factuality, abuse and human-factors tests meet documented go/no-go thresholds.","family":"Operations","body":{"sourceId":"OP-12","decisionLogic":"Do not release until required privacy, security, fairness, robustness, factuality, abuse and human-factors tests meet documented go/no-go thresholds.","defaultMode":"Hold release","automationTier":"E3","enforcementPoint":"CI/CD + governance workflow","reportedSupport":"Roadmap","evidence":"Test report + release decision","severity":"Critical","policyDependency":"Evaluation, Red Team and Benchmarking","minimumTest":"Use versioned representative datasets; independently review high-impact systems.","applicability":"All production AI; depth based on risk.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-13@d9a7b8a98719c7c2","id":"MS-RULE-OP-13","version":"d9a7b8a98719c7c2","kind":"rule","lifecycle":"DRAFT","title":"Enforce records retention, legal hold and defensible deletion","statement":"Classify AI interactions and decisions as records, apply approved retention and legal holds, and produce verified deletion at expiry.","family":"Operations","body":{"sourceId":"OP-13","defaultMode":"Gate / alert","automationTier":"E3/E4","enforcementPoint":"Log + evidence store + model memory","severity":"High","evidence":"Retention class + hold + deletion certificate","reportedDisposition":"Proposed new canonical","reportedApproval":"Proposed — review required","linkedPolicies":["POL-23"],"frameworkDrivers":["SOX","OMB-M25-21","CJIS-6.1","IRS-1075","UK-DP-AI","GDPR"],"admissionTest":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission.","reviewerNotes":null,"sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-14@b102df5650885781","id":"MS-RULE-OP-14","version":"b102df5650885781","kind":"rule","lifecycle":"DRAFT","title":"Run required independent bias audit and disclosure","statement":"Block covered employment or other deployments when an in-scope independent bias audit is missing, stale, failed, or not disclosed as required.","family":"Operations","body":{"sourceId":"OP-14","defaultMode":"Block / require approval","automationTier":"E2/E3","enforcementPoint":"Release gate + use-case registry","severity":"Critical","evidence":"Audit + independence + publication + validity date","reportedDisposition":"Proposed new canonical","reportedApproval":"Proposed — review required","linkedPolicies":["POL-25"],"frameworkDrivers":["NYC-LL144","IL-AIVIA","EU-AI-ACT","GDPR"],"admissionTest":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission.","reviewerNotes":null,"sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-15@bab74c0be8fc582d","id":"MS-RULE-OP-15","version":"bab74c0be8fc582d","kind":"rule","lifecycle":"DRAFT","title":"Validate clinical intended use and require qualified review","statement":"Constrain clinical AI to validated intended use, approved population and operating conditions, with qualified review before patient-impacting action.","family":"Operations","body":{"sourceId":"OP-15","defaultMode":"Block / require approval","automationTier":"E3","enforcementPoint":"Release + clinical workflow + output","severity":"Critical","evidence":"Intended-use match + validation + reviewer decision","reportedDisposition":"Proposed new canonical","reportedApproval":"Proposed — review required","linkedPolicies":["POL-27"],"frameworkDrivers":["HIPAA","HHS-PART2","ONC-HTI1","FDA-AI-MD"],"admissionTest":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission.","reviewerNotes":null,"sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-16@277159bc0f54c27c","id":"MS-RULE-OP-16","version":"277159bc0f54c27c","kind":"rule","lifecycle":"DRAFT","title":"Preserve public-sector due process and decision record","statement":"For government decisions affecting rights or benefits, require notice, reviewability, appeal, preserved rationale and a non-automated fallback where required.","family":"Operations","body":{"sourceId":"OP-16","defaultMode":"Block / require approval","automationTier":"E2/E3","enforcementPoint":"Decision workflow","severity":"Critical","evidence":"Notice + rationale + reviewer + appeal record","reportedDisposition":"Proposed new canonical","reportedApproval":"Proposed — review required","linkedPolicies":["POL-29"],"frameworkDrivers":["OMB-M25-21","NIST-800-53","CJIS-6.1","SECTION-508","EU-AI-ACT"],"admissionTest":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission.","reviewerNotes":null,"sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-17@6b311b898e8dc850","id":"MS-RULE-OP-17","version":"6b311b898e8dc850","kind":"rule","lifecycle":"DRAFT","title":"Require independent model validation and effective challenge","statement":"A model cannot enter or remain in material use without risk-tiered independent validation, tracked findings and accountable approval.","family":"Operations","body":{"sourceId":"OP-17","defaultMode":"Gate / alert","automationTier":"E2/E3","enforcementPoint":"Release + periodic review","severity":"High","evidence":"Validation + challenge + findings + approval","reportedDisposition":"Proposed new canonical","reportedApproval":"Proposed — review required","linkedPolicies":["POL-26","POL-31"],"frameworkDrivers":["ECOA-REG-B","FRB-MRM-2026","GLBA","GDPR","NAIC-AI","ISO-42005","NIST-AI-RMF"],"admissionTest":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission.","reviewerNotes":null,"sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-18@1df03547863d8288","id":"MS-RULE-OP-18","version":"1df03547863d8288","kind":"rule","lifecycle":"DRAFT","title":"Register automated decisions and required public disclosures","statement":"Maintain a current registry of covered automated decision systems and publish or deliver required system, purpose, risk and contact disclosures.","family":"Operations","body":{"sourceId":"OP-18","defaultMode":"Gate / alert","automationTier":"E1/E2","enforcementPoint":"Inventory + publication","severity":"High","evidence":"Registry record + disclosure artifact + timestamp","reportedDisposition":"Proposed new canonical","reportedApproval":"Proposed — review required","linkedPolicies":["POL-25","POL-29","POL-33"],"frameworkDrivers":["NYC-LL144","IL-AIVIA","EU-AI-ACT","GDPR","OMB-M25-21","NIST-800-53","CJIS-6.1","SECTION-508","ONC-HTI1","CO-AI"],"admissionTest":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission.","reviewerNotes":null,"sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OP-19@744dc9983a3098ac","id":"MS-RULE-OP-19","version":"744dc9983a3098ac","kind":"rule","lifecycle":"DRAFT","title":"Require ethics approval for human-subject AI research","statement":"Block research involving people or identifiable human data until required ethics or IRB review, consent terms and data controls are approved.","family":"Operations","body":{"sourceId":"OP-19","defaultMode":"Gate / alert","automationTier":"E2/E3","enforcementPoint":"Research intake + data access","severity":"High","evidence":"Protocol + approval + consent + data authorization","reportedDisposition":"Proposed new canonical","reportedApproval":"Proposed — review required","linkedPolicies":["POL-34"],"frameworkDrivers":["HIPAA","HHS-PART2","FDA-AI-MD","GDPR"],"admissionTest":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission.","reviewerNotes":null,"sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OU-01@d0805195b855c7dd","id":"MS-RULE-OU-01","version":"d0805195b855c7dd","kind":"rule","lifecycle":"EXTRACTED","title":"Block sensitive output disclosure","statement":"Inspect outputs for secrets, regulated data, hidden context and unauthorized tenant/customer information before display or downstream use.","family":"Output Safety","body":{"sourceId":"OU-01","decisionLogic":"Inspect outputs for secrets, regulated data, hidden context and unauthorized tenant/customer information before display or downstream use.","defaultMode":"Block / redact","automationTier":"E3","enforcementPoint":"Response + tool result","reportedSupport":"Roadmap","evidence":"Decision + redacted output","severity":"Critical","policyDependency":"Prompt and Output Interaction","minimumTest":"Seed hidden sensitive data and verify it never reaches the user or tool.","applicability":"External AI responses are not intercepted in the current build.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OU-02@4965655028a3d485","id":"MS-RULE-OU-02","version":"4965655028a3d485","kind":"rule","lifecycle":"EXTRACTED","title":"Prevent hidden-context and system-prompt leakage","statement":"Block disclosure of system prompts, hidden instructions, connector tokens, private retrieval context and chain-of-control metadata.","family":"Output Safety","body":{"sourceId":"OU-02","decisionLogic":"Block disclosure of system prompts, hidden instructions, connector tokens, private retrieval context and chain-of-control metadata.","defaultMode":"Block / redact","automationTier":"E3","enforcementPoint":"Response","reportedSupport":"Roadmap","evidence":"Decision + leakage class","severity":"Critical","policyDependency":"AI Security and Prompt Injection","minimumTest":"Run extraction attacks and canary-string tests.","applicability":"Especially important for hosted agents and RAG.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OU-03@ce8e31e07eb4da96","id":"MS-RULE-OU-03","version":"ce8e31e07eb4da96","kind":"rule","lifecycle":"EXTRACTED","title":"Require evidence for factual claims","statement":"For designated decisions, require citations or approved source grounding; flag unsupported, fabricated or stale claims.","family":"Output Safety","body":{"sourceId":"OU-03","decisionLogic":"For designated decisions, require citations or approved source grounding; flag unsupported, fabricated or stale claims.","defaultMode":"Warn / hold","automationTier":"E2/E3","enforcementPoint":"Response","reportedSupport":"Roadmap","evidence":"Claim-source links + verification result","severity":"High","policyDependency":"Evaluation, Red Team and Benchmarking","minimumTest":"Test answerability, fabricated citations and stale sources.","applicability":"Apply by use case; not every creative task needs citations.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OU-04@4f3b3444715b2744","id":"MS-RULE-OU-04","version":"4f3b3444715b2744","kind":"rule","lifecycle":"EXTRACTED","title":"Require human validation for high-stakes advice","statement":"Do not let unreviewed AI output make or communicate medical, legal, financial, employment, housing, education or safety decisions.","family":"Output Safety","body":{"sourceId":"OU-04","decisionLogic":"Do not let unreviewed AI output make or communicate medical, legal, financial, employment, housing, education or safety decisions.","defaultMode":"Hold for approval","automationTier":"E2/E3","enforcementPoint":"Response + workflow","reportedSupport":"Roadmap","evidence":"Reviewer identity + decision","severity":"Critical","policyDependency":"High-Impact AI and Human Oversight","minimumTest":"Simulate consequential outputs; verify required review and fail-safe.","applicability":"Configure domains and qualified reviewers.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OU-05@cb5aeaa742fb4521","id":"MS-RULE-OU-05","version":"cb5aeaa742fb4521","kind":"rule","lifecycle":"EXTRACTED","title":"Detect discriminatory or unfair outcomes","statement":"Hold or flag outputs that use protected traits, proxies or unjustified disparate treatment in consequential contexts.","family":"Output Safety","body":{"sourceId":"OU-05","decisionLogic":"Hold or flag outputs that use protected traits, proxies or unjustified disparate treatment in consequential contexts.","defaultMode":"Hold / alert","automationTier":"E2/E3","enforcementPoint":"Response + decision record","reportedSupport":"Roadmap","evidence":"Fairness test + decision","severity":"Critical","policyDependency":"Bias, Fairness and Civil Rights","minimumTest":"Test counterfactual pairs, subgroup performance and proxy features.","applicability":"Requires domain-specific legal and statistical review.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OU-06@ce0137df984ac601","id":"MS-RULE-OU-06","version":"ce0137df984ac601","kind":"rule","lifecycle":"EXTRACTED","title":"Block harassment, hate and abuse","statement":"Block or safely transform hateful, harassing, demeaning or targeted abusive content under the organization’s safety standard.","family":"Output Safety","body":{"sourceId":"OU-06","decisionLogic":"Block or safely transform hateful, harassing, demeaning or targeted abusive content under the organization’s safety standard.","defaultMode":"Block / transform","automationTier":"E3/E4","enforcementPoint":"Response","reportedSupport":"Roadmap","evidence":"Decision + safety category","severity":"High","policyDependency":"AI Acceptable Use","minimumTest":"Run multilingual and contextual safety tests, including quoted material exceptions.","applicability":"Tune for lawful monitoring and support contexts.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OU-07@7d5bc203e83e95c9","id":"MS-RULE-OU-07","version":"7d5bc203e83e95c9","kind":"rule","lifecycle":"EXTRACTED","title":"Block dangerous and illegal content","statement":"Block actionable content that materially facilitates violence, self-harm, illegal activity or CBRN harm; route emergencies to approved support.","family":"Output Safety","body":{"sourceId":"OU-07","decisionLogic":"Block actionable content that materially facilitates violence, self-harm, illegal activity or CBRN harm; route emergencies to approved support.","defaultMode":"Block / route","automationTier":"E3/E4","enforcementPoint":"Prompt + response","reportedSupport":"Roadmap","evidence":"Decision + escalation event","severity":"Critical","policyDependency":"AI Acceptable Use","minimumTest":"Use controlled safety datasets and escalation drills.","applicability":"Requires carefully governed exceptions for research and safety teams.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OU-08@4c7bb6dc00dfcbfd","id":"MS-RULE-OU-08","version":"4c7bb6dc00dfcbfd","kind":"rule","lifecycle":"EXTRACTED","title":"Block insecure code from automated use","statement":"Scan generated code for vulnerabilities, malware patterns, exposed secrets and unsafe dependencies before merge, execution or deployment.","family":"Output Safety","body":{"sourceId":"OU-08","decisionLogic":"Scan generated code for vulnerabilities, malware patterns, exposed secrets and unsafe dependencies before merge, execution or deployment.","defaultMode":"Hold / block","automationTier":"E2/E3","enforcementPoint":"Response + CI/CD","reportedSupport":"Roadmap","evidence":"Scan findings + approval","severity":"High","policyDependency":"AI Secure Development Lifecycle","minimumTest":"Benchmark common weakness classes and dependency risks.","applicability":"Development and code-generation use cases.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OU-09@2ffb1322457172b3","id":"MS-RULE-OU-09","version":"2ffb1322457172b3","kind":"rule","lifecycle":"EXTRACTED","title":"Sanitize and validate model output","statement":"Treat model output as untrusted: enforce schema, encode content, parameterize commands and validate before execution or display.","family":"Output Safety","body":{"sourceId":"OU-09","decisionLogic":"Treat model output as untrusted: enforce schema, encode content, parameterize commands and validate before execution or display.","defaultMode":"Transform / block","automationTier":"E3/E4","enforcementPoint":"Response + consuming application","reportedSupport":"Roadmap","evidence":"Validation result + rejected payload","severity":"Critical","policyDependency":"AI Secure Development Lifecycle","minimumTest":"Test XSS, SQL/command injection, malformed JSON and policy bypass.","applicability":"Applications consuming model output.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OU-10@2332653b89bcd331","id":"MS-RULE-OU-10","version":"2332653b89bcd331","kind":"rule","lifecycle":"EXTRACTED","title":"Protect intellectual property and licenses","statement":"Detect likely copyrighted, licensed or third-party confidential material; require attribution, license check or human review before reuse.","family":"Output Safety","body":{"sourceId":"OU-10","decisionLogic":"Detect likely copyrighted, licensed or third-party confidential material; require attribution, license check or human review before reuse.","defaultMode":"Warn / hold","automationTier":"E2/E3","enforcementPoint":"Response","reportedSupport":"Roadmap","evidence":"Similarity/license review record","severity":"High","policyDependency":"IP, Copyright and Confidentiality","minimumTest":"Test verbatim regeneration, code-license conflicts and source attribution.","applicability":"Use-case and jurisdiction specific.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OU-11@0710643d8a955cf6","id":"MS-RULE-OU-11","version":"0710643d8a955cf6","kind":"rule","lifecycle":"EXTRACTED","title":"Prevent re-identification","statement":"Block outputs that recombine, infer or expose identities from de-identified, aggregate or pseudonymous data.","family":"Output Safety","body":{"sourceId":"OU-11","decisionLogic":"Block outputs that recombine, infer or expose identities from de-identified, aggregate or pseudonymous data.","defaultMode":"Block / hold","automationTier":"E3","enforcementPoint":"Response","reportedSupport":"Roadmap","evidence":"Privacy-risk result","severity":"Critical","policyDependency":"Privacy and Personal Data","minimumTest":"Run linkage and uniqueness attacks against representative datasets.","applicability":"Analytics, synthetic data and health/research contexts.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OU-12@295cdecda41b8b55","id":"MS-RULE-OU-12","version":"295cdecda41b8b55","kind":"rule","lifecycle":"EXTRACTED","title":"Disclose AI-generated or synthetic content","statement":"Apply required AI-use notices, provenance metadata and machine-readable labels to designated content and interactions.","family":"Output Safety","body":{"sourceId":"OU-12","decisionLogic":"Apply required AI-use notices, provenance metadata and machine-readable labels to designated content and interactions.","defaultMode":"Transform / require disclosure","automationTier":"E3/E4","enforcementPoint":"Response + publication","reportedSupport":"Roadmap","evidence":"Label/provenance record","severity":"High","policyDependency":"Transparency, Disclosure and Provenance","minimumTest":"Verify labels survive export, reposting and supported transformations.","applicability":"Public-facing or regulated content.","sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OU-13@1eb7cb01e3cf473f","id":"MS-RULE-OU-13","version":"1eb7cb01e3cf473f","kind":"rule","lifecycle":"DRAFT","title":"Provide an accessible equivalent interaction and output","statement":"AI interfaces and generated content must preserve an accessible, tested path that provides equivalent information and action without disability-based exclusion.","family":"Output Safety","body":{"sourceId":"OU-13","defaultMode":"Gate / alert","automationTier":"E2/E3","enforcementPoint":"Interface + output + publication","severity":"High","evidence":"Accessibility test + conformance record","reportedDisposition":"Proposed new canonical","reportedApproval":"Proposed — review required","linkedPolicies":["POL-24"],"frameworkDrivers":["SECTION-508","EU-AI-ACT","NIST-AI-RMF"],"admissionTest":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission.","reviewerNotes":null,"sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OU-14@ae9d5f3f618c9838","id":"MS-RULE-OU-14","version":"ae9d5f3f618c9838","kind":"rule","lifecycle":"DRAFT","title":"Provide specific reasons and notice for consequential adverse decisions","statement":"Do not finalize a covered adverse decision unless specific, accurate reasons and required notices can be generated from preserved decision factors.","family":"Output Safety","body":{"sourceId":"OU-14","defaultMode":"Block / require approval","automationTier":"E3","enforcementPoint":"Decision output + notice","severity":"Critical","evidence":"Decision factors + notice + delivery record","reportedDisposition":"Proposed new canonical","reportedApproval":"Proposed — review required","linkedPolicies":["POL-25","POL-26"],"frameworkDrivers":["NYC-LL144","IL-AIVIA","EU-AI-ACT","GDPR","ECOA-REG-B","FRB-MRM-2026","GLBA"],"admissionTest":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission.","reviewerNotes":null,"sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"MS-RULE-OU-15@17dad38dad581076","id":"MS-RULE-OU-15","version":"17dad38dad581076","kind":"rule","lifecycle":"DRAFT","title":"Apply child-safe response and escalation controls","statement":"Detect child-directed contexts, constrain unsafe or manipulative responses, and route safety concerns to an approved adult or specialist process.","family":"Output Safety","body":{"sourceId":"OU-15","defaultMode":"Block / require approval","automationTier":"E2/E3","enforcementPoint":"Prompt + response + escalation","severity":"Critical","evidence":"Age/context decision + response control + escalation","reportedDisposition":"Proposed new canonical","reportedApproval":"Proposed — review required","linkedPolicies":["POL-28"],"frameworkDrivers":["COPPA","FERPA","EU-AI-ACT"],"admissionTest":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission.","reviewerNotes":null,"sourceDate":"2026-08-20","enforcementVerified":false,"adopted":false,"machineExecutable":false}},{"key":"GUIDE-CHIRALITY-MATURITY-abdb5c7bfe9b@6e66767c34e7897b","id":"GUIDE-CHIRALITY-MATURITY-abdb5c7bfe9b","version":"6e66767c34e7897b","kind":"scoring_model","lifecycle":"SECONDARY_REFERENCE","title":"The 5 Maturity Levels","statement":"### Level 1: Awareness\n**Color:** Blue | **Icon:** Eye\n\nThe organization knows AI exists and has begun identifying where it's used, but governance is reactive and informal.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Ad-Hoc Use** | AI tools adopted by individuals without organizational oversight. No central inventory. Shadow AI likely prevalent. |\n| **Risk Identification** | Some risks recognized but not systematically cataloged. Risk assessment is informal, driven by incidents not policy. |\n| **Minimal Oversight** | No formal governance structure. No Chief AI Officer. No AI policy. No compliance program. |\n\n**GOVERN Assessment Criteria:**\n- No AI system registry exists (GOVERN OS would score 0)\n- No policies defined (Policy Engine empty)\n- No assessments run (Assess unused)\n- Energy would discover significant shadow AI\n- Score: 0-20%\n\n**What the customer needs to advance to Level 2:**\n- Register all known AI systems in GOVERN\n- Define baseline acceptable use policy\n- Assign an AI governance owner\n- Run first Document Assess against one framework\n\n---\n\n### Level 2: Active\n**Color:** Green | **Icon:** Gears\n\nThe organization has begun establishing governance structures. Policies exist. Humans are in the loop. Controls are being implemented.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Baseline Policies** | Written AI acceptable use policies. Framework selected (NIST, EU AI Act, etc.). Policies communicated to teams. |\n| **Human-in-the-Loop** | Critical AI decisions require human review. Escalation paths defined. Override mechanisms in place. |\n| **Initial Controls** | Basic access controls on AI systems. Initial monitoring deployed. Some assessment activity. |\n\n**GOVERN Assessment Criteria:**\n- AI systems registered (at least 50% of known systems)\n- At least 1 policy framework imported and active\n- Document Assess run on at least 3 systems\n- Human oversight documented for high-risk systems\n- Some Probe deployment (at least 1 system monitored)\n- Score: 20-40%\n\n**What the customer needs to advance to Level 3:**\n- Complete AI system inventory (100% registered)\n- Standardize assessment process (regular cadence)\n- Implement formal compliance checks\n- Deploy Probe on all high-risk systems\n\n---\n\n### Level 3: Operational\n**Color:** Orange/Gold | **Icon:** Clipboard with checkmark\n\nGovernance is formalized, standardized, and regularly executed. Compliance is measurable. Audits are happening.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Standardized Processes** | AI governance follows documented procedures. Assessment cadence established (quarterly/monthly). Remediation workflow defined. |\n| **Ethical Compliance** | Bias testing implemented. Fairness metrics tracked. Ethical review board or equivalent active. |\n| **TEVV & Audits** | Test, Evaluation, Verification, and Validation (TEVV) processes in place. Regular audits with documented evidence. ATO packages maintained. |\n\n**GOVERN Assessment Criteria:**\n- 100% of AI systems registered and classified by risk level\n- Multiple frameworks active in Policy Engine\n- Regular assessment cadence (all 3 modes used)\n- Remediation tracker active with SLA compliance >80%\n- Compliance reports generated regularly\n- Bias and fairness testing documented\n- Score: 40-60%\n\n**What the customer needs to advance to Level 4:**\n- Enterprise-wide integration (all departments using GOVERN)\n- Continuous monitoring (Probe on all production systems)\n- Real-time risk management (alerts + auto-remediation)\n- Energy deployed for shadow AI detection\n\n---\n\n### Level 4: Systematic\n**Color:** Red/Coral | **Icon:** Connected gears\n\nGovernance is enterprise-wide, continuous, and integrated into every AI decision. Risk management is proactive, not reactive.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Enterprise Integration** | AI governance integrated into procurement, development, deployment, and retirement processes. All departments participate. |\n| **Continuous Monitoring** | Real-time monitoring of all AI systems. Probe deployed enterprise-wide. Energy sensors detecting shadow AI. Drift detection active. |\n| **Risk Management** | Proactive risk identification. Predictive risk scoring. Risk treatment plans for all high and medium findings. SLA compliance >95%. |\n\n**GOVERN Assessment Criteria:**\n- All AI systems monitored in real-time (Probe + Energy)\n- Shadow AI detection active with <10% false positive rate\n- Policy violations caught and remediated within SLA >95%\n- Cognitive energy baselines established for all critical systems\n- Silent drift detection active\n- CI/CD governance gates integrated\n- Cross-framework compliance maintained\n- Score: 60-80%\n\n**What the customer needs to advance to Level 5:**\n- AI governance becomes a strategic advantage (not just compliance)\n- Governance insights drive business decisions\n- Adaptive policies that evolve with the organization\n- Governance as a competitive differentiator\n\n---\n\n### Level 5: Transformational\n**Color:** Dark Red | **Icon:** Flag on mountain\n\nAI governance is a strategic asset. The organization doesn't just comply — it uses governance to outperform competitors and drive mission impact.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Strategic Advantage** | AI governance creates competitive advantage. Customers trust the organization BECAUSE of its governance. Governance enables faster, safer AI deployment. |\n| **Adaptive AI Governance** | Policies evolve automatically based on new risks, regulations, and organizational changes. CuC-governed policy refinement. Living governance. |\n| **Ethical & Mission Impact** | AI governance directly contributes to mission outcomes. Ethical AI is a brand differentiator. Governance insights drive strategic decisions. |\n\n**GOVERN Assessment Criteria:**\n- Governance score >90% across all frameworks\n- Zero critical findings unresolved >24 hours\n- Governance insights used in board-level decisions\n- Adaptive policies with version history showing evolution\n- GAN adversarial testing on all critical systems (Sandbox Assess)\n- Full audit trail with zero gaps\n- Customer trust metrics improving\n- Score: 80-100%\n\n---","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-acf51a8695dd@df15c458ec8f3ab3","id":"GUIDE-CHIRALITY-MATURITY-acf51a8695dd","version":"df15c458ec8f3ab3","kind":"scoring_model","lifecycle":"SECONDARY_REFERENCE","title":"How GOVERN Implements This / Maturity Score Calculation","statement":"```\nMaturity Score = weighted average across dimensions:\n\nDimension 1 (Responsible & Equitable):  25%\n  - Bias testing coverage (0-100)\n  - Fairness metrics tracked (0-100)\n  - Equity review process (0-100)\n\nDimension 2 (Traceable & Reliable):     25%\n  - System inventory completeness (0-100)\n  - Audit trail coverage (0-100)\n  - Model provenance documented (0-100)\n\nDimension 3 (Governable & Controlled):  25%\n  - Policy coverage (0-100)\n  - Assessment frequency (0-100)\n  - Monitoring deployment (0-100)\n\nDimension 4 (Human-Centric Outcomes):   25%\n  - Human oversight documented (0-100)\n  - Stakeholder feedback active (0-100)\n  - Impact measurement in place (0-100)\n\nLevel = floor(Maturity Score / 20) + 1\n  0-20%  = Level 1 (Awareness)\n  21-40% = Level 2 (Active)\n  41-60% = Level 3 (Operational)\n  61-80% = Level 4 (Systematic)\n  81-100% = Level 5 (Transformational)\n```\n\n---","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-CHIRALITY-MATURITY-f1f90001419d@1f59a3bb902004a5","id":"GUIDE-CHIRALITY-MATURITY-f1f90001419d","version":"1f59a3bb902004a5","kind":"scoring_model","lifecycle":"SECONDARY_REFERENCE","title":"4 Maturity Dimensions","statement":"Each level is also assessed across 4 dimensions:\n\n### Dimension 1: Responsible & Equitable\n- Level 1-2: Ad-hoc use, risk identification, minimal oversight\n- Level 3-4: Systematic fairness testing, documented equity practices\n- Level 5: AI actively promotes equity, bias eliminated by design\n\n### Dimension 2: Traceable & Reliable\n- Level 1-2: Defined owners, human-in-the-loop, initial controls\n- Level 3-4: Full audit trail, model provenance, version control\n- Level 5: Complete lineage from data to decision, cryptographically signed\n\n### Dimension 3: Governable & Controlled\n- Level 1-2: Managed/owned, initial bias & fairness testing\n- Level 3-4: Continuous bias monitoring, automated controls\n- Level 5: Self-governing AI with CuC-based integrity checks\n\n### Dimension 4: Human-Centric Outcomes\n- Level 1-2: Enhancing sentiment, adaptable risk concerns\n- Level 3-4: Measured human impact, stakeholder feedback loops\n- Level 5: AI governance demonstrably improves human outcomes\n\n---","family":"CHIRALITY-MATURITY","body":{"sourceFile":"POLICY(1).md","sourceFamily":"CHIRALITY-MATURITY","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-17ed47d69bd5@74597176329b3a92","id":"GUIDE-TAIMSCORE-17ed47d69bd5","version":"74597176329b3a92","kind":"scoring_model","lifecycle":"SECONDARY_REFERENCE","title":"Scoring Methodology / Control-Level Scoring","statement":"Each subcategory (control) is scored on a 0–4 scale:\n\n| Score | Label | Criteria |\n|-------|-------|---------|\n| 0 | Not Present | No evidence of this control existing |\n| 1 | Initial | Ad hoc, informal, or partial implementation |\n| 2 | Developing | Defined process exists but inconsistently applied |\n| 3 | Established | Consistently applied, documented, and repeatable |\n| 4 | Optimized | Measured, monitored, and continuously improved |","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-7373e9ecec96@54237a430c639ac1","id":"GUIDE-TAIMSCORE-7373e9ecec96","version":"54237a430c639ac1","kind":"scoring_model","lifecycle":"SECONDARY_REFERENCE","title":"What TAIMScore Is","statement":"TAIMScore™ is an enterprise AI maturity and risk assessment framework developed under HISPI Project Cerebellum. It provides organizations with a structured, scored methodology to assess the trustworthiness, governance, and risk posture of AI systems deployed within their environment.\n\nTAIMScore maps directly onto the NIST AI Risk Management Framework (NIST AI 100-1) — its four functions (GOVERN, MAP, MEASURE, MANAGE), 19 categories, and 72 subcategories are the NIST AI RMF structure applied with enterprise scoring methodology and automation hooks.\n\n**Primary use cases:**\n- Enterprise AI governance programs\n- Regulatory readiness assessments (NIST, ISO 42001, EU AI Act, FedRAMP)\n- Third-party AI vendor due diligence\n- Board-level AI risk reporting\n- Federal agency AI procurement evaluation\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-7c6f8ef8a701@8e28bd3d24809b08","id":"GUIDE-TAIMSCORE-7c6f8ef8a701","version":"8e28bd3d24809b08","kind":"scoring_model","lifecycle":"SECONDARY_REFERENCE","title":"Scoring Methodology / Category Score","statement":"Category score = average of all subcategory scores within the category, expressed as a percentage of maximum possible.","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-8fe44c472096@eee14394e87f714b","id":"GUIDE-TAIMSCORE-8fe44c472096","version":"eee14394e87f714b","kind":"scoring_model","lifecycle":"SECONDARY_REFERENCE","title":"Scoring Methodology / TAIMScore™ Composite","statement":"TAIMScore™ Composite = weighted average of all four function scores.\n\n| TAIMScore Range | Maturity Level | Interpretation |\n|-----------------|---------------|----------------|\n| 0–24 | Nascent | Significant gaps; high AI risk exposure |\n| 25–49 | Initial | Ad hoc practices; reactive posture |\n| 50–69 | Developing | Defined processes; inconsistent application |\n| 70–84 | Established | Consistent governance; some optimization gaps |\n| 85–100 | Optimized | Mature, measured, continuously improving |\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-9f18b171a0c0@d05bb0e1866b5200","id":"GUIDE-TAIMSCORE-9f18b171a0c0","version":"d05bb0e1866b5200","kind":"scoring_model","lifecycle":"SECONDARY_REFERENCE","title":"Scoring Methodology","statement":"### Control-Level Scoring\n\nEach subcategory (control) is scored on a 0–4 scale:\n\n| Score | Label | Criteria |\n|-------|-------|---------|\n| 0 | Not Present | No evidence of this control existing |\n| 1 | Initial | Ad hoc, informal, or partial implementation |\n| 2 | Developing | Defined process exists but inconsistently applied |\n| 3 | Established | Consistently applied, documented, and repeatable |\n| 4 | Optimized | Measured, monitored, and continuously improved |\n\n### Category Score\n\nCategory score = average of all subcategory scores within the category, expressed as a percentage of maximum possible.\n\n### Function Score\n\nFunction score = weighted average of all category scores within the function.\n\nDefault weighting:\n- GOVERN: 25%\n- MAP: 25%\n- MEASURE: 25%\n- MANAGE: 25%\n\nCustom weighting can be applied for sector-specific profiles (e.g., federal agencies weight GOVERN higher; healthcare weights MEASURE and MANAGE higher).\n\n### TAIMScore™ Composite\n\nTAIMScore™ Composite = weighted average of all four function scores.\n\n| TAIMScore Range | Maturity Level | Interpretation |\n|-----------------|---------------|----------------|\n| 0–24 | Nascent | Significant gaps; high AI risk exposure |\n| 25–49 | Initial | Ad hoc practices; reactive posture |\n| 50–69 | Developing | Defined processes; inconsistent application |\n| 70–84 | Established | Consistent governance; some optimization gaps |\n| 85–100 | Optimized | Mature, measured, continuously improving |\n\n---","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":2,"notAnOfficialFrameworkEdition":true}},{"key":"GUIDE-TAIMSCORE-ea449fed7451@540ba647e7400001","id":"GUIDE-TAIMSCORE-ea449fed7451","version":"540ba647e7400001","kind":"scoring_model","lifecycle":"SECONDARY_REFERENCE","title":"Scoring Methodology / Function Score","statement":"Function score = weighted average of all category scores within the function.\n\nDefault weighting:\n- GOVERN: 25%\n- MAP: 25%\n- MEASURE: 25%\n- MANAGE: 25%\n\nCustom weighting can be applied for sector-specific profiles (e.g., federal agencies weight GOVERN higher; healthcare weights MEASURE and MANAGE higher).","family":"TAIMSCORE","body":{"sourceFile":"POLICY.md","sourceFamily":"TAIMSCORE","sourceDate":null,"primarySourceRechecked":false,"warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","adopted":false,"enforcementVerified":false,"headingLevel":3,"notAnOfficialFrameworkEdition":true}},{"key":"MS-SOURCE-NOTE-AU-PRIVACY-AI@da30724b50ad5d96","id":"MS-SOURCE-NOTE-AU-PRIVACY-AI","version":"da30724b50ad5d96","kind":"source_note","lifecycle":"REFERENCE","title":"Australia Privacy Act / APPs + OAIC AI Guidance","statement":"OAIC guidance updated Jan 2025; automated-decision privacy-policy amendments commence 10 Dec 2026","family":"Source version note","body":{"sourceId":"AU-PRIVACY-AI","publisherUrl":"https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-BR-LGPD@5fcba992809b3b1e","id":"MS-SOURCE-NOTE-BR-LGPD","version":"5fcba992809b3b1e","kind":"source_note","lifecycle":"REFERENCE","title":"Brazil LGPD + ANPD AI Guidance","statement":"LGPD current; ANPD GenAI guidance continues to evolve","family":"Source version note","body":{"sourceId":"BR-LGPD","publisherUrl":"https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/lgpd-en-lei-no-13-709-capa.pdf","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-CCPA-CPRA@dfbd85b2a322fe7a","id":"MS-SOURCE-NOTE-CCPA-CPRA","version":"dfbd85b2a322fe7a","kind":"source_note","lifecycle":"REFERENCE","title":"California CCPA / CPRA Regulations","statement":"Updated regulations effective 1 Jan 2026; ADMT obligations begin 1 Jan 2027","family":"Source version note","body":{"sourceId":"CCPA-CPRA","publisherUrl":"https://cppa.ca.gov/regulations/ccpa_updates.html","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-CJIS-6.1@7add1fcf7e28764f","id":"MS-SOURCE-NOTE-CJIS-6.1","version":"7add1fcf7e28764f","kind":"source_note","lifecycle":"REFERENCE","title":"FBI CJIS Security Policy v6.1","statement":"Version 6.1 published 25 Jun 2026","family":"Source version note","body":{"sourceId":"CJIS-6.1","publisherUrl":"https://le.fbi.gov/file-repository/cjis_security_policy_v6-1_20260625.pdf/view","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-CMMC@9e207924a4f419e9","id":"MS-SOURCE-NOTE-CMMC","version":"9e207924a4f419e9","kind":"source_note","lifecycle":"REFERENCE","title":"Cybersecurity Maturity Model Certification","statement":"Phase I remains in effect; Phase II suspended 13 Jul 2026 pending review","family":"Source version note","body":{"sourceId":"CMMC","publisherUrl":"https://business.defense.gov/cmmc/","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-CO-AI@0990e7efdb70bde9","id":"MS-SOURCE-NOTE-CO-AI","version":"0990e7efdb70bde9","kind":"source_note","lifecycle":"REFERENCE","title":"Colorado AI laws and rulemaking","statement":"SB26-189 effective 1 Jan 2027; monitor rulemaking","family":"Source version note","body":{"sourceId":"CO-AI","publisherUrl":"https://coag.gov/ai/","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-CO-SB26-189@bc07181d7e90a278","id":"MS-SOURCE-NOTE-CO-SB26-189","version":"bc07181d7e90a278","kind":"source_note","lifecycle":"REFERENCE","title":"Colorado SB26-189","statement":"Signed May 2026; effective 1 Jan 2027","family":"Source version note","body":{"sourceId":"CO-SB26-189","publisherUrl":"https://leg.colorado.gov/bills/sb26-189","reportedQuality":"Official legislature source","useNote":"Revises/re-enacts Colorado AI requirements; monitor implementing rules.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-COPPA@b0ecfb53ebaea5ac","id":"MS-SOURCE-NOTE-COPPA","version":"b0ecfb53ebaea5ac","kind":"source_note","lifecycle":"REFERENCE","title":"Children’s Online Privacy Protection Rule","statement":"FTC amendments finalized Jan 2025; verify applicable compliance date","family":"Source version note","body":{"sourceId":"COPPA","publisherUrl":"https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-DOJ-DSP@033ab90c34a8ed45","id":"MS-SOURCE-NOTE-DOJ-DSP","version":"033ab90c34a8ed45","kind":"source_note","lifecycle":"REFERENCE","title":"DOJ Data Security Program — 28 CFR Part 202","statement":"Effective 8 Apr 2025; affirmative due-diligence and audit duties effective Oct 2025","family":"Source version note","body":{"sourceId":"DOJ-DSP","publisherUrl":"https://www.justice.gov/nsd/data-security","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-EAR@db7aeb13e0f74f04","id":"MS-SOURCE-NOTE-EAR","version":"db7aeb13e0f74f04","kind":"source_note","lifecycle":"REFERENCE","title":"U.S. Export Administration Regulations","statement":"Continuously updated; verify current EAR and license requirements","family":"Source version note","body":{"sourceId":"EAR","publisherUrl":"https://www.bis.gov/regulations/ear/734","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-ECOA-REG-B@bf7f1748f4f66630","id":"MS-SOURCE-NOTE-ECOA-REG-B","version":"bf7f1748f4f66630","kind":"source_note","lifecycle":"REFERENCE","title":"ECOA / Regulation B Adverse Action Requirements","statement":"Technology does not remove adverse-action obligations","family":"Source version note","body":{"sourceId":"ECOA-REG-B","publisherUrl":"https://www.consumerfinance.gov/archive/newsroom/cfpb-issues-guidance-on-credit-denials-by-lenders-using-artificial-intelligence/","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-EO-14110-RESCISSION@b1e1206ab8a875f8","id":"MS-SOURCE-NOTE-EO-14110-RESCISSION","version":"b1e1206ab8a875f8","kind":"source_note","lifecycle":"REFERENCE","title":"Initial Rescissions of Harmful Executive Orders and Actions","statement":"EO 14110 listed as revoked on 20 Jan 2025","family":"Source version note","body":{"sourceId":"EO-14110-RESCISSION","publisherUrl":"https://www.whitehouse.gov/presidential-actions/2025/01/initial-rescissions-of-harmful-executive-orders-and-actions/","reportedQuality":"Official White House source","useNote":"Treat prior EO 14110 mappings as historical/superseded, not current authority.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-EU-AI-ACT@52f0bd02c9eb6511","id":"MS-SOURCE-NOTE-EU-AI-ACT","version":"52f0bd02c9eb6511","kind":"source_note","lifecycle":"REFERENCE","title":"EU Artificial Intelligence Act","statement":"Consolidated text current 27 Jul 2026","family":"Source version note","body":{"sourceId":"EU-AI-ACT","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-FDA-AI-MD@61f59968505b1fa6","id":"MS-SOURCE-NOTE-FDA-AI-MD","version":"61f59968505b1fa6","kind":"source_note","lifecycle":"REFERENCE","title":"FDA AI-Enabled Medical Device Lifecycle Guidance","statement":"Use final requirements plus current FDA guidance; 2025 lifecycle guidance remains draft unless finalized","family":"Source version note","body":{"sourceId":"FDA-AI-MD","publisherUrl":"https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-enabled-medical-devices","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-FEDRAMP@5e0472e4d1ffabac","id":"MS-SOURCE-NOTE-FEDRAMP","version":"5e0472e4d1ffabac","kind":"source_note","lifecycle":"REFERENCE","title":"FedRAMP Rev. 5 Baselines","statement":"Rev. 5","family":"Source version note","body":{"sourceId":"FEDRAMP","publisherUrl":"https://www.fedramp.gov/archive/2023-05-30-rev-5-baselines-have-been-approved-and-released/","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-FERPA@07e23ebe6259be8e","id":"MS-SOURCE-NOTE-FERPA","version":"07e23ebe6259be8e","kind":"source_note","lifecycle":"REFERENCE","title":"Family Educational Rights and Privacy Act","statement":"Current","family":"Source version note","body":{"sourceId":"FERPA","publisherUrl":"https://studentprivacy.ed.gov/ferpa","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-FRB-MRM-2026@0acc0024ff8f2e8a","id":"MS-SOURCE-NOTE-FRB-MRM-2026","version":"0acc0024ff8f2e8a","kind":"source_note","lifecycle":"REFERENCE","title":"Interagency Revised Guidance on Model Risk Management","statement":"SR 26-2 superseded SR 11-7 on 17 Apr 2026","family":"Source version note","body":{"sourceId":"FRB-MRM-2026","publisherUrl":"https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-GDPR@df5de80066779850","id":"MS-SOURCE-NOTE-GDPR","version":"df5de80066779850","kind":"source_note","lifecycle":"REFERENCE","title":"EU General Data Protection Regulation","statement":"Current","family":"Source version note","body":{"sourceId":"GDPR","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-GLBA@dc735550e5b449c0","id":"MS-SOURCE-NOTE-GLBA","version":"dc735550e5b449c0","kind":"source_note","lifecycle":"REFERENCE","title":"GLBA Safeguards Rule","statement":"Current","family":"Source version note","body":{"sourceId":"GLBA","publisherUrl":"https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-HHS-PART2@9228679fc413763e","id":"MS-SOURCE-NOTE-HHS-PART2","version":"9228679fc413763e","kind":"source_note","lifecycle":"REFERENCE","title":"42 CFR Part 2 — SUD Patient Records","statement":"2024 final rule compliance required 16 Feb 2026","family":"Source version note","body":{"sourceId":"HHS-PART2","publisherUrl":"https://www.hhs.gov/hipaa/part-2/index.html","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-HIPAA@4a70cd2d5098a0c7","id":"MS-SOURCE-NOTE-HIPAA","version":"4a70cd2d5098a0c7","kind":"source_note","lifecycle":"REFERENCE","title":"HIPAA Privacy and Security Rules","statement":"Current","family":"Source version note","body":{"sourceId":"HIPAA","publisherUrl":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-IL-AIVIA@4835e2fbf12f2c51","id":"MS-SOURCE-NOTE-IL-AIVIA","version":"4835e2fbf12f2c51","kind":"source_note","lifecycle":"REFERENCE","title":"Illinois Artificial Intelligence Video Interview Act","statement":"Current Illinois statute","family":"Source version note","body":{"sourceId":"IL-AIVIA","publisherUrl":"https://www.ilga.gov/Legislation/PublicActs/PrinterFriendly/101-0260","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-IRS-1075@3e893b9fcbc81dca","id":"MS-SOURCE-NOTE-IRS-1075","version":"3e893b9fcbc81dca","kind":"source_note","lifecycle":"REFERENCE","title":"IRS Publication 1075","statement":"Current IRS safeguard program; verify latest publication revision","family":"Source version note","body":{"sourceId":"IRS-1075","publisherUrl":"https://www.irs.gov/privacy-disclosure/safeguards-program","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-ISO-23894@80e543ddeca562e5","id":"MS-SOURCE-NOTE-ISO-23894","version":"80e543ddeca562e5","kind":"source_note","lifecycle":"REFERENCE","title":"ISO/IEC 23894:2023","statement":"Current","family":"Source version note","body":{"sourceId":"ISO-23894","publisherUrl":"https://www.iso.org/standard/77304.html","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-ISO-24028@6163ca05af07cd39","id":"MS-SOURCE-NOTE-ISO-24028","version":"6163ca05af07cd39","kind":"source_note","lifecycle":"REFERENCE","title":"ISO/IEC TR 24028:2020","statement":"Levels of trustworthiness are out of scope","family":"Source version note","body":{"sourceId":"ISO-24028","publisherUrl":"https://www.iso.org/standard/77608.html","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-ISO-38507@770b79062960bed3","id":"MS-SOURCE-NOTE-ISO-38507","version":"770b79062960bed3","kind":"source_note","lifecycle":"REFERENCE","title":"ISO/IEC 38507:2022","statement":"Current","family":"Source version note","body":{"sourceId":"ISO-38507","publisherUrl":"https://www.iso.org/standard/56641.html","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-ISO-42001@87c0a2b5412aa0e9","id":"MS-SOURCE-NOTE-ISO-42001","version":"87c0a2b5412aa0e9","kind":"source_note","lifecycle":"REFERENCE","title":"ISO/IEC 42001:2023","statement":"Current","family":"Source version note","body":{"sourceId":"ISO-42001","publisherUrl":"https://www.iso.org/standard/42001","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-ISO-42005@e17e06ae157a1f98","id":"MS-SOURCE-NOTE-ISO-42005","version":"e17e06ae157a1f98","kind":"source_note","lifecycle":"REFERENCE","title":"ISO/IEC 42005:2025","statement":"Published 2025","family":"Source version note","body":{"sourceId":"ISO-42005","publisherUrl":"https://www.iso.org/standard/42005","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-ISO-5338@643c4b69567eef27","id":"MS-SOURCE-NOTE-ISO-5338","version":"643c4b69567eef27","kind":"source_note","lifecycle":"REFERENCE","title":"ISO/IEC 5338:2023","statement":"Current","family":"Source version note","body":{"sourceId":"ISO-5338","publisherUrl":"https://www.iso.org/standard/81118.html","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-NAIC-AI@7158e975d38b48aa","id":"MS-SOURCE-NOTE-NAIC-AI","version":"7158e975d38b48aa","kind":"source_note","lifecycle":"REFERENCE","title":"NAIC Model Bulletin on AI Systems by Insurers","statement":"Model bulletin adopted Dec 2023; state adoption must be checked","family":"Source version note","body":{"sourceId":"NAIC-AI","publisherUrl":"https://content.naic.org/article/naic-members-approve-model-bulletin-use-ai-insurers","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-NIST-800-171@5a19e663a8d345c5","id":"MS-SOURCE-NOTE-NIST-800-171","version":"5a19e663a8d345c5","kind":"source_note","lifecycle":"REFERENCE","title":"NIST SP 800-171 Rev. 3","statement":"Final May 2024; supersedes Rev. 2","family":"Source version note","body":{"sourceId":"NIST-800-171","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/171/r3/final","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-NIST-800-53@e121d1d1460084ec","id":"MS-SOURCE-NOTE-NIST-800-53","version":"e121d1d1460084ec","kind":"source_note","lifecycle":"REFERENCE","title":"NIST SP 800-53 Rev. 5","statement":"Rev. 5 Update 1","family":"Source version note","body":{"sourceId":"NIST-800-53","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-NIST-AI-600-1@9f18ca8a12bc344d","id":"MS-SOURCE-NOTE-NIST-AI-600-1","version":"9f18ca8a12bc344d","kind":"source_note","lifecycle":"REFERENCE","title":"NIST AI 600-1 Generative AI Profile","statement":"Published July 2024","family":"Source version note","body":{"sourceId":"NIST-AI-600-1","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-NIST-AI-RMF@98431fe675258378","id":"MS-SOURCE-NOTE-NIST-AI-RMF","version":"98431fe675258378","kind":"source_note","lifecycle":"REFERENCE","title":"NIST AI Risk Management Framework 1.0","statement":"Current; revision underway","family":"Source version note","body":{"sourceId":"NIST-AI-RMF","publisherUrl":"https://www.nist.gov/itl/ai-risk-management-framework","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-NIST-CSF2@a272302d62ba1740","id":"MS-SOURCE-NOTE-NIST-CSF2","version":"a272302d62ba1740","kind":"source_note","lifecycle":"REFERENCE","title":"NIST Cybersecurity Framework 2.0","statement":"Current","family":"Source version note","body":{"sourceId":"NIST-CSF2","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-NYC-LL144@7d6edadda20097d6","id":"MS-SOURCE-NOTE-NYC-LL144","version":"7d6edadda20097d6","kind":"source_note","lifecycle":"REFERENCE","title":"NYC Local Law 144 — AEDT","statement":"Enforced since 5 Jul 2023","family":"Source version note","body":{"sourceId":"NYC-LL144","publisherUrl":"https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-NYDFS-500@6374340ea3d01620","id":"MS-SOURCE-NOTE-NYDFS-500","version":"6374340ea3d01620","kind":"source_note","lifecycle":"REFERENCE","title":"23 NYCRR Part 500 + DFS AI Cybersecurity Guidance","statement":"Amended regulation effective from Nov 2023 with phased dates","family":"Source version note","body":{"sourceId":"NYDFS-500","publisherUrl":"https://www.dfs.ny.gov/industry_guidance/cybersecurity","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-OMB-M25-21@df948b26494bab24","id":"MS-SOURCE-NOTE-OMB-M25-21","version":"df948b26494bab24","kind":"source_note","lifecycle":"REFERENCE","title":"OMB M-25-21 Federal AI Governance","statement":"Replaced M-24-10","family":"Source version note","body":{"sourceId":"OMB-M25-21","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-OMB-M25-22@281271ae37faf796","id":"MS-SOURCE-NOTE-OMB-M25-22","version":"281271ae37faf796","kind":"source_note","lifecycle":"REFERENCE","title":"OMB M-25-22 AI Acquisition","statement":"Current","family":"Source version note","body":{"sourceId":"OMB-M25-22","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-OMB-M26-04@4394ab01566ed077","id":"MS-SOURCE-NOTE-OMB-M26-04","version":"4394ab01566ed077","kind":"source_note","lifecycle":"REFERENCE","title":"OMB M-26-04","statement":"Current federal agency LLM procurement/use principles","family":"Source version note","body":{"sourceId":"OMB-M26-04","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf","reportedQuality":"Official White House source","useNote":"Federal-agency applicability; includes transparency and evaluation expectations.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-ONC-HTI1@49483b2433b19c50","id":"MS-SOURCE-NOTE-ONC-HTI1","version":"49483b2433b19c50","kind":"source_note","lifecycle":"REFERENCE","title":"ONC HTI-1 Algorithm Transparency","statement":"Final rule effective; review current ONC enforcement notices","family":"Source version note","body":{"sourceId":"ONC-HTI1","publisherUrl":"https://healthit.gov/regulations/hti-rules/hti-1-final-rule/","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-OWASP-LLM-2026@c3439a2d9e8b7618","id":"MS-SOURCE-NOTE-OWASP-LLM-2026","version":"c3439a2d9e8b7618","kind":"source_note","lifecycle":"REFERENCE","title":"OWASP Top 10 for LLM Applications 2026","statement":"Released 3 Aug 2026","family":"Source version note","body":{"sourceId":"OWASP-LLM-2026","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-PCI-DSS@3bf9369883365902","id":"MS-SOURCE-NOTE-PCI-DSS","version":"3bf9369883365902","kind":"source_note","lifecycle":"REFERENCE","title":"PCI DSS v4.0.1","statement":"v4.0.1","family":"Source version note","body":{"sourceId":"PCI-DSS","publisherUrl":"https://www.pcisecuritystandards.org/standards/pci-dss/","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-SECTION-508@d70c0efece3bbbba","id":"MS-SOURCE-NOTE-SECTION-508","version":"d70c0efece3bbbba","kind":"source_note","lifecycle":"REFERENCE","title":"Revised Section 508 Standards","statement":"Current Revised 508 Standards","family":"Source version note","body":{"sourceId":"SECTION-508","publisherUrl":"https://www.section508.gov/buy-sell/","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-SG-MODEL-AI@82e8e54435c86c2b","id":"MS-SOURCE-NOTE-SG-MODEL-AI","version":"82e8e54435c86c2b","kind":"source_note","lifecycle":"REFERENCE","title":"Singapore Model AI Governance Framework","statement":"Second edition and related implementation resources","family":"Source version note","body":{"sourceId":"SG-MODEL-AI","publisherUrl":"https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-SOC2@4545ab4b9080158e","id":"MS-SOURCE-NOTE-SOC2","version":"4545ab4b9080158e","kind":"source_note","lifecycle":"REFERENCE","title":"AICPA Trust Services Criteria","statement":"2017 TSC with 2022 points of focus","family":"Source version note","body":{"sourceId":"SOC2","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-SOX@3765787d692c0bdd","id":"MS-SOURCE-NOTE-SOX","version":"3765787d692c0bdd","kind":"source_note","lifecycle":"REFERENCE","title":"Sarbanes-Oxley Act / ICFR","statement":"Current","family":"Source version note","body":{"sourceId":"SOX","publisherUrl":"https://www.sec.gov/spotlight/sarbanes-oxley.htm","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-TX-TRAIGA@ad2fe809b6252e8e","id":"MS-SOURCE-NOTE-TX-TRAIGA","version":"ad2fe809b6252e8e","kind":"source_note","lifecycle":"REFERENCE","title":"Texas Responsible Artificial Intelligence Governance Act","statement":"Current statutory text","family":"Source version note","body":{"sourceId":"TX-TRAIGA","publisherUrl":"https://statutes.capitol.texas.gov/GetStatute.aspx?Code=BC&Value=552","reportedQuality":"Primary / authoritative source","useNote":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion.","primarySourceRechecked":false}},{"key":"MS-SOURCE-NOTE-UK-DP-AI@477b70b509183173","id":"MS-SOURCE-NOTE-UK-DP-AI","version":"477b70b509183173","kind":"source_note","lifecycle":"REFERENCE","title":"UK Data Protection Law + ICO AI Guidance","statement":"Reflect Data (Use and Access) Act 2025; some ICO AI guidance remains under review","family":"Source version note","body":{"sourceId":"UK-DP-AI","publisherUrl":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/about-this-guidance/","reportedQuality":"Primary / authoritative source","useNote":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance.","primarySourceRechecked":false}},{"key":"TEST-MS-CAND-NEW-001@804a65653da341a1","id":"TEST-MS-CAND-NEW-001","version":"804a65653da341a1","kind":"test","lifecycle":"NOT_RUN","title":"Additionally, these goals will strengthen North Carolina’s economy by empowering our…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-001","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-002@1e1a8bf090f45c60","id":"TEST-MS-CAND-NEW-002","version":"1e1a8bf090f45c60","kind":"test","lifecycle":"NOT_RUN","title":"To successfully implement most of the recommendations, the State will need…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Output and Use","body":{"ruleRef":"MS-CAND-NEW-002","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-003@15292f2c27f6596a","id":"TEST-MS-CAND-NEW-003","version":"15292f2c27f6596a","kind":"test","lifecycle":"NOT_RUN","title":"General Assembly shares our desire to safeguard public trust and empower…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-003","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-004@19fe77e27bca9c1c","id":"TEST-MS-CAND-NEW-004","version":"19fe77e27bca9c1c","kind":"test","lifecycle":"NOT_RUN","title":"To realize this ambitious vision, North Carolina state agencies will collaborate…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-004","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-005@e974d8db1b83b550","id":"TEST-MS-CAND-NEW-005","version":"e974d8db1b83b550","kind":"test","lifecycle":"NOT_RUN","title":"Through these collective efforts, the state seeks to ensure that every…","statement":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","family":"Operations","body":{"ruleRef":"MS-CAND-NEW-005","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-006@72750517fb4e520d","id":"TEST-MS-CAND-NEW-006","version":"72750517fb4e520d","kind":"test","lifecycle":"NOT_RUN","title":"Workforce Empowerment Ensure technology augments rather than replaces the workforce by…","statement":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","family":"Operations","body":{"ruleRef":"MS-CAND-NEW-006","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-007@b41e0e7067dc1ddd","id":"TEST-MS-CAND-NEW-007","version":"b41e0e7067dc1ddd","kind":"test","lifecycle":"NOT_RUN","title":"Also must respect personal autonomy and dignity, maintaining people’s freedom to…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-007","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-008@364d304064ef45b9","id":"TEST-MS-CAND-NEW-008","version":"364d304064ef45b9","kind":"test","lifecycle":"NOT_RUN","title":"Since the creation of the Executive Order, the Council has been…","statement":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-008","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-009@f3a207e8803196d6","id":"TEST-MS-CAND-NEW-009","version":"f3a207e8803196d6","kind":"test","lifecycle":"NOT_RUN","title":"The goals are grouped into three categories to ensure a clear…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-009","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-010@3f9b72fb8a921418","id":"TEST-MS-CAND-NEW-010","version":"3f9b72fb8a921418","kind":"test","lifecycle":"NOT_RUN","title":"Each of these recommendations has been created with an implementation plan…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-010","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-011@1c2c675ccd83852e","id":"TEST-MS-CAND-NEW-011","version":"1c2c675ccd83852e","kind":"test","lifecycle":"NOT_RUN","title":"The recommendations below were identified by the Council to improve AI…","statement":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-011","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-012@a30365012a144327","id":"TEST-MS-CAND-NEW-012","version":"a30365012a144327","kind":"test","lifecycle":"NOT_RUN","title":"Details: As AI continues to reshape society, the state will explore…","statement":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","family":"Data Protection","body":{"ruleRef":"MS-CAND-NEW-012","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-013@9d144cfdaf6e87da","id":"TEST-MS-CAND-NEW-013","version":"9d144cfdaf6e87da","kind":"test","lifecycle":"NOT_RUN","title":"Child safety components will focus on foundational safety requirements that encourage…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Input and Content","body":{"ruleRef":"MS-CAND-NEW-013","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-014@1c8be2505e698afb","id":"TEST-MS-CAND-NEW-014","version":"1c8be2505e698afb","kind":"test","lifecycle":"NOT_RUN","title":"By 2029, approximately half of US jobs will be transformed by…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-014","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-015@a90ef5c9d9e5aefd","id":"TEST-MS-CAND-NEW-015","version":"a90ef5c9d9e5aefd","kind":"test","lifecycle":"NOT_RUN","title":"Details: North Carolina must proactively provide accessible pathways back into high-demand,…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-015","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-016@86d7253774c45b19","id":"TEST-MS-CAND-NEW-016","version":"86d7253774c45b19","kind":"test","lifecycle":"NOT_RUN","title":"This will be accomplished through identifying and supporting workers in roles…","statement":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","family":"Access and Use","body":{"ruleRef":"MS-CAND-NEW-016","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-017@49a4a317df2adc95","id":"TEST-MS-CAND-NEW-017","version":"49a4a317df2adc95","kind":"test","lifecycle":"NOT_RUN","title":"Embedding work-based learning opportunities and direct employer connections will accelerate reentry…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Access and Use","body":{"ruleRef":"MS-CAND-NEW-017","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-018@9c76916f938d826d","id":"TEST-MS-CAND-NEW-018","version":"9c76916f938d826d","kind":"test","lifecycle":"NOT_RUN","title":"Using displacement data and worker feedback will support the design of…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-018","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-019@965e896a6f565c67","id":"TEST-MS-CAND-NEW-019","version":"965e896a6f565c67","kind":"test","lifecycle":"NOT_RUN","title":"Additionally, tracking the re-skilling programs that successfully lead to meaningful employment…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-019","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-020@08557fa822272669","id":"TEST-MS-CAND-NEW-020","version":"08557fa822272669","kind":"test","lifecycle":"NOT_RUN","title":"Details: North Carolina must be ready to detect and respond to…","statement":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-020","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-021@2139d82ae984b402","id":"TEST-MS-CAND-NEW-021","version":"2139d82ae984b402","kind":"test","lifecycle":"NOT_RUN","title":"This effort will be advanced through advocating for legislation to counteract…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-021","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-022@e22552660f4975ec","id":"TEST-MS-CAND-NEW-022","version":"e22552660f4975ec","kind":"test","lifecycle":"NOT_RUN","title":"Worker Adjustment and Retraining Notification (WARN) data collection processes will help…","statement":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","family":"Operations","body":{"ruleRef":"MS-CAND-NEW-022","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-023@c6bff479056786a6","id":"TEST-MS-CAND-NEW-023","version":"c6bff479056786a6","kind":"test","lifecycle":"NOT_RUN","title":"In parallel, partnering with higher education institutions will allow the collection…","statement":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-023","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-024@189d78e606a4e11e","id":"TEST-MS-CAND-NEW-024","version":"189d78e606a4e11e","kind":"test","lifecycle":"NOT_RUN","title":"General Assembly Timeline: March 2027 Goal 3: Account for Resource Demands…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-024","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-025@6aedf0b387e1b6ae","id":"TEST-MS-CAND-NEW-025","version":"6aedf0b387e1b6ae","kind":"test","lifecycle":"NOT_RUN","title":"These facilities serve as the backbone of AI, and as AI…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-025","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-026@f630aba0d5b51962","id":"TEST-MS-CAND-NEW-026","version":"f630aba0d5b51962","kind":"test","lifecycle":"NOT_RUN","title":"It is essential for states to thoroughly assess the economic opportunities…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-026","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-027@85bf63184025e223","id":"TEST-MS-CAND-NEW-027","version":"85bf63184025e223","kind":"test","lifecycle":"NOT_RUN","title":"8 Recommendation: Monitor and publicly disclose impacts of AI infrastructure on…","statement":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","family":"Operations","body":{"ruleRef":"MS-CAND-NEW-027","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-028@fca8d670cec753de","id":"TEST-MS-CAND-NEW-028","version":"fca8d670cec753de","kind":"test","lifecycle":"NOT_RUN","title":"This recommendation calls for a resource monitoring program that uses independent,…","statement":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-028","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-029@6790a64ee4469992","id":"TEST-MS-CAND-NEW-029","version":"6790a64ee4469992","kind":"test","lifecycle":"NOT_RUN","title":"Legislation would strengthen this effort by requiring standardized disclosure of environmental,…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Output and Use","body":{"ruleRef":"MS-CAND-NEW-029","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-030@c6236291b5178b5f","id":"TEST-MS-CAND-NEW-030","version":"c6236291b5178b5f","kind":"test","lifecycle":"NOT_RUN","title":"General Assembly, Local Governments Timeline: June 2027 Goal 4: Reduce Fraud,…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-030","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-031@a4395ae59ad10eac","id":"TEST-MS-CAND-NEW-031","version":"a4395ae59ad10eac","kind":"test","lifecycle":"NOT_RUN","title":"Details: To ensure public confidence in official government communications, all state…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-031","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-032@89fb7122d4286449","id":"TEST-MS-CAND-NEW-032","version":"89fb7122d4286449","kind":"test","lifecycle":"NOT_RUN","title":"Implementing a statewide content verification standard will strengthen public trust by…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-032","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-033@d55c959ad062ef90","id":"TEST-MS-CAND-NEW-033","version":"d55c959ad062ef90","kind":"test","lifecycle":"NOT_RUN","title":"When AI is used to help generate official content, the standard…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-033","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-034@2331eead6f0d4634","id":"TEST-MS-CAND-NEW-034","version":"2331eead6f0d4634","kind":"test","lifecycle":"NOT_RUN","title":"Community upskilling efforts, via the Advancing Community Upskilling goal later in…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Output and Use","body":{"ruleRef":"MS-CAND-NEW-034","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-035@952f457c85878554","id":"TEST-MS-CAND-NEW-035","version":"952f457c85878554","kind":"test","lifecycle":"NOT_RUN","title":"This upskilling plan will target all skill levels, including senior citizens,…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-035","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-036@af3dd73187f85813","id":"TEST-MS-CAND-NEW-036","version":"af3dd73187f85813","kind":"test","lifecycle":"NOT_RUN","title":"With the state government’s support and backing, local governments and private…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Input and Content","body":{"ruleRef":"MS-CAND-NEW-036","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-037@c794591109a14605","id":"TEST-MS-CAND-NEW-037","version":"c794591109a14605","kind":"test","lifecycle":"NOT_RUN","title":"Some states publish all AI systems in their inventory, while others…","statement":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","family":"Operations","body":{"ruleRef":"MS-CAND-NEW-037","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-038@167338df2823c65a","id":"TEST-MS-CAND-NEW-038","version":"167338df2823c65a","kind":"test","lifecycle":"NOT_RUN","title":"The state’s 2025 Executive Order 24 also requires the AI Accelerator…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-038","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-039@bf7a2a553284be9c","id":"TEST-MS-CAND-NEW-039","version":"bf7a2a553284be9c","kind":"test","lifecycle":"NOT_RUN","title":"24: Advancing Trustworthy Artificial Intelligence That Benefits All North Carolinians requires…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Output and Use","body":{"ruleRef":"MS-CAND-NEW-039","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-040@4c5da53332591171","id":"TEST-MS-CAND-NEW-040","version":"4c5da53332591171","kind":"test","lifecycle":"NOT_RUN","title":"Dynamic dashboards will ensure transparency across state government by providing as…","statement":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-040","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-041@80a0db6f8533204b","id":"TEST-MS-CAND-NEW-041","version":"80a0db6f8533204b","kind":"test","lifecycle":"NOT_RUN","title":"Dashboards will be updated regularly to reflect the most current information…","statement":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-041","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-042@e0b7f2003d7a973c","id":"TEST-MS-CAND-NEW-042","version":"e0b7f2003d7a973c","kind":"test","lifecycle":"NOT_RUN","title":"Feedback mechanisms will be available to measure public sentiment and improve…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Input and Content","body":{"ruleRef":"MS-CAND-NEW-042","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-043@9b9f887cc11f3619","id":"TEST-MS-CAND-NEW-043","version":"9b9f887cc11f3619","kind":"test","lifecycle":"NOT_RUN","title":"Department of Information Technology, Agency AI Oversight Committees Timeline: December 2026…","statement":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","family":"Operations","body":{"ruleRef":"MS-CAND-NEW-043","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-044@b1e6c1c829ef67a3","id":"TEST-MS-CAND-NEW-044","version":"b1e6c1c829ef67a3","kind":"test","lifecycle":"NOT_RUN","title":"This recommendation calls for disclosure of AI utilization as any part…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Output and Use","body":{"ruleRef":"MS-CAND-NEW-044","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-045@916238499cd18c33","id":"TEST-MS-CAND-NEW-045","version":"916238499cd18c33","kind":"test","lifecycle":"NOT_RUN","title":"Additionally, residents should be given the opportunity to opt out of…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-045","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-046@c169b927af8610cd","id":"TEST-MS-CAND-NEW-046","version":"c169b927af8610cd","kind":"test","lifecycle":"NOT_RUN","title":"This initiative will ensure that the state can continue delivering vital…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-046","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-047@7e5462afb0d8be67","id":"TEST-MS-CAND-NEW-047","version":"7e5462afb0d8be67","kind":"test","lifecycle":"NOT_RUN","title":"The state will work in collaboration with utilities, security, and emergency…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-047","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-048@96bcf18d596c5657","id":"TEST-MS-CAND-NEW-048","version":"96bcf18d596c5657","kind":"test","lifecycle":"NOT_RUN","title":"Clear procedures must be documented for enabling, bypassing, or overriding AI…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-048","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-049@a0b16de2de28f853","id":"TEST-MS-CAND-NEW-049","version":"a0b16de2de28f853","kind":"test","lifecycle":"NOT_RUN","title":"Recommendation: Monitor, detect, and analyze ongoing AI threats and create a…","statement":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","family":"Operations","body":{"ruleRef":"MS-CAND-NEW-049","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-050@af4c9fda0a0406dc","id":"TEST-MS-CAND-NEW-050","version":"af4c9fda0a0406dc","kind":"test","lifecycle":"NOT_RUN","title":"Details: This initiative will build on existing continuous monitoring and threat…","statement":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","family":"Operations","body":{"ruleRef":"MS-CAND-NEW-050","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-051@fa85799f46f53cbb","id":"TEST-MS-CAND-NEW-051","version":"fa85799f46f53cbb","kind":"test","lifecycle":"NOT_RUN","title":"Agencies will implement a software bill of materials for deployed AI…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-051","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-052@d1a0e602f237267c","id":"TEST-MS-CAND-NEW-052","version":"d1a0e602f237267c","kind":"test","lifecycle":"NOT_RUN","title":"Additionally, the state will distribute vetted AI frameworks and training modules…","statement":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","family":"Data Protection","body":{"ruleRef":"MS-CAND-NEW-052","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-053@8fea3e8f53f0d622","id":"TEST-MS-CAND-NEW-053","version":"8fea3e8f53f0d622","kind":"test","lifecycle":"NOT_RUN","title":"National Guard, Local Governments Timeline: June 2027 Goal 8: Ensure Responsible…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Data Protection","body":{"ruleRef":"MS-CAND-NEW-053","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-054@20d7816ab8c8718b","id":"TEST-MS-CAND-NEW-054","version":"20d7816ab8c8718b","kind":"test","lifecycle":"NOT_RUN","title":"Recommendation: Establish minimum statewide trustworthy AI standards for all AI-enabled tools…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-054","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-055@a96d2c3c2df24027","id":"TEST-MS-CAND-NEW-055","version":"a96d2c3c2df24027","kind":"test","lifecycle":"NOT_RUN","title":"However, AI presents fundamentally different challenges that these existing frameworks do…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Access and Use","body":{"ruleRef":"MS-CAND-NEW-055","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-056@8ddf472ae09f562c","id":"TEST-MS-CAND-NEW-056","version":"8ddf472ae09f562c","kind":"test","lifecycle":"NOT_RUN","title":"This initiative will create and implement a tiered governance model specific…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Output and Use","body":{"ruleRef":"MS-CAND-NEW-056","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-057@63f85219baa3f681","id":"TEST-MS-CAND-NEW-057","version":"63f85219baa3f681","kind":"test","lifecycle":"NOT_RUN","title":"Regardless of risk level, mitigation plans will include ongoing monitoring requirements…","statement":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","family":"Access and Use","body":{"ruleRef":"MS-CAND-NEW-057","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-058@cea3ae2f413ff42b","id":"TEST-MS-CAND-NEW-058","version":"cea3ae2f413ff42b","kind":"test","lifecycle":"NOT_RUN","title":"Recurring security testing of products will be conducted to check for…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-058","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-059@58f97f007a51acdf","id":"TEST-MS-CAND-NEW-059","version":"58f97f007a51acdf","kind":"test","lifecycle":"NOT_RUN","title":"These liaisons must be given a sufficient level of authority to…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Access and Use","body":{"ruleRef":"MS-CAND-NEW-059","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-060@fd77edf53681010f","id":"TEST-MS-CAND-NEW-060","version":"fd77edf53681010f","kind":"test","lifecycle":"NOT_RUN","title":"They will also be the main point of contact for all…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Access and Use","body":{"ruleRef":"MS-CAND-NEW-060","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-061@513d44197caf5c9c","id":"TEST-MS-CAND-NEW-061","version":"513d44197caf5c9c","kind":"test","lifecycle":"NOT_RUN","title":"They will uphold whistleblower protections and coordinate across agencies in the…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-061","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-062@0815bde8a002cc6d","id":"TEST-MS-CAND-NEW-062","version":"0815bde8a002cc6d","kind":"test","lifecycle":"NOT_RUN","title":"This role will ensure shared learning, avoid wasted resources, and proactively…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Access and Use","body":{"ruleRef":"MS-CAND-NEW-062","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-063@afa775da340c4b6c","id":"TEST-MS-CAND-NEW-063","version":"afa775da340c4b6c","kind":"test","lifecycle":"NOT_RUN","title":"Across the United States, communities are using various methods to ensure…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-063","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-064@d35bf350d32e740f","id":"TEST-MS-CAND-NEW-064","version":"d35bf350d32e740f","kind":"test","lifecycle":"NOT_RUN","title":"The regional curriculum will be informed by community input","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Access and Use","body":{"ruleRef":"MS-CAND-NEW-064","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-065@4135b82cdb079436","id":"TEST-MS-CAND-NEW-065","version":"4135b82cdb079436","kind":"test","lifecycle":"NOT_RUN","title":"This effort will be achieved through collaborations with NCWorks Career Centers,…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Access and Use","body":{"ruleRef":"MS-CAND-NEW-065","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-066@81ef71b269fba13a","id":"TEST-MS-CAND-NEW-066","version":"81ef71b269fba13a","kind":"test","lifecycle":"NOT_RUN","title":"This training will help residents build practical understanding of AI concepts,…","statement":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","family":"Operations","body":{"ruleRef":"MS-CAND-NEW-066","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-067@e0ae37811c974daa","id":"TEST-MS-CAND-NEW-067","version":"e0ae37811c974daa","kind":"test","lifecycle":"NOT_RUN","title":"A feedback loop using hiring outcomes, employer demand, and worker feedback…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-067","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-068@d2a97ded15050acb","id":"TEST-MS-CAND-NEW-068","version":"d2a97ded15050acb","kind":"test","lifecycle":"NOT_RUN","title":"This mutually beneficial program would allow the private sector to help…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-068","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-CAND-NEW-069@4686d51801f6dff5","id":"TEST-MS-CAND-NEW-069","version":"4686d51801f6dff5","kind":"test","lifecycle":"NOT_RUN","title":"Partnering with N.C. higher education institutions, the state will coordinate AI…","statement":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","family":"Governance","body":{"ruleRef":"MS-CAND-NEW-069","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AG-01@ff7a0e8e2da5d17b","id":"TEST-MS-RULE-AG-01","version":"ff7a0e8e2da5d17b","kind":"test","lifecycle":"NOT_RUN","title":"Allowlisted tools and connectors only","statement":"Attempt unknown, renamed and newly installed tools.","family":"Agentic Controls","body":{"ruleRef":"MS-RULE-AG-01","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AG-02@aade6035a0855241","id":"TEST-MS-RULE-AG-02","version":"aade6035a0855241","kind":"test","lifecycle":"NOT_RUN","title":"Enforce least privilege for agents","statement":"Test privilege escalation, stale tokens and cross-environment access.","family":"Agentic Controls","body":{"ruleRef":"MS-RULE-AG-02","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AG-03@015e6c738b015bd2","id":"TEST-MS-RULE-AG-03","version":"015e6c738b015bd2","kind":"test","lifecycle":"NOT_RUN","title":"Require approval for high-impact or irreversible actions","statement":"Test each irreversible action and approval replay prevention.","family":"Agentic Controls","body":{"ruleRef":"MS-RULE-AG-03","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AG-04@098ca0df2ff02a79","id":"TEST-MS-RULE-AG-04","version":"098ca0df2ff02a79","kind":"test","lifecycle":"NOT_RUN","title":"Prohibit autonomous consequential decisions","statement":"Test indirect actions and recommendation-to-decision handoffs.","family":"Agentic Controls","body":{"ruleRef":"MS-RULE-AG-04","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AG-05@8edc0dd979fb9441","id":"TEST-MS-RULE-AG-05","version":"8edc0dd979fb9441","kind":"test","lifecycle":"NOT_RUN","title":"Approve external communications","statement":"Test wrong recipient, sensitive content and reply-all scenarios.","family":"Agentic Controls","body":{"ruleRef":"MS-RULE-AG-05","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AG-06@ee1eb5a987831137","id":"TEST-MS-RULE-AG-06","version":"ee1eb5a987831137","kind":"test","lifecycle":"NOT_RUN","title":"Approve destructive and permission-changing actions","statement":"Test deletion scope, permission escalation and rollback.","family":"Agentic Controls","body":{"ruleRef":"MS-RULE-AG-06","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AG-07@ba65d33eee3e267b","id":"TEST-MS-RULE-AG-07","version":"ba65d33eee3e267b","kind":"test","lifecycle":"NOT_RUN","title":"Enforce transaction and autonomy limits","statement":"Test single and cumulative limit evasion.","family":"Agentic Controls","body":{"ruleRef":"MS-RULE-AG-07","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AG-08@416a45e0a0b25761","id":"TEST-MS-RULE-AG-08","version":"416a45e0a0b25761","kind":"test","lifecycle":"NOT_RUN","title":"Enforce tenant and context isolation","statement":"Run cross-tenant canaries and confused-deputy tests.","family":"Agentic Controls","body":{"ruleRef":"MS-RULE-AG-08","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AG-09@77f7bead2ff59d1f","id":"TEST-MS-RULE-AG-09","version":"77f7bead2ff59d1f","kind":"test","lifecycle":"NOT_RUN","title":"Govern agent memory writes","statement":"Test poisoned memory, sensitive persistence and deletion.","family":"Agentic Controls","body":{"ruleRef":"MS-RULE-AG-09","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AG-10@fcfc304af4142870","id":"TEST-MS-RULE-AG-10","version":"fcfc304af4142870","kind":"test","lifecycle":"NOT_RUN","title":"Verify tool and package supply chain","statement":"Test tampered package, changed tool schema and revoked publisher.","family":"Agentic Controls","body":{"ruleRef":"MS-RULE-AG-10","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AU-01@0084a371cf0309b9","id":"TEST-MS-RULE-AU-01","version":"0084a371cf0309b9","kind":"test","lifecycle":"NOT_RUN","title":"Allow sanctioned AI services only","statement":"Attempt use through approved and unapproved domains, aliases and API endpoints.","family":"Authorized Use","body":{"ruleRef":"MS-RULE-AU-01","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AU-02@ab1063b0ed9fa8a0","id":"TEST-MS-RULE-AU-02","version":"ab1063b0ed9fa8a0","kind":"test","lifecycle":"NOT_RUN","title":"Require strong authentication","statement":"Test unmanaged device, personal account and MFA-bypass paths.","family":"Authorized Use","body":{"ruleRef":"MS-RULE-AU-02","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AU-03@2c0164b9ceb762fe","id":"TEST-MS-RULE-AU-03","version":"2c0164b9ceb762fe","kind":"test","lifecycle":"NOT_RUN","title":"Enforce role and data-class authorization","statement":"Test role changes, leavers and restricted data classes.","family":"Authorized Use","body":{"ruleRef":"MS-RULE-AU-03","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AU-04@d64cd4d5b62ae1d2","id":"TEST-MS-RULE-AU-04","version":"d64cd4d5b62ae1d2","kind":"test","lifecycle":"NOT_RUN","title":"Allow approved use cases and models only","statement":"Test unregistered purpose, model substitution and scope drift.","family":"Authorized Use","body":{"ruleRef":"MS-RULE-AU-04","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AU-05@0f305d8c832c7e2f","id":"TEST-MS-RULE-AU-05","version":"0f305d8c832c7e2f","kind":"test","lifecycle":"NOT_RUN","title":"Route by residency and retention constraints","statement":"Test region mismatch, retention settings and vendor changes.","family":"Authorized Use","body":{"ruleRef":"MS-RULE-AU-05","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AU-06@750f23cda17c3c4b","id":"TEST-MS-RULE-AU-06","version":"750f23cda17c3c4b","kind":"test","lifecycle":"NOT_RUN","title":"Prevent provider training on enterprise content","statement":"Test personal versus enterprise tenant and setting drift.","family":"Authorized Use","body":{"ruleRef":"MS-RULE-AU-06","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AU-07@5ffa142ce7218527","id":"TEST-MS-RULE-AU-07","version":"5ffa142ce7218527","kind":"test","lifecycle":"NOT_RUN","title":"Prohibit account sharing","statement":"Test shared-account and revoked-user scenarios.","family":"Authorized Use","body":{"ruleRef":"MS-RULE-AU-07","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-AU-08@1572d78ad2ecacee","id":"TEST-MS-RULE-AU-08","version":"1572d78ad2ecacee","kind":"test","lifecycle":"NOT_RUN","title":"Detect shadow AI and unmanaged plugins","statement":"Compare observed use to registry and test newly introduced domains.","family":"Authorized Use","body":{"ruleRef":"MS-RULE-AU-08","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-01@0bc48774d2f0f1dd","id":"TEST-MS-RULE-DP-01","version":"0bc48774d2f0f1dd","kind":"test","lifecycle":"NOT_RUN","title":"Block credentials and secrets","statement":"Seed test secrets plus obfuscated variants; require zero raw secret in destination.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-01","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-02@ca4ef66ca268a10a","id":"TEST-MS-RULE-DP-02","version":"ca4ef66ca268a10a","kind":"test","lifecycle":"NOT_RUN","title":"Block passwords and authentication answers","statement":"Test common and generated password formats without storing live credentials.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-02","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-03@50eab23253df5cb7","id":"TEST-MS-RULE-DP-03","version":"50eab23253df5cb7","kind":"test","lifecycle":"NOT_RUN","title":"Block payment card numbers","statement":"Use valid and invalid Luhn samples; test separators and OCR variants.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-03","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-04@f3aef5f922894a93","id":"TEST-MS-RULE-DP-04","version":"f3aef5f922894a93","kind":"test","lifecycle":"NOT_RUN","title":"Block CVV, CVC and PIN","statement":"Test label/value pairs and contextual variants.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-04","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-05@77349f3499851451","id":"TEST-MS-RULE-DP-05","version":"77349f3499851451","kind":"test","lifecycle":"NOT_RUN","title":"Block national identifiers","statement":"Test formatted, unformatted, and OCR variants; measure false positives.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-05","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-06@59256ca2a153a840","id":"TEST-MS-RULE-DP-06","version":"59256ca2a153a840","kind":"test","lifecycle":"NOT_RUN","title":"Block bank-account data","statement":"Test domestic routing/account formats in addition to IBAN.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-06","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-07@5002f8ed22b072a4","id":"TEST-MS-RULE-DP-07","version":"5002f8ed22b072a4","kind":"test","lifecycle":"NOT_RUN","title":"Restrict protected health information","statement":"Test identifiers plus diagnosis/treatment context and de-identified cases.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-07","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-08@5952c57b4ceafdbd","id":"TEST-MS-RULE-DP-08","version":"5952c57b4ceafdbd","kind":"test","lifecycle":"NOT_RUN","title":"Restrict education records","statement":"Test student-record narratives and directory-information exceptions.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-08","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-09@c4ed5280df2d8691","id":"TEST-MS-RULE-DP-09","version":"c4ed5280df2d8691","kind":"test","lifecycle":"NOT_RUN","title":"Protect contact information","statement":"Test single business contact, bulk lists, and sensitive-context combinations.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-09","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-10@6d512691a22458cc","id":"TEST-MS-RULE-DP-10","version":"6d512691a22458cc","kind":"test","lifecycle":"NOT_RUN","title":"Block biometric identifiers","statement":"Test text references and supported image/audio metadata.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-10","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-11@e6424832265654e7","id":"TEST-MS-RULE-DP-11","version":"e6424832265654e7","kind":"test","lifecycle":"NOT_RUN","title":"Protect precise location","statement":"Test coordinates, addresses, routes and location narratives.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-11","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-12@95d98ba0364aec85","id":"TEST-MS-RULE-DP-12","version":"95d98ba0364aec85","kind":"test","lifecycle":"NOT_RUN","title":"Block classified, CUI and FCI","statement":"Test markings, portion labels, headers, and contextual descriptions.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-12","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-13@f983ef5d4e01924d","id":"TEST-MS-RULE-DP-13","version":"f983ef5d4e01924d","kind":"test","lifecycle":"NOT_RUN","title":"Protect export-controlled and national-security data","statement":"Test project codes, markings and controlled technical narratives.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-13","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-14@ab80d0fa0d8db15e","id":"TEST-MS-RULE-DP-14","version":"ab80d0fa0d8db15e","kind":"test","lifecycle":"NOT_RUN","title":"Protect trade secrets and source code","statement":"Test code, design documents and organization-specific codewords.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-14","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-15@cea9c93668f602e0","id":"TEST-MS-RULE-DP-15","version":"cea9c93668f602e0","kind":"test","lifecycle":"NOT_RUN","title":"Protect architecture and vulnerability details","statement":"Test IPs, diagrams, vulnerabilities, findings and obfuscation.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-15","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-16@97bda9e88e479e68","id":"TEST-MS-RULE-DP-16","version":"97bda9e88e479e68","kind":"test","lifecycle":"NOT_RUN","title":"Protect customer confidential data","statement":"Test structured and narrative customer data, including multi-record uploads.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-16","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-17@811ed55e191f631e","id":"TEST-MS-RULE-DP-17","version":"811ed55e191f631e","kind":"test","lifecycle":"NOT_RUN","title":"Block MNPI and unreleased financials","statement":"Test earnings, M&A and deal narratives with organization codewords.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-17","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-DP-18@8a543089559677bc","id":"TEST-MS-RULE-DP-18","version":"8a543089559677bc","kind":"test","lifecycle":"NOT_RUN","title":"Protect privilege and investigations","statement":"Test privilege legends, matter numbers and investigation narratives.","family":"Data Protection","body":{"ruleRef":"MS-RULE-DP-18","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-IN-01@9d4be1fbcaec2bf2","id":"TEST-MS-RULE-IN-01","version":"9d4be1fbcaec2bf2","kind":"test","lifecycle":"NOT_RUN","title":"Detect direct prompt injection and jailbreaks","statement":"Run multilingual, role-play, encoded and multi-turn attack suites.","family":"Input Security","body":{"ruleRef":"MS-RULE-IN-01","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-IN-02@1d2838ae3e1a57ab","id":"TEST-MS-RULE-IN-02","version":"1d2838ae3e1a57ab","kind":"test","lifecycle":"NOT_RUN","title":"Detect indirect prompt injection","statement":"Test poisoned documents, web pages and retrieved chunks.","family":"Input Security","body":{"ruleRef":"MS-RULE-IN-02","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-IN-03@900d1236d564a9d6","id":"TEST-MS-RULE-IN-03","version":"900d1236d564a9d6","kind":"test","lifecycle":"NOT_RUN","title":"Detect obfuscated and multimodal attacks","statement":"Test homoglyphs, zero-width text, base64, OCR and image-based injection.","family":"Input Security","body":{"ruleRef":"MS-RULE-IN-03","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-IN-04@2643ff56cf23a729","id":"TEST-MS-RULE-IN-04","version":"2643ff56cf23a729","kind":"test","lifecycle":"NOT_RUN","title":"Restrict harmful cyber requests","statement":"Test dual-use boundaries and approved red-team contexts.","family":"Input Security","body":{"ruleRef":"MS-RULE-IN-04","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-IN-05@3c95bf3267fc393c","id":"TEST-MS-RULE-IN-05","version":"3c95bf3267fc393c","kind":"test","lifecycle":"NOT_RUN","title":"Quarantine unsafe files and malware","statement":"Test malware simulators, macros, encrypted archives and oversize files.","family":"Input Security","body":{"ruleRef":"MS-RULE-IN-05","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-IN-06@858400572c4c71c1","id":"TEST-MS-RULE-IN-06","version":"858400572c4c71c1","kind":"test","lifecycle":"NOT_RUN","title":"Prevent RAG and data poisoning","statement":"Inject conflicting, malicious and unauthorized content; verify rejection and rollback.","family":"Input Security","body":{"ruleRef":"MS-RULE-IN-06","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-IN-07@375f07965e1612f9","id":"TEST-MS-RULE-IN-07","version":"375f07965e1612f9","kind":"test","lifecycle":"NOT_RUN","title":"Enforce allowed intent and scope","statement":"Test plausible scope drift and role mismatch.","family":"Input Security","body":{"ruleRef":"MS-RULE-IN-07","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-IN-08@d7fc8b0e56e8838b","id":"TEST-MS-RULE-IN-08","version":"d7fc8b0e56e8838b","kind":"test","lifecycle":"NOT_RUN","title":"Limit resource consumption","statement":"Stress test long context, retries, tool loops and parallel calls.","family":"Input Security","body":{"ruleRef":"MS-RULE-IN-08","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OP-01@1650910477cab89a","id":"TEST-MS-RULE-OP-01","version":"1650910477cab89a","kind":"test","lifecycle":"NOT_RUN","title":"Log AI interactions and control decisions","statement":"Verify completeness, integrity, access, retention and redaction.","family":"Operations","body":{"ruleRef":"MS-RULE-OP-01","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OP-02@e6bebdee13a2794f","id":"TEST-MS-RULE-OP-02","version":"e6bebdee13a2794f","kind":"test","lifecycle":"NOT_RUN","title":"Capture provenance and citations","statement":"Trace a sample output end-to-end and validate source integrity.","family":"Operations","body":{"ruleRef":"MS-RULE-OP-02","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OP-03@63af44dbe3b87025","id":"TEST-MS-RULE-OP-03","version":"63af44dbe3b87025","kind":"test","lifecycle":"NOT_RUN","title":"Monitor control efficacy and model drift","statement":"Use labeled tests and production samples; investigate threshold breaches.","family":"Operations","body":{"ruleRef":"MS-RULE-OP-03","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OP-04@10af1b4283fbdf52","id":"TEST-MS-RULE-OP-04","version":"10af1b4283fbdf52","kind":"test","lifecycle":"NOT_RUN","title":"Escalate AI incidents","statement":"Run tabletop and technical drills from detection through closure.","family":"Operations","body":{"ruleRef":"MS-RULE-OP-04","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OP-05@0d20359d25737fc8","id":"TEST-MS-RULE-OP-05","version":"0d20359d25737fc8","kind":"test","lifecycle":"NOT_RUN","title":"Provide kill switch and fail-safe","statement":"Test scoped and global shutdown, fail-closed behavior and restoration.","family":"Operations","body":{"ruleRef":"MS-RULE-OP-05","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OP-06@a9f506c8bff242f1","id":"TEST-MS-RULE-OP-06","version":"a9f506c8bff242f1","kind":"test","lifecycle":"NOT_RUN","title":"Reassess on material change","statement":"Change each dependency and verify the gate activates.","family":"Operations","body":{"ruleRef":"MS-RULE-OP-06","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OP-07@8efbac703c680b3b","id":"TEST-MS-RULE-OP-07","version":"8efbac703c680b3b","kind":"test","lifecycle":"NOT_RUN","title":"Time-bound exceptions and waivers","statement":"Create expired, overbroad and missing-owner exceptions; verify rejection.","family":"Operations","body":{"ruleRef":"MS-RULE-OP-07","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OP-08@438a6f5faac23af7","id":"TEST-MS-RULE-OP-08","version":"438a6f5faac23af7","kind":"test","lifecycle":"NOT_RUN","title":"Support feedback, appeal and override","statement":"Test accessibility, timeliness and traceability of appeals.","family":"Operations","body":{"ruleRef":"MS-RULE-OP-08","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OP-09@30152b169dd9d2ae","id":"TEST-MS-RULE-OP-09","version":"30152b169dd9d2ae","kind":"test","lifecycle":"NOT_RUN","title":"Maintain AI inventory and ownership","statement":"Reconcile browser, endpoint, network, procurement and API observations.","family":"Operations","body":{"ruleRef":"MS-RULE-OP-09","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OP-10@e71f274c4901fd3c","id":"TEST-MS-RULE-OP-10","version":"e71f274c4901fd3c","kind":"test","lifecycle":"NOT_RUN","title":"Monitor vendor and model supply chain","statement":"Simulate model version, term and subprocessor change.","family":"Operations","body":{"ruleRef":"MS-RULE-OP-10","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OP-11@431f6754fa078c78","id":"TEST-MS-RULE-OP-11","version":"431f6754fa078c78","kind":"test","lifecycle":"NOT_RUN","title":"Decommission safely and delete data","statement":"Test deletion across primary, cache, backup and vendor scopes.","family":"Operations","body":{"ruleRef":"MS-RULE-OP-11","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OP-12@e2e102960c613341","id":"TEST-MS-RULE-OP-12","version":"e2e102960c613341","kind":"test","lifecycle":"NOT_RUN","title":"Require predeployment evaluation and red team","statement":"Use versioned representative datasets; independently review high-impact systems.","family":"Operations","body":{"ruleRef":"MS-RULE-OP-12","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OU-01@b9fd24d42e46a0aa","id":"TEST-MS-RULE-OU-01","version":"b9fd24d42e46a0aa","kind":"test","lifecycle":"NOT_RUN","title":"Block sensitive output disclosure","statement":"Seed hidden sensitive data and verify it never reaches the user or tool.","family":"Output Safety","body":{"ruleRef":"MS-RULE-OU-01","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OU-02@82b9b07bac4d235a","id":"TEST-MS-RULE-OU-02","version":"82b9b07bac4d235a","kind":"test","lifecycle":"NOT_RUN","title":"Prevent hidden-context and system-prompt leakage","statement":"Run extraction attacks and canary-string tests.","family":"Output Safety","body":{"ruleRef":"MS-RULE-OU-02","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OU-03@855aa6350f3b6faf","id":"TEST-MS-RULE-OU-03","version":"855aa6350f3b6faf","kind":"test","lifecycle":"NOT_RUN","title":"Require evidence for factual claims","statement":"Test answerability, fabricated citations and stale sources.","family":"Output Safety","body":{"ruleRef":"MS-RULE-OU-03","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OU-04@b8d5604c6e6cac3b","id":"TEST-MS-RULE-OU-04","version":"b8d5604c6e6cac3b","kind":"test","lifecycle":"NOT_RUN","title":"Require human validation for high-stakes advice","statement":"Simulate consequential outputs; verify required review and fail-safe.","family":"Output Safety","body":{"ruleRef":"MS-RULE-OU-04","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OU-05@790ba5609481741c","id":"TEST-MS-RULE-OU-05","version":"790ba5609481741c","kind":"test","lifecycle":"NOT_RUN","title":"Detect discriminatory or unfair outcomes","statement":"Test counterfactual pairs, subgroup performance and proxy features.","family":"Output Safety","body":{"ruleRef":"MS-RULE-OU-05","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OU-06@3389a94a06402212","id":"TEST-MS-RULE-OU-06","version":"3389a94a06402212","kind":"test","lifecycle":"NOT_RUN","title":"Block harassment, hate and abuse","statement":"Run multilingual and contextual safety tests, including quoted material exceptions.","family":"Output Safety","body":{"ruleRef":"MS-RULE-OU-06","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OU-07@c8b8661e517fb395","id":"TEST-MS-RULE-OU-07","version":"c8b8661e517fb395","kind":"test","lifecycle":"NOT_RUN","title":"Block dangerous and illegal content","statement":"Use controlled safety datasets and escalation drills.","family":"Output Safety","body":{"ruleRef":"MS-RULE-OU-07","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OU-08@2da28a7f88e05c49","id":"TEST-MS-RULE-OU-08","version":"2da28a7f88e05c49","kind":"test","lifecycle":"NOT_RUN","title":"Block insecure code from automated use","statement":"Benchmark common weakness classes and dependency risks.","family":"Output Safety","body":{"ruleRef":"MS-RULE-OU-08","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OU-09@225611971feba396","id":"TEST-MS-RULE-OU-09","version":"225611971feba396","kind":"test","lifecycle":"NOT_RUN","title":"Sanitize and validate model output","statement":"Test XSS, SQL/command injection, malformed JSON and policy bypass.","family":"Output Safety","body":{"ruleRef":"MS-RULE-OU-09","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OU-10@f6e5d3d4dc45e98f","id":"TEST-MS-RULE-OU-10","version":"f6e5d3d4dc45e98f","kind":"test","lifecycle":"NOT_RUN","title":"Protect intellectual property and licenses","statement":"Test verbatim regeneration, code-license conflicts and source attribution.","family":"Output Safety","body":{"ruleRef":"MS-RULE-OU-10","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OU-11@786090aa4216d6dd","id":"TEST-MS-RULE-OU-11","version":"786090aa4216d6dd","kind":"test","lifecycle":"NOT_RUN","title":"Prevent re-identification","statement":"Run linkage and uniqueness attacks against representative datasets.","family":"Output Safety","body":{"ruleRef":"MS-RULE-OU-11","syntheticOrAuthorizedInputsRequired":true,"result":null}},{"key":"TEST-MS-RULE-OU-12@249ad604ebb6fff7","id":"TEST-MS-RULE-OU-12","version":"249ad604ebb6fff7","kind":"test","lifecycle":"NOT_RUN","title":"Disclose AI-generated or synthetic content","statement":"Verify labels survive export, reposting and supported transformations.","family":"Output Safety","body":{"ruleRef":"MS-RULE-OU-12","syntheticOrAuthorizedInputsRequired":true,"result":null}}],"sources":[{"key":"workbook-38dbe80823a08687@65c7282ca4ef","id":"workbook-38dbe80823a08687","version":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b","title":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","kind":"workbook","uri":null,"verification":"UPLOADED_BYTES_VERIFIED","sourceDate":"2026-08-20","sha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"key":"workbook-595d3cba580f5771@b7251cfa104f","id":"workbook-595d3cba580f5771","version":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f","title":"missionSAFE_policy_expansion_2026-08-20.xlsx","kind":"workbook","uri":null,"verification":"UPLOADED_BYTES_VERIFIED","sourceDate":"2026-08-20","sha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"key":"workbook-90529719e3e3b5bc@943924618a78","id":"workbook-90529719e3e3b5bc","version":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992","title":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","kind":"workbook","uri":null,"verification":"UPLOADED_BYTES_VERIFIED","sourceDate":"2026-08-20","sha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"key":"nc-public-genai@fdb108006ef7","id":"nc-public-genai","version":"1.1 — April 14, 2026","title":"Use of Publicly Available Generative Artificial Intelligence Policy","kind":"organizational-policy","uri":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"nc-public-genai","title":"Use of Publicly Available Generative Artificial Intelligence Policy","publisher":"North Carolina Department of Information Technology","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","jurisdiction":"North Carolina, US","type":"organizational-policy","edition":"1.1 — April 14, 2026","effectiveDate":null,"checkedAt":"2026-09-28","coverage":"partial","summary":"State-agency minimum requirements for public GenAI tools.","limitations":"Selected employee rules. Full PDF read; extraction incomplete. Separate web guidance differs. Effective date unstated.","tags":["state-government","generative-ai","data-protection","North Carolina"],"fingerprint":"eb79447a45563393feec0d8eb94807a4e26174a1c47eca173eede98254d8f5be","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":8}},{"key":"va-ai-ea400@2e593dc57bbb","id":"va-ai-ea400","version":"EA400 — June 2026","title":"Artificial Intelligence (AI) Utilization Policy","kind":"organizational-policy","uri":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"va-ai-ea400","title":"Artificial Intelligence (AI) Utilization Policy","publisher":"Virginia Information Technologies Agency","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","jurisdiction":"Virginia, US","type":"organizational-policy","edition":"EA400 — June 2026","effectiveDate":null,"checkedAt":"2026-09-28","coverage":"partial","summary":"Executive-branch AI governance and approvals.","limitations":"Effective-date field is an unfilled placeholder. Higher-education research and instruction excluded. Reconfirm adoption before enforcement.","tags":["state-government","approval","human-review","transparency"],"fingerprint":"2752e8df4f1c7488837ab7f3dcc8a1b74b7e9b349cf75e960df393d93d2f81f6","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":6}},{"key":"pa-ai-2026@f9ebb0c412ba","id":"pa-ai-2026","version":"Revision January 13, 2026","title":"Artificial Intelligence Policy","kind":"organizational-policy","uri":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"pa-ai-2026","title":"Artificial Intelligence Policy","publisher":"Pennsylvania Office of Administration","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","jurisdiction":"Pennsylvania, US","type":"organizational-policy","edition":"Revision January 13, 2026","effectiveDate":"2026-01-13","checkedAt":"2026-09-28","coverage":"partial","summary":"Commonwealth AI governance and employee-use restrictions.","limitations":"Partial extraction. Scope includes Governor-jurisdiction agencies and Commonwealth-network entities. Formal exceptions use IT Policy Governance.","tags":["state-government","generative-ai","retention","disclosure"],"fingerprint":"f02f2e947d173f480bf386674ab3dc7c01b5892c3aec710e25f3fb440b7f3756","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":6}},{"key":"brookline-genai@8fce56b19d84","id":"brookline-genai","version":"1.7 — August 2025","title":"Generative Artificial Intelligence Use Policy","kind":"organizational-policy","uri":"https://www.brooklinema.gov/3975/Generative-AI-Use","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"brookline-genai","title":"Generative Artificial Intelligence Use Policy","publisher":"Town of Brookline, Massachusetts","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","jurisdiction":"Brookline, Massachusetts, US","type":"organizational-policy","edition":"1.7 — August 2025","effectiveDate":null,"checkedAt":"2026-09-28","coverage":"partial","summary":"Rules for users exposing town systems or data to GenAI.","limitations":"Selected rules. Sensitive-data prohibition and constrained-tool permission need reconciliation. Exceptions require IT security review; adoption August 19, 2025.","tags":["local-government","generative-ai","approval","human-review"],"fingerprint":"f88055fe772f4fdf64cddb84e749822d4204369ff50933a3a2e41ac50cafb305","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":6}},{"key":"harvard-genai-guidelines@42cacddb870d","id":"harvard-genai-guidelines","version":"Edition unspecified; prepared index checked 2026-09-28","title":"Generative AI Guidelines","kind":"organizational-policy","uri":"https://www.huit.harvard.edu/ai/guidelines","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"harvard-genai-guidelines","title":"Generative AI Guidelines","publisher":"Harvard University Information Technology","url":"https://www.huit.harvard.edu/ai/guidelines","jurisdiction":"Harvard University, US","type":"organizational-policy","edition":"Edition unspecified; prepared index checked 2026-09-28","effectiveDate":null,"checkedAt":"2026-09-28","coverage":"partial","summary":"Institutional guidance for Harvard AI use.","limitations":"Guidelines, not legislation. Revision/effective dates unavailable; school policies also apply.","tags":["university","generative-ai","confidentiality","procurement"],"fingerprint":"17fccd7682a4db1fbc185d3e0c7d89eee1c4f141b17287526522c589e97ba441","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4}},{"key":"msu-genai-guidelines@2b6ba5512b77","id":"msu-genai-guidelines","version":"Approved August 12, 2025; no revisions listed","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","kind":"organizational-policy","uri":"https://ai.msu.edu/guidelines","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","publisher":"Michigan State University","url":"https://ai.msu.edu/guidelines","jurisdiction":"Michigan State University, US","type":"organizational-policy","edition":"Approved August 12, 2025; no revisions listed","effectiveDate":null,"checkedAt":"2026-09-28","coverage":"partial","summary":"University guidance spanning academic and administrative AI.","limitations":"Partial extraction of institutional guidelines. Approval date is not an explicit effective date.","tags":["university","generative-ai","education","research"],"fingerprint":"9082b619d9a71d8373dff619801545bed89a05e7506ba0bce9a4d957ac8bf350","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":6}},{"key":"nist-ai-rmf-1@eeff9d803ee6","id":"nist-ai-rmf-1","version":"AI RMF 1.0 (2023)","title":"AI Risk Management Framework 1.0","kind":"framework","uri":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-10-03","body":{"id":"nist-ai-rmf-1","title":"AI Risk Management Framework 1.0","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","jurisdiction":"United States","type":"framework","edition":"AI RMF 1.0 (2023)","effectiveDate":null,"publishedDate":"2023-01-26","checkedAt":"2026-10-03","coverage":"partial","summary":"Voluntary AI risk outcomes across the lifecycle.","limitations":"All 72 core subcategories mapped to selected atomic actions. Compound outcomes may require additional actions; this is not full Playbook extraction.","tags":["AI governance","inventory","risk management"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"publisher-core-read","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["GOVERN 1.1","GOVERN 1.5","GOVERN 1.6","GOVERN 1.7"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:b1183dbe301b7cbde20ab8b0d1ad6035e561f6165c0c01a6accf90691b3a68fd","fingerprint":"570d6996fff58a679befc826cd489145fdabb2013912e93704bdd7e0ab0a71d6","lastVerifiedAt":"2026-10-03","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":72}},{"key":"nist-genai-profile@735d08bf9863","id":"nist-genai-profile","version":"AI 600-1","title":"Generative AI Profile","kind":"framework","uri":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-10-03","body":{"id":"nist-genai-profile","title":"Generative AI Profile","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","jurisdiction":"United States","type":"framework","edition":"AI 600-1","effectiveDate":null,"publishedDate":"2024-07-26","checkedAt":"2026-10-03","coverage":"partial","summary":"Suggested generative AI risk-management actions.","limitations":"Selected precisely located atomic templates from AI 600-1; full 211-action extraction remains a coverage gap.","tags":["generative AI","inventory","shutdown","provenance"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"selected-publisher-actions-read","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":5,"coverageDetail":{"indexedControls":["GV-1.3-007","GV-1.5-003","GV-1.6-001","GV-1.6-002","GV-1.7-001"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:c4ad40875bcac148ab8f66c168b9e44b7e9e194e70f7407dd8c205a96da6f189","fingerprint":"854b49562c3fcbd2c491c3096dbe4cd9332bf64eac581448292dde4c17a39c5d","lastVerifiedAt":"2026-10-03","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":10}},{"key":"nist-csf-2@02163ac1eda6","id":"nist-csf-2","version":"CSWP 29 / 2.0","title":"Cybersecurity Framework 2.0","kind":"framework","uri":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"nist-csf-2","title":"Cybersecurity Framework 2.0","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","jurisdiction":"United States","type":"framework","edition":"CSWP 29 / 2.0","effectiveDate":null,"publishedDate":"2024-02-26","checkedAt":"2026-09-28","coverage":"partial","summary":"Cybersecurity outcomes for organizational risk management.","limitations":"Five selected outcomes; this is not a complete CSF profile.","tags":["cybersecurity","inventory","logging","data protection"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":5,"coverageDetail":{"indexedControls":["ID.AM-01","ID.AM-02","PR.DS-02","PR.PS-04","PR.PS-05"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:1616137186c21fd736d139aaa6448eb70458e479cd6dc11b5b4432815491a637","fingerprint":"a39b6ed597fcc0a7d4e15fc04b1e0186985631c3ff05405558cc587a24fedf39","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":5}},{"key":"nist-privacy-1@1244c574bf2a","id":"nist-privacy-1","version":"CSWP 10 / 1.0","title":"Privacy Framework 1.0","kind":"framework","uri":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"nist-privacy-1","title":"Privacy Framework 1.0","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf","jurisdiction":"United States","type":"framework","edition":"CSWP 10 / 1.0","effectiveDate":null,"publishedDate":"2020-01-16","checkedAt":"2026-09-28","coverage":"partial","summary":"Voluntary privacy risk-management outcomes.","limitations":"Inventory subset only. Publisher also advertises a 1.1 initial public draft; draft is not substituted here.","tags":["privacy","data inventory","data purpose"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","versionState":"final-baseline","updatePointer":"https://www.nist.gov/privacy-framework","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"},{"url":"https://www.nist.gov/privacy-framework","readAt":"2026-09-28","method":"Publisher version metadata checked"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["ID.IM-P1","ID.IM-P3","ID.IM-P4","ID.IM-P5"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:aca377a8893100dc77d1c1a88d358aa047019fdc5ebcedbaacca99a69bee8e8c","fingerprint":"f6c65f5795ec4b430c2e81ed947a1e55c5d6768f4be9264380520ff6f9fafc36","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4}},{"key":"nist-800-53-r5@4f21062a3f36","id":"nist-800-53-r5","version":"SP 800-53 Rev.5 / Dec-2020 updates","title":"Security and Privacy Controls","kind":"framework","uri":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"nist-800-53-r5","title":"Security and Privacy Controls","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf","jurisdiction":"United States","type":"framework","edition":"SP 800-53 Rev.5 / Dec-2020 updates","effectiveDate":null,"publishedDate":"2020-09-23","checkedAt":"2026-09-28","coverage":"partial","summary":"Tailorable security and privacy control catalog.","limitations":"Baseline PDF only; publisher lists Release 5.2.0 (2025-08-27). Reconcile newer release before adoption. Controls require selection and parameters.","tags":["security controls","least privilege","privacy"],"authority":"technical-controls-when-adopted","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","versionState":"newer-release-needs-reconciliation","updatePointer":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"},{"url":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","readAt":"2026-09-28","method":"Publisher version metadata checked"}],"preparedRuleCount":5,"coverageDetail":{"indexedControls":["AC-3","AC-6","PT-2(a)","PT-2(b)"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:6253e0836e2c9c832252aba60e9a91aac38b13eba7b15c3ffd1e48ed0a0ba88b","fingerprint":"f90285ebe9f7628c21a3c2a1c5887626002e0aab40d63ec84655fff809a50392","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":5}},{"key":"nist-800-171-r3@2eb9b17a4b7e","id":"nist-800-171-r3","version":"SP 800-171 Rev.3","title":"Protecting Controlled Unclassified Information","kind":"guidance","uri":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"nist-800-171-r3","title":"Protecting Controlled Unclassified Information","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf","jurisdiction":"United States","type":"guidance","edition":"SP 800-171 Rev.3","effectiveDate":null,"publishedDate":"2024-05-14","checkedAt":"2026-09-28","coverage":"partial","summary":"Recommended CUI safeguards for nonfederal systems.","limitations":"Four selected requirements. Contract incorporation and required revision must be verified; publication alone does not bind every organization.","tags":["CUI","access control","federal contractors"],"authority":"technical-requirements-when-incorporated","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["03.01.02","03.01.05(a)","03.01.07(a)","03.01.07(b)"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:5bc814d991eed9d9478f00d730d9a0091af6f82888232deadc81ef3e6fd48958","fingerprint":"345e6f1c845ad7bb3fe7642ffe3cc2c553fd3cc8c66a62eea1203845ec65f20a","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4}},{"key":"nist-ssdf-1-1@50330a194ff2","id":"nist-ssdf-1-1","version":"SP 800-218 / SSDF 1.1","title":"Secure Software Development Framework","kind":"framework","uri":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"nist-ssdf-1-1","title":"Secure Software Development Framework","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf","jurisdiction":"United States","type":"framework","edition":"SP 800-218 / SSDF 1.1","effectiveDate":null,"publishedDate":"2022-02-03","checkedAt":"2026-09-28","coverage":"partial","summary":"Recommended secure software development practices.","limitations":"Selected practices only. Revision 1 initial public draft exists; this index retains final 1.1.","tags":["software security","supply chain","vulnerability response"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","versionState":"final-baseline","updatePointer":"https://csrc.nist.gov/pubs/sp/800/218/final","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"},{"url":"https://csrc.nist.gov/pubs/sp/800/218/final","readAt":"2026-09-28","method":"Publisher version metadata checked"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["PS.1.1","PS.2.1","RV.1.1"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:938270e36b849dbaf065a70ec30318f8b91cba2f639f89a94c89a0c51fff47cd","fingerprint":"ada47701174cc35e7ebaed3eb003ca0222bd920f4bb30e30a527e263e238cb7d","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4}},{"key":"cisa-ncsc-secure-ai-development@d0ff5974b6aa","id":"cisa-ncsc-secure-ai-development","version":"1.0","title":"Guidelines for Secure AI System Development","kind":"guidance","uri":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","publisher":"NCSC, CISA and partners","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","jurisdiction":"United States","type":"guidance","edition":"1.0","effectiveDate":null,"publishedDate":"2023-11-27","checkedAt":"2026-09-28","coverage":"partial","summary":"Lifecycle security recommendations for AI providers.","limitations":"Four selected development recommendations; other lifecycle sections remain unindexed.","tags":["AI security","development","supply chain","sensitive data"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","jurisdictionDetail":"Joint international guidance","evidence":[{"url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["Secure development / assets","Secure development / documentation"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:f0e5b3bdf7c95b67d87c1194bd3883e616a42c1572eb3a7eb4f68be05a16803b","fingerprint":"3887e1b0420cfda9908d30c4887cbb157678194db20a4ee2aac0e326b6f8e602","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4}},{"key":"nsa-cisa-secure-ai-deployment@6eacc566971b","id":"nsa-cisa-secure-ai-deployment","version":"April 2024 / 1.0","title":"Deploying AI Systems Securely","kind":"guidance","uri":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"nsa-cisa-secure-ai-deployment","title":"Deploying AI Systems Securely","publisher":"NSA AISC, CISA, FBI and partners","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","jurisdiction":"United States","type":"guidance","edition":"April 2024 / 1.0","effectiveDate":null,"publishedDate":"2024-04-15","checkedAt":"2026-09-28","coverage":"partial","summary":"Security guidance for deploying externally developed AI.","limitations":"Selected recommendations. Applies to deployers; not merely users of others’ hosted AI. Official coauthor HTML used after NSA PDF returned 403.","tags":["AI security","deployment","model weights","threat modeling"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","jurisdictionDetail":"Joint international guidance","primaryPublisherPointer":"https://media.defense.gov/2024/Apr/15/2003439257/-1/-1/0/CSI-DEPLOYING-AI-SYSTEMS-SECURELY.PDF","evidence":[{"url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["Deployment governance / threat model","Deployment architecture / boundaries","Summary / validation","Summary / model weights"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:c46c4b15947f61b1067d4175985bd261b3d813e7a487030e3c1a2099fc2f7c70","fingerprint":"5a2b6af416a7db93086cd04c8accccfaebba166d07ef5a071f3566e34ea8eaa5","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4}},{"key":"omb-m-25-21@2965141a9c5b","id":"omb-m-25-21","version":"M-25-21","title":"Accelerating Federal Use of AI","kind":"policy","uri":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"omb-m-25-21","title":"Accelerating Federal Use of AI","publisher":"Office of Management and Budget","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","jurisdiction":"United States","type":"policy","edition":"M-25-21","effectiveDate":"2025-04-03","publishedDate":"2025-04-03","checkedAt":"2026-09-28","coverage":"partial","summary":"Federal agency AI governance policy.","limitations":"Three clauses only. NSS excluded; inventory excludes DoD/IC; §4(a)-(b) excludes IC. High-impact practices have conditional pilot exemptions and CAIO waivers.","tags":["federal AI","impact assessment","inventory","waivers"],"authority":"binding-within-defined-federal-scope","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","supersedes":["OMB M-24-10"],"evidence":[{"url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":3,"coverageDetail":{"indexedControls":["3(b)(v)","4(b)(ii)","4(a)(ii)"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:51038bec3f6608e7a8d52074dd8f85af7232dea13c7aa49ce09d83183acb62f8","fingerprint":"ecef40be10a4ce3aa18ebb38bff1d891d4a566c1be5b55d134ba49831bbaf3c9","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":3}},{"key":"omb-m-25-22@9224fb5053c1","id":"omb-m-25-22","version":"M-25-22","title":"Driving Efficient Acquisition of AI","kind":"policy","uri":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"omb-m-25-22","title":"Driving Efficient Acquisition of AI","publisher":"Office of Management and Budget","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","jurisdiction":"United States","type":"policy","edition":"M-25-22","effectiveDate":"2025-04-03","publishedDate":"2025-04-03","checkedAt":"2026-09-28","coverage":"partial","summary":"Federal AI acquisition requirements.","limitations":"Selected clauses only. §2 limits scope, excludes NSS and some embedded AI, and specifies contract transition dates.","tags":["procurement","federal AI","evaluation","authorization"],"authority":"binding-within-defined-federal-scope","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","supersedes":["OMB M-24-18"],"evidence":[{"url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["4(d)(i)","4(d)(ii)(E)","4(d)(ii)(E)(I)","4(e)(i)"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:819b375905f73f1b06bac23dc2ec49316737caf641df12b4cd543104ef8baea5","fingerprint":"d950443a125c5bf4dda71e469bedf029813704e5ba4e3c0b613cf8219a9fc941","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4}},{"key":"omb-m-26-04@8cd9a5e0e73d","id":"omb-m-26-04","version":"M-26-04","title":"Increasing Public Trust Through Unbiased AI Principles","kind":"policy","uri":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-09-28","body":{"id":"omb-m-26-04","title":"Increasing Public Trust Through Unbiased AI Principles","publisher":"Office of Management and Budget","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf","jurisdiction":"United States","type":"policy","edition":"M-26-04","effectiveDate":"2025-12-11","publishedDate":"2025-12-11","checkedAt":"2026-09-28","coverage":"partial","summary":"Additional federal LLM procurement requirements.","limitations":"Three clauses only; exclusions and open-source treatment require scope review. Sunset: two years after issuance unless OMB directs otherwise.","tags":["LLM procurement","federal AI","transparency"],"authority":"binding-within-defined-federal-scope","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","evidence":[{"url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":3,"coverageDetail":{"indexedControls":["Agency Actions (a)","Agency Actions (c)","Appendix A.1(A)(i)"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:f8794e4df44d7a3d18c8dd9b86db768253f639236749d84bb574e12fdb48a86b","fingerprint":"d844d521b5f24a0745be44d963a1907257304ec739c5afef5af7696345c4d116","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":3}},{"key":"eu-ai-act@587d350ccaee","id":"eu-ai-act","version":"Regulation 2024/1689; 2026 amendments tracked separately","title":"EU Artificial Intelligence Act","kind":"law","uri":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-10-03","body":{"id":"eu-ai-act","title":"EU Artificial Intelligence Act","publisher":"European Union","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","jurisdiction":"European Union","type":"law","edition":"Regulation 2024/1689; 2026 amendments tracked separately","authority":"binding-within-scope","checkedAt":"2026-10-03","lastVerifiedAt":"2026-10-03","coverage":"partial","reviewStatus":"publisher-text-read","summary":"Provider, deployer or other specified operator; territorial and risk-category scope must be assessed.","limitations":"Selected original-text obligations. AI Omnibus amendments require consolidated clause review; high-risk deadlines follow the Commission timeline. Do not assume every clause is currently applicable.","rights":"Selective original paraphrases; authoritative text remains with publisher.","tags":[],"timelineUrl":"https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai","applicabilityNote":"Commission reports Annex III high-risk rules apply 2027-12-02; Annex I product rules 2028-08-02 after the 2026 AI Omnibus. Original text retained as source edition; clause reconciliation pending.","ruleCount":49,"fingerprint":"4faacfc940d07c320a04fd01df149dd266f3fd7df675842b2d628694508bb589"}},{"key":"eu-gdpr@86540090d955","id":"eu-gdpr","version":"Regulation 2016/679","title":"General Data Protection Regulation","kind":"law","uri":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-10-03","body":{"id":"eu-gdpr","title":"General Data Protection Regulation","publisher":"European Union","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","jurisdiction":"European Union","type":"law","edition":"Regulation 2016/679","authority":"binding-within-scope","checkedAt":"2026-10-03","lastVerifiedAt":"2026-10-03","coverage":"partial","reviewStatus":"publisher-text-read","summary":"Personal-data processing within GDPR material and territorial scope.","limitations":"Selected data-protection obligations relevant to AI; full GDPR and national overlays are not extracted.","rights":"Selective original paraphrases; authoritative text remains with publisher.","tags":[],"ruleCount":22,"fingerprint":"85767c145543fcffff25030496963a6df99affce4c5e494f0207757afe1e98e8"}},{"key":"cn-genai-interim@d7fc895a372e","id":"cn-genai-interim","version":"Order 15; effective 2023-08-15","title":"Interim Measures for Generative AI Services","kind":"law","uri":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-10-03","body":{"id":"cn-genai-interim","title":"Interim Measures for Generative AI Services","publisher":"Cyberspace Administration of China and six departments","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","jurisdiction":"China","type":"law","edition":"Order 15; effective 2023-08-15","authority":"binding-within-scope","checkedAt":"2026-10-03","lastVerifiedAt":"2026-10-03","coverage":"partial","reviewStatus":"publisher-text-read","summary":"GenAI services offered to the public in mainland China; nonpublic research and enterprise development excluded by Article 2.","limitations":"Selected English paraphrases of Chinese provisions; professional translation and later measures require reconciliation.","rights":"Selective original paraphrases; authoritative text remains with publisher.","tags":[],"ruleCount":26,"fingerprint":"f3a1e4c8093d56999b178a4b5614fb931dd00d1cf6a607a0d8832f32aedcabed"}},{"key":"ca-automated-decisions@025abfffca33","id":"ca-automated-decisions","version":"Modified 2025-06-24","title":"Directive on Automated Decision-Making","kind":"policy","uri":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","verification":"LEGACY_SOURCE_REPORTED","lastVerifiedAt":"2026-10-03","body":{"id":"ca-automated-decisions","title":"Directive on Automated Decision-Making","publisher":"Treasury Board of Canada","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","jurisdiction":"Canada federal government","type":"policy","edition":"Modified 2025-06-24","authority":"binding-within-federal-scope","checkedAt":"2026-10-03","lastVerifiedAt":"2026-10-03","coverage":"partial","reviewStatus":"publisher-index-retrieved-direct-fetch-rejected","summary":"Federal administrative decisions; scope and department exemptions apply; research and test-only systems excluded.","limitations":"Indexed search retrieval available; direct publisher fetch rejected. Selected clauses only; Appendix C severity-specific obligations remain unextracted.","rights":"Selective original paraphrases; authoritative text remains with publisher.","tags":[],"ruleCount":9,"fingerprint":"9b20a10c09087ef5d40744e11bbb0f33f0a7e0aad94faa9035b88f600770fb3c"}},{"key":"framework-NIST-AI-RMF@4c28215720fc","id":"framework-NIST-AI-RMF","version":"Workbook reference — 2026-08-20","title":"NIST AI Risk Management Framework 1.0","kind":"Voluntary framework","uri":"https://www.nist.gov/itl/ai-risk-management-framework","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-NIST-AI-600-1@4c28215720fc","id":"framework-NIST-AI-600-1","version":"Workbook reference — 2026-08-20","title":"NIST AI 600-1 Generative AI Profile","kind":"Voluntary profile","uri":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-NIST-CSF2@4c28215720fc","id":"framework-NIST-CSF2","version":"Workbook reference — 2026-08-20","title":"NIST Cybersecurity Framework 2.0","kind":"Voluntary framework","uri":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-NIST-800-53@4c28215720fc","id":"framework-NIST-800-53","version":"Workbook reference — 2026-08-20","title":"NIST SP 800-53 Rev. 5","kind":"Control catalog","uri":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-FEDRAMP@4c28215720fc","id":"framework-FEDRAMP","version":"Workbook reference — 2026-08-20","title":"FedRAMP Rev. 5 Baselines","kind":"Federal authorization baseline","uri":"https://www.fedramp.gov/archive/2023-05-30-rev-5-baselines-have-been-approved-and-released/","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-ISO-42001@4c28215720fc","id":"framework-ISO-42001","version":"Workbook reference — 2026-08-20","title":"ISO/IEC 42001:2023","kind":"Certifiable management-system standard","uri":"https://www.iso.org/standard/42001","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-ISO-42005@4c28215720fc","id":"framework-ISO-42005","version":"Workbook reference — 2026-08-20","title":"ISO/IEC 42005:2025","kind":"International standard","uri":"https://www.iso.org/standard/42005","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-ISO-23894@4c28215720fc","id":"framework-ISO-23894","version":"Workbook reference — 2026-08-20","title":"ISO/IEC 23894:2023","kind":"Guidance","uri":"https://www.iso.org/standard/77304.html","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-ISO-38507@4c28215720fc","id":"framework-ISO-38507","version":"Workbook reference — 2026-08-20","title":"ISO/IEC 38507:2022","kind":"Governance guidance","uri":"https://www.iso.org/standard/56641.html","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-ISO-5338@4c28215720fc","id":"framework-ISO-5338","version":"Workbook reference — 2026-08-20","title":"ISO/IEC 5338:2023","kind":"Lifecycle standard","uri":"https://www.iso.org/standard/81118.html","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-ISO-24028@4c28215720fc","id":"framework-ISO-24028","version":"Workbook reference — 2026-08-20","title":"ISO/IEC TR 24028:2020","kind":"Technical report","uri":"https://www.iso.org/standard/77608.html","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-EU-AI-ACT@4c28215720fc","id":"framework-EU-AI-ACT","version":"Workbook reference — 2026-08-20","title":"EU Artificial Intelligence Act","kind":"Law","uri":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-GDPR@4c28215720fc","id":"framework-GDPR","version":"Workbook reference — 2026-08-20","title":"EU General Data Protection Regulation","kind":"Law","uri":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-HIPAA@4c28215720fc","id":"framework-HIPAA","version":"Workbook reference — 2026-08-20","title":"HIPAA Privacy and Security Rules","kind":"U.S. federal law/regulation","uri":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-PCI-DSS@4c28215720fc","id":"framework-PCI-DSS","version":"Workbook reference — 2026-08-20","title":"PCI DSS v4.0.1","kind":"Industry contractual standard","uri":"https://www.pcisecuritystandards.org/standards/pci-dss/","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-SOC2@4c28215720fc","id":"framework-SOC2","version":"Workbook reference — 2026-08-20","title":"AICPA Trust Services Criteria","kind":"Attestation criteria","uri":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-GLBA@4c28215720fc","id":"framework-GLBA","version":"Workbook reference — 2026-08-20","title":"GLBA Safeguards Rule","kind":"U.S. federal regulation","uri":"https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-FERPA@4c28215720fc","id":"framework-FERPA","version":"Workbook reference — 2026-08-20","title":"Family Educational Rights and Privacy Act","kind":"U.S. federal law/regulation","uri":"https://studentprivacy.ed.gov/ferpa","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-CCPA-CPRA@4c28215720fc","id":"framework-CCPA-CPRA","version":"Workbook reference — 2026-08-20","title":"California CCPA / CPRA Regulations","kind":"California law/regulation","uri":"https://cppa.ca.gov/regulations/ccpa_updates.html","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-CO-AI@4c28215720fc","id":"framework-CO-AI","version":"Workbook reference — 2026-08-20","title":"Colorado AI laws and rulemaking","kind":"State law/regulation","uri":"https://coag.gov/ai/","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-TX-TRAIGA@4c28215720fc","id":"framework-TX-TRAIGA","version":"Workbook reference — 2026-08-20","title":"Texas Responsible Artificial Intelligence Governance Act","kind":"State law","uri":"https://statutes.capitol.texas.gov/GetStatute.aspx?Code=BC&Value=552","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-OMB-M25-21@4c28215720fc","id":"framework-OMB-M25-21","version":"Workbook reference — 2026-08-20","title":"OMB M-25-21 Federal AI Governance","kind":"Federal executive policy","uri":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-OMB-M25-22@4c28215720fc","id":"framework-OMB-M25-22","version":"Workbook reference — 2026-08-20","title":"OMB M-25-22 AI Acquisition","kind":"Federal executive policy","uri":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-OWASP-LLM-2026@4c28215720fc","id":"framework-OWASP-LLM-2026","version":"Workbook reference — 2026-08-20","title":"OWASP Top 10 for LLM Applications 2026","kind":"Security guidance","uri":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-SOX@4c28215720fc","id":"framework-SOX","version":"Workbook reference — 2026-08-20","title":"Sarbanes-Oxley Act / ICFR","kind":"U.S. federal law and audit context","uri":"https://www.sec.gov/spotlight/sarbanes-oxley.htm","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-NIST-800-171@4c28215720fc","id":"framework-NIST-800-171","version":"Workbook reference — 2026-08-20","title":"NIST SP 800-171 Rev. 3","kind":"Federal security requirements","uri":"https://csrc.nist.gov/pubs/sp/800/171/r3/final","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-CMMC@4c28215720fc","id":"framework-CMMC","version":"Workbook reference — 2026-08-20","title":"Cybersecurity Maturity Model Certification","kind":"DoD contractual assessment framework","uri":"https://business.defense.gov/cmmc/","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-CJIS-6.1@4c28215720fc","id":"framework-CJIS-6.1","version":"Workbook reference — 2026-08-20","title":"FBI CJIS Security Policy v6.1","kind":"Criminal justice security policy","uri":"https://le.fbi.gov/file-repository/cjis_security_policy_v6-1_20260625.pdf/view","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-IRS-1075@4c28215720fc","id":"framework-IRS-1075","version":"Workbook reference — 2026-08-20","title":"IRS Publication 1075","kind":"Federal tax information safeguard requirements","uri":"https://www.irs.gov/privacy-disclosure/safeguards-program","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-SECTION-508@4c28215720fc","id":"framework-SECTION-508","version":"Workbook reference — 2026-08-20","title":"Revised Section 508 Standards","kind":"Federal accessibility requirements","uri":"https://www.section508.gov/buy-sell/","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-HHS-PART2@4c28215720fc","id":"framework-HHS-PART2","version":"Workbook reference — 2026-08-20","title":"42 CFR Part 2 — SUD Patient Records","kind":"U.S. federal regulation","uri":"https://www.hhs.gov/hipaa/part-2/index.html","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-ONC-HTI1@4c28215720fc","id":"framework-ONC-HTI1","version":"Workbook reference — 2026-08-20","title":"ONC HTI-1 Algorithm Transparency","kind":"Health IT certification regulation","uri":"https://healthit.gov/regulations/hti-rules/hti-1-final-rule/","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-FDA-AI-MD@4c28215720fc","id":"framework-FDA-AI-MD","version":"Workbook reference — 2026-08-20","title":"FDA AI-Enabled Medical Device Lifecycle Guidance","kind":"Regulatory guidance / device requirements","uri":"https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-enabled-medical-devices","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-FRB-MRM-2026@4c28215720fc","id":"framework-FRB-MRM-2026","version":"Workbook reference — 2026-08-20","title":"Interagency Revised Guidance on Model Risk Management","kind":"U.S. banking supervisory guidance","uri":"https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-NYDFS-500@4c28215720fc","id":"framework-NYDFS-500","version":"Workbook reference — 2026-08-20","title":"23 NYCRR Part 500 + DFS AI Cybersecurity Guidance","kind":"New York financial cybersecurity regulation","uri":"https://www.dfs.ny.gov/industry_guidance/cybersecurity","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-ECOA-REG-B@4c28215720fc","id":"framework-ECOA-REG-B","version":"Workbook reference — 2026-08-20","title":"ECOA / Regulation B Adverse Action Requirements","kind":"U.S. federal consumer-credit law and regulation","uri":"https://www.consumerfinance.gov/archive/newsroom/cfpb-issues-guidance-on-credit-denials-by-lenders-using-artificial-intelligence/","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-NAIC-AI@4c28215720fc","id":"framework-NAIC-AI","version":"Workbook reference — 2026-08-20","title":"NAIC Model Bulletin on AI Systems by Insurers","kind":"State insurance regulatory model bulletin","uri":"https://content.naic.org/article/naic-members-approve-model-bulletin-use-ai-insurers","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-COPPA@4c28215720fc","id":"framework-COPPA","version":"Workbook reference — 2026-08-20","title":"Children’s Online Privacy Protection Rule","kind":"U.S. federal regulation","uri":"https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-NYC-LL144@4c28215720fc","id":"framework-NYC-LL144","version":"Workbook reference — 2026-08-20","title":"NYC Local Law 144 — AEDT","kind":"New York City employment law","uri":"https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-IL-AIVIA@4c28215720fc","id":"framework-IL-AIVIA","version":"Workbook reference — 2026-08-20","title":"Illinois Artificial Intelligence Video Interview Act","kind":"Illinois employment law","uri":"https://www.ilga.gov/Legislation/PublicActs/PrinterFriendly/101-0260","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-UK-DP-AI@4c28215720fc","id":"framework-UK-DP-AI","version":"Workbook reference — 2026-08-20","title":"UK Data Protection Law + ICO AI Guidance","kind":"Law plus regulator guidance","uri":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/about-this-guidance/","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-BR-LGPD@4c28215720fc","id":"framework-BR-LGPD","version":"Workbook reference — 2026-08-20","title":"Brazil LGPD + ANPD AI Guidance","kind":"Brazilian data-protection law and regulator guidance","uri":"https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/lgpd-en-lei-no-13-709-capa.pdf","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-AU-PRIVACY-AI@4c28215720fc","id":"framework-AU-PRIVACY-AI","version":"Workbook reference — 2026-08-20","title":"Australia Privacy Act / APPs + OAIC AI Guidance","kind":"Australian privacy law and regulator guidance","uri":"https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-SG-MODEL-AI@4c28215720fc","id":"framework-SG-MODEL-AI","version":"Workbook reference — 2026-08-20","title":"Singapore Model AI Governance Framework","kind":"Voluntary governance framework","uri":"https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-DOJ-DSP@4c28215720fc","id":"framework-DOJ-DSP","version":"Workbook reference — 2026-08-20","title":"DOJ Data Security Program — 28 CFR Part 202","kind":"U.S. national-security regulation","uri":"https://www.justice.gov/nsd/data-security","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"framework-EAR@4c28215720fc","id":"framework-EAR","version":"Workbook reference — 2026-08-20","title":"U.S. Export Administration Regulations","kind":"U.S. export-control regulation","uri":"https://www.bis.gov/regulations/ear/734","verification":"WORKBOOK_REFERENCE_UNVERIFIED","sourceDate":"2026-08-20"},{"key":"policy-guide-taimscore@e8334126d25759e0","id":"policy-guide-taimscore","version":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea","title":"TAIMScore™ — Trusted AI Model Score","kind":"uploaded-policy-guidance","uri":null,"verification":"UPLOADED_BYTES_VERIFIED_SECONDARY_CONTENT_UNVERIFIED","sha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea","sourceDate":null,"uploadedAt":"2026-10-16","warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","historical":false},{"key":"policy-guide-chirality-maturity@9134743a099f1dc9","id":"policy-guide-chirality-maturity","version":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6","title":"AI Governance Maturity Roadmap","kind":"uploaded-policy-guidance","uri":null,"verification":"UPLOADED_BYTES_VERIFIED_SECONDARY_CONTENT_UNVERIFIED","sha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6","sourceDate":null,"uploadedAt":"2026-10-16","warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","historical":false},{"key":"policy-guide-cmmc@41d1e97d020a97ab","id":"policy-guide-cmmc","version":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca","title":"CMMC — Cybersecurity Maturity Model Certification","kind":"uploaded-policy-guidance","uri":null,"verification":"UPLOADED_BYTES_VERIFIED_SECONDARY_CONTENT_UNVERIFIED","sha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca","sourceDate":null,"uploadedAt":"2026-10-16","warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","historical":false},{"key":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","id":"policy-guide-dod-ai-ethics","version":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0","title":"DoD AI Ethics Principles","kind":"uploaded-policy-guidance","uri":null,"verification":"UPLOADED_BYTES_VERIFIED_SECONDARY_CONTENT_UNVERIFIED","sha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0","sourceDate":null,"uploadedAt":"2026-10-16","warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","historical":false},{"key":"policy-guide-eo-14110@88d519cc9c305e1a","id":"policy-guide-eo-14110","version":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5","title":"Executive Order 14110 — Safe, Secure, and Trustworthy Artificial Intelligence","kind":"uploaded-policy-guidance","uri":null,"verification":"UPLOADED_BYTES_VERIFIED_SECONDARY_CONTENT_UNVERIFIED","sha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5","sourceDate":null,"uploadedAt":"2026-10-16","warning":"Historical reference: EO 14110 was revoked. Do not treat its requirements as current authority.","historical":true,"primaryStatusEvidence":"https://www.federalregister.gov/documents/2023/11/01/2023-24283/safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence"},{"key":"policy-guide-eu-ai-act@952eee7420eda0a8","id":"policy-guide-eu-ai-act","version":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75","title":"EU AI Act — European Union Artificial Intelligence Act","kind":"uploaded-policy-guidance","uri":null,"verification":"UPLOADED_BYTES_VERIFIED_SECONDARY_CONTENT_UNVERIFIED","sha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75","sourceDate":null,"uploadedAt":"2026-10-16","warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. Article numbering and current amendments require primary-source reconciliation.","historical":false},{"key":"policy-guide-fedramp@6bc3eb5520724cd4","id":"policy-guide-fedramp","version":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478","title":"FedRAMP — Federal Risk and Authorization Management Program","kind":"uploaded-policy-guidance","uri":null,"verification":"UPLOADED_BYTES_VERIFIED_SECONDARY_CONTENT_UNVERIFIED","sha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478","sourceDate":null,"uploadedAt":"2026-10-16","warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","historical":false},{"key":"policy-guide-iso-42001@ef8be3fea8d9b33e","id":"policy-guide-iso-42001","version":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32","title":"ISO/IEC 42001:2023 — Artificial Intelligence Management System","kind":"uploaded-policy-guidance","uri":null,"verification":"UPLOADED_BYTES_VERIFIED_SECONDARY_CONTENT_UNVERIFIED","sha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32","sourceDate":null,"uploadedAt":"2026-10-16","warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","historical":false},{"key":"policy-guide-nist-800-53@4818dbe94063b8d9","id":"policy-guide-nist-800-53","version":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06","title":"NIST 800-53 Rev 5 — Security and Privacy Controls","kind":"uploaded-policy-guidance","uri":null,"verification":"UPLOADED_BYTES_VERIFIED_SECONDARY_CONTENT_UNVERIFIED","sha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06","sourceDate":null,"uploadedAt":"2026-10-16","warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","historical":false},{"key":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","id":"policy-guide-nist-ai-rmf","version":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9","title":"NIST AI Risk Management Framework (AI RMF 1.0)","kind":"uploaded-policy-guidance","uri":null,"verification":"UPLOADED_BYTES_VERIFIED_SECONDARY_CONTENT_UNVERIFIED","sha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9","sourceDate":null,"uploadedAt":"2026-10-16","warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review. EO 14110-based current-mandate claims in these notes are outdated.","historical":false},{"key":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","id":"policy-guide-owasp-llm-2025","version":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1","title":"OWASP LLM Top 10 (2025)","kind":"uploaded-policy-guidance","uri":null,"verification":"UPLOADED_BYTES_VERIFIED_SECONDARY_CONTENT_UNVERIFIED","sha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1","sourceDate":null,"uploadedAt":"2026-10-16","warning":"Secondary supplied guidance; claims, exact source numbering, edition and applicability require publisher review.","historical":false}],"sourceRows":[{"id":"ROW-73ae5c8d6d76da722c7cbaad","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":5,"originalCells":{"A":"NIST-AI-RMF","B":"NIST AI Risk Management Framework 1.0","C":"Voluntary framework","D":"All AI","E":"Govern, Map, Measure, Manage","F":"High","G":"Risk thresholds, testing, monitoring, human oversight","H":"Governance records, assessments, tests","I":"Current; revision underway","J":"https://www.nist.gov/itl/ai-risk-management-framework"},"originalFormulas":{}},{"id":"ROW-eea746eaa776d1004c48a97e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":6,"originalCells":{"A":"NIST-AI-600-1","B":"NIST AI 600-1 Generative AI Profile","C":"Voluntary profile","D":"Generative AI","E":"GAI risks and actions","F":"High","G":"Acceptable use, provider allowlist, PII/output monitoring, testing","H":"Go/no-go thresholds, evaluations, monitoring","I":"Published July 2024","J":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence"},"originalFormulas":{}},{"id":"ROW-80a19ee37e5c8a39a94c4430","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":7,"originalCells":{"A":"NIST-CSF2","B":"NIST Cybersecurity Framework 2.0","C":"Voluntary framework","D":"Cybersecurity","E":"Govern, Identify, Protect, Detect, Respond, Recover","F":"High","G":"Identity, data security, monitoring, incident response","H":"Policies, configurations, logs, tests","I":"Current","J":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf"},"originalFormulas":{}},{"id":"ROW-abb22caa6cac267762b34574","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":8,"originalCells":{"A":"NIST-800-53","B":"NIST SP 800-53 Rev. 5","C":"Control catalog","D":"Federal and high-assurance systems","E":"Security and privacy control families","F":"High","G":"Access, information flow, logging, privacy, incident controls","H":"Control implementation and assessment evidence","I":"Rev. 5 Update 1","J":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final"},"originalFormulas":{}},{"id":"ROW-b4e26730b069df54fe2c4431","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":9,"originalCells":{"A":"FEDRAMP","B":"FedRAMP Rev. 5 Baselines","C":"Federal authorization baseline","D":"Federal cloud services","E":"NIST 800-53 baselines + continuous monitoring","F":"High where applicable","G":"Identity, boundary, logging, monitoring","H":"SSP, assessment, POA&M, continuous monitoring","I":"Rev. 5","J":"https://www.fedramp.gov/archive/2023-05-30-rev-5-baselines-have-been-approved-and-released/"},"originalFormulas":{}},{"id":"ROW-8c5c9cbcfa995fdab7bf6c52","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":10,"originalCells":{"A":"ISO-42001","B":"ISO/IEC 42001:2023","C":"Certifiable management-system standard","D":"AI management systems","E":"Governance, risk, lifecycle, controls","F":"High","G":"Operational controls depend on organizational context","H":"AIMS policies, objectives, audits, management review","I":"Current","J":"https://www.iso.org/standard/42001"},"originalFormulas":{}},{"id":"ROW-88ab72918d81a546deb54d40","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":11,"originalCells":{"A":"ISO-42005","B":"ISO/IEC 42005:2025","C":"International standard","D":"AI system impact assessment","E":"Impact assessment process","F":"High","G":"Assessment gates and reassessment triggers","H":"Impact assessment and decisions","I":"Published 2025","J":"https://www.iso.org/standard/42005"},"originalFormulas":{}},{"id":"ROW-d866faab7434a392a05c8077","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":12,"originalCells":{"A":"ISO-23894","B":"ISO/IEC 23894:2023","C":"Guidance","D":"AI risk management","E":"AI-specific risk guidance","F":"Medium","G":"Risk treatment drives rules","H":"Risk records and treatment evidence","I":"Current","J":"https://www.iso.org/standard/77304.html"},"originalFormulas":{}},{"id":"ROW-780eec363401f6c7ab3ef9ed","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":13,"originalCells":{"A":"ISO-38507","B":"ISO/IEC 38507:2022","C":"Governance guidance","D":"Governing-body use of AI","E":"Governance implications","F":"Medium","G":"Accountability and oversight","H":"Governance decisions","I":"Current","J":"https://www.iso.org/standard/56641.html"},"originalFormulas":{}},{"id":"ROW-b1b53188bb14f4816982db5d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":14,"originalCells":{"A":"ISO-5338","B":"ISO/IEC 5338:2023","C":"Lifecycle standard","D":"AI system lifecycle","E":"Lifecycle processes","F":"Medium","G":"Change, release, and retirement gates","H":"Lifecycle records","I":"Current","J":"https://www.iso.org/standard/81118.html"},"originalFormulas":{}},{"id":"ROW-5f4f858b01c24dc023378ecd","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":15,"originalCells":{"A":"ISO-24028","B":"ISO/IEC TR 24028:2020","C":"Technical report","D":"Trustworthiness in AI","E":"Trustworthiness overview","F":"Medium","G":"Informs criteria; does not define trust levels","H":"Assurance rationale","I":"Levels of trustworthiness are out of scope","J":"https://www.iso.org/standard/77608.html"},"originalFormulas":{}},{"id":"ROW-548c940ac91d34d10266b030","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":16,"originalCells":{"A":"EU-AI-ACT","B":"EU Artificial Intelligence Act","C":"Law","D":"AI placed or used in the EU","E":"Risk-based obligations","F":"High where applicable","G":"Prohibited use, logs, transparency, oversight, accuracy, cybersecurity","H":"Technical documentation, logs, assessments","I":"Consolidated text current 27 Jul 2026","J":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng"},"originalFormulas":{}},{"id":"ROW-a5b964d0f8fb608f909addb2","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":17,"originalCells":{"A":"GDPR","B":"EU General Data Protection Regulation","C":"Law","D":"EU personal-data processing","E":"Data protection principles and rights","F":"High where applicable","G":"Purpose, minimization, security, DPIA, automated decisions","H":"Records, DPIA, security evidence","I":"Current","J":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng"},"originalFormulas":{}},{"id":"ROW-5a2eea07e54357f98a3bc76c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":18,"originalCells":{"A":"HIPAA","B":"HIPAA Privacy and Security Rules","C":"U.S. federal law/regulation","D":"Covered entities and business associates","E":"PHI privacy and security","F":"High where applicable","G":"Prevent unauthorized PHI disclosure; access and audit controls","H":"Risk analysis, policies, access, logs","I":"Current","J":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html"},"originalFormulas":{}},{"id":"ROW-bec6795cdc61b0b63b20edf3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":19,"originalCells":{"A":"PCI-DSS","B":"PCI DSS v4.0.1","C":"Industry contractual standard","D":"Cardholder-data environment","E":"Payment-account data security","F":"High where applicable","G":"PAN/SAD handling, access, monitoring","H":"Configuration, scan, test, audit evidence","I":"v4.0.1","J":"https://www.pcisecuritystandards.org/standards/pci-dss/"},"originalFormulas":{}},{"id":"ROW-9e5c2493221240f760707703","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":20,"originalCells":{"A":"SOC2","B":"AICPA Trust Services Criteria","C":"Attestation criteria","D":"Service organizations","E":"Security, availability, processing integrity, confidentiality, privacy","F":"High commercially","G":"Confidentiality, logical access, monitoring","H":"Control design and operating evidence","I":"2017 TSC with 2022 points of focus","J":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022"},"originalFormulas":{}},{"id":"ROW-880a0349c80e702a19802fa9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":21,"originalCells":{"A":"GLBA","B":"GLBA Safeguards Rule","C":"U.S. federal regulation","D":"Covered financial institutions","E":"Customer-information security program","F":"High where applicable","G":"MFA, access, encryption, monitoring","H":"System configuration and program evidence","I":"Current","J":"https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know"},"originalFormulas":{}},{"id":"ROW-e697421b09e4c6c895476f7a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":22,"originalCells":{"A":"FERPA","B":"Family Educational Rights and Privacy Act","C":"U.S. federal law/regulation","D":"Federally funded educational institutions","E":"Student education-record privacy","F":"High where applicable","G":"Prevent unauthorized record disclosure","H":"Consent and disclosure records","I":"Current","J":"https://studentprivacy.ed.gov/ferpa"},"originalFormulas":{}},{"id":"ROW-63642d79d6dd1161886b4d4c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":23,"originalCells":{"A":"CCPA-CPRA","B":"California CCPA / CPRA Regulations","C":"California law/regulation","D":"Covered businesses","E":"Consumer privacy and automated decisionmaking","F":"High where applicable","G":"Sensitive-data restrictions, rights, ADMT governance","H":"Notices, risk assessments, response records","I":"Updated regulations effective 1 Jan 2026; ADMT obligations begin 1 Jan 2027","J":"https://cppa.ca.gov/regulations/ccpa_updates.html"},"originalFormulas":{}},{"id":"ROW-6de696f06f216ca70407b33c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":24,"originalCells":{"A":"CO-AI","B":"Colorado AI laws and rulemaking","C":"State law/regulation","D":"Covered Colorado AI uses","E":"High-risk AI and chatbot safety","F":"Medium / High where applicable","G":"Disclosures, risk management, high-risk controls","H":"Impact assessments and consumer records","I":"SB26-189 effective 1 Jan 2027; monitor rulemaking","J":"https://coag.gov/ai/"},"originalFormulas":{}},{"id":"ROW-d46fa160b8d1aee1749ce463","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":25,"originalCells":{"A":"TX-TRAIGA","B":"Texas Responsible Artificial Intelligence Governance Act","C":"State law","D":"Covered Texas AI actors","E":"AI practices and governance","F":"Medium / High where applicable","G":"Prohibited practices and disclosure duties","H":"Program and use-case evidence","I":"Current statutory text","J":"https://statutes.capitol.texas.gov/GetStatute.aspx?Code=BC&Value=552"},"originalFormulas":{}},{"id":"ROW-8c351c3be05735ddb5d79641","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":26,"originalCells":{"A":"OMB-M25-21","B":"OMB M-25-21 Federal AI Governance","C":"Federal executive policy","D":"U.S. federal agencies","E":"AI inventories, high-impact AI risk management","F":"High for agencies","G":"Testing, impact assessment, monitoring, independent review, human oversight","H":"Inventory, assessment, monitoring and waiver records","I":"Replaced M-24-10","J":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf"},"originalFormulas":{}},{"id":"ROW-18e155872b5714755c72a6b4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":27,"originalCells":{"A":"OMB-M25-22","B":"OMB M-25-22 AI Acquisition","C":"Federal executive policy","D":"U.S. federal AI procurement","E":"Acquisition and vendor controls","F":"High for agencies","G":"Contractual, data, interoperability, performance controls","H":"Acquisition records and contract terms","I":"Current","J":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf"},"originalFormulas":{}},{"id":"ROW-0df173c786f2542b4a71ccbf","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":28,"originalCells":{"A":"OWASP-LLM-2026","B":"OWASP Top 10 for LLM Applications 2026","C":"Security guidance","D":"LLM applications","E":"Top LLM application risks","F":"High","G":"Prompt injection, sensitive data, agency, supply chain, poisoning, output handling","H":"Threat tests, runtime events, remediation","I":"Released 3 Aug 2026","J":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/"},"originalFormulas":{}},{"id":"ROW-a84d0053d81f2ee411bd1159","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"04 Framework Catalog","row":29,"originalCells":{"A":"SOX","B":"Sarbanes-Oxley Act / ICFR","C":"U.S. federal law and audit context","D":"Public-company financial reporting","E":"Internal control over financial reporting","F":"High where applicable","G":"Protect MNPI, audit evidence, and reporting integrity","H":"Control and audit evidence","I":"Current","J":"https://www.sec.gov/spotlight/sarbanes-oxley.htm"},"originalFormulas":{}},{"id":"ROW-cd85062e7ac0c61b25b7ccfa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":5,"originalCells":{"A":"DP-01","B":"Data Protection","C":"Block credentials and secrets","D":"Block or mask passwords, API keys, access tokens, private keys, signing secrets, and connection strings before transfer to an AI service.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + redacted match","J":"Critical","K":"Data Classification for AI","L":"Seed test secrets plus obfuscated variants; require zero raw secret in destination.","M":"All systems; allow only designated secret-management workflows.","N":"3"},"originalFormulas":{}},{"id":"ROW-929d008e90b940386f30ebc2","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":6,"originalCells":{"A":"DP-02","B":"Data Protection","C":"Block passwords and authentication answers","D":"Block passwords, passphrases, recovery codes, one-time codes, and authentication answers.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + redacted match","J":"Critical","K":"Data Classification for AI","L":"Test common and generated password formats without storing live credentials.","M":"All systems.","N":"3"},"originalFormulas":{}},{"id":"ROW-eef7147d9c917353b1a7b327","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":7,"originalCells":{"A":"DP-03","B":"Data Protection","C":"Block payment card numbers","D":"Block full PAN; optionally mask to last four only in approved support workflows.","E":"Block / mask","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + masked value","J":"Critical","K":"Data Classification for AI","L":"Use valid and invalid Luhn samples; test separators and OCR variants.","M":"Card data; PCI scope.","N":"2"},"originalFormulas":{}},{"id":"ROW-84fc11489a5ebc391562c935","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":8,"originalCells":{"A":"DP-04","B":"Data Protection","C":"Block CVV, CVC and PIN","D":"Block sensitive authentication data, including CVV/CVC, PIN and PIN blocks.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log","J":"Critical","K":"Data Classification for AI","L":"Test label/value pairs and contextual variants.","M":"Payment workflows.","N":"2"},"originalFormulas":{}},{"id":"ROW-9a76f87f30da7fc372c24829","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":9,"originalCells":{"A":"DP-05","B":"Data Protection","C":"Block national identifiers","D":"Block SSN and other configured national or government identifiers unless an approved regulated workflow explicitly permits them.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + redacted match","J":"Critical","K":"Privacy and Personal Data","L":"Test formatted, unformatted, and OCR variants; measure false positives.","M":"Configure by jurisdiction.","N":"3"},"originalFormulas":{}},{"id":"ROW-0def1aba93921a9ff3fba01b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":10,"originalCells":{"A":"DP-06","B":"Data Protection","C":"Block bank-account data","D":"Block bank account, routing, IBAN, SWIFT and similar financial account identifiers unless approved and protected.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + redacted match","J":"Critical","K":"Privacy and Personal Data","L":"Test domestic routing/account formats in addition to IBAN.","M":"Financial services and payment workflows.","N":"2"},"originalFormulas":{}},{"id":"ROW-58a8154b909954796bccc76e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":11,"originalCells":{"A":"DP-07","B":"Data Protection","C":"Restrict protected health information","D":"Block PHI in unapproved AI; allow only minimum-necessary, authorized processing on a contracted and configured service.","E":"Conditional block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + approved context + BAA evidence","J":"Critical","K":"Privacy and Personal Data","L":"Test identifiers plus diagnosis/treatment context and de-identified cases.","M":"HIPAA workflows; context-sensitive, not a blanket ‘no PII’ rule.","N":"2"},"originalFormulas":{}},{"id":"ROW-f72722eda829ef9ce6269d45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":12,"originalCells":{"A":"DP-08","B":"Data Protection","C":"Restrict education records","D":"Block grades, transcripts, discipline records and student identifiers in unapproved AI; require authorized purpose and disclosure basis.","E":"Conditional block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + authorization record","J":"High","K":"Privacy and Personal Data","L":"Test student-record narratives and directory-information exceptions.","M":"Educational institutions.","N":"2"},"originalFormulas":{}},{"id":"ROW-e9bd0cc93e5eb03bf6ec5b6a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":13,"originalCells":{"A":"DP-09","B":"Data Protection","C":"Protect contact information","D":"Warn or block email, phone and postal address based on data classification, purpose, volume and approved service.","E":"Conditional warn/block","F":"E2/E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + context","J":"High","K":"Privacy and Personal Data","L":"Test single business contact, bulk lists, and sensitive-context combinations.","M":"Contextual; a single public business email may be permitted.","N":"3"},"originalFormulas":{}},{"id":"ROW-a518471a5fc987744bd95763","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":14,"originalCells":{"A":"DP-10","B":"Data Protection","C":"Block biometric identifiers","D":"Block face templates, voiceprints, fingerprints, iris data and other biometric identifiers outside approved use.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Roadmap","I":"Decision log","J":"Critical","K":"Privacy and Personal Data","L":"Test text references and supported image/audio metadata.","M":"High-risk personal data.","N":"3"},"originalFormulas":{}},{"id":"ROW-7ee8130d46b59de4bfc10fcb","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":15,"originalCells":{"A":"DP-11","B":"Data Protection","C":"Protect precise location","D":"Warn or block precise geolocation and sensitive movement history unless purpose, consent and service are approved.","E":"Conditional warn/block","F":"E2/E3","G":"Prompt + upload + response","H":"Roadmap","I":"Decision + approved purpose","J":"High","K":"Privacy and Personal Data","L":"Test coordinates, addresses, routes and location narratives.","M":"Configure precision and context thresholds.","N":"2"},"originalFormulas":{}},{"id":"ROW-c5131579cff5cbaa095a5549","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":16,"originalCells":{"A":"DP-12","B":"Data Protection","C":"Block classified, CUI and FCI","D":"Block classified information, CUI/FCI markings and designated government data from unauthorized AI channels.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + classification match","J":"Critical","K":"Data Classification for AI","L":"Test markings, portion labels, headers, and contextual descriptions.","M":"Government and contractors.","N":"2"},"originalFormulas":{}},{"id":"ROW-52136b64326c448aea9fe218","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":17,"originalCells":{"A":"DP-13","B":"Data Protection","C":"Protect export-controlled and national-security data","D":"Block ITAR/EAR-controlled technical data and designated national-security information from unauthorized models, regions and persons.","E":"Conditional block","F":"E3","G":"Prompt + upload + response","H":"Roadmap","I":"Decision + jurisdiction + authorization","J":"Critical","K":"Data Classification for AI","L":"Test project codes, markings and controlled technical narratives.","M":"Requires enterprise classifications and jurisdiction rules.","N":"2"},"originalFormulas":{}},{"id":"ROW-71c72c3c0d19d67e23657f98","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":18,"originalCells":{"A":"DP-14","B":"Data Protection","C":"Protect trade secrets and source code","D":"Block or require approval for proprietary algorithms, source code, product roadmaps and trade secrets sent to unapproved AI.","E":"Conditional block/approve","F":"E2/E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + repository/project context","J":"High","K":"IP, Copyright and Confidentiality","L":"Test code, design documents and organization-specific codewords.","M":"Enterprise-specific classification is required.","N":"3"},"originalFormulas":{}},{"id":"ROW-8f14f3d1efa189e73a0a4307","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":19,"originalCells":{"A":"DP-15","B":"Data Protection","C":"Protect architecture and vulnerability details","D":"Warn or block internal topology, system configuration, exploit paths, audit findings and unpatched vulnerabilities.","E":"Conditional warn/block","F":"E2/E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + recipient/service context","J":"High","K":"AI Security and Prompt Injection","L":"Test IPs, diagrams, vulnerabilities, findings and obfuscation.","M":"Permit approved remediation use on sanctioned systems.","N":"3"},"originalFormulas":{}},{"id":"ROW-3e49c6649b3cff114fbf1c6b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":20,"originalCells":{"A":"DP-16","B":"Data Protection","C":"Protect customer confidential data","D":"Block or approve customer records, contracts, support cases and tenant data according to contract, classification and purpose.","E":"Conditional block/approve","F":"E2/E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + customer/tenant context","J":"High","K":"IP, Copyright and Confidentiality","L":"Test structured and narrative customer data, including multi-record uploads.","M":"Requires customer and tenant identifiers.","N":"3"},"originalFormulas":{}},{"id":"ROW-41b8c84cd95a456bd89094e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":21,"originalCells":{"A":"DP-17","B":"Data Protection","C":"Block MNPI and unreleased financials","D":"Block material nonpublic information, unreleased earnings, transactions and forecasts from external AI unless specifically authorized.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + matter code","J":"Critical","K":"IP, Copyright and Confidentiality","L":"Test earnings, M&A and deal narratives with organization codewords.","M":"Public companies and regulated financial workflows.","N":"2"},"originalFormulas":{}},{"id":"ROW-c404a28782b7d517ded8f4dd","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":22,"originalCells":{"A":"DP-18","B":"Data Protection","C":"Protect privilege and investigations","D":"Warn or block attorney-client privileged material, work product, investigations, employee matters and protected audit content.","E":"Conditional block/approve","F":"E2/E3","G":"Prompt + upload + response","H":"Roadmap","I":"Decision + matter authorization","J":"High","K":"IP, Copyright and Confidentiality","L":"Test privilege legends, matter numbers and investigation narratives.","M":"Legal and HR workflows.","N":"2"},"originalFormulas":{}},{"id":"ROW-6111647deee222de2daa6a83","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":23,"originalCells":{"A":"AU-01","B":"Authorized Use","C":"Allow sanctioned AI services only","D":"Detect and block or redirect unapproved AI domains, desktop apps, APIs and embedded assistants.","E":"Block / redirect","F":"E3","G":"Network + browser + endpoint","H":"Partial","I":"Discovery and enforcement event","J":"Critical","K":"Approved AI Tools and Shadow AI","L":"Attempt use through approved and unapproved domains, aliases and API endpoints.","M":"Requires complete inventory and egress coverage.","N":"2"},"originalFormulas":{}},{"id":"ROW-bfbbf81768db82dcd2a5e4ec","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":24,"originalCells":{"A":"AU-02","B":"Authorized Use","C":"Require strong authentication","D":"Require enterprise identity and MFA before sensitive AI use; deny unmanaged or anonymous sessions.","E":"Block","F":"E3","G":"Identity + session","H":"Roadmap","I":"IdP/config assertion + decision","J":"Critical","K":"Approved AI Tools and Shadow AI","L":"Test unmanaged device, personal account and MFA-bypass paths.","M":"Not provable from a policy document alone.","N":"3"},"originalFormulas":{}},{"id":"ROW-0bf8ca3a5d57cb98ec9e264a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":25,"originalCells":{"A":"AU-03","B":"Authorized Use","C":"Enforce role and data-class authorization","D":"Permit AI systems, models, data classes and capabilities only to authorized roles and groups.","E":"Block","F":"E3","G":"Identity + policy engine","H":"Roadmap","I":"Decision + entitlement snapshot","J":"Critical","K":"Approved AI Tools and Shadow AI","L":"Test role changes, leavers and restricted data classes.","M":"Requires identity and directory integration.","N":"2"},"originalFormulas":{}},{"id":"ROW-ddc212acfe65d6301eac2a81","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":26,"originalCells":{"A":"AU-04","B":"Authorized Use","C":"Allow approved use cases and models only","D":"Bind each high-risk use case to approved model/version, purpose, owner, data classes and risk decision.","E":"Block / approve","F":"E2/E3","G":"Use-case registry + gateway","H":"Roadmap","I":"Use-case approval + runtime context","J":"Critical","K":"AI Governance and Accountability","L":"Test unregistered purpose, model substitution and scope drift.","M":"All high-impact and regulated use cases.","N":"3"},"originalFormulas":{}},{"id":"ROW-4dc45e13d8c202a54e1e9d0b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":27,"originalCells":{"A":"AU-05","B":"Authorized Use","C":"Route by residency and retention constraints","D":"Block or reroute data when model region, storage, retention or subprocessors conflict with approved requirements.","E":"Block / route","F":"E3/E4","G":"Gateway + vendor metadata","H":"Roadmap","I":"Routing decision + vendor configuration","J":"High","K":"Vendor and AI Procurement","L":"Test region mismatch, retention settings and vendor changes.","M":"Jurisdiction- and contract-specific.","N":"2"},"originalFormulas":{}},{"id":"ROW-11830073254b5fd8ee324eda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":28,"originalCells":{"A":"AU-06","B":"Authorized Use","C":"Prevent provider training on enterprise content","D":"Require a contracted enterprise service and verified setting prohibiting provider training or secondary use where policy demands it.","E":"Block","F":"E3","G":"Vendor config + session","H":"Roadmap","I":"Contract + configuration assertion","J":"Critical","K":"Vendor and AI Procurement","L":"Test personal versus enterprise tenant and setting drift.","M":"Depends on provider contract and configuration.","N":"3"},"originalFormulas":{}},{"id":"ROW-94934e8e6dbbab1b6aa88abd","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":29,"originalCells":{"A":"AU-07","B":"Authorized Use","C":"Prohibit account sharing","D":"Detect and prevent shared credentials, concurrent anomalous access and use of another person’s AI account.","E":"Block / alert","F":"E2/E3","G":"Identity + session analytics","H":"Roadmap","I":"Authentication and anomaly event","J":"High","K":"Approved AI Tools and Shadow AI","L":"Test shared-account and revoked-user scenarios.","M":"Requires identity telemetry.","N":"2"},"originalFormulas":{}},{"id":"ROW-7118de4af53232513d8f01a7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":30,"originalCells":{"A":"AU-08","B":"Authorized Use","C":"Detect shadow AI and unmanaged plugins","D":"Continuously inventory AI web apps, APIs, browser extensions, connectors and plugins; alert on unknown services.","E":"Detect / block","F":"E1/E3","G":"Browser + endpoint + network","H":"Partial","I":"Inventory and alert","J":"High","K":"Approved AI Tools and Shadow AI","L":"Compare observed use to registry and test newly introduced domains.","M":"Current code sees only nine configured web surfaces.","N":"3"},"originalFormulas":{}},{"id":"ROW-d7cfd5fbc7957e3d786e7a71","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":31,"originalCells":{"A":"IN-01","B":"Input Security","C":"Detect direct prompt injection and jailbreaks","D":"Block or isolate instructions that attempt to override policy, reveal hidden context or bypass safeguards.","E":"Block","F":"E3","G":"Prompt","H":"Partial","I":"Decision + attack class","J":"Critical","K":"AI Security and Prompt Injection","L":"Run multilingual, role-play, encoded and multi-turn attack suites.","M":"Tune to use case; preserve legitimate security testing in sandboxes.","N":"2"},"originalFormulas":{}},{"id":"ROW-6000e6cd4fcdc79de8a2ba74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":32,"originalCells":{"A":"IN-02","B":"Input Security","C":"Detect indirect prompt injection","D":"Treat files, web pages, email, RAG content and tool results as untrusted; block hidden instructions from driving actions.","E":"Block / isolate","F":"E3","G":"Upload + retrieval + tool result","H":"Roadmap","I":"Decision + source provenance","J":"Critical","K":"AI Security and Prompt Injection","L":"Test poisoned documents, web pages and retrieved chunks.","M":"Critical for RAG and agents.","N":"2"},"originalFormulas":{}},{"id":"ROW-51ff4e19ab0458c9ef6e8738","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":33,"originalCells":{"A":"IN-03","B":"Input Security","C":"Detect obfuscated and multimodal attacks","D":"Normalize Unicode, encodings, invisible text, images, audio and document structure before rule evaluation.","E":"Block / isolate","F":"E3","G":"All inputs","H":"Roadmap","I":"Normalization and decision log","J":"High","K":"AI Security and Prompt Injection","L":"Test homoglyphs, zero-width text, base64, OCR and image-based injection.","M":"Requires modality-specific extraction.","N":"2"},"originalFormulas":{}},{"id":"ROW-7b84c8e27682cba512ff0b29","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":34,"originalCells":{"A":"IN-04","B":"Input Security","C":"Restrict harmful cyber requests","D":"Block malicious requests for credential theft, destructive exploitation or unauthorized access; route approved defensive testing to a controlled mode.","E":"Conditional block","F":"E3","G":"Prompt + tool call","H":"Roadmap","I":"Decision + approved test context","J":"Critical","K":"AI Security and Prompt Injection","L":"Test dual-use boundaries and approved red-team contexts.","M":"Context- and authorization-sensitive.","N":"2"},"originalFormulas":{}},{"id":"ROW-90c3adacab4b4ba0aa7f6621","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":35,"originalCells":{"A":"IN-05","B":"Input Security","C":"Quarantine unsafe files and malware","D":"Scan attachments for malware, active content, archive bombs and prohibited formats; block or quarantine before AI ingestion.","E":"Block / quarantine","F":"E3/E4","G":"Upload","H":"Roadmap","I":"Scan result + quarantine event","J":"Critical","K":"AI Security and Prompt Injection","L":"Test malware simulators, macros, encrypted archives and oversize files.","M":"Current build scans only readable text files ≤1 MB and does not prevent upload.","N":"2"},"originalFormulas":{}},{"id":"ROW-a4346b58308bfe3bede1da44","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":36,"originalCells":{"A":"IN-06","B":"Input Security","C":"Prevent RAG and data poisoning","D":"Validate provenance, authorization and integrity before documents, embeddings, feedback or fine-tuning data enter an AI corpus.","E":"Block / quarantine","F":"E3/E4","G":"Ingestion pipeline","H":"Roadmap","I":"Provenance + integrity + decision","J":"Critical","K":"Data, Model and RAG Supply Chain","L":"Inject conflicting, malicious and unauthorized content; verify rejection and rollback.","M":"RAG, training, fine-tuning and memory stores.","N":"3"},"originalFormulas":{}},{"id":"ROW-c39d877712e62c3bec7eacfa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":37,"originalCells":{"A":"IN-07","B":"Input Security","C":"Enforce allowed intent and scope","D":"Constrain requests to the approved business purpose, user role and system capability; warn or block out-of-scope use.","E":"Warn / block","F":"E2/E3","G":"Prompt + use-case context","H":"Roadmap","I":"Decision + policy context","J":"High","K":"AI Acceptable Use","L":"Test plausible scope drift and role mismatch.","M":"Requires use-case and role context.","N":"2"},"originalFormulas":{}},{"id":"ROW-1d5e2c906a234d9790564589","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":38,"originalCells":{"A":"IN-08","B":"Input Security","C":"Limit resource consumption","D":"Enforce prompt, token, file, query, rate, recursion and spend limits; stop runaway loops.","E":"Block / throttle","F":"E3/E4","G":"Gateway + agent runtime","H":"Roadmap","I":"Usage meter + throttle event","J":"High","K":"Agentic AI and Connectors","L":"Stress test long context, retries, tool loops and parallel calls.","M":"All paid or resource-constrained AI.","N":"2"},"originalFormulas":{}},{"id":"ROW-dc0d119c2f9a7a247f3b9683","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":39,"originalCells":{"A":"OU-01","B":"Output Safety","C":"Block sensitive output disclosure","D":"Inspect outputs for secrets, regulated data, hidden context and unauthorized tenant/customer information before display or downstream use.","E":"Block / redact","F":"E3","G":"Response + tool result","H":"Roadmap","I":"Decision + redacted output","J":"Critical","K":"Prompt and Output Interaction","L":"Seed hidden sensitive data and verify it never reaches the user or tool.","M":"External AI responses are not intercepted in the current build.","N":"3"},"originalFormulas":{}},{"id":"ROW-4ba888a1a528a9f9d4305343","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":40,"originalCells":{"A":"OU-02","B":"Output Safety","C":"Prevent hidden-context and system-prompt leakage","D":"Block disclosure of system prompts, hidden instructions, connector tokens, private retrieval context and chain-of-control metadata.","E":"Block / redact","F":"E3","G":"Response","H":"Roadmap","I":"Decision + leakage class","J":"Critical","K":"AI Security and Prompt Injection","L":"Run extraction attacks and canary-string tests.","M":"Especially important for hosted agents and RAG.","N":"2"},"originalFormulas":{}},{"id":"ROW-b9adffd312e6e4031cac7d98","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":41,"originalCells":{"A":"OU-03","B":"Output Safety","C":"Require evidence for factual claims","D":"For designated decisions, require citations or approved source grounding; flag unsupported, fabricated or stale claims.","E":"Warn / hold","F":"E2/E3","G":"Response","H":"Roadmap","I":"Claim-source links + verification result","J":"High","K":"Evaluation, Red Team and Benchmarking","L":"Test answerability, fabricated citations and stale sources.","M":"Apply by use case; not every creative task needs citations.","N":"2"},"originalFormulas":{}},{"id":"ROW-13057f76ff7965908a2b45f2","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":42,"originalCells":{"A":"OU-04","B":"Output Safety","C":"Require human validation for high-stakes advice","D":"Do not let unreviewed AI output make or communicate medical, legal, financial, employment, housing, education or safety decisions.","E":"Hold for approval","F":"E2/E3","G":"Response + workflow","H":"Roadmap","I":"Reviewer identity + decision","J":"Critical","K":"High-Impact AI and Human Oversight","L":"Simulate consequential outputs; verify required review and fail-safe.","M":"Configure domains and qualified reviewers.","N":"3"},"originalFormulas":{}},{"id":"ROW-8b9d417b4f742444d1f53adc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":43,"originalCells":{"A":"OU-05","B":"Output Safety","C":"Detect discriminatory or unfair outcomes","D":"Hold or flag outputs that use protected traits, proxies or unjustified disparate treatment in consequential contexts.","E":"Hold / alert","F":"E2/E3","G":"Response + decision record","H":"Roadmap","I":"Fairness test + decision","J":"Critical","K":"Bias, Fairness and Civil Rights","L":"Test counterfactual pairs, subgroup performance and proxy features.","M":"Requires domain-specific legal and statistical review.","N":"3"},"originalFormulas":{}},{"id":"ROW-a9aff2087160059ac7b9cfae","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":44,"originalCells":{"A":"OU-06","B":"Output Safety","C":"Block harassment, hate and abuse","D":"Block or safely transform hateful, harassing, demeaning or targeted abusive content under the organization’s safety standard.","E":"Block / transform","F":"E3/E4","G":"Response","H":"Roadmap","I":"Decision + safety category","J":"High","K":"AI Acceptable Use","L":"Run multilingual and contextual safety tests, including quoted material exceptions.","M":"Tune for lawful monitoring and support contexts.","N":"1"},"originalFormulas":{}},{"id":"ROW-b2c1ef7b5f817494ba947d42","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":45,"originalCells":{"A":"OU-07","B":"Output Safety","C":"Block dangerous and illegal content","D":"Block actionable content that materially facilitates violence, self-harm, illegal activity or CBRN harm; route emergencies to approved support.","E":"Block / route","F":"E3/E4","G":"Prompt + response","H":"Roadmap","I":"Decision + escalation event","J":"Critical","K":"AI Acceptable Use","L":"Use controlled safety datasets and escalation drills.","M":"Requires carefully governed exceptions for research and safety teams.","N":"2"},"originalFormulas":{}},{"id":"ROW-14a036264a680f76850ed20a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":46,"originalCells":{"A":"OU-08","B":"Output Safety","C":"Block insecure code from automated use","D":"Scan generated code for vulnerabilities, malware patterns, exposed secrets and unsafe dependencies before merge, execution or deployment.","E":"Hold / block","F":"E2/E3","G":"Response + CI/CD","H":"Roadmap","I":"Scan findings + approval","J":"High","K":"AI Secure Development Lifecycle","L":"Benchmark common weakness classes and dependency risks.","M":"Development and code-generation use cases.","N":"2"},"originalFormulas":{}},{"id":"ROW-085264d9c4ac8a84fada7ed6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":47,"originalCells":{"A":"OU-09","B":"Output Safety","C":"Sanitize and validate model output","D":"Treat model output as untrusted: enforce schema, encode content, parameterize commands and validate before execution or display.","E":"Transform / block","F":"E3/E4","G":"Response + consuming application","H":"Roadmap","I":"Validation result + rejected payload","J":"Critical","K":"AI Secure Development Lifecycle","L":"Test XSS, SQL/command injection, malformed JSON and policy bypass.","M":"Applications consuming model output.","N":"2"},"originalFormulas":{}},{"id":"ROW-b6b85bcd685a48725b010f71","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":48,"originalCells":{"A":"OU-10","B":"Output Safety","C":"Protect intellectual property and licenses","D":"Detect likely copyrighted, licensed or third-party confidential material; require attribution, license check or human review before reuse.","E":"Warn / hold","F":"E2/E3","G":"Response","H":"Roadmap","I":"Similarity/license review record","J":"High","K":"IP, Copyright and Confidentiality","L":"Test verbatim regeneration, code-license conflicts and source attribution.","M":"Use-case and jurisdiction specific.","N":"2"},"originalFormulas":{}},{"id":"ROW-d908d819dc6355d7f986a60c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":49,"originalCells":{"A":"OU-11","B":"Output Safety","C":"Prevent re-identification","D":"Block outputs that recombine, infer or expose identities from de-identified, aggregate or pseudonymous data.","E":"Block / hold","F":"E3","G":"Response","H":"Roadmap","I":"Privacy-risk result","J":"Critical","K":"Privacy and Personal Data","L":"Run linkage and uniqueness attacks against representative datasets.","M":"Analytics, synthetic data and health/research contexts.","N":"2"},"originalFormulas":{}},{"id":"ROW-8389bc866148e023e41da011","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":50,"originalCells":{"A":"OU-12","B":"Output Safety","C":"Disclose AI-generated or synthetic content","D":"Apply required AI-use notices, provenance metadata and machine-readable labels to designated content and interactions.","E":"Transform / require disclosure","F":"E3/E4","G":"Response + publication","H":"Roadmap","I":"Label/provenance record","J":"High","K":"Transparency, Disclosure and Provenance","L":"Verify labels survive export, reposting and supported transformations.","M":"Public-facing or regulated content.","N":"3"},"originalFormulas":{}},{"id":"ROW-c6d9c9d7a4c18b01bc83ceed","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":51,"originalCells":{"A":"AG-01","B":"Agentic Controls","C":"Allowlisted tools and connectors only","D":"Permit only approved tools, MCP servers, plugins, APIs and connector operations for the use case and role.","E":"Block","F":"E3","G":"Agent tool gateway","H":"Roadmap","I":"Tool-policy decision","J":"Critical","K":"Agentic AI and Connectors","L":"Attempt unknown, renamed and newly installed tools.","M":"Agentic systems.","N":"2"},"originalFormulas":{}},{"id":"ROW-a969a0119ede43d7da6cf4c9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":52,"originalCells":{"A":"AG-02","B":"Agentic Controls","C":"Enforce least privilege for agents","D":"Issue short-lived, scoped credentials; restrict data, action, tenant and environment permissions to the minimum necessary.","E":"Block","F":"E3","G":"Identity + tool gateway","H":"Roadmap","I":"Credential scope + decision","J":"Critical","K":"Agentic AI and Connectors","L":"Test privilege escalation, stale tokens and cross-environment access.","M":"Agentic systems.","N":"2"},"originalFormulas":{}},{"id":"ROW-87efe05b0f1bc8e240689826","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":53,"originalCells":{"A":"AG-03","B":"Agentic Controls","C":"Require approval for high-impact or irreversible actions","D":"Require step-up human confirmation before payments, submissions, deletions, permission changes, production actions or legal commitments.","E":"Hold for approval","F":"E2/E3","G":"Tool call","H":"Roadmap","I":"Action preview + approver + result","J":"Critical","K":"Agentic AI and Connectors","L":"Test each irreversible action and approval replay prevention.","M":"Agentic systems.","N":"3"},"originalFormulas":{}},{"id":"ROW-c44212e5712afccffa0b9a8d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":54,"originalCells":{"A":"AG-04","B":"Agentic Controls","C":"Prohibit autonomous consequential decisions","D":"Prevent agents from making final employment, credit, housing, education, healthcare, legal or similarly consequential decisions without authorized human determination.","E":"Block / hold","F":"E2/E3","G":"Decision + tool call","H":"Roadmap","I":"Human decision record","J":"Critical","K":"High-Impact AI and Human Oversight","L":"Test indirect actions and recommendation-to-decision handoffs.","M":"High-impact domains.","N":"3"},"originalFormulas":{}},{"id":"ROW-57091a93092d37831b3f1c82","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":55,"originalCells":{"A":"AG-05","B":"Agentic Controls","C":"Approve external communications","D":"Require approval before an agent sends email, messages, posts, tickets or other external communications in designated contexts.","E":"Hold for approval","F":"E2/E3","G":"Tool call","H":"Roadmap","I":"Preview + approver + sent artifact","J":"High","K":"Agentic AI and Connectors","L":"Test wrong recipient, sensitive content and reply-all scenarios.","M":"Configure trusted low-risk automations separately.","N":"2"},"originalFormulas":{}},{"id":"ROW-6c965d648b3a87a0d63206e1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":56,"originalCells":{"A":"AG-06","B":"Agentic Controls","C":"Approve destructive and permission-changing actions","D":"Require approval and recoverability before delete, overwrite, access-control, security-setting or production-change actions.","E":"Hold / block","F":"E2/E3","G":"Tool call","H":"Roadmap","I":"Diff/preview + approval + rollback reference","J":"Critical","K":"Agentic AI and Connectors","L":"Test deletion scope, permission escalation and rollback.","M":"Agentic systems.","N":"2"},"originalFormulas":{}},{"id":"ROW-ac0806c0d1cab126f0536869","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":57,"originalCells":{"A":"AG-07","B":"Agentic Controls","C":"Enforce transaction and autonomy limits","D":"Apply amount, volume, recipient, duration, recursion, environment and cumulative-risk limits to agent actions.","E":"Block / throttle","F":"E3/E4","G":"Agent runtime","H":"Roadmap","I":"Meter + limit decision","J":"Critical","K":"Agentic AI and Connectors","L":"Test single and cumulative limit evasion.","M":"Agentic systems.","N":"1"},"originalFormulas":{}},{"id":"ROW-189dfa37186c642f2addce8b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":58,"originalCells":{"A":"AG-08","B":"Agentic Controls","C":"Enforce tenant and context isolation","D":"Prevent retrieval, memory, cache, prompt or tool results from crossing user, customer, tenant, case or security boundaries.","E":"Block","F":"E3","G":"Retrieval + memory + tool gateway","H":"Roadmap","I":"Isolation test + decision","J":"Critical","K":"Data, Model and RAG Supply Chain","L":"Run cross-tenant canaries and confused-deputy tests.","M":"Multi-tenant and multi-case systems.","N":"2"},"originalFormulas":{}},{"id":"ROW-280320ff896a3aacfd285852","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":59,"originalCells":{"A":"AG-09","B":"Agentic Controls","C":"Govern agent memory writes","D":"Validate, minimize and approve durable memory; prevent secrets, poisoned instructions and sensitive data from persistence.","E":"Block / approve","F":"E2/E3","G":"Memory write","H":"Roadmap","I":"Memory diff + provenance + decision","J":"High","K":"Agentic AI and Connectors","L":"Test poisoned memory, sensitive persistence and deletion.","M":"Systems with persistent memory.","N":"2"},"originalFormulas":{}},{"id":"ROW-45538072cfb8a4ac2f2c68b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":60,"originalCells":{"A":"AG-10","B":"Agentic Controls","C":"Verify tool and package supply chain","D":"Pin, sign, scan and monitor model, tool, connector, MCP server, package and prompt dependencies; block untrusted versions.","E":"Block / quarantine","F":"E3/E4","G":"Build + runtime","H":"Roadmap","I":"SBOM/provenance + verification event","J":"Critical","K":"Data, Model and RAG Supply Chain","L":"Test tampered package, changed tool schema and revoked publisher.","M":"Applications and agents.","N":"2"},"originalFormulas":{}},{"id":"ROW-4407fd9b1be93893e86716c1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":61,"originalCells":{"A":"OP-01","B":"Operations","C":"Log AI interactions and control decisions","D":"Record approved prompt/response metadata, rule outcomes, user/system, model/version, use case, time and action with privacy-aware minimization.","E":"Log","F":"E1","G":"All enforcement points","H":"Partial","I":"Tamper-evident audit event","J":"High","K":"AI Monitoring and Logging","L":"Verify completeness, integrity, access, retention and redaction.","M":"All governed systems; log content only where lawful and necessary.","N":"3"},"originalFormulas":{}},{"id":"ROW-37f85a5306a23567bae52640","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":62,"originalCells":{"A":"OP-02","B":"Operations","C":"Capture provenance and citations","D":"Preserve model/version, source documents, retrieval identifiers, tool calls and transformations for decisions and published content.","E":"Log / require","F":"E1/E3","G":"Response + workflow","H":"Roadmap","I":"Provenance record","J":"High","K":"Transparency, Disclosure and Provenance","L":"Trace a sample output end-to-end and validate source integrity.","M":"High-impact, factual and published outputs.","N":"2"},"originalFormulas":{}},{"id":"ROW-1200071da5361e498925f66d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":63,"originalCells":{"A":"OP-03","B":"Operations","C":"Monitor control efficacy and model drift","D":"Measure precision, recall, bypass rate, false-positive burden, model/output drift and control coverage against thresholds.","E":"Monitor / gate","F":"E1/E3","G":"Evaluation + production telemetry","H":"Roadmap","I":"Metric series + threshold event","J":"Critical","K":"Evaluation, Red Team and Benchmarking","L":"Use labeled tests and production samples; investigate threshold breaches.","M":"All critical rules.","N":"3"},"originalFormulas":{}},{"id":"ROW-175b00fabbd5d258e5898143","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":64,"originalCells":{"A":"OP-04","B":"Operations","C":"Escalate AI incidents","D":"Create and route incidents for critical blocks, suspected leakage, harmful output, control failure and policy evasion; preserve evidence.","E":"Alert / case","F":"E1/E4","G":"Runtime + SOC workflow","H":"Partial","I":"Incident/case record","J":"Critical","K":"AI Incident Response and Kill Switch","L":"Run tabletop and technical drills from detection through closure.","M":"All governed systems.","N":"2"},"originalFormulas":{}},{"id":"ROW-34493db48d50cf94487bf888","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":65,"originalCells":{"A":"OP-05","B":"Operations","C":"Provide kill switch and fail-safe","D":"Disable a model, connector, use case, rule exception or autonomous action path quickly; default safely when critical controls fail.","E":"Block / disable","F":"E4","G":"Gateway + admin plane","H":"Roadmap","I":"Kill event + authorization + recovery","J":"Critical","K":"AI Incident Response and Kill Switch","L":"Test scoped and global shutdown, fail-closed behavior and restoration.","M":"Critical and high-impact systems.","N":"3"},"originalFormulas":{}},{"id":"ROW-ecc37b8adb3bf4edc29641df","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":66,"originalCells":{"A":"OP-06","B":"Operations","C":"Reassess on material change","D":"Trigger tests, impact assessment and approval when model, data, prompt, tool, vendor, law, use case or risk profile changes.","E":"Hold release","F":"E2/E3","G":"Change pipeline","H":"Roadmap","I":"Change record + reassessment","J":"High","K":"AI Secure Development Lifecycle","L":"Change each dependency and verify the gate activates.","M":"All production AI.","N":"3"},"originalFormulas":{}},{"id":"ROW-59bc89bf3aae5a54613196b3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":67,"originalCells":{"A":"OP-07","B":"Operations","C":"Time-bound exceptions and waivers","D":"Require scope, owner, rationale, compensating controls, approval, expiry and automatic revocation for every exception.","E":"Approve / expire","F":"E2/E4","G":"Policy engine + workflow","H":"Roadmap","I":"Exception record + expiry event","J":"High","K":"Exceptions, Appeals and Risk Acceptance","L":"Create expired, overbroad and missing-owner exceptions; verify rejection.","M":"All rule families.","N":"2"},"originalFormulas":{}},{"id":"ROW-237b7b1abe3296e64d82564c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":68,"originalCells":{"A":"OP-08","B":"Operations","C":"Support feedback, appeal and override","D":"Provide affected users and operators a documented route to contest, correct, override or escalate AI decisions without retaliation.","E":"Workflow","F":"E2","G":"User experience + case management","H":"Roadmap","I":"Appeal + resolution record","J":"High","K":"Exceptions, Appeals and Risk Acceptance","L":"Test accessibility, timeliness and traceability of appeals.","M":"Consequential and user-facing AI.","N":"3"},"originalFormulas":{}},{"id":"ROW-de1c87cc194c6a00cb60129a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":69,"originalCells":{"A":"OP-09","B":"Operations","C":"Maintain AI inventory and ownership","D":"Continuously inventory AI systems, models, versions, use cases, owners, users, data, vendors, risk tier and status.","E":"Detect / require","F":"E1/E3","G":"Discovery + registry","H":"Partial","I":"Inventory record + reconciliation","J":"Critical","K":"AI Governance and Accountability","L":"Reconcile browser, endpoint, network, procurement and API observations.","M":"Enterprise-wide.","N":"3"},"originalFormulas":{}},{"id":"ROW-4ee8f3a80704716a5667cb17","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":70,"originalCells":{"A":"OP-10","B":"Operations","C":"Monitor vendor and model supply chain","D":"Track vendor/model changes, subprocessors, incidents, terms, data use, performance and end-of-life; reassess affected rules.","E":"Monitor / gate","F":"E1/E3","G":"Vendor management + runtime","H":"Roadmap","I":"Vendor evidence + change event","J":"High","K":"Vendor and AI Procurement","L":"Simulate model version, term and subprocessor change.","M":"Third-party AI.","N":"3"},"originalFormulas":{}},{"id":"ROW-2d9dfa60a6e7c51a566dadad","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":71,"originalCells":{"A":"OP-11","B":"Operations","C":"Decommission safely and delete data","D":"Revoke access, export required records, delete prompts/files/embeddings/memory, terminate connectors and document residual risk.","E":"Automate / verify","F":"E4","G":"Admin + data lifecycle","H":"Roadmap","I":"Deletion certificate + access revocation","J":"High","K":"AI Decommissioning and Data Lifecycle","L":"Test deletion across primary, cache, backup and vendor scopes.","M":"Retired systems and use cases.","N":"3"},"originalFormulas":{}},{"id":"ROW-aae33c20baece0f398f9ed04","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"05 Canonical Rules","row":72,"originalCells":{"A":"OP-12","B":"Operations","C":"Require predeployment evaluation and red team","D":"Do not release until required privacy, security, fairness, robustness, factuality, abuse and human-factors tests meet documented go/no-go thresholds.","E":"Hold release","F":"E3","G":"CI/CD + governance workflow","H":"Roadmap","I":"Test report + release decision","J":"Critical","K":"Evaluation, Red Team and Benchmarking","L":"Use versioned representative datasets; independently review high-impact systems.","M":"All production AI; depth based on risk.","N":"3"},"originalFormulas":{}},{"id":"ROW-819ca9a790466294c7880fb4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":5,"originalCells":{"A":"2","B":"GOVERN","C":"GOVERN 1","D":"GOVERN 1.1","E":"Legal and regulatory requirements involving AI are understood, managed, and documented.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"15","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-2195baf47ca237d8f8b078bf","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":6,"originalCells":{"A":"3","B":"GOVERN","C":"GOVERN 1","D":"GOVERN 1.2","E":"The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"No direct runtime rule; retain as program control","K":"Approved document or workflow record","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-921e23b09bdc5e163c46fe50","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":7,"originalCells":{"A":"4","B":"GOVERN","C":"GOVERN 1","D":"GOVERN 1.3","E":"Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization’s risk tolerance.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"AU-04; OP-07","K":"Approved document or workflow record","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-b6d04d8bc54145f7347502da","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":8,"originalCells":{"A":"5","B":"GOVERN","C":"GOVERN 1","D":"GOVERN 1.4","E":"The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OU-12; OP-02; AU-04; OP-07","K":"Approved document or workflow record","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-6cd11a5191a0a19b246a52f9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":9,"originalCells":{"A":"6","B":"GOVERN","C":"GOVERN 1","D":"GOVERN 1.5","E":"Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; AU-03","K":"Metric, alert and review evidence","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-80e2b8b967081ab07201119f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":10,"originalCells":{"A":"7","B":"GOVERN","C":"GOVERN 1","D":"GOVERN 1.6","E":"Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"OP-09; AU-04; OP-07","K":"Control-specific evidence","L":"16","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-4c0b2945e58d182da9acd33f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":11,"originalCells":{"A":"8","B":"GOVERN","C":"GOVERN 1","D":"GOVERN 1.7","E":"Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization’s trustworthiness.","F":"System Configuration / Workflow","G":"Corrective","H":"E4","I":"Roadmap","J":"OP-11; OP-05","K":"Shutdown, deletion and revocation evidence","L":"7","M":"ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Can be automated with admin-plane integration and an approved workflow."},"originalFormulas":{}},{"id":"ROW-720973fc2d47ba02f1b079ef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":12,"originalCells":{"A":"9","B":"GOVERN","C":"GOVERN 2","D":"GOVERN 2.1","E":"Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"AU-03; OP-01; OP-02","K":"Approved document or workflow record","L":"8","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-e02a2343b7f25a791a1b2256","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":13,"originalCells":{"A":"10","B":"GOVERN","C":"GOVERN 2","D":"GOVERN 2.2","E":"The organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.","F":"Human Competency","G":"Directive","H":"E0","I":"Evidence only","J":"AU-03; Supporting policy POL-19","K":"Training completion + competency result","L":"15","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Human evidence; no runtime transaction to intercept."},"originalFormulas":{}},{"id":"ROW-8e1c612547a7de5a2e632de8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":14,"originalCells":{"A":"11","B":"GOVERN","C":"GOVERN 2","D":"GOVERN 2.3","E":"Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"AU-03","K":"Approved document or workflow record","L":"15","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-45b630cce465294238ed89f8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":15,"originalCells":{"A":"12","B":"GOVERN","C":"GOVERN 3","D":"GOVERN 3.1","E":"Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds).","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"OP-06","K":"Control-specific evidence","L":"8","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-1784a41903043a624059f22f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":16,"originalCells":{"A":"13","B":"GOVERN","C":"GOVERN 3","D":"GOVERN 3.2","E":"Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"AU-03","K":"Approved document or workflow record","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-4b3dc974f164a4b5e109d0af","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":17,"originalCells":{"A":"14","B":"GOVERN","C":"GOVERN 4","D":"GOVERN 4.1","E":"Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"No direct runtime rule; retain as program control","K":"Control-specific evidence","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-7e8e994b919a67ffca09fae2","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":18,"originalCells":{"A":"15","B":"GOVERN","C":"GOVERN 4","D":"GOVERN 4.2","E":"Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-10d6bb10236ced7d53f9949f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":19,"originalCells":{"A":"16","B":"GOVERN","C":"GOVERN 4","D":"GOVERN 4.3","E":"Organizational practices are in place to enable AI testing, identification of incidents, and information sharing.","F":"Continuous Detection / Monitoring","G":"Detective / Corrective","H":"E1–E4","I":"Partial","J":"OP-04; OP-05; OP-12; OP-03","K":"Incident + escalation + recovery evidence","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Current events help, but enterprise response and kill-switch workflows are missing."},"originalFormulas":{}},{"id":"ROW-5b7b586a45a1461f449a76b3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":20,"originalCells":{"A":"17","B":"GOVERN","C":"GOVERN 5","D":"GOVERN 5.1","E":"Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"OP-08","K":"Control-specific evidence","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-04be8f2df3ae25975a9ebf84","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":21,"originalCells":{"A":"18","B":"GOVERN","C":"GOVERN 5","D":"GOVERN 5.2","E":"Mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"OP-08","K":"Control-specific evidence","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-b17388eb898ca526dcf2128a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":22,"originalCells":{"A":"19","B":"GOVERN","C":"GOVERN 6","D":"GOVERN 6.1","E":"Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights.","F":"Third-Party / Contractual","G":"Preventive / Detective","H":"E1–E3","I":"Roadmap","J":"OP-10; AG-10","K":"Due diligence + contract + monitoring","L":"16","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Requires vendor and supply-chain integration beyond prompt inspection."},"originalFormulas":{}},{"id":"ROW-caa9d3285b423733cc899c98","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":23,"originalCells":{"A":"20","B":"GOVERN","C":"GOVERN 6","D":"GOVERN 6.2","E":"Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk.","F":"Third-Party / Contractual","G":"Preventive / Detective","H":"E1–E3","I":"Roadmap","J":"OP-04; OP-05; OP-10; AG-10","K":"Due diligence + contract + monitoring","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Requires vendor and supply-chain integration beyond prompt inspection."},"originalFormulas":{}},{"id":"ROW-0b87ecc2f01c76a0ba3b33a9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":24,"originalCells":{"A":"21","B":"MAP","C":"MAP 1","D":"MAP 1.1","E":"Intended purposes, potentially beneficial uses, context specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented.\n\nConsiderations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related Test & Evaluation, Validation & Verification (TEVV) and system metrics.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; OP-12; OP-06; OP-01; OP-02","K":"Metric, alert and review evidence","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-215a102019628e3c4d652e99","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":25,"originalCells":{"A":"22","B":"MAP","C":"MAP 1","D":"MAP 1.2","E":"Interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. Opportunities for interdisciplinary collaboration are prioritized.","F":"Human Competency","G":"Directive","H":"E0","I":"Evidence only","J":"Supporting policy POL-19; OP-01; OP-02","K":"Training completion + competency result","L":"14","M":"ISO 24028; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Human evidence; no runtime transaction to intercept."},"originalFormulas":{}},{"id":"ROW-8bdb150e2ff44341573e05b6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":26,"originalCells":{"A":"23","B":"MAP","C":"MAP 1","D":"MAP 1.3","E":"The organization’s mission and relevant goals for AI technology are understood and documented.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"7","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-aaeee90e8d90db2adb9fb2d2","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":27,"originalCells":{"A":"24","B":"MAP","C":"MAP 1","D":"MAP 1.4","E":"The business value or context of business use has been clearly defined or – in the case of assessing existing AI systems – re-evaluated.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03","K":"Versioned evaluation plan, dataset and results","L":"8","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-9922351b2195eed5dfa42ba9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":28,"originalCells":{"A":"25","B":"MAP","C":"MAP 1","D":"MAP 1.5","E":"Organizational risk tolerances are determined and documented.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"AU-04; OP-07; OP-01; OP-02","K":"Approved document or workflow record","L":"14","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-83698ba923f75cd1d3ca6589","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":29,"originalCells":{"A":"26","B":"MAP","C":"MAP 1","D":"MAP 1.6","E":"System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. \n\nDesign decisions take socio-technical implications into account to address AI risks.","F":"Transaction Prevention / Monitoring","G":"Preventive / Detective","H":"E1–E3","I":"Partial","J":"DP-07–DP-18; OU-01","K":"Decision logs + configuration + efficacy tests","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; OWASP (source says 2025)","N":"A subset can become content rules; broad control effectiveness still needs evidence and integration."},"originalFormulas":{}},{"id":"ROW-94df4ccd334d59365fbbf4a0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":30,"originalCells":{"A":"27","B":"MAP","C":"MAP 2","D":"MAP 2.1","E":"The specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders).","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"No direct runtime rule; retain as program control","K":"Control-specific evidence","L":"8","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-0eec6bfec20219f0e8e1d9b6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":31,"originalCells":{"A":"28","B":"MAP","C":"MAP 2","D":"MAP 2.2","E":"Information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans is documented. \n\nDocumentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"8","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-a0c014848bc2d99867212098","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":32,"originalCells":{"A":"29","B":"MAP","C":"MAP 2","D":"MAP 2.3","E":"Scientific integrity and Test & Evaluation, Validation & Verification (TEVV) considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"8","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-9ac26e37c4f025accee63696","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":33,"originalCells":{"A":"30","B":"MAP","C":"MAP 3","D":"MAP 3.1","E":"Potential benefits of intended AI system functionality and performance are examined and documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"6","M":"ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-93f001d7b0378773e7c1b98c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":34,"originalCells":{"A":"31","B":"MAP","C":"MAP 3","D":"MAP 3.2","E":"Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness – as connected to organizational risk tolerance\n– are examined and documented.","F":"Continuous Detection / Monitoring","G":"Detective / Corrective","H":"E1–E4","I":"Partial","J":"OP-04; OP-05; AU-04; OP-07; OP-01","K":"Incident + escalation + recovery evidence","L":"9","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Current events help, but enterprise response and kill-switch workflows are missing."},"originalFormulas":{}},{"id":"ROW-fc59f9ff12a1c8237c692ba5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":35,"originalCells":{"A":"32","B":"MAP","C":"MAP 3","D":"MAP 3.3","E":"Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"9","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-a4ec73c06b3ad39443e9522d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":36,"originalCells":{"A":"33","B":"MAP","C":"MAP 3","D":"MAP 3.4","E":"Processes for operator and practitioner proficiency with AI system performance and trustworthiness – and relevant technical standards and certifications – are defined, assessed, and documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"7","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-a974fb669a31a61df0e3b141","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":37,"originalCells":{"A":"34","B":"MAP","C":"MAP 3","D":"MAP 3.5","E":"Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.","F":"Workflow / Process","G":"Preventive / Corrective","H":"E2","I":"Roadmap","J":"OU-04; AU-04; OP-01; OP-02","K":"Assessment, approval, appeal or override record","L":"8","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Requires a workflow engine and accountable human decision."},"originalFormulas":{}},{"id":"ROW-0e85023ec55115e7e271d14c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":38,"originalCells":{"A":"35","B":"MAP","C":"MAP 4","D":"MAP 4.1","E":"Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.","F":"Third-Party / Contractual","G":"Preventive / Detective","H":"E1–E3","I":"Roadmap","J":"OP-10; AG-10; OP-01; OP-02","K":"Due diligence + contract + monitoring","L":"16","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Requires vendor and supply-chain integration beyond prompt inspection."},"originalFormulas":{}},{"id":"ROW-39b6c49b172b8af5fc3a36a4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":39,"originalCells":{"A":"36","B":"MAP","C":"MAP 4","D":"MAP 4.2","E":"Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented.","F":"Third-Party / Contractual","G":"Preventive / Detective","H":"E1–E3","I":"Roadmap","J":"OP-10; AG-10; OP-01; OP-02","K":"Due diligence + contract + monitoring","L":"15","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; OWASP (source says 2025)","N":"Requires vendor and supply-chain integration beyond prompt inspection."},"originalFormulas":{}},{"id":"ROW-c4e2fe28b81cda7e42722f07","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":40,"originalCells":{"A":"37","B":"MAP","C":"MAP 5","D":"MAP 5.1","E":"Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.","F":"Continuous Detection / Monitoring","G":"Detective / Corrective","H":"E1–E4","I":"Partial","J":"OP-04; OP-05; OP-08; OP-01; OP-02","K":"Incident + escalation + recovery evidence","L":"16","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Current events help, but enterprise response and kill-switch workflows are missing."},"originalFormulas":{}},{"id":"ROW-d6ee7c96e3777b0f5d6ebf3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":41,"originalCells":{"A":"38","B":"MAP","C":"MAP 5","D":"MAP 5.2","E":"Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-08; OP-01; OP-02","K":"Approved document or workflow record","L":"16","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-99a4d52682f010765d327ba7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":42,"originalCells":{"A":"39","B":"MEASURE","C":"MEASURE 1","D":"MEASURE 1.1","E":"Approaches and metrics for measurement of AI risks enumerated during the MAP function are selected for implementation starting with the most significant AI risks. \n\nThe risks or trustworthiness characteristics that will not – or cannot – be measured are properly documented.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; OP-01; OP-02","K":"Metric, alert and review evidence","L":"16","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-349960ceac0918aa7e021655","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":43,"originalCells":{"A":"40","B":"MEASURE","C":"MEASURE 1","D":"MEASURE 1.2","E":"Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities.","F":"Continuous Detection / Monitoring","G":"Detective / Corrective","H":"E1–E4","I":"Partial","J":"OP-04; OP-05; OP-03; OP-06","K":"Incident + escalation + recovery evidence","L":"15","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; OWASP (source says 2025)","N":"Current events help, but enterprise response and kill-switch workflows are missing."},"originalFormulas":{}},{"id":"ROW-c04df19fe669a9c1ca3c4a0d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":44,"originalCells":{"A":"41","B":"MEASURE","C":"MEASURE 1","D":"MEASURE 1.3","E":"Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. \n\nDomain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"AU-04; OP-07; OP-06","K":"Control-specific evidence","L":"15","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-2fcb0ac62c49cef1f0479501","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":45,"originalCells":{"A":"42","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.1","E":"Test sets, metrics, and details about the tools used during Test & Evaluation, Validation & Verification (TEVV) are documented.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; OP-12; OP-01; OP-02","K":"Metric, alert and review evidence","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-4ca771d6203286b618acbe4a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":46,"originalCells":{"A":"43","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.2","E":"Evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03","K":"Versioned evaluation plan, dataset and results","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-50f4fc9e3fd1e499c939abc1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":47,"originalCells":{"A":"44","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.3","E":"AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). \n\nMeasures are documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"14","M":"ISO 24028; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-27735a0781a3135107ba3a8d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":48,"originalCells":{"A":"45","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.4","E":"The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03","K":"Metric, alert and review evidence","L":"16","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-73081055a72521811089739e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":49,"originalCells":{"A":"46","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.5","E":"The AI system to be deployed is demonstrated to be valid and reliable. \n\nLimitations of the generalizability beyond the conditions under which the technology was developed are documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"15","M":"ISO 24028; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-7eb2896fb88f9b19be4ffce6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":50,"originalCells":{"A":"47","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.6","E":"The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; IN-01–IN-06; OP-12; AU-04; OP-07","K":"Metric, alert and review evidence","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-18b25465a830cb6f6d9f896c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":51,"originalCells":{"A":"48","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.7","E":"AI system security and resilience – as identified in the MAP function – are evaluated and documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"IN-01–IN-06; OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-e8d0231694e1a725ccc376a1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":52,"originalCells":{"A":"49","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.8","E":"Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OU-04; AU-04; OP-01; OP-02","K":"Approved document or workflow record","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-926c7f2887b076252ce54493","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":53,"originalCells":{"A":"50","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.9","E":"The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OU-12; OP-02; OP-12; OP-03; OP-01","K":"Versioned evaluation plan, dataset and results","L":"16","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-54ba0806fe4a4aca9c0ab84f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":54,"originalCells":{"A":"51","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.10","E":"Privacy risk of the AI system – as identified in the MAP function – is examined and documented.","F":"Transaction Prevention / Monitoring","G":"Preventive / Detective","H":"E1–E3","I":"Partial","J":"DP-07–DP-18; OU-01; OP-01; OP-02","K":"Decision logs + configuration + efficacy tests","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"A subset can become content rules; broad control effectiveness still needs evidence and integration."},"originalFormulas":{}},{"id":"ROW-51da5c412025d9777b3782a5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":55,"originalCells":{"A":"52","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.11","E":"Fairness and bias – as identified in the MAP function – are evaluated and results are documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OU-05; OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-cfe54aa1f403a5d504bd1d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":56,"originalCells":{"A":"53","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.12","E":"Environmental impact and sustainability of AI model training and management activities – as identified in the MAP function – are assessed and documented.","F":"Human Competency","G":"Directive","H":"E0","I":"Evidence only","J":"Supporting policy POL-19; OP-01; OP-02","K":"Training completion + competency result","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Human evidence; no runtime transaction to intercept."},"originalFormulas":{}},{"id":"ROW-3b42a7b9ec139dc3fde4432d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":57,"originalCells":{"A":"54","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.13","E":"Effectiveness of the employed Test & Evaluation, Validation & Verification (TEVV) metrics and processes in the MEASURE function are evaluated and documented.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; OP-12; OP-01; OP-02","K":"Metric, alert and review evidence","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-f5914e7e97e40b7f1fa2e2ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":58,"originalCells":{"A":"55","B":"MEASURE","C":"MEASURE 3","D":"MEASURE 3.1","E":"Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"16","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-ef4854ea3dbef189c3a7e1d9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":59,"originalCells":{"A":"56","B":"MEASURE","C":"MEASURE 3","D":"MEASURE 3.2","E":"Risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03","K":"Metric, alert and review evidence","L":"14","M":"ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-6b202c73b7b3e671d3d0cb34","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":60,"originalCells":{"A":"57","B":"MEASURE","C":"MEASURE 3","D":"MEASURE 3.3","E":"Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; OP-08; OP-12","K":"Metric, alert and review evidence","L":"16","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-ec2a27ba67737971b2a4a521","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":61,"originalCells":{"A":"58","B":"MEASURE","C":"MEASURE 4","D":"MEASURE 4.1","E":"Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"16","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-2bc07653b579d5333e99e4ad","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":62,"originalCells":{"A":"59","B":"MEASURE","C":"MEASURE 4","D":"MEASURE 4.2","E":"Measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. \n\nResults are documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-06; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"16","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-a47bedbef8d9135c8ab149c0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":63,"originalCells":{"A":"60","B":"MEASURE","C":"MEASURE 4","D":"MEASURE 4.3","E":"Measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context relevant risks and trustworthiness characteristics are identified and documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-3a47798c22e62e9e0b038014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":64,"originalCells":{"A":"61","B":"MANAGE","C":"MANAGE 1","D":"MANAGE 1.1","E":"A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"No direct runtime rule; retain as program control","K":"Control-specific evidence","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-c6edd71cb273b8c132e929ca","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":65,"originalCells":{"A":"62","B":"MANAGE","C":"MANAGE 1","D":"MANAGE 1.2","E":"Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"15","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-bbe3d5547c0025d0b38ca118","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":66,"originalCells":{"A":"63","B":"MANAGE","C":"MANAGE 1","D":"MANAGE 1.3","E":"Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. \n\nRisk response options can include mitigating, transferring, avoiding, or accepting.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-765c7ddf2aea1cd0784d4c50","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":67,"originalCells":{"A":"64","B":"MANAGE","C":"MANAGE 1","D":"MANAGE 1.4","E":"Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-d4b32502690ef3a37d30a30c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":68,"originalCells":{"A":"65","B":"MANAGE","C":"MANAGE 2","D":"MANAGE 2.1","E":"Resources required to manage AI risks are taken into account – along with viable non-AI alternative systems, approaches, or methods – to reduce the magnitude or likelihood of potential impacts.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"No direct runtime rule; retain as program control","K":"Control-specific evidence","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-02ddd08a21cbd27ffae950c5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":69,"originalCells":{"A":"66","B":"MANAGE","C":"MANAGE 2","D":"MANAGE 2.2","E":"Mechanisms are in place and applied to sustain the value of deployed AI systems.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"No direct runtime rule; retain as program control","K":"Control-specific evidence","L":"15","M":"ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-5d8ae79d964066c23cc63550","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":70,"originalCells":{"A":"67","B":"MANAGE","C":"MANAGE 2","D":"MANAGE 2.3","E":"Procedures are followed to respond to and recover from a previously unknown risk when it is identified.","F":"Continuous Detection / Monitoring","G":"Detective / Corrective","H":"E1–E4","I":"Partial","J":"OP-04; OP-05","K":"Incident + escalation + recovery evidence","L":"15","M":"ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Current events help, but enterprise response and kill-switch workflows are missing."},"originalFormulas":{}},{"id":"ROW-1adb04c39171e7766e76fc5d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":71,"originalCells":{"A":"68","B":"MANAGE","C":"MANAGE 2","D":"MANAGE 2.4","E":"Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.","F":"System Configuration / Workflow","G":"Corrective","H":"E4","I":"Roadmap","J":"OP-11; OP-05; OP-12; OP-03; AU-03","K":"Shutdown, deletion and revocation evidence","L":"15","M":"ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Can be automated with admin-plane integration and an approved workflow."},"originalFormulas":{}},{"id":"ROW-277f45e8c9581b43d549fcf4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":72,"originalCells":{"A":"69","B":"MANAGE","C":"MANAGE 3","D":"MANAGE 3.1","E":"AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.","F":"Third-Party / Contractual","G":"Preventive / Detective","H":"E1–E3","I":"Roadmap","J":"OP-03; OP-10; AG-10; OP-01; OP-02","K":"Due diligence + contract + monitoring","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Requires vendor and supply-chain integration beyond prompt inspection."},"originalFormulas":{}},{"id":"ROW-ad893d6bffed920415c0cd73","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":73,"originalCells":{"A":"70","B":"MANAGE","C":"MANAGE 3","D":"MANAGE 3.2","E":"Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance.","F":"Third-Party / Contractual","G":"Preventive / Detective","H":"E1–E3","I":"Roadmap","J":"OP-03; OP-10; AG-10","K":"Due diligence + contract + monitoring","L":"15","M":"ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Requires vendor and supply-chain integration beyond prompt inspection."},"originalFormulas":{}},{"id":"ROW-bafbb6ea73fe8bdc0f57d94d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":74,"originalCells":{"A":"71","B":"MANAGE","C":"MANAGE 4","D":"MANAGE 4.1","E":"Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.","F":"System Configuration / Workflow","G":"Corrective","H":"E4","I":"Roadmap","J":"OP-11; OP-05; OP-04; OP-03; OP-08","K":"Shutdown, deletion and revocation evidence","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Can be automated with admin-plane integration and an approved workflow."},"originalFormulas":{}},{"id":"ROW-0320adf66ffc4a146bbec926","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":75,"originalCells":{"A":"72","B":"MANAGE","C":"MANAGE 4","D":"MANAGE 4.2","E":"Measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; OP-06","K":"Metric, alert and review evidence","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-5584b1cee9a2142804f15377","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"07 TAIM Control Map","row":76,"originalCells":{"A":"73","B":"MANAGE","C":"MANAGE 4","D":"MANAGE 4.3","E":"Incidents and errors are communicated to relevant AI actors, including affected communities. \n\nProcesses for tracking, responding to, and recovering from incidents and errors are followed and documented.","F":"Continuous Detection / Monitoring","G":"Detective / Corrective","H":"E1–E4","I":"Partial","J":"OP-04; OP-05; OP-01; OP-02","K":"Incident + escalation + recovery evidence","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Current events help, but enterprise response and kill-switch workflows are missing."},"originalFormulas":{}},{"id":"ROW-5da53578f6fffe1a35146cd6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":5,"originalCells":{"A":"POL-01","B":"AI Governance and Accountability","C":"Required","D":"Board/executive accountability, roles, risk appetite, inventory, metrics and reporting","E":"OP-09; AU-04; OP-07","F":"Policy + charter + minutes","G":"Chief AI / Risk Officer"},"originalFormulas":{}},{"id":"ROW-38ce44d1dc499090b643aed2","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":6,"originalCells":{"A":"POL-02","B":"AI Acceptable Use","C":"Required","D":"Permitted/prohibited uses, user duties, escalation, sanctions and safe-use expectations","E":"IN-07; OU-06; OU-07","F":"Policy + attestation","G":"CISO / Legal / HR"},"originalFormulas":{}},{"id":"ROW-7c00f7ce413857f0ff12a98a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":7,"originalCells":{"A":"POL-03","B":"Approved AI Tools and Shadow AI","C":"Required","D":"Sanctioned providers, personal-account restrictions, onboarding and discovery","E":"AU-01; AU-02; AU-08","F":"Policy + inventory + egress logs","G":"CISO / IT"},"originalFormulas":{}},{"id":"ROW-e65db8b635839726933f7fb0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":8,"originalCells":{"A":"POL-04","B":"Data Classification for AI","C":"Required","D":"Which data classes may enter which AI systems under which conditions","E":"DP-01–DP-18; AU-05; AU-06","F":"Standard + decision matrix + DLP events","G":"Data Protection / Security"},"originalFormulas":{}},{"id":"ROW-cdb947fc5d4636afb9bacf8a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":9,"originalCells":{"A":"POL-05","B":"Prompt and Output Interaction","C":"Required","D":"Prompt hygiene, output review, citations, disclosure and publication rules","E":"OU-01–OU-12","F":"Policy + runtime events","G":"AI Product / Compliance"},"originalFormulas":{}},{"id":"ROW-d59e9216537c711e7ff48551","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":10,"originalCells":{"A":"POL-06","B":"Privacy and Personal Data","C":"Required where personal data exists","D":"Purpose, minimization, lawful basis, DPIA, rights, retention and sensitive data","E":"DP-05–DP-11; OU-11","F":"Privacy policy + DPIA + configuration","G":"DPO / Privacy"},"originalFormulas":{}},{"id":"ROW-5f6af58462b3b2f8163b0c0b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":11,"originalCells":{"A":"POL-07","B":"AI Security and Prompt Injection","C":"Required","D":"Threat model, injection defenses, input trust, secrets and vulnerability handling","E":"IN-01–IN-05; DP-15","F":"Security standard + tests + events","G":"CISO / AppSec"},"originalFormulas":{}},{"id":"ROW-d14547299ed69f1d735621a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":12,"originalCells":{"A":"POL-08","B":"High-Impact AI and Human Oversight","C":"Required for consequential use","D":"High-impact definition, required reviewers, fail-safe and prohibited autonomy","E":"OU-04; OU-05; AG-03; AG-04; OP-05","F":"Impact assessment + approval + logs","G":"Risk / Legal / Business owner"},"originalFormulas":{}},{"id":"ROW-0197cedf341fccac5d3b8ac3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":13,"originalCells":{"A":"POL-09","B":"AI Impact Assessment and Risk Acceptance","C":"Required","D":"Intake, impact assessment, control selection, risk acceptance and reassessment","E":"AU-04; OP-06; OP-07","F":"Assessment + approval","G":"Enterprise Risk"},"originalFormulas":{}},{"id":"ROW-fd311e7164231814415386d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":14,"originalCells":{"A":"POL-10","B":"Evaluation, Red Team and Benchmarking","C":"Required","D":"Test dimensions, datasets, thresholds, independence, cadence and release gates","E":"OP-03; OP-12","F":"Test evidence","G":"AI Assurance / Model Risk"},"originalFormulas":{}},{"id":"ROW-b3ddf8be8f31002572820bcf","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":15,"originalCells":{"A":"POL-11","B":"AI Monitoring and Logging","C":"Required","D":"Events, content minimization, metrics, alerting, access, integrity and retention","E":"OP-01–OP-03","F":"Logs + monitoring evidence","G":"Security Operations / Platform"},"originalFormulas":{}},{"id":"ROW-5bdaacda2cc4b3c9aa5dcc40","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":16,"originalCells":{"A":"POL-12","B":"AI Incident Response and Kill Switch","C":"Required","D":"AI incident taxonomy, escalation, containment, reporting, kill switch and recovery","E":"OP-04; OP-05","F":"Plan + drill + incident evidence","G":"CISO / Incident Response"},"originalFormulas":{}},{"id":"ROW-74090ea0bfcc75669f6984e8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":17,"originalCells":{"A":"POL-13","B":"Vendor and AI Procurement","C":"Required for third parties","D":"Due diligence, DPA/BAA, training use, subprocessors, SLAs, audit, exit and change notice","E":"AU-05; AU-06; OP-10","F":"Contract + assessment","G":"Procurement / Legal / Security"},"originalFormulas":{}},{"id":"ROW-ed9444c9e4dff6f2ac173b6c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":18,"originalCells":{"A":"POL-14","B":"Agentic AI and Connectors","C":"Required where tools/actions exist","D":"Tool allowlists, least privilege, approvals, limits, memory and transaction controls","E":"AG-01–AG-09; IN-08","F":"Policy + tool logs + approvals","G":"AI Platform / Security"},"originalFormulas":{}},{"id":"ROW-4dc710b8b6b2304b15a162a8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":19,"originalCells":{"A":"POL-15","B":"AI Secure Development Lifecycle","C":"Required for built AI","D":"Threat modeling, design review, output handling, change, release and rollback","E":"OU-08; OU-09; OP-06; OP-12","F":"SDLC records + tests","G":"Engineering / AppSec"},"originalFormulas":{}},{"id":"ROW-1522dc6215e15cf85b8cbd15","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":20,"originalCells":{"A":"POL-16","B":"Bias, Fairness and Civil Rights","C":"Required for people-impacting AI","D":"Protected groups, evaluation, accommodations, monitoring and remediation","E":"OU-05","F":"Fairness assessment + monitoring","G":"Legal / Model Risk"},"originalFormulas":{}},{"id":"ROW-bfc4dd3736f13ccb042e5f1c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":21,"originalCells":{"A":"POL-17","B":"Transparency, Disclosure and Provenance","C":"Required for user-facing AI","D":"Notices, explainability, citations, synthetic-content labels and provenance","E":"OU-03; OU-12; OP-02","F":"Notices + provenance logs","G":"Product / Legal"},"originalFormulas":{}},{"id":"ROW-27f5a0fee6815e6237068b33","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":22,"originalCells":{"A":"POL-18","B":"IP, Copyright and Confidentiality","C":"Required","D":"Trade secrets, customer data, privilege, copyright, license and publication review","E":"DP-14; DP-16–DP-18; OU-10","F":"Policy + review records","G":"Legal / Information Governance"},"originalFormulas":{}},{"id":"ROW-143dcabb1090241751b5685e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":23,"originalCells":{"A":"POL-19","B":"AI Training, Literacy and Competency","C":"Required","D":"Role-based literacy, operator competency, developer safety and executive duties","E":"Supports all rules","F":"Completion + assessment","G":"HR / Compliance"},"originalFormulas":{}},{"id":"ROW-256a27618683d4bcaa50dd44","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":24,"originalCells":{"A":"POL-20","B":"Exceptions, Appeals and Risk Acceptance","C":"Required","D":"User appeal, operator override, risk acceptance, compensating controls and expiry","E":"OP-07; OP-08","F":"Workflow records","G":"Risk / Legal"},"originalFormulas":{}},{"id":"ROW-bd83089f2f5413ec22ca24ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":25,"originalCells":{"A":"POL-21","B":"AI Decommissioning and Data Lifecycle","C":"Required","D":"Retention, deletion, memory/vector cleanup, access revocation, records and exit","E":"OP-11","F":"Deletion and revocation evidence","G":"Data Governance / IT"},"originalFormulas":{}},{"id":"ROW-e3efd503495ea12c43748ea7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"08 Internal Policies","row":26,"originalCells":{"A":"POL-22","B":"Data, Model and RAG Supply Chain","C":"Required for RAG/training/custom models","D":"Provenance, authorization, poisoning defense, embedding isolation, dataset/model versioning","E":"IN-06; AG-08; AG-10","F":"Provenance + test + SBOM evidence","G":"Data / ML Platform / Security"},"originalFormulas":{}},{"id":"ROW-5837ef1c1de1a9c4c4677821","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":5,"originalCells":{"A":"CUS-01","B":"Block named individuals’ or VIP data","C":"Organization-specific identifier lists","D":"DP-05; DP-09","E":"Regex/keyword/entity","F":"Block","G":"Privacy owner","H":"Needs strict access and false-positive testing"},"originalFormulas":{}},{"id":"ROW-53db398e966bc5a803d2d295","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":6,"originalCells":{"A":"CUS-02","B":"Block client and project codewords","C":"Client names, codenames, deal rooms and matter numbers","D":"DP-14; DP-16; DP-18","E":"Keyword/entity/classification","F":"Block or approve","G":"Business data owner","H":"Often not present in external frameworks"},"originalFormulas":{}},{"id":"ROW-0222b802d5383ebf9987e28a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":7,"originalCells":{"A":"CUS-03","B":"Restrict specific email domains","C":"Personal, competitor, customer or external domains","D":"AU-01; AG-05","E":"Domain/context","F":"Block or warn","G":"IT / Security","H":"May combine with recipient approval"},"originalFormulas":{}},{"id":"ROW-25ebd4f9bd7e77f9f547b02e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":8,"originalCells":{"A":"CUS-04","B":"Restrict repositories and file paths","C":"Production repos, regulated shares, privileged folders","D":"DP-14; DP-16","E":"Path/repository metadata","F":"Block","G":"Engineering / Data owner","H":"Requires upload/source metadata"},"originalFormulas":{}},{"id":"ROW-2520994108320ff8743ae060","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":9,"originalCells":{"A":"CUS-05","B":"Approved model and version list","C":"Enterprise-approved model IDs and release channels","D":"AU-04","E":"Allowlist","F":"Block","G":"AI governance","H":"Reassess on model change"},"originalFormulas":{}},{"id":"ROW-ebb1ce2a43b6830c6e1a67ad","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":10,"originalCells":{"A":"CUS-06","B":"Approved geography and tenant","C":"Regions, tenant IDs, enterprise accounts and device posture","D":"AU-02; AU-05; AU-06","E":"Session/context","F":"Block","G":"Security / Privacy","H":"Needs identity and provider integration"},"originalFormulas":{}},{"id":"ROW-fb2002829e950fafd2429b52","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":11,"originalCells":{"A":"CUS-07","B":"Required disclaimer by workflow","C":"Legal, medical, financial, support or public-facing wording","D":"OU-04; OU-12","E":"Use-case response template","F":"Transform/hold","G":"Legal / Product","H":"Do not treat disclaimer as a substitute for oversight"},"originalFormulas":{}},{"id":"ROW-65a7eadd76e544a3fc9a7a63","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":12,"originalCells":{"A":"CUS-08","B":"Transaction amount limits","C":"Dollar, quantity, frequency and cumulative limits","D":"AG-07","E":"Numeric/context","F":"Block/approve","G":"Finance / Risk","H":"Include cumulative and split-transaction detection"},"originalFormulas":{}},{"id":"ROW-b3c5f0638e5ec659c13e79f4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":13,"originalCells":{"A":"CUS-09","B":"Approved external recipients","C":"Domains, people, distribution lists and channels","D":"AG-05","E":"Identity/recipient allowlist","F":"Approve/block","G":"Business owner","H":"Resolve recipient identity before send"},"originalFormulas":{}},{"id":"ROW-c93b748422bc054f47a76e8b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":14,"originalCells":{"A":"CUS-10","B":"Connector and tool allowlist","C":"Specific MCP servers, SaaS connectors, APIs and actions","D":"AG-01; AG-10","E":"Tool identity/version","F":"Block","G":"Platform security","H":"Pin publisher, schema and version"},"originalFormulas":{}},{"id":"ROW-e9ac42c75d1e4c2fcd2001c8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":15,"originalCells":{"A":"CUS-11","B":"Retention by use case","C":"Prompt, response, file, log, vector and memory retention","D":"AU-05; OP-11","E":"Use-case/configuration","F":"Configure/block","G":"Data governance","H":"Verify downstream copies and backups"},"originalFormulas":{}},{"id":"ROW-ec5426214da8d72f6f3427b9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":16,"originalCells":{"A":"CUS-12","B":"Production credential boundary","C":"Known production hosts, tokens, vault paths and environments","D":"DP-01; DP-15","E":"Keyword/regex/context","F":"Block","G":"Engineering / Security","H":"Seed only synthetic examples in tests"},"originalFormulas":{}},{"id":"ROW-0575be55fa3a4cd51e9b852f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":17,"originalCells":{"A":"CUS-13","B":"Oversize or unscannable attachment handling","C":"Encrypted, image-only, archive, binary and size thresholds","D":"IN-03; IN-05","E":"File metadata/scanner","F":"Block/quarantine","G":"Security","H":"Current build fails to enforce this"},"originalFormulas":{}},{"id":"ROW-c082c97f14511e542b1beb34","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":18,"originalCells":{"A":"CUS-14","B":"Business-specific prohibited advice","C":"Product suitability, underwriting, pricing, HR or safety boundaries","D":"IN-07; OU-04","E":"Semantic/use-case","F":"Hold/block","G":"Legal / Business owner","H":"Requires domain evaluation"},"originalFormulas":{}},{"id":"ROW-3248f07d2f746592c085c7d6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":19,"originalCells":{"A":"CUS-15","B":"Required human approval groups","C":"Named roles/groups for defined actions and risk tiers","D":"AG-03; AG-04; OP-08","E":"Workflow/identity","F":"Approve","G":"Risk / Business owner","H":"Must handle delegation and conflicts"},"originalFormulas":{}},{"id":"ROW-3805638448f295dec9a68c8b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":20,"originalCells":{"A":"CUS-16","B":"Data-loss canaries","C":"Unique synthetic markers in hidden context, RAG and tenant data","D":"OU-01; OU-02; AG-08","E":"Canary/token","F":"Block/alert","G":"Security / AI assurance","H":"Use to test leakage without real sensitive data"},"originalFormulas":{}},{"id":"ROW-60bb97f031278089309f789f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":21,"originalCells":{"A":"CUS-17","B":"Brand and communications standard","C":"Tone, claims, regulated wording and approval thresholds","D":"OU-03; OU-12; AG-05","E":"Semantic/template","F":"Warn/hold","G":"Communications / Legal","H":"Separate brand preference from safety criticality"},"originalFormulas":{}},{"id":"ROW-25d29dfc5348c104d2341251","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"09 Custom Rule Backlog","row":22,"originalCells":{"A":"CUS-18","B":"Change blackout and release windows","C":"Freeze dates, required approvers and emergency path","D":"OP-06; OP-12","E":"Workflow/time","F":"Hold","G":"Engineering / Change management","H":"Useful for high-impact production systems"},"originalFormulas":{}},{"id":"ROW-3c32fa1a320e57da550dbfef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":5,"originalCells":{"A":"GAP-01","B":"Coverage claim mismatch","C":"High","D":"User described ten AI systems; code contains nine adapters.","E":"Inventory and scope integrity","F":"Confirm the intended tenth system; drive UI count from adapter registry.","G":"OP-09","H":"Open"},"originalFormulas":{}},{"id":"ROW-18577722d757f7ebc5ffbc19","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":6,"originalCells":{"A":"GAP-02","B":"External response not intercepted","C":"Critical","D":"Third-party AI outputs are not scanned, redacted or held.","E":"Sensitive disclosure, misinformation, unsafe output","F":"Add response interception/gateway integration and OU rules.","G":"OU-01–OU-12","H":"Open"},"originalFormulas":{}},{"id":"ROW-8b9f2a485a46d6f89bb00bc4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":7,"originalCells":{"A":"GAP-03","B":"Uploads are not stopped","C":"Critical","D":"Readable text files ≤1 MB are scanned/logged, but upload events are not prevented.","E":"Sensitive data and malicious document ingestion","F":"Block/quarantine before upload; cover binary, archive, OCR and oversize files.","G":"DP; IN-02; IN-03; IN-05","H":"Open"},"originalFormulas":{}},{"id":"ROW-aa07a7f67dc6dd86c8f0d00f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":8,"originalCells":{"A":"GAP-04","B":"Fail-open enforcement","C":"Critical","D":"Engine errors, timeouts and selector misses allow the request to continue.","E":"Critical rule bypass","F":"Use severity-aware fail-closed behavior, health checks and user-visible safe fallback.","G":"OP-05; all Critical rules","H":"Open"},"originalFormulas":{}},{"id":"ROW-c7a91815fd88d84d49b57ca1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":9,"originalCells":{"A":"GAP-05","B":"Limited detector set","C":"High","D":"Built-ins cover email, phone, credit card, SSN, IBAN, IP and secrets only.","E":"Uncovered regulated and enterprise data","F":"Add bank routing/account, PHI, biometrics, location, CUI, privilege, MNPI and organization entities.","G":"DP-01–DP-18","H":"Open"},"originalFormulas":{}},{"id":"ROW-f63728a42af3993a003b6afc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":10,"originalCells":{"A":"GAP-06","B":"No identity or device context","C":"Critical","D":"No SSO, MFA, role, group, tenant or managed-device assertion is used.","E":"Unauthorized AI use and data access","F":"Integrate IdP/device posture and enforce AU-02/AU-03/AU-06.","G":"AU-02; AU-03; AU-06","H":"Open"},"originalFormulas":{}},{"id":"ROW-9a812774feea1369b1964134","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":11,"originalCells":{"A":"GAP-07","B":"No exceptions lifecycle","C":"High","D":"No scoped approval, compensating control, expiry or auto-revocation model.","E":"Permanent bypasses and audit gaps","F":"Implement versioned exceptions with owner, scope and expiry.","G":"OP-07","H":"Open"},"originalFormulas":{}},{"id":"ROW-f0e14d8626c89447d977f580","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":12,"originalCells":{"A":"GAP-08","B":"No unified evidence store","C":"High","D":"Runtime events exist, but evidence types, integrity, retention and framework claims are not modeled holistically.","E":"Weak auditability","F":"Create evidence objects linked to rule, control, system, period and assessor.","G":"OP-01; score model","H":"Open"},"originalFormulas":{}},{"id":"ROW-6566eaffd39f4ecff911cafb","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":13,"originalCells":{"A":"GAP-09","B":"No agent-action enforcement","C":"Critical","D":"No tool-call, connector, transaction, recipient or destructive-action controls.","E":"Excessive agency and irreversible harm","F":"Add agent gateway and AG-01–AG-10.","G":"AG-01–AG-10","H":"Open"},"originalFormulas":{}},{"id":"ROW-f15a98f09dbd9d3c6e9cc901","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":14,"originalCells":{"A":"GAP-10","B":"No rule version/effective dates","C":"High","D":"Rules lack formal versions, applicability conditions, tests, approvals and effective dates.","E":"Uncontrolled policy changes","F":"Add rule lifecycle states, versioning, deployment and rollback.","G":"OP-06; OP-12","H":"Open"},"originalFormulas":{}},{"id":"ROW-3d66e190539131e805e55863","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":15,"originalCells":{"A":"GAP-11","B":"No tenant or case isolation","C":"Critical","D":"No explicit tenant, customer, matter or RAG-context boundary.","E":"Cross-tenant leakage","F":"Enforce context isolation and canary tests.","G":"AG-08; OU-01","H":"Open"},"originalFormulas":{}},{"id":"ROW-2489926295b9f60e266bc3d9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":16,"originalCells":{"A":"GAP-12","B":"No efficacy metrics","C":"Critical","D":"No precision, recall, bypass, drift or false-positive thresholds are evidenced.","E":"Controls may appear enabled but fail","F":"Build representative eval sets and release/monitoring thresholds.","G":"OP-03; OP-12","H":"Open"},"originalFormulas":{}},{"id":"ROW-21cc82e99afc68e0acaff97b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":17,"originalCells":{"A":"GAP-13","B":"No classification-label integration","C":"High","D":"Runtime decisions do not consume enterprise DLP labels, repositories, matters or data owners.","E":"Context-blind rules","F":"Integrate DLP/classification and organization entities.","G":"DP-07–DP-18","H":"Open"},"originalFormulas":{}},{"id":"ROW-eb1643de74425e536329deaf","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":18,"originalCells":{"A":"GAP-14","B":"Adherence terminology overclaims","C":"High","D":"The UI divides enabled chat policies by total framework controls and calls it adherence.","E":"Misleading compliance claim","F":"Rename to ‘chat-control coverage’; never represent it as compliance or framework adherence.","G":"Scoring model","H":"Open"},"originalFormulas":{}},{"id":"ROW-eb5532f556081090f23ad6f5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":19,"originalCells":{"A":"GAP-15","B":"Framework seed scope is narrow","C":"Medium","D":"Only ten U.S.-centric seed frameworks and 35 disabled starter policies are in code.","E":"Incomplete AI and international coverage","F":"Add NIST AI RMF/GAI, EU AI Act, GDPR, ISO, OWASP 2026 and current state/federal policy mappings.","G":"Framework catalog","H":"Open"},"originalFormulas":{}},{"id":"ROW-3b863926540fb475913a713a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":20,"originalCells":{"A":"GAP-16","B":"Current-source drift","C":"High","D":"TAIM references OWASP 2025 and a White House EO category; EO 14110 was rescinded and OWASP 2026 is current.","E":"Stale obligations and guidance","F":"Version sources; mark superseded material; monitor authoritative updates.","G":"Framework catalog; Sources","H":"Open"},"originalFormulas":{}},{"id":"ROW-fe97fad606370097362c7b35","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":21,"originalCells":{"A":"GAP-17","B":"Extracted rules can be semantically unsafe","C":"High","D":"Document extraction may convert broad nouns/directives into keyword or semantic rules without applicability context.","E":"Overblocking, underblocking, false compliance","F":"Require applicability, owner, decision table, test set and approval before activation.","G":"Rule lifecycle","H":"Open"},"originalFormulas":{}},{"id":"ROW-7067a6b6c365cbd9a551baa1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"11 Implementation Gaps","row":22,"originalCells":{"A":"GAP-18","B":"Local logs and admin separation","C":"High","D":"Local-only storage can lack centralized integrity, retention, separation of duties and enterprise investigation access.","E":"Evidence loss or tampering","F":"Add signed export/central collection, RBAC and retention controls while preserving privacy.","G":"OP-01; OP-04","H":"Open"},"originalFormulas":{}},{"id":"ROW-a926db0600ee12ef3a597fa4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":5,"originalCells":{"A":"nist-csf-2","B":"NIST CSF","C":"106","D":"subcategories","E":"Credentials & API keys","F":"Authentication secrets, API keys and tokens must never be shared in messages.","G":"pii_builtin","H":"secret","I":"block","J":"high","K":"PR.AA — Identity Management & Access Control","L":"DP-01 / DP-02","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-77ca0c8f72c0719974367f20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":6,"originalCells":{"A":"nist-csf-2","B":"NIST CSF","C":"106","D":"subcategories","E":"Internal IP addresses","F":"Do not disclose internal network addresses to outside parties.","G":"pii_builtin","H":"ip","I":"warn","J":"medium","K":"PR.IR — Technology Infrastructure Resilience","L":"DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-44e9aba8014a0eadf08b5b29","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":7,"originalCells":{"A":"nist-csf-2","B":"NIST CSF","C":"106","D":"subcategories","E":"Incident details stay internal","F":"Do not discuss active security incidents with anyone outside the response team.","G":"semantic","I":"warn","J":"high","K":"RS.CO — Incident Response Communication","L":"OP-04","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-bb80811229fb723e57c9dfc8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":8,"originalCells":{"A":"nist-csf-2","B":"NIST CSF","C":"106","D":"subcategories","E":"Vulnerability details","F":"Never share details of unpatched security vulnerabilities with anyone outside the company.","G":"semantic","I":"warn","J":"high","K":"ID.RA — Risk Assessment","L":"DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-77763a56ad06ab2382475bef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":9,"originalCells":{"A":"nist-800-53","B":"NIST 800-53","C":"1189","D":"controls & enhancements (Rev 5)","E":"Authenticator content","F":"Passwords, keys and other authenticators must not be transmitted in plain text.","G":"pii_builtin","H":"secret","I":"block","J":"high","K":"IA-5 — Authenticator Management","L":"DP-01 / DP-02","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-678d76e62e8a11e88a46f982","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":10,"originalCells":{"A":"nist-800-53","B":"NIST 800-53","C":"1189","D":"controls & enhancements (Rev 5)","E":"PII in messages (SSN)","F":"Social Security numbers are personally identifiable information and must not be shared.","G":"pii_builtin","H":"ssn","I":"block","J":"high","K":"PT-2 / SI-19 — PII Processing & De-identification","L":"DP-05","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-dd628b7b57dc33d63a0f07f7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":11,"originalCells":{"A":"nist-800-53","B":"NIST 800-53","C":"1189","D":"controls & enhancements (Rev 5)","E":"System configuration details","F":"Do not reveal system configuration or architecture details to unauthorized parties.","G":"semantic","I":"warn","J":"medium","K":"CM-8 / SC-7 — System Inventory & Boundary Protection","L":"DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-13eb8127539b05d28d18cca8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":12,"originalCells":{"A":"nist-800-53","B":"NIST 800-53","C":"1189","D":"controls & enhancements (Rev 5)","E":"Controlled Unclassified Information","F":"Controlled Unclassified Information must not leave authorized channels.","G":"keyword","H":"CUI","I":"warn","J":"high","K":"AC-4 — Information Flow Enforcement","L":"DP-12","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-fdf1823c5417f62f1432e773","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":13,"originalCells":{"A":"soc2","B":"SOC 2","C":"61","D":"Trust Services Criteria","E":"Customer data confidentiality","F":"Customer data must not be disclosed to unauthorized parties.","G":"semantic","I":"warn","J":"high","K":"CC6.1 / C1.1 — Logical Access & Confidentiality","L":"DP-16","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-ab14203398e4dd98dd01b9c6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":14,"originalCells":{"A":"soc2","B":"SOC 2","C":"61","D":"Trust Services Criteria","E":"Production credentials","F":"Production credentials and access tokens must never be shared.","G":"pii_builtin","H":"secret","I":"block","J":"high","K":"CC6.1 — Logical & Physical Access Controls","L":"DP-01 / DP-02","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-7c7fd4f71894df5b8ba94d66","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":15,"originalCells":{"A":"soc2","B":"SOC 2","C":"61","D":"Trust Services Criteria","E":"Customer contact details","F":"Customer email addresses are confidential customer data.","G":"pii_builtin","H":"email","I":"warn","J":"medium","K":"C1.1 — Confidential Information Identification","L":"DP-09","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-54f9aa1befd37917a916881f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":16,"originalCells":{"A":"soc2","B":"SOC 2","C":"61","D":"Trust Services Criteria","E":"Security findings stay internal","F":"Do not share audit findings or control gaps outside the engagement.","G":"semantic","I":"warn","J":"medium","K":"CC4.2 — Internal Control Evaluations","L":"DP-18 / DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-afe2f370808f221765b14714","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":17,"originalCells":{"A":"hipaa","B":"HIPAA","C":"54","D":"Security Rule standards & implementation specs","E":"SSNs in health records","F":"Social Security numbers are PHI identifiers and must not be disclosed.","G":"pii_builtin","H":"ssn","I":"block","J":"high","K":"45 CFR §164.514(b) — De-identification","L":"DP-05","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-53762de86e62ef90691cfe16","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":18,"originalCells":{"A":"hipaa","B":"HIPAA","C":"54","D":"Security Rule standards & implementation specs","E":"Patient contact information","F":"Patient phone numbers are PHI identifiers.","G":"pii_builtin","H":"phone","I":"warn","J":"high","K":"45 CFR §164.514(b)(2) — Identifiers","L":"DP-07","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-e2492afee0a48b2cf658d3bd","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":19,"originalCells":{"A":"hipaa","B":"HIPAA","C":"54","D":"Security Rule standards & implementation specs","E":"Patient email addresses","F":"Patient email addresses are PHI identifiers.","G":"pii_builtin","H":"email","I":"warn","J":"high","K":"45 CFR §164.514(b)(2) — Identifiers","L":"DP-07","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-6348dde435b116323b72dd60","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":20,"originalCells":{"A":"hipaa","B":"HIPAA","C":"54","D":"Security Rule standards & implementation specs","E":"Protected health information","F":"Never reveal a patient\\u2019s diagnosis, illness, treatment plan or prescribed medication.","G":"semantic","I":"block","J":"high","K":"45 CFR §164.502 — Uses & Disclosures of PHI","L":"DP-07","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-b12387c96c751c9cbacbe0b9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":21,"originalCells":{"A":"pci-dss-4","B":"PCI DSS","C":"280","D":"testable requirements (v4.0 incl. appendices)","E":"Primary account numbers","F":"Payment card numbers (PAN) must never appear in messages or logs.","G":"pii_builtin","H":"credit_card","I":"block","J":"high","K":"Req. 3.4 — PAN Rendered Unreadable","L":"DP-03","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-548f3a790ac62678ce7f99ca","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":22,"originalCells":{"A":"pci-dss-4","B":"PCI DSS","C":"280","D":"testable requirements (v4.0 incl. appendices)","E":"Card verification codes","F":"CVV/CVC codes must never be stored or transmitted after authorization.","G":"keyword","H":"cvv, cvc, card verification","I":"block","J":"high","K":"Req. 3.3.1 — Sensitive Authentication Data","L":"DP-04","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-044aaac38a652e366871785b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":23,"originalCells":{"A":"pci-dss-4","B":"PCI DSS","C":"280","D":"testable requirements (v4.0 incl. appendices)","E":"Cardholder data environment","F":"Never describe the cardholder data environment, its architecture or network layout to outside parties.","G":"semantic","I":"warn","J":"medium","K":"Req. 1.2 — Network Security Controls","L":"DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-8360d1514c202a8f0cbda1a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":24,"originalCells":{"A":"ccpa","B":"CCPA","C":"10","D":"core statutory obligations","E":"Consumer email addresses","F":"Consumer email addresses are personal information under the CCPA.","G":"pii_builtin","H":"email","I":"warn","J":"medium","K":"Cal. Civ. Code §1798.140(v) — Personal Information","L":"DP-09","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-0ebd4344938da8b3f5bcd86c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":25,"originalCells":{"A":"ccpa","B":"CCPA","C":"10","D":"core statutory obligations","E":"Consumer phone numbers","F":"Consumer phone numbers are personal information under the CCPA.","G":"pii_builtin","H":"phone","I":"warn","J":"medium","K":"Cal. Civ. Code §1798.140(v) — Personal Information","L":"DP-09","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-9beb93964e6e3eaaf4db1914","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":26,"originalCells":{"A":"ccpa","B":"CCPA","C":"10","D":"core statutory obligations","E":"Selling personal information","F":"Do not share or sell consumer personal information without an opt-out path.","G":"semantic","I":"warn","J":"high","K":"Cal. Civ. Code §1798.120 — Right to Opt Out","L":"Review required","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-dcef05efe6e510cce063009a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":27,"originalCells":{"A":"ccpa","B":"CCPA","C":"10","D":"core statutory obligations","E":"SSNs of consumers","F":"Social Security numbers require heightened protection under the CPRA.","G":"pii_builtin","H":"ssn","I":"block","J":"high","K":"Cal. Civ. Code §1798.81.5 — Reasonable Security","L":"DP-05","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-2ebcca3da3ac2a761196f4b3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":28,"originalCells":{"A":"glba","B":"GLBA","C":"9","D":"Safeguards Rule program elements","E":"Bank account numbers","F":"Customer account and routing numbers are nonpublic personal information.","G":"pii_builtin","H":"iban","I":"block","J":"high","K":"Safeguards Rule, 16 CFR 314.4","L":"DP-06","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-14737a1144781541233b114f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":29,"originalCells":{"A":"glba","B":"GLBA","C":"9","D":"Safeguards Rule program elements","E":"Card numbers of customers","F":"Customer payment card numbers are nonpublic personal information.","G":"pii_builtin","H":"credit_card","I":"block","J":"high","K":"Safeguards Rule, 16 CFR 314.4","L":"DP-03","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-977d58e5cc41b61d8619ef5b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":30,"originalCells":{"A":"glba","B":"GLBA","C":"9","D":"Safeguards Rule program elements","E":"Customer financial information","F":"Do not disclose customer balances, transactions or credit information.","G":"semantic","I":"block","J":"high","K":"Privacy Rule, 16 CFR 313.10","L":"DP-06","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-9c27d33d3f4fa7c5958400e1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":31,"originalCells":{"A":"sox","B":"SOX","C":"17","D":"COSO 2013 internal-control principles","E":"Unreleased financial results","F":"Never share unreleased financial results, revenue numbers or earnings figures before they are announced.","G":"semantic","I":"block","J":"high","K":"§409 — Real-Time Issuer Disclosures / Reg FD","L":"DP-17","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-1eea5c66a13b9afc1dc1e0bd","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":32,"originalCells":{"A":"sox","B":"SOX","C":"17","D":"COSO 2013 internal-control principles","E":"Material nonpublic information","F":"Never share material nonpublic information such as unannounced mergers, acquisitions or deals.","G":"semantic","I":"block","J":"high","K":"§302 — Corporate Responsibility for Reports","L":"DP-17","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-08d1e68f2858f3dfc9d22516","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":33,"originalCells":{"A":"sox","B":"SOX","C":"17","D":"COSO 2013 internal-control principles","E":"Audit workpapers","F":"Audit workpapers and drafts must not circulate outside the audit team.","G":"keyword","H":"audit workpaper, workpapers","I":"warn","J":"medium","K":"§802 — Records Retention","L":"DP-18 / DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-9152ffd4da54399ae25acd97","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":34,"originalCells":{"A":"fedramp","B":"FedRAMP","C":"323","D":"Moderate-baseline controls","E":"Federal system credentials","F":"Credentials for federal information systems must never be shared.","G":"pii_builtin","H":"secret","I":"block","J":"high","K":"IA-5 — Authenticator Management","L":"DP-01 / DP-02","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-6dd820003c993e98daf97bcf","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":35,"originalCells":{"A":"fedramp","B":"FedRAMP","C":"323","D":"Moderate-baseline controls","E":"Authorization boundary details","F":"Do not describe the authorization boundary or POA&M items externally.","G":"semantic","I":"warn","J":"medium","K":"CA-3 — Information Exchange","L":"DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-d2baa81daa8f6659d47974d6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":36,"originalCells":{"A":"fedramp","B":"FedRAMP","C":"323","D":"Moderate-baseline controls","E":"Federal metadata addresses","F":"Do not expose internal government system IP addresses.","G":"pii_builtin","H":"ip","I":"warn","J":"medium","K":"SC-7 — Boundary Protection","L":"DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-193e9904a93da1caa713e278","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":37,"originalCells":{"A":"ferpa","B":"FERPA","C":"31","D":"regulatory sections (34 CFR 99)","E":"Student records","F":"Do not disclose grades, transcripts or disciplinary records of students.","G":"semantic","I":"block","J":"high","K":"34 CFR §99.30 — Prior Consent to Disclose","L":"DP-08","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-6d53464179b39d3103f46cf4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":38,"originalCells":{"A":"ferpa","B":"FERPA","C":"31","D":"regulatory sections (34 CFR 99)","E":"Student SSNs","F":"Student Social Security numbers are protected identifiers.","G":"pii_builtin","H":"ssn","I":"block","J":"high","K":"34 CFR §99.3 — Personally Identifiable Information","L":"DP-05","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-f1054800c42e969b1738ec4d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"12 Code Seed Crosswalk","row":39,"originalCells":{"A":"ferpa","B":"FERPA","C":"31","D":"regulatory sections (34 CFR 99)","E":"Student contact details","F":"Student email addresses require directory-information handling.","G":"pii_builtin","H":"email","I":"warn","J":"medium","K":"34 CFR §99.37 — Directory Information","L":"DP-08","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-6afd775adaeef56adc83e18e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":5,"originalCells":{"A":"NIST-AI-RMF","B":"NIST AI Risk Management Framework 1.0","C":"Current; revision underway","D":"https://www.nist.gov/itl/ai-risk-management-framework","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-60bb29d6f40f2638e0ae194b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":6,"originalCells":{"A":"NIST-AI-600-1","B":"NIST AI 600-1 Generative AI Profile","C":"Published July 2024","D":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-dd85bd9f50bb53640f4f9d02","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":7,"originalCells":{"A":"NIST-CSF2","B":"NIST Cybersecurity Framework 2.0","C":"Current","D":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-794143327d3bd6f6a8677b5b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":8,"originalCells":{"A":"NIST-800-53","B":"NIST SP 800-53 Rev. 5","C":"Rev. 5 Update 1","D":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-27f2a8d67f22f644d8e567c8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":9,"originalCells":{"A":"FEDRAMP","B":"FedRAMP Rev. 5 Baselines","C":"Rev. 5","D":"https://www.fedramp.gov/archive/2023-05-30-rev-5-baselines-have-been-approved-and-released/","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-74f27ae0f73e17c216b3d9c8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":10,"originalCells":{"A":"ISO-42001","B":"ISO/IEC 42001:2023","C":"Current","D":"https://www.iso.org/standard/42001","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-f8834d598368e17253182266","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":11,"originalCells":{"A":"ISO-42005","B":"ISO/IEC 42005:2025","C":"Published 2025","D":"https://www.iso.org/standard/42005","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-c59c1ccc2c6b51dd77eca452","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":12,"originalCells":{"A":"ISO-23894","B":"ISO/IEC 23894:2023","C":"Current","D":"https://www.iso.org/standard/77304.html","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-8e617d94ab0942c5f0ee9b47","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":13,"originalCells":{"A":"ISO-38507","B":"ISO/IEC 38507:2022","C":"Current","D":"https://www.iso.org/standard/56641.html","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-9e71c47c1044027a85490368","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":14,"originalCells":{"A":"ISO-5338","B":"ISO/IEC 5338:2023","C":"Current","D":"https://www.iso.org/standard/81118.html","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-d3a4b2cf2f047c233100d3b4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":15,"originalCells":{"A":"ISO-24028","B":"ISO/IEC TR 24028:2020","C":"Levels of trustworthiness are out of scope","D":"https://www.iso.org/standard/77608.html","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-55f0d39e423c96e97070d666","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":16,"originalCells":{"A":"EU-AI-ACT","B":"EU Artificial Intelligence Act","C":"Consolidated text current 27 Jul 2026","D":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-4d71b63e68fcc1e7ad3a4fcf","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":17,"originalCells":{"A":"GDPR","B":"EU General Data Protection Regulation","C":"Current","D":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-969cec8f5f514da859ec292b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":18,"originalCells":{"A":"HIPAA","B":"HIPAA Privacy and Security Rules","C":"Current","D":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-d174bffcb151e650d54aa69b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":19,"originalCells":{"A":"PCI-DSS","B":"PCI DSS v4.0.1","C":"v4.0.1","D":"https://www.pcisecuritystandards.org/standards/pci-dss/","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-a92bc7ea8aed8b0b24d17711","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":20,"originalCells":{"A":"SOC2","B":"AICPA Trust Services Criteria","C":"2017 TSC with 2022 points of focus","D":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-8943de9e224f99f851e4ad72","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":21,"originalCells":{"A":"GLBA","B":"GLBA Safeguards Rule","C":"Current","D":"https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-9a44d42740dda31e13edade8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":22,"originalCells":{"A":"FERPA","B":"Family Educational Rights and Privacy Act","C":"Current","D":"https://studentprivacy.ed.gov/ferpa","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-ef2d08260188fcf13b964335","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":23,"originalCells":{"A":"CCPA-CPRA","B":"California CCPA / CPRA Regulations","C":"Updated regulations effective 1 Jan 2026; ADMT obligations begin 1 Jan 2027","D":"https://cppa.ca.gov/regulations/ccpa_updates.html","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-7ad35a64020580ec266f292f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":24,"originalCells":{"A":"CO-AI","B":"Colorado AI laws and rulemaking","C":"SB26-189 effective 1 Jan 2027; monitor rulemaking","D":"https://coag.gov/ai/","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-e847646abbf73e93f3ee1043","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":25,"originalCells":{"A":"TX-TRAIGA","B":"Texas Responsible Artificial Intelligence Governance Act","C":"Current statutory text","D":"https://statutes.capitol.texas.gov/GetStatute.aspx?Code=BC&Value=552","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-53009e594bc335a673d95b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":26,"originalCells":{"A":"OMB-M25-21","B":"OMB M-25-21 Federal AI Governance","C":"Replaced M-24-10","D":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-8d41ed1f4fb17d37f610c5a3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":27,"originalCells":{"A":"OMB-M25-22","B":"OMB M-25-22 AI Acquisition","C":"Current","D":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-b2cb27cba8e6a21320d5c668","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":28,"originalCells":{"A":"OWASP-LLM-2026","B":"OWASP Top 10 for LLM Applications 2026","C":"Released 3 Aug 2026","D":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-33b5719dcc6f74088e7ec665","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":29,"originalCells":{"A":"SOX","B":"Sarbanes-Oxley Act / ICFR","C":"Current","D":"https://www.sec.gov/spotlight/sarbanes-oxley.htm","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-be42105bdecf7a8dd1e3aadb","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":30,"originalCells":{"A":"EO-14110-RESCISSION","B":"Initial Rescissions of Harmful Executive Orders and Actions","C":"EO 14110 listed as revoked on 20 Jan 2025","D":"https://www.whitehouse.gov/presidential-actions/2025/01/initial-rescissions-of-harmful-executive-orders-and-actions/","E":"Official White House source","F":"Treat prior EO 14110 mappings as historical/superseded, not current authority."},"originalFormulas":{}},{"id":"ROW-9c94471549386392075ac3b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":31,"originalCells":{"A":"CO-SB26-189","B":"Colorado SB26-189","C":"Signed May 2026; effective 1 Jan 2027","D":"https://leg.colorado.gov/bills/sb26-189","E":"Official legislature source","F":"Revises/re-enacts Colorado AI requirements; monitor implementing rules."},"originalFormulas":{}},{"id":"ROW-49822c4a4d79af610118c366","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"13 Sources","row":32,"originalCells":{"A":"OMB-M26-04","B":"OMB M-26-04","C":"Current federal agency LLM procurement/use principles","D":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf","E":"Official White House source","F":"Federal-agency applicability; includes transparency and evaluation expectations."},"originalFormulas":{}},{"id":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":2,"originalCells":{"A":"GOVERN","B":"GOVERN 1","C":"Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","D":"GOVERN 1.1","E":"Legal and regulatory requirements involving AI are understood, managed, and documented.","F":"Are legal and regulatory requirements involving AI understood, managed, and documented?","G":"Ensure that legal and regulatory requirements involving AI are understood, managed, and documented.","J":"✓","K":"✓","L":"✓","N":"7.1\n8.7\n9.11.1","P":"5.4.1 - ISO 31000:2018\n5.4.2 - ISO 31000:2018","Q":"6.1.1.3\n6.3.4.3\n6.3.8.3\n6.4.1.3\n6.4.2.3\n6.4.3.3\n6.4.8.2\n6.4.8.3\n6.4.17\n6.4.3","R":"5.1\n5.5\n6.1\n6.4\n6.6.1\n6.7.3\nA.1.2\nA.1.3\nA.1.4","S":"3.5.2\n5.15.1\n5.15.5\n5.17\n5.18\n5.19.5.4\n5.19.7.3\n6.2.2\n8.1\n","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","Y":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"4.1 - Understanding the organization and its context\n6.2 - AI objectives and planning to achieve them\nB.2.2 - AI policy\nB.2.4 - Review of the AI policy","AK":"Alabama: Enacted facial recognition restrictions (2022) and laws against sexual and political deepfakes (2024).\nAlaska: No significant AI-specific legislation enacted as of April 2025.\nArkansas: Proposed bills (HB127, SB59) to criminalize deceptive deepfakes in elections and require AI chatbot disclosures.\nCalifornia: Deepfake regulations (electoral and sexual), chatbot disclosures, bias audits for criminal justice agencies; vetoed AI safety bill (Sept 2024); exploring AI avatars for court rulings.\nIdaho: Bill introduced that requires AI chatbot disclosures in consumer transactions (2025).\nKansas: No significant AI-specific legislation enacted as of April 2025.\nMississippi: Enacted political and sexual deepfake laws (2024).\nMissouri: No significant AI-specific legislation enacted as of April 2025.\nMontana: No significant AI-specific legislation enacted as of April 2025.\nNebraska: No significant AI-specific legislation enacted as of April 2025.\nNew Hampshire: Prohibits Department of Motor Vehicles use of Facial recognition technology (2014/2016); sexual deepfake and election fraud laws (2024).\nOhio: No significant AI-specific legislation enacted as of April 2025.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA establishes many new statutory requirements for legal compliance in use, deployment, and prohibited uses of AI (e.g., manipulation, discrimination, certain biometrics).\nUtah: AI Policy Act (2024): UAIPA liability cannot be transferred to AI reinforces NIST's accountability even when AI is involved; legal responsibility must be maintained."},"originalFormulas":{}},{"id":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":3,"originalCells":{"D":"GOVERN 1.2","E":"The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices.","F":"Are the characteristics of trustworthy AI integrated into organizational policies, processes, procedures, and practices?","G":"Ensure that the characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices.","J":"✓","K":"✓","L":"✓","N":"9.2\n9.3\n9.4","O":"3.3.3\n6.5.5.1\n6.5.5.5\n8.7","P":"5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","Q":"5.1\n5.2\n6.3.8.3\n6.4.2.3\n6.4.3.1\n6.4.11.1\nA.2.3\n","R":"6","S":"5.15","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","Y":"✓","AB":"GV.RR-03\nGV.SC-01\n","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.9.3 - Objectives for responsible use of AI system\nB.6.1.2 - Objectives for responsible development of AI system\nB.6.1.3 - Processes for responsible design and development of AI systems\nB.10.3 - Suppliers\nB.2.2 - AI policy\n4.4 - AI management system\n5.2 - AI Policy","AK":"Colorado: Colorado AI Act (2024): CAIA requires alignment with NIST AI RMF and ISO 42001, which codifies adherence to trustworthy AI characteristics and risk frameworks.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute."},"originalFormulas":{}},{"id":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":4,"originalCells":{"D":"GOVERN 1.3","E":"Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization’s risk tolerance.","F":"Are processes, procedures, and practices  in place to determine the needed level of risk management activities based on the organization’s risk tolerance?","G":"Ensure that processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization’s risk tolerance.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.4","O":"8.1","P":"6.4.3.2 - ISO 31000:2018","Q":"5.3\n6.3.4\n6.4.3.1","R":"5.3\n6.7","S":"6.1\n6.2.2\n6.2.5\n6.2.6\n6.2.7\n9.4\nAnnex A","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","Y":"✓","AB":"GV.RM-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.2 - AI risk assessment_x000D_\n6.1.1 - General_x000D_\n6.1.3 - AI risk treatment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute."},"originalFormulas":{}},{"id":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":5,"originalCells":{"D":"GOVERN 1.4","E":"The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.","F":"Are the risk management process and its outcomes established through transparent policies, procedures, and other controls based on organizational risk priorities?","G":"Ensure that the risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.4","O":"8.5","P":"6.4.2.6","Q":"5.3\n6.3.4\n6.3.5.3\n6.4.3.1","R":"6.7","S":"6.1","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","Y":"✓","AB":"GV.PO-01","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment_x000D_\n8.3 - AI risk treatment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA applies to government and covered healthcare disclosure, prohibits dark patterns, mandates transparency when AI is in use.\n"},"originalFormulas":{}},{"id":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":6,"originalCells":{"D":"GOVERN 1.5","E":"Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.","F":"Are ongoing monitoring and periodic review of the risk management process and its outcomes planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review?","G":"Ensure that ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.4","O":"6.3\n8.7","P":"6.6 - ISO 31000:2018\n5.4.3 - ISO 31000:2018","Q":"5.4.1\n5.4.3\n6.1.1.2\n6.1.2\n6.2.1\n6.2.2\n6.2.3.2\n6.2.4.2\n6.2.5.2\n6.2.6.2\n6.3.1.2\n6.3.2.2\n6.3.3.2\n6.3.4.2\n6.3.5.2\n6.3.6.2\n6.3.7\n6.3.8.2\n6.4.1.2\n6.4.2.2\n6.4.3.2\n6.4.4\n6.4.5\n6.4.6\n6.4.7.2\n6.4.8.2\n6.4.9.2\n6.4.10\n6.4.11.2\n6.4.12.2\n6.4.14.2\n6.4.15.2\n6.4.16.2\n6.4.17.2\n","R":"6.2\n6.3\n6.5\n6.7.1\n6.7.2\n6.7.3\nA.1.3\nA.1.4\nA.2","S":"5.19","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","Y":"✓","AB":"GV.OV-01","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"8.2 - AI risk assessment_x000D_\n8.3 - AI risk treatment_x000D_\n8.4 - AI system impact assessment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute."},"originalFormulas":{}},{"id":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":7,"originalCells":{"D":"GOVERN 1.6","E":"Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.","F":"Are mechanisms in place to inventory AI systems and resourced according to organizational risk priorities?","G":"Ensure that mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.","J":"✓","K":"✓","L":"✓","M":"✓","N":"6.3","P":"6.3.1","Q":"5.1\n6.2.3.3\n6.2.4.1\n6.2.4.3\n6.2.6.3\n6.3.1.1\n","R":"4.3\n5.3\n6.3\n6.7.3","S":"6.2.2","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","Y":"✓","AB":"ID.AM-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.4.5 - System and computing resources_x000D_\nB.4.3 - Data resources_x000D_\nB.4.4 - Tooling resources_x000D_\nB.4.6 - Human resources_x000D_\nB.4.2 - Resource documentation","AK":"Connecticut: Established AI Task Force (2023); developing \"AI Bill of Rights\"; mandates annual inventory of state AI systems.\nNew Jersey: Governor's AI Task Force to study impact (2023).\nOklahoma: Governor's AI task force to study and develop policy recommendations (2023).\nPennsylvania: Generative AI Governing Board to guide policy, use, and deployment (2023).\nSouth Carolina: House AI study special committee (2024).\nWest Virginia: 2023 supply chain and AI hearing.\nWyoming: Select committee discussing synthetic media regulations (2023).","AL":"LLM03 Supply Chain\n\nNote: An AI inventory supports dependency visibility, third-party oversight, and control of external systems and models. It helps reduce supply-chain risk."},"originalFormulas":{}},{"id":"ROW-61cc7a9e3d5af3e4a28903bb","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":8,"originalCells":{"D":"GOVERN 1.7","E":"Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization’s trustworthiness.","F":"Are processes and procedures in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization’s trustworthiness?","G":"Ensure that processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization’s trustworthiness.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/govern-1-7","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","Q":"5.3\n6.3.3.3\n6.4.8.2\n6.4.8.3\n6.4.17.1\n","R":"4.3\n5.3","S":"6.1\n6.2.9","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","Z":"✓","AJ":"B.6.2.6 - AI system operation and monitoring","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","AL":"LLM03 Supply Chain\nLLM06 Excessive Agency\n\nNote: Safe retirement removes old models, residual access, and obsolete dependencies. That directly reduces supply-chain exposure and leftover autonomous behavior."},"originalFormulas":{}},{"id":"ROW-a48f708bf6e0c780ea4502ef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":9,"originalCells":{"B":"GOVERN 2","C":"Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.","D":"GOVERN 2.1","E":"Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.","F":"Are roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks documented and are clear to individuals and teams throughout the organization?","G":"Ensure that roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.","J":"✓","K":"✓","L":"✓","N":"6.1","O":"6.1","P":"5.4.5 - ISO 3100:2018\n6.2 ISO 3100:2015","Q":"6.2.4.3\n6.4.2.3\n6.4.7.3\n6.4.9.4","R":"4.1\n6.2\n6.3\n6.7.1\n6.7.3\nA2","S":"5.19","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","AJ":"9.1 - Monitoring, measurement, analysis, and evaluation\n5.3 - Roles, responsibilities and authorities\n7.1 - Resources\n7.2 - Competence\n7.3 - Awareness\n7.4 - Communication\nB.3.2 - AI roles and responsibilities","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA establishes AG enforcement, complaints portal, and state advisory council with defined statutory responsibilities."},"originalFormulas":{}},{"id":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":10,"originalCells":{"D":"GOVERN 2.2","E":"The organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.","F":"Do the organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements?","G":"Ensure that the organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/govern-2-2","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.4","P":"5.4.1 - ISO 31000:2018","Q":"6.4.12.1","R":"4.1\n4.3\n5.1\n6.7.2\n6.7.5\nA.1.3","S":"6.2.2","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","Y":"✓","AB":"PR.AT-01\nPR.AT-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"7.2 - Competence","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute."},"originalFormulas":{}},{"id":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":11,"originalCells":{"D":"GOVERN 2.3","E":"Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.","F":"Does executive leadership of the organization take responsibility for decisions about risks associated with AI system development and deployment?","G":"Ensure that executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.","J":"✓","K":"✓","L":"✓","M":"✓","O":"A.2.2.3","P":"5.5","Q":"6.3.4.3\n6.4.3.3","R":"6.6.1","S":"6.2.2","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","Y":"✓","AB":"GV.RM-04\nGV.RR-01","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"5.1 - Leadership and commitment\n9.3.1 - General\n9.3.2 - Management review inputs\n9.3.3 - Management review results\n5.2 - AI Policy\nB.2.2 - AI Policy","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute."},"originalFormulas":{}},{"id":"ROW-0098fef5b5465970b83a35a3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":12,"originalCells":{"B":"GOVERN 3","C":"Workforce diversity, equity, inclusion, and accessibility processes are prioritized in the mapping, measuring, and managing of AI risks throughout the lifecycle.","D":"GOVERN 3.1","E":"Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds).","F":"Are decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds)?","G":"Ensure that decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds).","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/govern-3-1","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.1","O":"7.2","P":"6.2 - ISO 31000:2018","Q":"6.3.3","R":"6.1\n6.3\n6.5\n6.7.1\n6.7.2\n6.7.3\nAnnex A","S":"6.2.2","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","W":"✓","X":"✓","AA":"✓","AJ":"B.4.6 - Human resources_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute."},"originalFormulas":{}},{"id":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":13,"originalCells":{"D":"GOVERN 3.2","E":"Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.","F":"Are policies and procedures in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems?","G":"Ensure that policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.1","O":"8.1","P":"5.4.3 - ISO 31000:2018","Q":"5.3","R":"4.3\n6.2\n6.6.2\n6.7.4\n","S":"3.1.5\n3.1.16\n3.3.3\n5.1\n5.13\n7.1\n7.4.3","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","AB":"GV.SC-01","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.9.3 - Objectives for responsible use of AI system_x000D_\nB.4.6 - Human resources_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\n7.2 - Competence_x000D_\nB.3.2 - Management review inputs","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","AL":"LLM06 Excessive Agency\nLLM05 Improper Output Handling\nLLM09 Misinformation\n\nNote: Human oversight boundaries directly reduce over-automation, unsafe output use, and unchecked misleading output."},"originalFormulas":{}},{"id":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":14,"originalCells":{"B":"GOVERN 4","C":"Organizational teams are committed to a culture that considers and communicates AI risk.","D":"GOVERN 4.1","E":"Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts.","F":"Are organizational policies and practices in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts?","G":"Ensure that organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.3","O":"8.1","P":"6.3.3\n6.4.2.6\n6.4.3.2","Q":"6.3.4.3\n6.4.3.3\n6.4.17.1","R":"4.3\n6.7.3","S":"3.5.16\n5.15.2\n5.15.3\nAnnex A","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","Z":"✓","AB":"ID.AM-05\nID.RA-04\nID.RA-05\nID.RA-07\nDE.AE-04","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.5.2 - AI system impact assessment process\nB.6.1.2 - Objectives for responsible development of AI system\nB.6.1.3 - Processes for responsible design and development of AI systems\nB.6.2.4 - AI system verification and validation\nB.9.2 - Processes for responsible use of AI systems\nB.9.3 - Objectives for responsible use of AI system\nB.10.3 - Suppliers\nB.5.4 - Assessing AI system impact on individuals and groups of individuals","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\n\nNote: A safety-first mindset reduces blind acceptance of model output and encourages verification before downstream use."},"originalFormulas":{}},{"id":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":15,"originalCells":{"D":"GOVERN 4.2","E":"Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.","F":"Do organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and do they communicate about the impacts more broadly?","G":"Ensure that organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.2","O":"3.1.4","P":"5.2","Q":"6.3.8.3\n6.4.2.3","R":"4.2\n4.3\n5.5\n6.1\n6.3\n6.5\n6.6.1\n6.7.2\n6.7.4\n6.7.5","S":"5.18","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","Z":"✓","AB":"ID.AM-05\nID.RA-04\nID.RA-05\nID.RA-07\nDE.AE-04","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.8.5 - Information for interested parties_x000D_\n7.4 - Communication_x000D_\n6.1.4 - AI system impact assessment_x000D_\nB.5.5 - Assessing societal impacts of AI systems","AK":"Colorado: Colorado AI Act (2024): CAIA requires public disclosure and notification to consumers when HRAIS (High Risk AI Systems) are used, so NIST builds transparency into system operation and consumer rights.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is implicit on where use or deployment of AI in a prohibited or high-risk context is banned or must be reported.\nUtah: AI Policy Act (2024): UAIPA requirement for mandatory GenAI disclosure at first interaction (regulated occupations and consumer settings) maps as NIST requires communication of AI system involvement and its risks​; UAIPA liability cannot be transferred to AI reinforces NIST's accountability even when AI is involved; legal responsibility must be maintained."},"originalFormulas":{}},{"id":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":16,"originalCells":{"D":"GOVERN 4.3","E":"Organizational practices are in place to enable AI testing, identification of incidents, and information sharing.","F":"Are organizational practices in place to enable AI testing, identification of incidents, and information sharing?","G":"Ensure that organizational practices are in place to enable AI testing, identification of incidents, and information sharing.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.5","O":"3.1.4\n6.4\n7.2\n8.2\n8.4\n8.5","P":"6.4.2.4","Q":"6.4.15.3\n6.4.16.1","R":"4.3\n6.7.4","S":"3.5.10\n5.15.4\n6.2.6","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","Z":"✓","AB":"RS.CO-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users_x000D_\nB.8.3 - External reporting_x000D_\nB.8.4 - Communication of incidents_x000D_\nB.8.5 - Information for interested parties_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","AL":"LLM01 Prompt Injection\nLLM04 Data and Model Poisoning\nLLM05 Improper Output Handling\nLLM09 Misinformation\n\nNote: Testing and incident sharing directly help detect adversarial prompting, poisoning, bad outputs, and repeated misinformation patterns."},"originalFormulas":{}},{"id":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":17,"originalCells":{"B":"GOVERN 5","C":"Processes are in place for robust engagement with relevant AI actors.","D":"GOVERN 5.1","E":"Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks.","F":"Are organizational policies and practices in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks?","G":"Ensure that organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.2","O":"7.6\n","P":"5.4.5 - ISO 3100:2018\n6.2 - ISO 3100:2015","Q":"5.1\n6.4.3.3","R":"4.3\n5.1\n5.2.3\n5.4\n5.5\n6.5\n6.7.2\nA.1.3\nA.1.4\nA.3","S":"5.11.4\n5.18\n8.6.2","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","Z":"✓","AB":"DE.AE-04","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.10.4 - Customers_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.8.3 - External reporting","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.\nUtah: AI Policy Act (2024): UAIPA establishes an Office of AI Policy, which institutionalizes stakeholder engagement and public sector governance for ongoing oversight.","AL":"LLM09 Misinformation\nLLM05 Improper Output Handling\n\nNote: External feedback helps surface harmful or misleading outputs that internal teams may miss."},"originalFormulas":{}},{"id":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":18,"originalCells":{"D":"GOVERN 5.2","E":"Mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation.","F":"Are mechanisms established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation?","G":"Ensure that mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.4.2\n9.10.5","O":"8.1\n8.4\n8.5","P":"5.4.5 - ISO 3100:2018\n6.2 - ISO 3100:2015","Q":"5.1\n5.3\n6.3.5.3\n6.4.5\n6.4.9.1\n6.4.12.3\n6.4.15.3\n6.4.16.3","R":"5.2.3\n5.4","S":"5.11.4\n5.18\n8.6.2","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","Z":"✓","AB":"RS.CO-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.8.3 - External reporting_x000D_\nB.10.4 - Customers_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.\nUtah: AI Policy Act (2024): UAIPA establishes an Office of AI Policy, which institutionalizes stakeholder engagement and public sector governance for ongoing oversight.","AL":"LLM09 Misinformation\nLLM05 Improper Output Handling\n\nNote: Closing the feedback loop helps correct recurring falsehoods and output-handling weaknesses."},"originalFormulas":{}},{"id":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":19,"originalCells":{"B":"GOVERN 6","C":"Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues.","D":"GOVERN 6.1","E":"Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights.","F":"Are policies and procedures in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights?","G":"Ensure that policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/govern-6-1","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.5","P":"5.4.1 - ISO 31000:2018","Q":"6.4.3.3\n","R":"5.5\n6.4\nA.3","S":"8.6.1","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","Z":"✓","AB":"GV.SC-05","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.10.2 - Allocating responsibilities_x000D_\nB.10.3 - Suppliers","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","AL":"LLM03 Supply Chain\n\nNote: Third-party entity risk is a direct supply-chain issue because it covers vendors, hosted services, and external dependencies."},"originalFormulas":{}},{"id":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":20,"originalCells":{"D":"GOVERN 6.2","E":"Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk.","F":"Are contingency processes in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk?","G":"Ensure that contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/govern-6-2","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.1","O":"8.3","P":"5.4.1 - ISO 31000:2018","Q":"6.4.15.3\n","R":"6.7.5","S":"5.15.4","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","Z":"✓","AB":"GV.SC-10","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.10.2 - Allocating responsibilities_x000D_\nB.10.3 - Suppliers","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","AL":"LLM03 Supply Chain\nLLM10 Unbounded Consumption\n\nNote: Contingency planning addresses dependency failures and service overuse when upstream systems fail or become unavailable."},"originalFormulas":{}},{"id":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":21,"originalCells":{"A":"MAP","B":"MAP 1","C":"Context is established and understood.","D":"MAP 1.1","E":"Intended purposes, potentially beneficial uses, context specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented.\n\nConsiderations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related Test & Evaluation, Validation & Verification (TEVV) and system metrics.","F":"Are intended purposes, potentially beneficial uses, context specific laws, norms and expectations, and prospective settings in which the AI system will be deployed understood and documented?\n\nDo considerations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related Test & Evaluation, Validation & Verification (TEVV) and system metrics?","G":"Ensure that intended purposes, potentially beneficial uses, context specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented.\n\nEnsure that considerations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related Test & Evaluation, Validation & Verification (TEVV) and system metrics.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.6","O":"6.3\n6.5.1\n6.5.5\n8.2\n8.5\n8.8\n","P":"6.4.2.6\n6.5.2 - ISO 31000:2018\n","Q":"5.2\n6.3.4.3\n6.4.2.1\n6.4.13.1\n6.4.15.3\n6.4.17.1\nA.2.5","R":"4.2\n4.3\n5.3\n6.4\n6.7.4\n6.7.5","S":"5.13\n5.15.2\n5.16\n5.17\n6.2.2\n7.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"PR.PS-06","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.4 - AI system impact assessment_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","AK":"Arizona: Supreme Court uses AI avatars for judicial transparency (2025); laws against sexual and political deepfakes (2024); SB640 (2025) requires chatbot disclosure in consumer interactions.\nColorado: Colorado AI Act (2024): CAIA requires public disclosure and notification to consumers when HRAIS (High Risk AI Systems) are used, so NIST maps consequential use contexts and provides system knowledge boundaries.\nNevada: SB2203 requires AI company registration and misinformation frameworks; proposed synthetic media disclosure for elections (2025).\nNew Mexico: Proposed AI regulations to regulate child profiling (2024).\nNorth Dakota: HB1167 proposed AI election disclaimers (2025).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA requires clear disclosure, bans deployment for certain uses (e.g., behavioral manipulation, social scoring by government).\nUtah: AI Policy Act (2024): UAIPA is a context-specific law and ​mapping this disclosure requirement into the AI’s deployment context aligns with this subcategory relating to knowledge limits and human oversight of AI.","AL":"LLM02 Sensitive Information Disclosure\nLLM06 Excessive Agency\nLLM09 Misinformation\n\nNote: Knowing the use context helps bound what data is exposed, what the system may do, and how misleading output could harm users."},"originalFormulas":{}},{"id":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":22,"originalCells":{"D":"MAP 1.2","E":"Interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. Opportunities for interdisciplinary collaboration are prioritized.","F":"Are interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation documented? \n\nAre opportunities for interdisciplinary collaboration prioritized?","G":"Ensure that interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. \n\nEnsure that opportunities for interdisciplinary collaboration are prioritized.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-1-2","J":"✓","K":"✓","L":"✓","N":"9.8","Q":"5.1\n6.2.3.3\n6.2.4.1\n6.2.4.3\n6.2.6.1\n6.2.6.3\n6.4.9.4\n","R":"A.1.3","S":"5.1\n6.2.2","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"PR.AT-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.4.6 - Human resources_x000D_\n7.2 - Competence","AK":"Utah: AI Policy Act (2024): Requirement for prominent GenAI disclosure in professions requiring state licensure, such as healthcare, accounting, and law ties directly to disclosure of AI involvement and ensuring the user knows the limits of GenAI's role."},"originalFormulas":{}},{"id":"ROW-85932760270a1fa0ded7c021","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":23,"originalCells":{"D":"MAP 1.3","E":"The organization’s mission and relevant goals for AI technology are understood and documented.","F":"Are the organization’s mission and relevant goals for AI technology understood and documented?","G":"Ensure that the organization’s mission and relevant goals for AI technology are understood and documented.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-1-3","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.1","O":"6.2.1\n6.3\n7.6\n8.1\n8.8","Q":"6.4.1\n6.4.13.1\nA.2.5","R":"4.1\nA.1.1\nA.1.4\nA.2","S":"6.2.2","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","X":"✓","AJ":"4.1 - Understanding the organization and its context_x000D_\n5.2 - AI Policy_x000D_\n6.2 - AI objectives and planning to achieve them_x000D_\n7.5.3 - Control of documented information_x000D_\n7.3 - Awareness_x000D_\n7.4 - Communication","AL":"LLM06 Excessive Agency\nLLM09 Misinformation\n\nNote: A clear mission limits inappropriate autonomy and reduces off-goal output behavior."},"originalFormulas":{}},{"id":"ROW-703b31d88fa158ac7a58b26f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":24,"originalCells":{"D":"MAP 1.4","E":"The business value or context of business use has been clearly defined or – in the case of assessing existing AI systems – re-evaluated.","F":"Have the business value or context of business use been clearly defined or – in the case of assessing existing AI systems – re-evaluated?","G":"Ensure that the business value or context of business use has been clearly defined or – in the case of assessing existing AI systems – re-evaluated.","J":"✓","K":"✓","L":"✓","M":"✓","N":"6.2\n8.8.2.5","O":"8.2\n","P":"5.4.1\n5.4.2","Q":"6.1.1.3\n6.2.3.3\n6.2.4.1\n6.3.2.1\n6.4.1","R":"5.4\nA.1.2\nA.3","S":"5.10\n6.2.2\n7.1\n7.4.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","X":"✓","AJ":"5.1 - Leadership and commitment_x000D_\n4.1 - Understanding the organization and its context_x000D_\nB.2.2 - Customers_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.9.4 - Intended use of the AI system_x000D_\nB.6.2.2 - AI system requirements and specification","AL":"LLM06 Excessive Agency\nLLM09 Misinformation\n\nNote: Defining intended use helps constrain deployment scope and reduces misuse-driven false output."},"originalFormulas":{}},{"id":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":25,"originalCells":{"D":"MAP 1.5","E":"Organizational risk tolerances are determined and documented.","F":"Are organizational risk tolerances determined and documented?","G":"Ensure that organizational risk tolerances are determined and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.4","P":"5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","Q":"6.3.4","R":"4.2\n4.3\n5.5\n6.6.1\n6.7.1\n6.7.2\n6.7.3\n6.7.5\nA.1.4\nA.2","S":"5.18\n6.1\n6.2.2\n6.2.3\n6.2.4\n6.2.5\n6.2.6\n6.2.7\n6.2.8\n9.4\nAnnex A","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","X":"✓","Y":"✓","AB":"GV.RM-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.1 - Objective"},"originalFormulas":{}},{"id":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":26,"originalCells":{"D":"MAP 1.6","E":"System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. \n\nDesign decisions take socio-technical implications into account to address AI risks.","F":"Are system requirements (e.g., “the system shall respect the privacy of its users”) elicited from and understood by relevant AI actors?\n\nDoes design decisions take socio-technical implications into account to address AI risks?","G":"Ensure that system requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. \n\nEnsure that design decisions take socio-technical implications into account to address AI risks.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-1-6","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.5","O":"8.3","P":"5.4.1 - ISO 31000:2018","Q":"6.3.4.3\n6.4.1.3\n6.4.3.3\n6.4.8.3\n6.4.17.3","R":"5.3\n6.4\n6.6.2\n6.7.2\n6.7.3\n6.7.5\nA.3","S":"3.2.11\n3.5.14\n3.5.15\n3.5.16\n5.15.8\n5.19\n6.2\n6.1\n6.2.2\n8.6.2\nAnnex A","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","X":"✓","Y":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.2 - AI system requirements and specification_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","AL":"LLM02 Sensitive Information Disclosure\nLLM07 System Prompt Leakage\nLLM06 Excessive Agency\n\nNote: Privacy and output-boundary requirements directly reduce leakage and unsafe autonomous behavior."},"originalFormulas":{}},{"id":"ROW-ba52e3e7b4f68cefe2772138","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":27,"originalCells":{"B":"MAP 2","C":"Categorization of the AI system is performed.","D":"MAP 2.1","E":"The specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders).","F":"Are the specific tasks and methods used to implement the tasks that the AI system will support defined (e.g., classifiers, generative models, recommenders)?","G":"Ensure that the specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders).","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.3\n9.7","O":"6.1\n6.2\n6.5.3.2.8\n6.5.5.1\n6.5.5.6\n7.3","Q":"5.1\n5.4.2\n6.1.1.3\n6.1.2.3\n6.2.3.3\n6.2.4.3\n6.2.5.3\n6.2.6.3\n6.3.1.3\n6.3.2.3\n6.3.3.3\n6.4.8.3","R":"3.2.1\n5.2.1\n5.4\n6.3\nA.1.4","S":"3.1.14\n3.1.24\n3.1.29\n3.1.35\n5.1\n5.2\n5.5\n5.11.1\n5.19.5.1\n7.2\n8.2\n8.6.2\n8.7.2\n9.1\n9.2.2.1\n10.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AJ":"B.6.2.3 - Documentation of AI system design and development_x000D_\nB.4.2 - Resource documentation_x000D_\nB.4.3 - Data resources_x000D_\nB.4.4 - Tooling resources_x000D_\nB.4.5 - System and computing resources_x000D_\nB.4.6 - Human resources","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","AL":"LLM06 Excessive Agency\nLLM05 Improper Output Handling\nLLM09 Misinformation\n\nNote: The architecture choice determines output handling, autonomy, and hallucination risk."},"originalFormulas":{}},{"id":"ROW-46e67c638cc2b2eda5d9c56f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":28,"originalCells":{"D":"MAP 2.2","E":"Information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans is documented. \n\nDocumentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions.","F":"Is information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans documented?\n\nDoes documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions?","G":"Ensure that information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans is documented. \n\nEnsure that documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.11.3","O":"6.5.3.2.7","Q":"5.1","R":"5.1\n5.2.1\n5.2.3\n6.3\n6.5\n6.6.1","S":"5.4\n5.15.8\n7.3\n8.1\n8.5.1\n8.5.2","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AJ":"B.6.2.7 - AI system technical documentation_x000D_\nB.9.3 - Objectives for responsible use of AI system_x000D_\nB.8.2 - System documentation and information for users","AK":"Colorado: Colorado AI Act (2024): CAIA requires public disclosure and notification to consumers when HRAIS (High Risk AI Systems) are used, so NIST maps consequential use contexts and provides system knowledge boundaries.\nFlorida: Unlawful to possess AI-generated child pornography (2024); established tech modernization council to study and monitor the development and deployment of AI systems.\nHawaii: SB640 Chatbot disclosure mandates; prohibits discriminatory algorithmic eligibility determinations (2025).\nIowa: Sexual deepfake laws enacted in 2024; appropriated $2.8M to expand AI-related degree programs (SF2435).\nLouisiana: Laws against child sexual deepfakes (2023); created technology and cybersecurity committee AI impact study (2023).\nMassachusetts: Facial recognition technology restrictions for law enforcement (2020).\nVirginia: HB2094 Synthetic media disclaimer requirements for elections (2025); SB741 facial recognition technology legalization (2022).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.\nUtah: AI Policy Act (2024): UAIPA is a context-specific law and ​mapping this disclosure requirement into the AI’s deployment context aligns with this subcategory relating to knowledge limits and human oversight of AI.","AL":"LLM09 Misinformation\nLLM06 Excessive Agency\n\nNote: Explicitly defining limitations and oversight is a direct control against over-reliance and unsafe use of output."},"originalFormulas":{}},{"id":"ROW-d9f06df2f305738c6ee22a37","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":29,"originalCells":{"D":"MAP 2.3","E":"Scientific integrity and Test & Evaluation, Validation & Verification (TEVV) considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.","F":"Are scientific integrity and Test & Evaluation, Validation & Verification (TEVV) considerations identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation?","G":"Ensure that scientific integrity and Test & Evaluation, Validation & Verification (TEVV) considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-2-3","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.3","O":"6.4\n6.5.3.1\n8.2\n8.4\n8.5\n8.6\n8.8\n","Q":"5.3\n6.3.1.3\n6.4.13\n6.4.14\nA.2.5\nA.3","R":"4.3\n6.6.1\n6.6.2","S":"3.5.17\n5.10\n5.11.9.2\n5.16\n6.1\n6.2.3\n6.2.4","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AJ":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.7.2 - Data for development and enhancement of AI system_x000D_\nB.7.3 - Acquisition of data_x000D_\nB.7.4 - Quality of data for AI systems_x000D_\nB.7.5 - Data provenance_x000D_\nB.7.6 - Data preparation_x000D_\nB.6.2.4 - AI system verification and validation","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","AL":"LLM04 Data and Model Poisoning\nLLM09 Misinformation\nLLM08 Vector and Embedding Weaknesses\n\nNote: Weak data selection and poor validation are upstream causes of poisoned models, misleading behavior, and retrieval weaknesses."},"originalFormulas":{}},{"id":"ROW-a667c7e4bfa9ed4093d8339e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":30,"originalCells":{"B":"MAP 3","C":"AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","D":"MAP 3.1","E":"Potential benefits of intended AI system functionality and performance are examined and documented.","F":"Are potential benefits of intended AI system functionality and performance  examined and documented?","G":"Ensure that potential benefits of intended AI system functionality and performance are examined and documented.","J":"✓","K":"✓","L":"✓","M":"✓","O":"3.1.4\n6.3\n6.4\n6.5.1\n6.5.3.1\n6.5.3.2\n6.5.5.6\n6.5.5.7\n6.5.5.8\n7.2\n7.4\n7.6\n8.2\n8.3\n8.4\n8.5\n8.7\n8.8","Q":"5.3","R":"5.2.3\n5.3","S":"3.1.29\n3.5.9\n3.5.18\n5.13\n5.15.1\n5.15.2\n5.16\n5.17\n6.2.2\n7.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AA":"✓","AJ":"B.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols."},"originalFormulas":{}},{"id":"ROW-b02ffae768353b3e8eaa71a0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":31,"originalCells":{"D":"MAP 3.2","E":"Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness – as connected to organizational risk tolerance\n– are examined and documented.","F":"Are potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness – as connected to organizational risk tolerance – examined and documented?","G":"Ensure that potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness – as connected to organizational risk tolerance – are examined and documented.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-3-2","J":"✓","K":"✓","L":"✓","M":"✓","N":"8.10\n9.8\n","O":"6.5.4.1\n6.5.4.2\n7.4","P":"6.4.2.6","Q":"6.4.3.3\n6.4.12.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","R":"4.2\n6.4\n","S":"6.2.2\n6.2.6\n7.4.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AA":"✓","AJ":"B.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\n8.2 - AI risk assessment_x000D_\n8.3 - AI risk treatment_x000D_\n8.4 - AI system impact assessment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","AL":"LLM09 Misinformation\nLLM05 Improper Output Handling\n\nNote: Evaluating cost of errors highlights the impact of false or unsafe outputs and supports stronger safeguards."},"originalFormulas":{}},{"id":"ROW-8602a79ba41c9dd322dc03f3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":32,"originalCells":{"D":"MAP 3.3","E":"Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.","F":"Is targeted application scope specified and documented based on the system’s capability, established context, and AI system categorization?","G":"Ensure that targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.3.4","O":"6.5.3.2.1\n6.5.3.2.3.2\n8.4","P":"6.3.2 - ISO 31000:2018\n6.3.3 - ISO 31000:2018","Q":"5.3\n6.2.3.3\n6.4.2.1\n6.4.12.1\n6.4.15.3\n6.4.16.1\nA.2.4\nA.2.7\n","R":"5.5\n6.5\n6.6.2\n6.7.4","S":"3.7.1\n8.7.2\n9.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AA":"✓","AJ":"4.3 - Determining the scope of the AI management system_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","AL":"LLM06 Excessive Agency\nLLM01 Prompt Injection\n\nNote: Narrower scope limits abuse surface and reduces the opportunity for prompt-based misuse."},"originalFormulas":{}},{"id":"ROW-3f93b4efa0dcd201822467db","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":33,"originalCells":{"D":"MAP 3.4","E":"Processes for operator and practitioner proficiency with AI system performance and trustworthiness – and relevant technical standards and certifications – are defined, assessed, and documented.","F":"Are processes for operator and practitioner proficiency with AI system performance and trustworthiness – and relevant technical standards and certifications – defined, assessed, and documented?","G":"Ensure that processes for operator and practitioner proficiency with AI system performance and trustworthiness – and relevant technical standards and certifications – are defined, assessed, and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"6.3","O":"8.1","Q":"5.3\n6.3.4.3\n6.4.11.1\n6.4.15.1","R":"6.6.2","S":"5.15.1\n5.15.2\n5.19.5.4\n5.19.5.5","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AA":"✓","AJ":"7.2 - Competence_x000D_\nB.4.6 - Human resources","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols."},"originalFormulas":{}},{"id":"ROW-8116ca7de2a78bfcee4bf523","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":34,"originalCells":{"D":"MAP 3.5","E":"Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.","F":"Are processes for human oversight defined, assessed, and documented in accordance with organizational policies from the GOVERN function?","G":"Ensure that processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-3-5","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","P":"5.4.3 - ISO 31000:2018","Q":"6.3.4.3\n6.4.3.3\n6.4.14.1","R":"3.2.1\n4.3\n5.1\n5.3\n5.4\n5.5\n6.2\n6.3\n6.5\n6.7.3\nA.1.1\nA.1.3\nA.1.4","S":"5.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AA":"✓","AJ":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","AL":"LLM06 Excessive Agency\nLLM05 Improper Output Handling\nLLM09 Misinformation\n\nNote: Human review is directly relevant to preventing unchecked autonomy and untrusted output."},"originalFormulas":{}},{"id":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":35,"originalCells":{"B":"MAP 4","C":"Risks and benefits are mapped for all components of the AI system including third-party software and data.","D":"MAP 4.1","E":"Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.","F":"Are approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights?","G":"Ensure that approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-4-1","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.1","P":"5.4.1 - ISO 31000:2018\n5.6 - ISO 31000:2018","Q":"6.1.1.3\n6.4.1.3\n6.4.3.3\n6.4.8.2\n6.4.8.3\n6.4.17.1","R":"5.5\n6.4\nA.3","S":"5.15.1\n5.17","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Y":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"4.1 - Understanding the organization and its context_x000D_\nB.2.2 - AI policy_x000D_\nB.9.2 - Processes for responsible use of AI systems_x000D_\nB.9.4 - Intended use of the AI system","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. Explicit in TRAIGA: biometric consent, privacy violation, unlawful discrimination, deepfake/child exploitation, etc.","AL":"LLM03 Supply Chain\nLLM04 Data and Model Poisoning\n\nNote: Third-party components and data are classic supply-chain and poisoning entry points."},"originalFormulas":{}},{"id":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":36,"originalCells":{"D":"MAP 4.2","E":"Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented.","F":"Are internal risk controls for components of the AI system, including third-party AI technologies, identified and documented?","G":"Ensure that internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-4-2","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.4","P":"5.4.1 - ISO 31000:2018","Q":"6.4.8.3","R":"6.7.2","S":"6.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Y":"✓","AB":"ID.RA-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users_x000D_\nB.10.3 - Suppliers","AL":"LLM03 Supply Chain\nLLM04 Data and Model Poisoning\nLLM08 Vector and Embedding Weaknesses\n\nNote: Internal controls on components directly reduce third-party dependency risk and poisoned or weak retrieval components."},"originalFormulas":{}},{"id":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":37,"originalCells":{"B":"MAP 5","C":"Impacts to individuals, groups, communities, organizations, and society are characterized.","D":"MAP 5.1","E":"Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.","F":"Are likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data identified and documented?","G":"Ensure that likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.4.2\n9.10.5\n","P":"6.3.4 - ISO 31000:2018\n6.4.2.6\n6.4.3.2\n6.4.3.3","Q":"6.3.8.3\n6.4.2.3","R":"3.2.2\n6.7.3","S":"5.15.7\n5.18","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.2 - AI risk assessment_x000D_\nB.5.2 - AI system impact assessment process","AK":"Colorado: Colorado AI Act (2024): CAIA prohibits algorithmic discrimination in high-risk areas (jobs, loans, housing, etc.) and NIST requires identification of group-level impacts and high-risk decision contexts.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA includes complaint process and AG assessment of harm where statutory lines crossed.","AL":"LLM09 Misinformation\nLLM05 Improper Output Handling\nLLM06 Excessive Agency\n\nNote: Impact assessment helps identify where misleading output, unsafe output handling, or over-autonomy would cause the most harm."},"originalFormulas":{}},{"id":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":38,"originalCells":{"D":"MAP 5.2","E":"Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented.","F":"Are practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts in place and documented?","G":"Ensure that practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.4.2\n9.10.5\n","P":"ISO 31000:2018, Clause 4","Q":"6.3.8.3\n6.4.1.3","R":"4.3\n5.1\n5.5\n6.7.2","S":"5.18\n5.19","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"ID.RA-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.8.3 - External reporting","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. The Texas AI Council created under TRAIGA has a mandate to advise, review, and integrate feedback.","AL":"LLM09 Misinformation\nLLM05 Improper Output Handling\n\nNote: User and stakeholder feedback often reveals output errors and harmful behaviors not visible internally."},"originalFormulas":{}},{"id":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":39,"originalCells":{"A":"MEASURE","B":"MEASURE 1","C":"Appropriate methods and metrics are identified and applied.","D":"MEASURE 1.1","E":"Approaches and metrics for measurement of AI risks enumerated during the MAP function are selected for implementation starting with the most significant AI risks. \n\nThe risks or trustworthiness characteristics that will not – or cannot – be measured are properly documented.","F":"Are approaches and metrics for measurement of AI risks enumerated during the MAP function selected for implementation starting with the most significant AI risks? \n\nAre the risks or trustworthiness characteristics that will not – or cannot – be measured properly documented?","G":"Ensure that approaches and metrics for measurement of AI risks enumerated during the MAP function are selected for implementation starting with the most significant AI risks. \n\nEnsure that the risks or trustworthiness characteristics that will not – or cannot – be measured are properly documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.3\n5.4\n6.4\n","O":"8.1","Q":"6.4.3.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","R":"4.3\n5.5\n6.4\n6.6.2\n6.7.2","S":"5.15.2\n6.2.2\n8.1","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AB":"ID.RA-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.1 - General_x000D_\n6.1.2 - AI risk assessment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM04 Data and Model Poisoning\nLLM09 Misinformation\nLLM05 Improper Output Handling\nLLM10 Unbounded Consumption\n\nNote: Prioritizing measurement for the most significant risks directly supports detection of poisoned behavior, false output, unsafe output handling, and resource abuse."},"originalFormulas":{}},{"id":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":40,"originalCells":{"D":"MEASURE 1.2","E":"Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities.","F":"Are appropriateness of AI metrics and effectiveness of existing controls regularly assessed and updated, including reports of errors and potential impacts on affected communities?","G":"Ensure that appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.4","O":"6.5.5","Q":"6.4.12.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","R":"4.3\n6.1\n6.4\n6.7.3","S":"5.15.2\n6.2.2\n8.1","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AB":"GV.OV-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.4 - AI system verification and validation_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.5 - Assessing societal impacts of AI systems","AL":"LLM04 Data and Model Poisoning\nLLM09 Misinformation\nLLM05 Improper Output Handling\nLLM10 Unbounded Consumption\n\nNote: Ongoing metric review is directly relevant to drift, recurring errors, output quality, and anomalous consumption patterns."},"originalFormulas":{}},{"id":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":41,"originalCells":{"D":"MEASURE 1.3","E":"Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. \n\nDomain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance.","F":"Are internal experts who did not serve as front-line developers for the system and/or independent assessors involved in regular assessments and updates?\n\nAre domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities consulted in support of assessments as necessary per organizational risk tolerance?","G":"Ensure that internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. \n\nEnsure that domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/measure-1-3","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.2","P":"5.4.1 - ISO 31000:2018\n6.4.1 - ISO 31000:2018\n6.7","Q":"6.4.7.1\n6.4.7.3\n6.4.9.4","R":"4.3\n5.2.3\n6.4","S":"5.19.1\n5.19.5.1\n5.19.5.4\n6.2.8","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AB":"GV.SC-07","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.2 - AI risk assessment_x000D_\n9.2.2 - Internal audit programme_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements."},"originalFormulas":{}},{"id":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":42,"originalCells":{"B":"MEASURE 2","C":"AI systems are evaluated for trustworthy characteristics.","D":"MEASURE 2.1","E":"Test sets, metrics, and details about the tools used during Test & Evaluation, Validation & Verification (TEVV) are documented.","F":"Are test sets, metrics, and details about the tools used during Test & Evaluation, Validation & Verification (TEVV) documented?","G":"Ensure that test sets, metrics, and details about the tools used during Test & Evaluation, Validation & Verification (TEVV) are documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.5","O":"6.5\n8.3\n8.8\nA.3.2","P":"5.4.3","Q":"6.4.11.3","R":"4.3\n6.6.1\n6.6.2","S":"3.2.15\n5.11.8","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"ID.IM-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.8.4 - Communication of incidents_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.4.2 - Resource documentation","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements."},"originalFormulas":{}},{"id":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":43,"originalCells":{"D":"MEASURE 2.2","E":"Evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population.","F":"Do evaluations involving human subjects meet applicable requirements (including human subject protection) and  representative of the relevant population?","G":"Ensure that evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.6","O":"8.2","P":"6.6","Q":"6.4.2.3","R":"6.5","S":"5.19.6.2\n6.2.2","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.4 - AI system verification and validation","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements."},"originalFormulas":{}},{"id":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":44,"originalCells":{"D":"MEASURE 2.3","E":"AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). \n\nMeasures are documented.","F":"Are AI system performance or assurance criteria measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s)? \n\nAre measures documented?","G":"Ensure that AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). \n\nEnsure that measures are documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.6","Q":"6.3.8","R":"6.6.2","S":"3.1.25","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OV-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.7.4 - Quality of data for AI systems_x000D_\nB.6.2.6 - AI system operation and monitoring","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements."},"originalFormulas":{}},{"id":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":45,"originalCells":{"D":"MEASURE 2.4","E":"The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.","F":"Are the functionality and behavior of the AI system and its components – as identified in the MAP function –  monitored when in production?","G":"Ensure that the functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.1\n8.8.3\n9.9","O":"5","Q":"6.4.3.1","R":"5.2.3","S":"5.15.5\n5.16","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"RC.RP-04","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"9.1 - Monitoring, measurement, analysis, and evaluation_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.8 - AI system recording of event logs","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM04 Data and Model Poisoning\nLLM09 Misinformation\nLLM05 Improper Output Handling\nLLM10 Unbounded Consumption\n\nNote: Production monitoring helps detect degraded, manipulated, unsafe, or resource-abusive behavior after deployment."},"originalFormulas":{}},{"id":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":46,"originalCells":{"D":"MEASURE 2.5","E":"The AI system to be deployed is demonstrated to be valid and reliable. \n\nLimitations of the generalizability beyond the conditions under which the technology was developed are documented.","F":"Is the AI system to be deployed demonstrated to be valid and reliable?\n\nAre limitations of the generalizability beyond the conditions under which the technology was developed documented?","G":"Ensure that the AI system to be deployed is demonstrated to be valid and reliable. \n\nEnsure that limitations of the generalizability beyond the conditions under which the technology was developed are documented.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/measure-2-5","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.7\n9.11.2","Q":"5.1\n6.3.4.3\n6.4.11\n6.4.13\n6.4.14\nA.2.5\nA.3\n\n","R":"6.6.1","S":"3.5.9\n3.5.16\n5.15.2\n5.15.3\n5.15.4","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"PR.IR-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.4 - AI system verification and validation_x000D_\nB.6.2.5 - AI system deployment_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM01 Prompt Injection\nLLM07 System Prompt Leakage\nLLM06 Excessive Agency\n\nNote: Adversarial testing directly targets instruction manipulation, hidden-prompt exposure, and unsafe tool-using behavior."},"originalFormulas":{}},{"id":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":47,"originalCells":{"D":"MEASURE 2.6","E":"The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.","F":"Is the AI system evaluated regularly for safety risks – as identified in the MAP function? \n\nIs the AI system to be deployed demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits?\n\nDoes safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures?","G":"Ensure that the AI system is evaluated regularly for safety risks – as identified in the MAP function. \n\nEnsure that the AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. \n\nEnsure that safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/measure-2-6","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.2\n9.9\n9.11.3","O":"8.1","P":"5.6 - ISO 31000:2018","Q":"6.3.4.3","R":"6.7.2\n6.7.3","S":"Annex A","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.RM-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.8 - AI system recording of event logs_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\n8.2 - AI risk assessment","AK":"Colorado: Colorado AI Act (2024): CAIA is a comprehensive AI law addressing algorithmic discrimination (effective Feb 1, 2026); facial recognition guidelines for government use.\nMaine: Prohibits facial recognition technology use for law enforcement (2021).\nSouth Dakota: Sexual deepfake laws targeting child pornography (2024).\nTennessee: ELVIS Act (2024) against voice cloning; requires universities and local school boards to adopt AI-use policies by 2025.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA requires agencies (and in specific healthcare contexts) to prevent and detect prohibited/harmful use, and the AG can require removal/suspension of systems in violation.\nUtah: AI Policy Act (2024): Consumer protections; focus on vulnerable populations.\nWashington: Biometric consent laws (2017); political ad disclosure (2023); sexual deepfake law (2024).","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM06 Excessive Agency\nLLM10 Unbounded Consumption\n\nNote: Safety evaluation, failure behavior, and runtime monitoring are most relevant to unsafe outputs, misleading results, and runaway behavior."},"originalFormulas":{}},{"id":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":48,"originalCells":{"D":"MEASURE 2.7","E":"AI system security and resilience – as identified in the MAP function – are evaluated and documented.","F":"Are AI system security and resilience – as identified in the MAP function – evaluated and documented?","G":"Ensure that AI system security and resilience – as identified in the MAP function – are evaluated and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"8.2\n9.7\n5.4","O":"8.1","P":"5.4.1 - ISO 31000:2018","Q":"6.4.3.3","R":"4.3\n5.3\n6.4\n6.6.2\n6.7.2\n6.7.3\n6.7.5","S":"3.5.10\n3.5.16\n5.15.2\n5.15.3\n5.15.4","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.RM-06","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.7.2 - Data for development and enhancement of AI system_x000D_\nB.3.2 - AI roles and responsibilities_x000D_\nB.2.3 - Alignment with other organizational policies_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.6.2.3 - Documentation of AI system design and development_x000D_\nB.9.3 - Objectives for responsible use of AI system","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA’s language on “intentional violations,” and AG’s power to require information about model/data/metrics in case of complaints.","AL":"LLM01 Prompt Injection\nLLM04 Data and Model Poisoning\nLLM03 Supply Chain\nLLM10 Unbounded Consumption\nLLM05 Improper Output Handling\nLLM07 System Prompt Leakage\nLLM08 Vector and Embedding Weaknesses\n\nNote: Security and resilience evaluation is directly relevant to compromised dependencies, poisoned components, and harmful outputs."},"originalFormulas":{}},{"id":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":49,"originalCells":{"D":"MEASURE 2.8","E":"Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.","F":"Are risks associated with transparency and accountability – as identified in the MAP function – examined and documented?","G":"Ensure that risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.1\n9.2","O":"8.1","P":"5.4.1 - ISO 31000:2018","Q":"5.3\n6.3.4.3\n6.3.8.3\n6.4.3.3\n6.4.9.3\n6.4.14.3","R":"4.1\n4.2\n4.3\n5.3\n6.2\n6.3\n6.6.1\n6.7.2\n6.7.3\n6.7.4\nA.1.3","S":"3.5.2\n3.5.14\n3.5.15\n3.5.16\n5.15.8\n5.18\n6.1\n6.2.2\n7.4.1\n","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.RR-01","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.7.2 - Data for development and enhancement of AI system_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.9.3 - Objectives for responsible use of AI system_x000D_\n6.1.2 - AI risk assessment","AK":"Colorado: Colorado AI Act (2024): CAIA requires a duty to report algorithmic discrimination risk to Attorney General and NIST captures transparency/accountability risks and mandates traceable incident responses.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.\nUtah: AI Policy Act (2024): Requirement for prominent GenAI disclosure in professions requiring state licensure, such as healthcare, accounting, and law is part of this transparency/accountability dimension. Ensuring it's implemented and traceable fits this subcategory around evaluating transparency and accountability risks—whether disclosure mechanisms function correctly."},"originalFormulas":{}},{"id":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":50,"originalCells":{"D":"MEASURE 2.9","E":"The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.","F":"Is the AI model explained, validated, and documented, and AI system output interpreted within its context – as identified in the MAP function – to inform responsible use and governance?","G":"Ensure that the AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.3.4\n9.3.6\n9.10.2","O":"8.1","Q":"6.4.3.3\n6.4.9.3","R":"4.2\n5.5\n6.4\n6.7.1\n6.7.3\n6.7.4\n","S":"3.5.7\n5.15.6\n6.1","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.RR-01","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.7.5 - Data provenance_x000D_\nB.6.2.5 - AI system deployment_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM02 Sensitive Information Disclosure\n \nNote: Validation and contextual interpretation help prevent unsafe downstream use of incorrect, misleading, or sensitive output."},"originalFormulas":{}},{"id":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":51,"originalCells":{"D":"MEASURE 2.10","E":"Privacy risk of the AI system – as identified in the MAP function – is examined and documented.","F":"Is privacy risk of the AI system – as identified in the MAP function – examined and documented?","G":"Ensure that privacy risk of the AI system – as identified in the MAP function – is examined and documented.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/measure-2-10","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.6\n9.10.4","O":"8.1","P":"5.4.1 - ISO 31000:2018","Q":"5.1\n6.3.4.3\n6.4.1.3\n6.4.3.3\n6.4.8.3\n6.4.17.3\n","R":"5.3\n6.4\n6.6.2\n6.7.2\n6.7.3\n6.7.5\nA.3","S":"5.19.6.2\n6.1\n6.2.2\n8.6.2\nAnnex A","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.5.2 - AI system impact assessment process_x000D_\nB.7.2 - Data for development and enhancement of AI system_x000D_\nB.7.3 - Acquisition of data_x000D_\nB.2.3 - Alignment with other organizational policies","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is explicitly required for biometric data and anti-discrimination; other forms encouraged as best practice.","AL":"LLM02 Sensitive Information Disclosure\n\nNote: Privacy risk evaluation maps directly to disclosure of personal, training, or confidential information."},"originalFormulas":{}},{"id":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":52,"originalCells":{"D":"MEASURE 2.11","E":"Fairness and bias – as identified in the MAP function – are evaluated and results are documented.","F":"Are fairness and bias – as identified in the MAP function – evaluated and results documented?","G":"Ensure that Fairness and bias – as identified in the MAP\nfunction – are evaluated and results are documented.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/measure-2-11","J":"✓","K":"✓","L":"✓","M":"✓","N":"8.4","O":"6.3\n8.1\n8.3\nA.2.2.2","P":"5.4.1 - ISO 31000:2018","Q":"5.1\n6.3.4.3\n6.3.8.3\n6.4.3.3\n6.4.14.3\n","R":"4.2\n5.4\n6.4\n6.5\n6.7.2\n6.7.4\n","S":"3.2.2\n3.5.4\n5.10\n5.15.9\n7.4.1\nAnnex A\n","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.5.5 - Assessing societal impacts of AI systems_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals","AK":"Georgia: Early sexual deepfake laws (2021 and 2024); considering AI profiling bills.\nIllinois: Biometric Information Privacy Act (2008); restricts AI use in hiring process; sexual deepfake laws (2023-2024).\nMichigan: Election deepfake laws (2023).\nNew York: Criminalized sexual deepfakes (2023); requires disclaimers for political deepfakes (2024).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is explicitly required for biometric data and anti-discrimination; other forms encouraged as best practice."},"originalFormulas":{}},{"id":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":53,"originalCells":{"D":"MEASURE 2.12","E":"Environmental impact and sustainability of AI model training and management activities – as identified in the MAP function – are assessed and documented.","F":"Are environmental impact and sustainability of AI model training and management activities – as identified in the MAP function – assessed and documented?","G":"Ensure that environmental impact and sustainability of AI model training and management activities – as identified in the MAP function – are assessed and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.5\n8.7\n9.10.5","O":"6.2.7\n","P":"6.4.2\n6.4.3","Q":"6.4.2.3\n6.4.17.1","R":"6.5\n6.7.4","S":"5.15.2\n6.2.2","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.5.5 - Assessing societal impacts of AI systems_x000D_\nB.4.5 - System and computing resources","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements."},"originalFormulas":{}},{"id":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":54,"originalCells":{"D":"MEASURE 2.13","E":"Effectiveness of the employed Test & Evaluation, Validation & Verification (TEVV) metrics and processes in the MEASURE function are evaluated and documented.","F":"Is effectiveness of the employed Test & Evaluation, Validation & Verification (TEVV) metrics and processes in the MEASURE function evaluated and documented?","G":"Ensure that effectiveness of the employed Test & Evaluation, Validation & Verification (TEVV) metrics and processes in the MEASURE function are evaluated and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.3\n","O":"8.2","P":"5.4.4","Q":"6.3.8","R":"4.3\n6.6.1\n6.6.2","S":"6.2.6","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OV-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements."},"originalFormulas":{}},{"id":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":55,"originalCells":{"B":"MEASURE 3","C":"Mechanisms for tracking identified AI risks over time are in place.","D":"MEASURE 3.1","E":"Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts.","F":"Are approaches, personnel, and documentation in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts?","G":"Ensure that approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.5","O":"8.7","Q":"6.4.3.3\n6.4.12.3\n6.4.13.3\n6.4.15.3\n6.4.16.1","R":"6.7","S":"3.5.11\n5.18\n6.1\n6.2.2\n6.2.3\n6.2.4\n6.2.5\n6.2.6\n6.2.7\n6.2.8\n7.4.3\nAnnex A","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"ID.IM-01\nID.IM-02\nID.IM-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"8.2 - AI risk assessment_x000D_\n4.4 - AI management system_x000D_\n8.4 - AI system impact assessment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM04 Data and Model Poisoning\nLLM09 Misinformation\nLLM05 Improper Output Handling\n\nNote: Ongoing tracking of emergent risks is most relevant to drift, degradation, and incorrect or unsafe behavior in production."},"originalFormulas":{}},{"id":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":56,"originalCells":{"D":"MEASURE 3.2","E":"Risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available.","F":"Are risk tracking approaches considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available?","G":"Ensure that risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available.","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","Q":"6.4.3.3\n6.4.11.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","R":"5.3\n6.7","S":"6.1\n6.2.4\n6.2.6\n6.2.8","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"ID.RA-06\nID.RA-07","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.8 - AI system recording of event logs_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\n10.1 - Continual improvement","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements."},"originalFormulas":{}},{"id":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":57,"originalCells":{"D":"MEASURE 3.3","E":"Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.","F":"Are feedback processes for end users and impacted communities to report problems and appeal system outcomes established and integrated into AI system evaluation metrics?","G":"Ensure that feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.4.2","O":"7.6","Q":"6.4.2.3\n6.4.15.3","R":"5.2.3\n5.4","S":"5.19.6.3","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.8.2 - System documentation and information for users_x000D_\nB.8.4 - Communication of incidents_x000D_\nB.8.3 - External reporting","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM06 Excessive Agency\n\nNote: User and community feedback helps identify harmful outputs, bad outcomes, and inappropriate autonomous behavior."},"originalFormulas":{}},{"id":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":58,"originalCells":{"B":"MEASURE 4","C":"Feedback about efficacy of measurement is gathered and assessed.","D":"MEASURE 4.1","E":"Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented.","F":"Are measurement approaches for identifying AI risks connected to deployment context(s) and informed through consultation with domain experts and other end users?\n\nAre approaches documented?","G":"Ensure that measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. \n\nEnsure that approaches are documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.4.2","P":"5.4.5","Q":"6.4.2.1","R":"4.1\n4.3\n5.5\n6.1\n6.2\n6.4\n6.5\n6.6.1\n6.7.1\nA.1.3\nA.3","S":"6.2.6","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"ID.RA-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.4 - AI system verification and validation_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\n9.1 - Monitoring, measurement, analysis, and evaluation","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM02 Sensitive Information Disclosure\n\nNote: Context-aware measurement informed by experts improves detection of misleading, unsafe, or privacy-invasive system behavior."},"originalFormulas":{}},{"id":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":59,"originalCells":{"D":"MEASURE 4.2","E":"Measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. \n\nResults are documented.","F":"Are measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle  informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended? \n\nAre results documented?","G":"Ensure that measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. \n\nEnsure that results are documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2","O":"7.7","Q":"6.4.7.1\n6.4.7.3\n6.4.9.4","R":"4.1\n4.3\n5.5\n6.1\n6.2\n6.4\n6.5\n6.6.1\n6.7.1\nA.1.3\nA.3","S":"6.2.6","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"ID.RA-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"9.1 - Monitoring, measurement, analysis, and evaluation_x000D_\nB.8.2 - System documentation and information for users_x000D_\n9.2.1 - General_x000D_\nB.8.3 - External reporting","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM06 Excessive Agency\n\nNote: Expert validation of trustworthiness in deployment context helps detect output inconsistency and unsafe autonomy."},"originalFormulas":{}},{"id":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":60,"originalCells":{"D":"MEASURE 4.3","E":"Measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context relevant risks and trustworthiness characteristics are identified and documented.","F":"Are measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context relevant risks and trustworthiness characteristics identified and documented?","G":"Ensure that measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context relevant risks and trustworthiness characteristics are identified and documented.","J":"✓","K":"✓","L":"✓","M":"✓","O":"7.2","P":"5.4.5 - ISO 31000:2018\n6.2 - ISO 31000:2018","Q":"6.2.5.3\n6.3.1.3\n6.3.5.3\n6.4.3.1\n6.4.3.3\n6.4.9.3\n6.4.12.3\n6.4.13.3\n6.4.14.1\n6.4.14.3\n6.4.15.1\n","R":"6.1","S":"6.1\n6.2.7","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"ID.RA-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"9.3.1 - General_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.7 - AI system technical documentation","AK":"Delaware: Created AI Commission (2024); requires annual inventory of generative AI use and identification of high-risk areas.\nIndiana: Studying AI risks through Commerce and Economic Development Committee (2023).\nKentucky: Interim Committee briefing on AI bias and impact on jobs (2023).\nMaryland: HB1314 (2025): Prohibits AI denial of healthcare prior authorizations (effective Jan 1, 2026).\nMinnesota: Restricts AI use in entertainment industry (2025); drone facial recognition technology warrant requirements for law enforcement use (2020).\nNorth Carolina: Sexual deepfake laws (2024); $3.5M AI healthcare study funding.\nOregon: Political campaign AI disclosure (2024); facial recognition technology prohibition for police bodycams (2015).\nRhode Island: Lawmakers requires AI system review (2023).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.\nVermont: Moratorium on facial recognition technology expect for investigating child sexual exploitation (2019 and 2021); sexual deepfake laws (2024).\nWisconsin: AI workforce and election task forces (2023); political and sexual deepfake laws (2024).","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM06 Excessive Agency\n\nNote: Expert validation of trustworthiness in deployment context helps detect output inconsistency and unsafe autonomy."},"originalFormulas":{}},{"id":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":61,"originalCells":{"A":"MANAGE","B":"MANAGE 1","C":"AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.","D":"MANAGE 1.1","E":"A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed.","F":"Is a determination made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed?","G":"Ensure that a determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed.","J":"✓","K":"✓","L":"✓","M":"✓","O":"6.5.3.5\n7.6\n8.5","P":"6.4.3.2\n6.7","Q":"6.4.13.1\n6.4.17.1\nA.2.5","R":"4.2\n4.3\n5.3\n6.4\n6.7.4\n6.7.5","S":"3.1.35\n5.3\n5.11.4\n5.14.3\n6.1\n6.2.8\n7.1\n8.2\n8.3","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OC-04","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.9.3 - Objectives for responsible use of AI system_x000D_\nB.9.2 - Processes for responsible use of AI systems_x000D_\nB.9.4 - Intended use of the AI system_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.4 - AI system verification and validation","AK":"Colorado: Colorado AI Act (2024): CAIA requires impact assessments and risk management programs for deployers and NIST formalizes risk treatments and post-deployment monitoring.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM06 Excessive Agency\n\nNote: Determining go/no-go suitability depends heavily on whether output behavior, accuracy, and autonomy are acceptable."},"originalFormulas":{}},{"id":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":62,"originalCells":{"D":"MANAGE 1.2","E":"Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods.","F":"Is treatment of documented AI risks prioritized based on impact, likelihood, and available resources or methods?","G":"Ensure that treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods.","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","P":"6.1 - ISO 31000:2018\n6.4.3.3\n6.5.1 - ISO 31000:2018\n6.5.2 - ISO 310008:2018\n6.5.3 - ISO 31000:2018","Q":"6.3.4.3","R":"6.4\n6.7","S":"6.1\n6.2.2\n6.2.3\n6.2.4\n6.2.5\n6.2.8","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"GV.RM-06","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"9.3.3 - Management review results_x000D_\n6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment_x000D_\n6.1.4 - AI system impact assessment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors."},"originalFormulas":{}},{"id":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":63,"originalCells":{"D":"MANAGE 1.3","E":"Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. \n\nRisk response options can include mitigating, transferring, avoiding, or accepting.","F":"Are responses to the AI risks deemed high priority, as identified by the MAP function, developed, planned, and documented?\n\nDoes risk response options include mitigating, transferring, avoiding, or accepting?","G":"Ensure that responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. \n\nEnsure that risk response options include mitigating, transferring, avoiding, or accepting.","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","P":"6.5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","Q":"6.3.4.3","R":"6.5\n6.7.5","S":"Annex A","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"GV.RM-06","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.1 - General_x000D_\n6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment_x000D_\n6.1.4 - AI system impact assessment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA requires remediation where prohibited activities are discovered (with notice/cure periods).\nUtah: AI Policy Act (2024): UAIPA establishes a Regulatory Sandbox (AI Learning Laboratory), which supports experimental testing with oversight; allows measured, temporary deviations from full compliance.","AL":"LLM01 Prompt Injection\nLLM02 Sensitive Information Disclosure\nLLM03 Supply Chain\nLLM04 Data and Model Poisoning\nLLM05 Improper Output Handling\nLLM06 Excessive Agency\nLLM07 System Prompt Leakage\nLLM08 Vector and Embedding Weaknesses\nLLM09 Misinformation\nLLM10 Unbounded Consumption\n\nNote: Response planning can address the full set of major OWASP LLM risks depending on the selected treatment strategy."},"originalFormulas":{}},{"id":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":64,"originalCells":{"D":"MANAGE 1.4","E":"Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented.","F":"Are negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users documented?","G":"Ensure that negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented.","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","P":"6.5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","Q":"6.3.4.3\n6.4.1.3","R":"3.2.2\n5.5","S":"5.18","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"GV.RM-06","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM02 Sensitive Information Disclosure\n\nNote: Residual risk documentation is especially relevant when harmful outputs, misinformation, or exposure could reach downstream users."},"originalFormulas":{}},{"id":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":65,"originalCells":{"B":"MANAGE 2","C":"Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.","D":"MANAGE 2.1","E":"Resources required to manage AI risks are taken into account – along with viable non-AI alternative systems, approaches, or methods – to reduce the magnitude or likelihood of potential impacts.","F":"Are resources required to manage AI risks taken into account – along with viable non-AI alternative systems, approaches, or methods – to reduce the magnitude or likelihood of potential impacts?","G":"Ensure that resources required to manage AI risks are taken into account – along with viable non-AI alternative systems, approaches, or methods – to reduce the magnitude or likelihood of potential impacts.","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","P":"5.4.3 - ISO 31000:2018\n5.4.4 - ISO 31000:2018","Q":"6.3.4","R":"6.7.3","S":"5.18","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"GV.RM-06","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.4.2 - Resource documentation_x000D_\n7.1 - Resources","AK":"Colorado: Colorado AI Act (2024): CAIA requires impact assessments and risk management programs for deployers and NIST formalizes risk treatments and post-deployment monitoring.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","AL":"LLM03 Supply Chain\nLLM04 Data and Model Poisoning\nLLM10 Unbounded Consumption\n\nNote: Resource planning and alternative methods help reduce reliance on vulnerable components and limit operational abuse."},"originalFormulas":{}},{"id":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":66,"originalCells":{"D":"MANAGE 2.2","E":"Mechanisms are in place and applied to sustain the value of deployed AI systems.","F":"Are mechanisms in place and applied to sustain the value of deployed AI systems?","G":"Ensure that mechanisms are in place and applied to sustain the value of deployed AI systems.","J":"✓","K":"✓","L":"✓","M":"✓","P":"5.4.1 - ISO 31000:2018\n6.4.2.2","Q":"6.4.2.3\n6.4.13.3","R":"4.1","S":"5.15.1","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.RM-06","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.3.3 - Reporting of concerns_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.7.2 - Data for development and enhancement of AI system_x000D_\n7.1 - Resources_x000D_\n10.1 - Continual improvement","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.\nUtah: AI Policy Act (2024): UAIPA establishes a Regulatory Sandbox (AI Learning Laboratory), which supports experimental testing with oversight; allows measured, temporary deviations from full compliance.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM06 Excessive Agency\n\nNote: Sustaining value in deployment usually requires managing bad outputs, drift, and unchecked agent behavior."},"originalFormulas":{}},{"id":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":67,"originalCells":{"D":"MANAGE 2.3","E":"Procedures are followed to respond to and recover from a previously unknown risk when it is identified.","F":"Are procedures followed to respond to and recover from a previously unknown risk when it is identified?","G":"Procedures are followed to respond to and recover from a previously unknown risk when it is identified.","J":"✓","K":"✓","L":"✓","M":"✓","P":"5.2\n5.3","Q":"6.4.15.3\n6.4.16.1\n","R":"4.2","S":"3.5.10\n5.15.4","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"RC.RP-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"10.2 - Nonconformity and corrective action_x000D_\n6.1.1 - General_x000D_\n6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA states that if notified by AG, systems must be suspended or removed to avoid liability. AG has statutory removal/cure enforcement power.","AL":"LLM03 Supply Chain\nLLM04 Data and Model Poisoning\nLLM05 Improper Output Handling\nLLM06 Excessive Agency\nLLM09 Misinformation\nLLM10 Unbounded Consumption\n\nNote: Recovery from a previously unknown risk commonly involves poisoned inputs, degraded behavior, unsafe output, or runaway consumption."},"originalFormulas":{}},{"id":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":68,"originalCells":{"D":"MANAGE 2.4","E":"Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.","F":"Are mechanisms in place and applied, and responsibilities assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use?","G":"Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/manage-2-4","J":"✓","K":"✓","L":"✓","M":"✓","P":"6.3.4 - ISO 31000:2018\n6.4.2.4\n6.4.2.5\n6.4.2.6\n6.5.2 - ISO 31000:2018","Q":"6.4.17.1","R":"3.2.3\n6.7\n","S":"3.1.22\n5.17\n6.1\n6.2.9\nAnnex A","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"RC.RP-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.9.4 - Intended use of the AI system_x000D_\nB.8.2 - System documentation and information for users_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA states that if notified by AG, systems must be suspended or removed to avoid liability. AG has statutory removal/cure enforcement power.","AL":"LLM05 Improper Output Handling\nLLM06 Excessive Agency\nLLM09 Misinformation\nLLM10 Unbounded Consumption\n\nNote: Deactivating systems inconsistent with intended use directly addresses unsafe output, autonomy, and resource overuse."},"originalFormulas":{}},{"id":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":69,"originalCells":{"B":"MANAGE 3","C":"AI risks and benefits from third-party entities are managed.","D":"MANAGE 3.1","E":"AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.","F":"Are AI risks and benefits from third-party resources regularly monitored, and risk controls applied and documented?","G":"Ensure that AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","P":"5.4.1","Q":"6.3.5.3\n6.3.8.3","R":"6.7.2","S":"6.1\n6.2.4\n6.2.6\n6.2.8","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"GV.SC-07","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.10.3 - Suppliers_x000D_\nB.10.2 - Allocating responsibilities","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA imposes statutory liability, including for deployers using third-party AI or datasets if laws are violated (biometric, child protection, unlawful discrimination, etc.).","AL":"LLM03 Supply Chain\nLLM04 Data and Model Poisoning\nLLM02 Sensitive Information Disclosure\n\nNote: Third-party resource monitoring directly addresses vendor, model, and supply-chain risks."},"originalFormulas":{}},{"id":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":70,"originalCells":{"D":"MANAGE 3.2","E":"Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance.","F":"Are pre-trained models which are used for development monitored as part of AI system regular monitoring and maintenance?","G":"Ensure that pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance.","J":"✓","K":"✓","L":"✓","M":"✓","O":"3.1.3\n3.1.4\n6.2.1\n6.2.2\n6.3\n6.5.1\n6.5.3\n6.5.5\n7.2\n7.3\n7.4\n7.7\n8.4\n8.5\n8.6\n8.7\nA.2.2.3","Q":"5.3\n6.1.1.3\n6.3.4","R":"A.1.3","S":"3.3.10\n3.3.14\n5.11.6\n5.11.7\n5.11.8\n5.11.9.1\n8.6.2\n10.4","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"GV.SC-07","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.4.4 - Tooling resources_x000D_\nB.6.2.6 - AI system operation and monitoring","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","AL":"LLM03 Supply Chain\nLLM04 Data and Model Poisoning\nLLM09 Misinformation\n\nNote: Monitoring pre-trained models helps detect upstream compromise, poisoning, or quality degradation."},"originalFormulas":{}},{"id":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":71,"originalCells":{"B":"MANAGE 4","C":"Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored regularly.","D":"MANAGE 4.1","E":"Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.","F":"Are post-deployment AI system monitoring plans implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management?","G":"Ensure that post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.2\n8.6","P":"5.4.2\n6.6 - ISO 31000:2018","Q":"6.4.15\n6.4.16","R":"5.2.3","S":"6.1\n6.2.9\nAnnex A","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"GV.SC-07","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"9.2.1 - General_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.8.3 - External reporting_x000D_\nB.10.4 - Customers","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","AL":"LLM01 Prompt Injection\nLLM02 Sensitive Information Disclosure\nLLM05 Improper Output Handling\nLLM06 Excessive Agency\nLLM07 System Prompt Leakage\nLLM09 Misinformation\nLLM10 Unbounded Consumption\n\nNote: Post-deployment monitoring with appeals, override, incident response, recovery, and decommissioning covers most operational LLM risk classes."},"originalFormulas":{}},{"id":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":72,"originalCells":{"D":"MANAGE 4.2","E":"Measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors.","F":"Are measurable activities for continual improvements integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors?","G":"Ensure that measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors.","J":"✓","K":"✓","L":"✓","M":"✓","O":"6.5.4.1\n7.4\nA.3.2\nA.3.4","P":"5.7.1 ISO 31000:2018\n5.7.2 - ISO 31000:2018","Q":"6.1.2.3\n6.4.14","R":"6.2\n6.7.4","S":"6.1\n6.2.7","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"ID.IM-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"9.3.3 - Management review results_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring","AK":"Colorado: Colorado AI Act (2024): CAIA requires impact assessments and risk management programs for deployers and NIST formalizes risk treatments and post-deployment monitoring.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","AL":"LLM05 Improper Output Handling\nLLM06 Excessive Agency\nLLM09 Misinformation\n\nNote: Continual improvement and stakeholder engagement help reduce recurring harmful outputs and unsafe behavior over time."},"originalFormulas":{}},{"id":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","sheet":"99 TAIM Source","row":73,"originalCells":{"D":"MANAGE 4.3","E":"Incidents and errors are communicated to relevant AI actors, including affected communities. \n\nProcesses for tracking, responding to, and recovering from incidents and errors are followed and documented.","F":"Are incidents and errors communicated to relevant AI actors, including affected communities?\n\nAre processes for tracking, responding to, and recovering from incidents and errors followed and documented?","G":"Ensure that incidents and errors are communicated to relevant AI actors, including affected communities. \n\nEnsure that processes for tracking, responding to, and recovering from incidents and errors are followed and documented.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/manage-4-3","J":"✓","K":"✓","L":"✓","M":"✓","O":"3.1.4\nA.2.2.2","P":"6.5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","Q":"6.4.3.3\n6.4.15.3","R":"4.3\n6.1\n6.4\n6.7.3","S":"6.2.6","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"RC.CO-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"9.3.2 - Management review inputs_x000D_\nB.8.5 - Information for interested parties_x000D_\nB.6.2.6 - AI system operation and monitoring","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM02 Sensitive Information Disclosure\n\nNote: Communicating incidents and errors is most relevant when bad output, misinformation, or disclosure affects users and communities."},"originalFormulas":{}},{"id":"ROW-a3825fd52e03a23a138e6c7c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":2,"originalCells":{"A":"doc-1787223639269-0-1","B":"draft","C":"New internal policy","D":"2, 2025, created the Council to advise on “AI strategy, policy,…","E":"Governance","F":"AU-06","G":"Prevent provider training on enterprise content","H":"4","I":"E0 — evidence","J":"Require evidence","K":"Policy / training / approval","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 1","P":"2, 2025, created the Council to advise on “AI strategy, policy, and  training to ensure North Carolina becomes a national leader in AI literacy, governance, and deployment to the benefit of our  residents, communities, and economy.” This Roadmap puts the State of North Carolina and its partners on a path to meet  this high standard, and we are pleased to share it with you.","Q":"The directive establishes a program topic not represented as a distinct policy in the current 22-policy baseline.","R":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence."},"originalFormulas":{}},{"id":"ROW-640cebeeb69ede6e45df7610","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":3,"originalCells":{"A":"doc-1787223639269-0-2","B":"draft","C":"New canonical rule","D":"Additionally, these goals will strengthen North Carolina’s economy by empowering our…","E":"Governance","F":"AG-01","G":"Allowlisted tools and connectors only","H":"3","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 2","P":"Additionally, these goals will strengthen North Carolina’s economy by empowering  our workforce and businesses to deploy AI tools responsibly, supporting innovation and economic competitiveness, and  preparing communities for the economy of the future.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-bdf5de5fa6b1619e15b396bd","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":4,"originalCells":{"A":"doc-1787223639269-0-3","B":"draft","C":"New canonical rule","D":"To successfully implement most of the recommendations, the State will need…","E":"Output and Use","F":"DP-10","G":"Block biometric identifiers","H":"3","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 3","P":"To successfully implement most of the recommendations, the State will need to realign its existing funding, and in  other cases, seek more resources from governmental and non-governmental sources.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-326e4c84892d85985c5058a7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":5,"originalCells":{"A":"doc-1787223639269-0-4","B":"draft","C":"New canonical rule","D":"General Assembly shares our desire to safeguard public trust and empower…","E":"Governance","F":"DP-03","G":"Block payment card numbers","H":"3","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 4","P":"General Assembly shares our desire to safeguard public trust and empower the  workforce, and NCGA support will be crucial.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-3e34ea4aaa5aba804cf86693","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":6,"originalCells":{"A":"doc-1787223639269-0-5","B":"draft","C":"New canonical rule","D":"To realize this ambitious vision, North Carolina state agencies will collaborate…","E":"Governance","F":"DP-08","G":"Restrict education records","H":"4","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 5","P":"To realize this ambitious vision, North Carolina state agencies will collaborate with higher education institutions, private employers,  nonprofits, and workforce partners to create pathways for success in an AI-driven future.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-fd234595ddd4a6137ed11668","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":7,"originalCells":{"A":"doc-1787223639269-0-6","B":"draft","C":"New canonical rule","D":"Through these collective efforts, the state seeks to ensure that every…","E":"Operations","F":"AU-01","G":"Allow sanctioned AI services only","H":"2","I":"E1 — observe","J":"Detect / log","K":"Event / log","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 6","P":"Through these collective efforts, the  state seeks to ensure that every North Carolinian has the opportunity to thrive in a landscape that will be shaped by advanced  technology.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Generate a representative event and verify completeness, alert routing, retention, and access controls."},"originalFormulas":{}},{"id":"ROW-66b7acd52479a97aa7540ac1","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":8,"originalCells":{"A":"doc-1787223639269-0-7","B":"draft","C":"New internal policy","D":"AI Literacy Ensure all North Carolinians have the knowledge to understand,…","E":"Operations","F":"DP-02","G":"Block passwords and authentication answers","H":"3","I":"E0 — evidence","J":"Require evidence","K":"Policy / training / approval","L":"Critical","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 7","P":"AI Literacy  Ensure all North Carolinians have the knowledge to understand, use, and critically evaluate AI technologies, enabling  people to make informed choices about the technology in their lives.","Q":"The directive establishes a program topic not represented as a distinct policy in the current 22-policy baseline.","R":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence."},"originalFormulas":{}},{"id":"ROW-ea35141a741aeaf2cba7124f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":9,"originalCells":{"A":"doc-1787223639269-0-8","B":"draft","C":"New canonical rule","D":"Workforce Empowerment Ensure technology augments rather than replaces the workforce by…","E":"Operations","F":"OU-06","G":"Block harassment, hate and abuse","H":"4","I":"E1 — observe","J":"Detect / log","K":"Event / log","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 8","P":"Workforce Empowerment  Ensure technology augments rather than replaces the workforce by preparing workers in all industries, including state  government, for an AI-enabled economy by upskilling, reskilling, and strengthening the worker safety net.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Generate a representative event and verify completeness, alert routing, retention, and access controls."},"originalFormulas":{}},{"id":"ROW-64b63c2c53c3c8e76e3e14d2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":10,"originalCells":{"A":"doc-1787223639269-0-9","B":"draft","C":"New canonical rule","D":"Also must respect personal autonomy and dignity, maintaining people’s freedom to…","E":"Governance","F":"AG-09","G":"Govern agent memory writes","H":"5","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 9","P":"Systems also must respect personal autonomy and  dignity, maintaining people’s freedom to think, choose, and act independently, and systems must prevent manipulation or restriction of choices.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-d3d51325f4bd49787fb5467a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":11,"originalCells":{"A":"doc-1787223639269-0-10","B":"draft","C":"New canonical rule","D":"Since the creation of the Executive Order, the Council has been…","E":"Governance","F":"AU-06","G":"Prevent provider training on enterprise content","H":"2","I":"E0 — evidence","J":"Require evidence","K":"Policy / training / approval","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 10","P":"Since the creation of the  Executive Order, the Council has been focused on creating informed recommendations on policy, governance, ethics, and literacy to ensure the safe, transparent,  and fair adoption of artificial intelligence across the state and to develop recommendations to address the potential impact of AI on the workforce.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence."},"originalFormulas":{}},{"id":"ROW-1f6b2bce4f2975ea1190887e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":12,"originalCells":{"A":"doc-1787223639269-0-11","B":"draft","C":"New canonical rule","D":"The goals are grouped into three categories to ensure a clear…","E":"Governance","F":"OU-07","G":"Block dangerous and illegal content","H":"4","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 11","P":"The  goals are grouped into three categories to ensure a clear and actionable framework that supports statewide safety, opportunity, and innovation:  1)   Protect   focuses on safeguarding North Carolina residents through responsible AI use and strong risk mitigation practices.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-b47fc0079d4b0d4f53295a48","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":13,"originalCells":{"A":"doc-1787223639269-0-12","B":"draft","C":"New canonical rule","D":"Each of these recommendations has been created with an implementation plan…","E":"Governance","F":"AU-07","G":"Prohibit account sharing","H":"3","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 12","P":"Each of these recommendations has been created with an implementation plan and timeline, recognizing that work will progress and be shared as it is  available.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-8ae0d92f14158369d5be099f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":14,"originalCells":{"A":"doc-1787223639269-0-13","B":"draft","C":"New canonical rule","D":"The recommendations below were identified by the Council to improve AI…","E":"Governance","F":"AU-06","G":"Prevent provider training on enterprise content","H":"3","I":"E0 — evidence","J":"Require evidence","K":"Policy / training / approval","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 13","P":"The recommendations below were identified by the Council to improve  AI policy, governance, ethics, and literacy for the state with the understanding that AI will continue to evolve.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence."},"originalFormulas":{}},{"id":"ROW-41b37be51bdcd959b56077ea","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":15,"originalCells":{"A":"doc-1787223639269-0-14","B":"draft","C":"Map existing","D":"Protect Prepare Transform • Protect Residents from AI Harms • Advance…","E":"Data Protection","F":"DP-01","G":"Block credentials and secrets","H":"76","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Critical","M":"89","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 14","P":"Protect   Prepare   Transform  •   Protect Residents from AI Harms   •   Advance Community Upskilling   •   Deliver Better for the Public  •   Expand Unemployment and Re-  Employment Programs   •   Create Pipelines to Workforce   •   Drive Statewide Innovation  •   Account for Resource Demands and  Impacts   •   Support PK-13 Education   •   Broaden Access to Critical Resources  •   Reduce Fraud, Manipulation, and  Deception   •   Promote Credentialing Opportunities   •   Build a Culture of Change  •   Improve Transparency and Accountability   •   Establish Government-Wide AI Resources  •   Develop Robust Contingency Plans  •   Strengthen Cybersecurity  •   Ensure Safe Government AI Usage","Q":"Closest semantic and keyword match is DP-01 — Block credentials and secrets. The source adds applicability and evidence context.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-c08b9b82d7e602513f28fb11","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":16,"originalCells":{"A":"doc-1787223639269-0-15","B":"draft","C":"New canonical rule","D":"Details: As AI continues to reshape society, the state will explore…","E":"Data Protection","F":"OU-11","G":"Prevent re-identification","H":"6","I":"E1 — observe","J":"Detect / log","K":"Event / log","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 15","P":"Details:   As AI continues to reshape society, the state will explore a package of statewide policies that address numerous  concerns enabled by AI technologies, including child safety and mental health, lack of privacy protections, and senior  citizen fraud and abuse.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Generate a representative event and verify completeness, alert routing, retention, and access controls."},"originalFormulas":{}},{"id":"ROW-b3b87930da7a18d060067f76","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":17,"originalCells":{"A":"doc-1787223639269-0-16","B":"draft","C":"New canonical rule","D":"Child safety components will focus on foundational safety requirements that encourage…","E":"Input and Content","F":"OU-06","G":"Block harassment, hate and abuse","H":"5","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 16","P":"Child safety components will focus on foundational safety requirements that encourage non-  addictive designs and establish a standard duty of care.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-c52dd704ef892ba9c5a6da0a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":18,"originalCells":{"A":"doc-1787223639269-0-17","B":"draft","C":"New canonical rule","D":"By 2029, approximately half of US jobs will be transformed by…","E":"Governance","F":"PROPOSED","G":"No close canonical match","H":"0","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 17","P":"By 2029, approximately half of US jobs will be   transformed by AI .","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-0dd487bc1b976aef45297bd4","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":19,"originalCells":{"A":"doc-1787223639269-0-18","B":"draft","C":"New canonical rule","D":"Details: North Carolina must proactively provide accessible pathways back into high-demand,…","E":"Governance","F":"OP-08","G":"Support feedback, appeal and override","H":"3","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 18","P":"Details:   North Carolina must proactively provide accessible pathways back into high-demand, sustainable careers.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-1d901d5423258c69c45d479f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":20,"originalCells":{"A":"doc-1787223639269-0-19","B":"draft","C":"New canonical rule","D":"This will be accomplished through identifying and supporting workers in roles…","E":"Access and Use","F":"DP-10","G":"Block biometric identifiers","H":"2","I":"E0 — evidence","J":"Require evidence","K":"Policy / training / approval","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 19","P":"This will be accomplished through identifying and supporting workers in roles most vulnerable to automation and  partnering with employers, Commerce’s Labor and Economic Analysis Division, community colleges, local workforce  development boards, and NCWorks Career Centers to track labor-market signals and pinpoint high-risk areas of AI-driven  displacement.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence."},"originalFormulas":{}},{"id":"ROW-74fb99791d99364b722a3723","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":21,"originalCells":{"A":"doc-1787223639269-0-20","B":"draft","C":"New canonical rule","D":"Embedding work-based learning opportunities and direct employer connections will accelerate reentry…","E":"Access and Use","F":"AU-03","G":"Enforce role and data-class authorization","H":"3","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 20","P":"Embedding work-based  learning opportunities and direct employer connections will accelerate reentry into private- and public-sector roles.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-071f63ad3c28c8f170399599","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":22,"originalCells":{"A":"doc-1787223639269-0-21","B":"draft","C":"New canonical rule","D":"Using displacement data and worker feedback will support the design of…","E":"Governance","F":"DP-03","G":"Block payment card numbers","H":"5","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 21","P":"Using  displacement data and worker feedback will support the design of career transition tracks tailored to the needs and  experiences of AI-impacted workers to avoid long-term unemployment.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-7b023cbc4fb415afcece1806","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":23,"originalCells":{"A":"doc-1787223639269-0-22","B":"draft","C":"New canonical rule","D":"Additionally, tracking the re-skilling programs that successfully lead to meaningful employment…","E":"Governance","F":"DP-10","G":"Block biometric identifiers","H":"3","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 22","P":"Additionally, tracking the re-skilling programs that  successfully lead to meaningful employment will help improve other reskilling tracks.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-7f3414fcb0b7a064aa47932b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":24,"originalCells":{"A":"doc-1787223639269-0-23","B":"draft","C":"New canonical rule","D":"Details: North Carolina must be ready to detect and respond to…","E":"Governance","F":"AU-07","G":"Prohibit account sharing","H":"3","I":"E1 — observe","J":"Detect / log","K":"Event / log","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 23","P":"Details:   North Carolina must be ready to detect and respond to AI-driven labor disruptions early to stabilize the workforce.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Generate a representative event and verify completeness, alert routing, retention, and access controls."},"originalFormulas":{}},{"id":"ROW-53f67697db1ca0c84d5158da","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":25,"originalCells":{"A":"doc-1787223639269-0-24","B":"draft","C":"New canonical rule","D":"This effort will be advanced through advocating for legislation to counteract…","E":"Governance","F":"AU-01","G":"Allow sanctioned AI services only","H":"3","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 24","P":"This effort will be advanced through advocating for legislation to counteract potential AI-driven labor disruptions and  to prepare for any such disruptions.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-974c71eb5d08d6dae3b42bb2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":26,"originalCells":{"A":"doc-1787223639269-0-25","B":"draft","C":"New canonical rule","D":"Worker Adjustment and Retraining Notification (WARN) data collection processes will help…","E":"Operations","F":"DP-05","G":"Block national identifiers","H":"4","I":"E0 — evidence","J":"Require evidence","K":"Policy / training / approval","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 25","P":"Worker Adjustment and Retraining Notification  (WARN) data collection processes will help to explicitly capture AI-related job losses and use these insights to inform  retraining opportunities to avoid long-term unemployment.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence."},"originalFormulas":{}},{"id":"ROW-20a70b59b3d66c0b59309939","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":27,"originalCells":{"A":"doc-1787223639269-0-26","B":"draft","C":"New canonical rule","D":"In parallel, partnering with higher education institutions will allow the collection…","E":"Governance","F":"DP-08","G":"Restrict education records","H":"6","I":"E1 — observe","J":"Detect / log","K":"Event / log","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 26","P":"In parallel, partnering with higher education institutions will  allow the collection of more granular unemployment and program-enrollment data that can signal emerging displacement  trends and inform rapid intervention strategies to improve early detection and response.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Generate a representative event and verify completeness, alert routing, retention, and access controls."},"originalFormulas":{}},{"id":"ROW-92448f50341ee8bd9b789a55","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":28,"originalCells":{"A":"doc-1787223639269-0-27","B":"draft","C":"New canonical rule","D":"General Assembly Timeline: March 2027 Goal 3: Account for Resource Demands…","E":"Governance","F":"AU-07","G":"Prohibit account sharing","H":"2","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 27","P":"General Assembly  Timeline:   March 2027  Goal 3: Account for Resource Demands and Impacts  Ensure appropriate environmental stewardship that balances community needs and public trust with the  demands that AI creates on land, water, and energy.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-01dca4cee18c42123ac827c8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":29,"originalCells":{"A":"doc-1787223639269-0-28","B":"draft","C":"New canonical rule","D":"These facilities serve as the backbone of AI, and as AI…","E":"Governance","F":"DP-04","G":"Block CVV, CVC and PIN","H":"4","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 28","P":"These  facilities serve as the backbone of AI, and as AI continues to advance, the demand for data centers will only increase.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-081486ef0099744a9d2b74dc","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":30,"originalCells":{"A":"doc-1787223639269-0-29","B":"draft","C":"New canonical rule","D":"It is essential for states to thoroughly assess the economic opportunities…","E":"Governance","F":"OP-06","G":"Reassess on material change","H":"4","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 29","P":"It is essential for states to thoroughly assess the economic opportunities data centers  bring alongside the impact these facilities have on communities to maximize benefits and reduce data center challenges.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-414ff4101f22308b610f3ffb","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":31,"originalCells":{"A":"doc-1787223639269-0-30","B":"draft","C":"New canonical rule","D":"8 Recommendation: Monitor and publicly disclose impacts of AI infrastructure on…","E":"Operations","F":"OP-10","G":"Monitor vendor and model supply chain","H":"6","I":"E1 — observe","J":"Detect / log","K":"Event / log","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 30","P":"8  Recommendation:  Monitor and publicly disclose impacts of AI infrastructure on communities using third-party evaluations.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Generate a representative event and verify completeness, alert routing, retention, and access controls."},"originalFormulas":{}},{"id":"ROW-e4e4b526670da1bdf3a9ec30","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":32,"originalCells":{"A":"doc-1787223639269-0-31","B":"draft","C":"New canonical rule","D":"This recommendation calls for a resource monitoring program that uses independent,…","E":"Governance","F":"IN-08","G":"Limit resource consumption","H":"4","I":"E1 — observe","J":"Detect / log","K":"Event / log","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 31","P":"This recommendation  calls for a resource monitoring program that uses independent, third-party evaluators to assess and publicly report the  environmental and community impacts of AI-related infrastructure, with a focus on land, water, energy, and public health  concerns.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Generate a representative event and verify completeness, alert routing, retention, and access controls."},"originalFormulas":{}},{"id":"ROW-a396d332122ecad0ab3e0932","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":33,"originalCells":{"A":"doc-1787223639269-0-32","B":"draft","C":"New canonical rule","D":"Legislation would strengthen this effort by requiring standardized disclosure of environmental,…","E":"Output and Use","F":"IN-08","G":"Limit resource consumption","H":"6","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 32","P":"Legislation would strengthen this effort by requiring standardized disclosure of environmental, energy, and other baseline  consumption metrics from all AI data center developers and operators to ensure transparent and consistent tracking of  resource utilization.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-42bf9a64b0b7c04671b57fc6","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":34,"originalCells":{"A":"doc-1787223639269-0-33","B":"draft","C":"New canonical rule","D":"General Assembly, Local Governments Timeline: June 2027 Goal 4: Reduce Fraud,…","E":"Governance","F":"OU-06","G":"Block harassment, hate and abuse","H":"4","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 33","P":"General Assembly, Local Governments  Timeline:   June 2027  Goal 4: Reduce Fraud, Manipulation, and Deception  Ensure 100% of state government-produced content abides by a content authenticity standard.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-4bb2a58a345a601f448f8c32","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":35,"originalCells":{"A":"doc-1787223639269-0-34","B":"draft","C":"New canonical rule","D":"Details: To ensure public confidence in official government communications, all state…","E":"Governance","F":"OP-07","G":"Time-bound exceptions and waivers","H":"5","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 34","P":"Details:   To ensure public confidence in official government communications, all state agencies should verify the  authenticity of their communications with clear tracing of their origins.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-ed47de10c32b620ddec4a484","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":36,"originalCells":{"A":"doc-1787223639269-0-35","B":"draft","C":"New canonical rule","D":"Implementing a statewide content verification standard will strengthen public trust by…","E":"Governance","F":"OU-06","G":"Block harassment, hate and abuse","H":"5","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 35","P":"Implementing a statewide content verification  standard will strengthen public trust by assuring residents content is authentic, especially in times of emergency.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-a203586b69564a0481b513e4","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":37,"originalCells":{"A":"doc-1787223639269-0-36","B":"draft","C":"Map existing","D":"This effort will involve researching and adopting content verification standards already…","E":"Governance","F":"OU-12","G":"Disclose AI-generated or synthetic content","H":"76","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"89","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 36","P":"This  effort will involve researching and adopting content verification standards already widely accepted across industry, such as  Coalition for Content Provenance and Authenticity (C2PA).","Q":"Closest semantic and keyword match is OU-12 — Disclose AI-generated or synthetic content. The source adds applicability and evidence context.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-30fe5e8784d87b824ff0ef19","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":38,"originalCells":{"A":"doc-1787223639269-0-37","B":"draft","C":"New canonical rule","D":"When AI is used to help generate official content, the standard…","E":"Governance","F":"OU-12","G":"Disclose AI-generated or synthetic content","H":"9","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 37","P":"When AI is used to help generate official content, the standard  should also disclose how it was used to ensure transparency.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-f046d365d3d96d1b4c6e8bc8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":39,"originalCells":{"A":"doc-1787223639269-0-38","B":"draft","C":"New canonical rule","D":"Community upskilling efforts, via the Advancing Community Upskilling goal later in…","E":"Output and Use","F":"AU-06","G":"Prevent provider training on enterprise content","H":"5","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 38","P":"Community upskilling efforts, via the Advancing Community  Upskilling goal later in this framework, will include education on how to recognize verified content from government  sources.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-ec717d785b83b86f5452fb20","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":40,"originalCells":{"A":"doc-1787223639269-0-39","B":"draft","C":"New canonical rule","D":"This upskilling plan will target all skill levels, including senior citizens,…","E":"Governance","F":"DP-04","G":"Block CVV, CVC and PIN","H":"3","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 39","P":"This upskilling plan will target all skill levels, including senior citizens, students, and rural communities.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-a7157905a590de8a392187e5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":41,"originalCells":{"A":"doc-1787223639269-0-40","B":"draft","C":"New canonical rule","D":"With the state government’s support and backing, local governments and private…","E":"Input and Content","F":"DP-12","G":"Block classified, CUI and FCI","H":"3","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 40","P":"With the  state government’s support and backing, local governments and private sector organizations will also be encouraged to  adopt such standards, reducing the potential for misinformation campaigns.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-94840abd40bb06472ce8214a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":42,"originalCells":{"A":"doc-1787223639269-0-41","B":"draft","C":"New canonical rule","D":"Some states publish all AI systems in their inventory, while others…","E":"Operations","F":"DP-02","G":"Block passwords and authentication answers","H":"7","I":"E1 — observe","J":"Detect / log","K":"Event / log","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 41","P":"Some states publish all AI systems in their inventory, while others focus  only on   high-risk systems .","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Generate a representative event and verify completeness, alert routing, retention, and access controls."},"originalFormulas":{}},{"id":"ROW-df10e0cdc86adf7851326c3a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":43,"originalCells":{"A":"doc-1787223639269-0-42","B":"draft","C":"Map existing","D":"Regardless of how states choose to disclose AI systems, the information…","E":"Governance","F":"OU-03","G":"Require evidence for factual claims","H":"76","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"89","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 42","P":"Regardless of how states choose to disclose AI systems, the information disclosed typically includes  the system name, its purpose, a description of the use case, and the agency using the tool.","Q":"Closest semantic and keyword match is OU-03 — Require evidence for factual claims. The source adds applicability and evidence context.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-a121819d17a6476331541d4a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":44,"originalCells":{"A":"doc-1787223639269-0-43","B":"draft","C":"New canonical rule","D":"The state’s 2025 Executive Order 24 also requires the AI Accelerator…","E":"Governance","F":"AU-04","G":"Allow approved use cases and models only","H":"8","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 43","P":"The state’s 2025   Executive Order 24   also requires the AI Accelerator to disclose all high-risk AI  use cases   to the public .","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-d277a3dc97c4272c5552ef0e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":45,"originalCells":{"A":"doc-1787223639269-0-44","B":"draft","C":"New canonical rule","D":"24: Advancing Trustworthy Artificial Intelligence That Benefits All North Carolinians requires…","E":"Output and Use","F":"AU-04","G":"Allow approved use cases and models only","H":"7","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"High","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 44","P":"24: Advancing Trustworthy Artificial Intelligence That Benefits All North Carolinians  requires the disclosure of high-risk AI use cases throughout state government, this initiative will strengthen public trust  by disclosing additional public-facing AI use.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-206523e460ae7d5e37508a82","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":46,"originalCells":{"A":"doc-1787223639269-0-45","B":"draft","C":"New canonical rule","D":"Dynamic dashboards will ensure transparency across state government by providing as…","E":"Governance","F":"DP-12","G":"Block classified, CUI and FCI","H":"6","I":"E0 — evidence","J":"Require evidence","K":"Policy / training / approval","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 45","P":"Dynamic dashboards will ensure transparency across state government  by providing as much information as possible to the public while maintaining the security and integrity of systems.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence."},"originalFormulas":{}},{"id":"ROW-adb71c0d698d36ba91f8a711","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":47,"originalCells":{"A":"doc-1787223639269-0-46","B":"draft","C":"New canonical rule","D":"Dashboards will be updated regularly to reflect the most current information…","E":"Governance","F":"AU-08","G":"Detect shadow AI and unmanaged plugins","H":"5","I":"E0 — evidence","J":"Require evidence","K":"Policy / training / approval","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 46","P":"Dashboards will be updated regularly to reflect the most current information related to AI tools and will be accessible, with  information presented in plain language to promote transparency.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence."},"originalFormulas":{}},{"id":"ROW-88d67d5267884192e27a58ee","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":48,"originalCells":{"A":"doc-1787223639269-0-47","B":"draft","C":"New canonical rule","D":"Feedback mechanisms will be available to measure public sentiment and improve…","E":"Input and Content","F":"DP-09","G":"Protect contact information","H":"5","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 47","P":"Feedback mechanisms will be available to measure  public sentiment and improve tools based on input.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-a743367fd7bbfe78ca525fa8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":49,"originalCells":{"A":"doc-1787223639269-0-48","B":"draft","C":"New canonical rule","D":"Department of Information Technology, Agency AI Oversight Committees Timeline: December 2026…","E":"Operations","F":"AG-04","G":"Prohibit autonomous consequential decisions","H":"6","I":"E0 — evidence","J":"Require evidence","K":"Policy / training / approval","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 48","P":"Department of Information Technology, Agency AI Oversight Committees  Timeline:   December 2026  Recommendation:  Maintain transparency, traceability, and human oversight for any use of AI in the administration of government benefits programs,  ensuring AI systems do not make final benefits determinations.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence."},"originalFormulas":{}},{"id":"ROW-7e5891b66f1bfb5e4b3f44ad","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":50,"originalCells":{"A":"doc-1787223639269-0-49","B":"draft","C":"New canonical rule","D":"This recommendation calls for disclosure of AI utilization as any part…","E":"Output and Use","F":"AG-04","G":"Prohibit autonomous consequential decisions","H":"7","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 49","P":"This recommendation calls for disclosure of AI utilization  as any part of a benefits eligibility process and guardrails to ensure that final benefits determination decisions are not  made by AI systems.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-973fa26287432e78f88fdd97","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":51,"originalCells":{"A":"doc-1787223639269-0-50","B":"draft","C":"New canonical rule","D":"Additionally, residents should be given the opportunity to opt out of…","E":"Governance","F":"AU-03","G":"Enforce role and data-class authorization","H":"6","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 50","P":"Additionally, residents should be given the opportunity to opt out of their data being shared or used  in AI models beyond where required for program participation.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-3e8203318dc23f2c2ecc82a9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":52,"originalCells":{"A":"doc-1787223639269-0-51","B":"draft","C":"New canonical rule","D":"This initiative will ensure that the state can continue delivering vital…","E":"Governance","F":"DP-15","G":"Protect architecture and vulnerability details","H":"4","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Critical","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 51","P":"This initiative will ensure that the state  can continue delivering vital services to residents by defining and prioritizing critical statewide systems that use AI in the  event of system outages, failures, or attacks.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-135e138eefd91d583f58e051","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":53,"originalCells":{"A":"doc-1787223639269-0-52","B":"draft","C":"New canonical rule","D":"The state will work in collaboration with utilities, security, and emergency…","E":"Governance","F":"OP-04","G":"Escalate AI incidents","H":"7","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 52","P":"The state will work in collaboration with utilities, security, and emergency  response teams to design a plan to recover those systems, including through redundant architectures, where possible.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-e44f1d61efa90dc7e2c57ba6","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":54,"originalCells":{"A":"doc-1787223639269-0-53","B":"draft","C":"New canonical rule","D":"Clear procedures must be documented for enabling, bypassing, or overriding AI…","E":"Governance","F":"OP-04","G":"Escalate AI incidents","H":"4","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Critical","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 53","P":"Clear procedures must be documented for enabling, bypassing, or overriding AI systems, and staff should be trained to  manually operate critical processes without AI assistance during outages.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-98eede2079330409090505bc","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":55,"originalCells":{"A":"doc-1787223639269-0-54","B":"draft","C":"New canonical rule","D":"Recommendation: Monitor, detect, and analyze ongoing AI threats and create a…","E":"Operations","F":"OP-07","G":"Time-bound exceptions and waivers","H":"4","I":"E1 — observe","J":"Detect / log","K":"Event / log","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 54","P":"Recommendation:  Monitor, detect, and analyze ongoing AI threats and create a mechanism to share risk landscape with trusted AI and cyber liaisons  in local government, as well as federal, peer state, and private sector partners.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Generate a representative event and verify completeness, alert routing, retention, and access controls."},"originalFormulas":{}},{"id":"ROW-861de93325f2dd51a8b59ffd","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":56,"originalCells":{"A":"doc-1787223639269-0-55","B":"draft","C":"New canonical rule","D":"Details: This initiative will build on existing continuous monitoring and threat…","E":"Operations","F":"DP-12","G":"Block classified, CUI and FCI","H":"2","I":"E1 — observe","J":"Detect / log","K":"Event / log","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 55","P":"Details:   This initiative will build on existing continuous monitoring and threat detection programs across state government  to identify emerging AI-related risks and alert trusted liaisons in state and local governments to act.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Generate a representative event and verify completeness, alert routing, retention, and access controls."},"originalFormulas":{}},{"id":"ROW-4300944491a0238122b3a5f1","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":57,"originalCells":{"A":"doc-1787223639269-0-56","B":"draft","C":"New canonical rule","D":"Agencies will implement a software bill of materials for deployed AI…","E":"Governance","F":"DP-06","G":"Block bank-account data","H":"5","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 56","P":"Agencies will  implement a software bill   of materials for deployed AI solutions that   map lineage of models, data,   and code to ensure  swift remediation.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-e7302c46a31e80de571c55da","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":58,"originalCells":{"A":"doc-1787223639269-0-57","B":"draft","C":"Map existing","D":"The state will also develop and deploy secure communication channels to…","E":"Operations","F":"DP-14","G":"Protect trade secrets and source code","H":"76","I":"E1/E2 — observe + workflow","J":"Monitor / escalate","K":"Event / workflow","L":"High","M":"89","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 57","P":"The state will also develop and deploy secure communication channels to ensure confidential, real-  time exchange of AI threat intelligence and coordinated incident response with local governments and other partners.","Q":"Closest semantic and keyword match is DP-14 — Protect trade secrets and source code. The source adds applicability and evidence context.","R":"Generate a representative event and verify completeness, alert routing, retention, and access controls."},"originalFormulas":{}},{"id":"ROW-67ccc1472f945ddac9c1f9f7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":59,"originalCells":{"A":"doc-1787223639269-0-58","B":"draft","C":"New canonical rule","D":"Additionally, the state will distribute vetted AI frameworks and training modules…","E":"Data Protection","F":"DP-05","G":"Block national identifiers","H":"4","I":"E0 — evidence","J":"Require evidence","K":"Policy / training / approval","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 58","P":"Additionally, the state will distribute vetted AI frameworks and training modules to local government partners to guarantee  proven, safe, and transparent AI security practices are leveraged statewide, including privacy by design.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence."},"originalFormulas":{}},{"id":"ROW-8420b54bd6262206b35a1f43","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":60,"originalCells":{"A":"doc-1787223639269-0-59","B":"draft","C":"New canonical rule","D":"National Guard, Local Governments Timeline: June 2027 Goal 8: Ensure Responsible…","E":"Data Protection","F":"OP-12","G":"Require predeployment evaluation and red team","H":"9","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"High","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 59","P":"National Guard, Local  Governments  Timeline:   June 2027  Goal 8: Ensure Responsible Government AI Usage  Ensure AI systems used by state agencies meet standardized internal safety, privacy, security, reliability,  fairness, and explainability requirements.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-a9c6f0da94ea249a1fa05079","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":61,"originalCells":{"A":"doc-1787223639269-0-60","B":"draft","C":"New canonical rule","D":"Recommendation: Establish minimum statewide trustworthy AI standards for all AI-enabled tools…","E":"Governance","F":"DP-01","G":"Block credentials and secrets","H":"7","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 60","P":"Recommendation:  Establish minimum statewide trustworthy AI standards for all AI-enabled tools and systems that must be met before agencies","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-657571006f3d8eed78a8d614","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":62,"originalCells":{"A":"doc-1787223639269-0-61","B":"draft","C":"New canonical rule","D":"However, AI presents fundamentally different challenges that these existing frameworks do…","E":"Access and Use","F":"AU-07","G":"Prohibit account sharing","H":"3","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 61","P":"However, AI  presents fundamentally different challenges that these existing frameworks do not account for.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-0cf8407a2d40fba20bead1a1","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":63,"originalCells":{"A":"doc-1787223639269-0-62","B":"draft","C":"New canonical rule","D":"This initiative will create and implement a tiered governance model specific…","E":"Output and Use","F":"AU-04","G":"Allow approved use cases and models only","H":"7","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"High","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 62","P":"This initiative will create  and implement a tiered governance model specific to AI, with tailored mitigation plans according to risk level that address  safety concerns including bias, accuracy, model degradation, and more.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-a94d14d91111cf2fcec2ce7c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":64,"originalCells":{"A":"doc-1787223639269-0-63","B":"draft","C":"New canonical rule","D":"Regardless of risk level, mitigation plans will include ongoing monitoring requirements…","E":"Access and Use","F":"OP-09","G":"Maintain AI inventory and ownership","H":"8","I":"E1 — observe","J":"Detect / log","K":"Event / log","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 63","P":"Regardless of risk level, mitigation plans will  include ongoing monitoring requirements and accountability mechanisms for all AI-enabled systems.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Generate a representative event and verify completeness, alert routing, retention, and access controls."},"originalFormulas":{}},{"id":"ROW-d3ce801030f7261bdf22b6c3","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":65,"originalCells":{"A":"doc-1787223639269-0-64","B":"draft","C":"New canonical rule","D":"Recurring security testing of products will be conducted to check for…","E":"Governance","F":"IN-04","G":"Restrict harmful cyber requests","H":"5","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 64","P":"Recurring security  testing of products will be conducted to check for emerging threats and defend against vulnerabilities.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-b4e6cea6104935d466767f59","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":66,"originalCells":{"A":"doc-1787223639269-0-65","B":"draft","C":"New canonical rule","D":"These liaisons must be given a sufficient level of authority to…","E":"Access and Use","F":"OP-09","G":"Maintain AI inventory and ownership","H":"5","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 65","P":"These liaisons must  be given a sufficient level of authority to create accountability mechanisms to enforce the standards and governance  mechanisms established in the previous recommendation for this goal.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-dd48f710b4f50b54b9f10c8e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":67,"originalCells":{"A":"doc-1787223639269-0-66","B":"draft","C":"New canonical rule","D":"They will also be the main point of contact for all…","E":"Access and Use","F":"AU-04","G":"Allow approved use cases and models only","H":"6","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 66","P":"They will also be the main point of contact for all  accountability escalation.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-0c8f49072849f138f26dbbf2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":68,"originalCells":{"A":"doc-1787223639269-0-67","B":"draft","C":"Map existing","D":"They each will maintain an AI inventory for the agency and…","E":"Access and Use","F":"AU-01","G":"Allow sanctioned AI services only","H":"76","I":"E0 — evidence","J":"Require evidence","K":"Policy / training / approval","L":"Medium","M":"89","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 67","P":"They each will maintain an AI inventory for the agency and assist the AI Oversight Committees  in overseeing the ongoing monitoring of approved AI tools.","Q":"Closest semantic and keyword match is AU-01 — Allow sanctioned AI services only. The source adds applicability and evidence context.","R":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence."},"originalFormulas":{}},{"id":"ROW-061155174c638c14c63ac416","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":69,"originalCells":{"A":"doc-1787223639269-0-68","B":"draft","C":"New canonical rule","D":"They will uphold whistleblower protections and coordinate across agencies in the…","E":"Governance","F":"OP-11","G":"Decommission safely and delete data","H":"2","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 68","P":"They will uphold   whistleblower protections   and coordinate  across agencies in the event of an emergency related to or impacting AI use.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-8b27236695c29762e61071a8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":70,"originalCells":{"A":"doc-1787223639269-0-69","B":"draft","C":"New canonical rule","D":"This role will ensure shared learning, avoid wasted resources, and proactively…","E":"Access and Use","F":"AG-01","G":"Allowlisted tools and connectors only","H":"3","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 69","P":"This role will ensure shared learning,  avoid wasted resources, and proactively address AI related threats and opportunities.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-991b04fe504db19a0be0666f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":71,"originalCells":{"A":"doc-1787223639269-0-70","B":"draft","C":"New canonical rule","D":"Across the United States, communities are using various methods to ensure…","E":"Governance","F":"OP-11","G":"Decommission safely and delete data","H":"3","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 70","P":"Across the United States, communities are using various methods to ensure their members are AI literate.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-be52e7fdb3fe4aa029dd245f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":72,"originalCells":{"A":"doc-1787223639269-0-71","B":"draft","C":"New internal policy","D":"Details: This program will deploy free, foundational AI literacy learning opportunities…","E":"Access and Use","F":"DP-01","G":"Block credentials and secrets","H":"3","I":"E0 — evidence","J":"Require evidence","K":"Policy / training / approval","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 71","P":"Details:   This program will deploy free, foundational AI literacy learning opportunities in all regions of North Carolina and  will be designed for residents of all backgrounds and skill levels, including the workforce, senior citizens, rural residents,  individuals with limited digital access, and other underserved communities.","Q":"The directive establishes a program topic not represented as a distinct policy in the current 22-policy baseline.","R":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence."},"originalFormulas":{}},{"id":"ROW-2a5e196c6feb71f2a2dc0d55","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":73,"originalCells":{"A":"doc-1787223639269-0-72","B":"draft","C":"New canonical rule","D":"The regional curriculum will be informed by community input","E":"Access and Use","F":"IN-07","G":"Enforce allowed intent and scope","H":"3","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 72","P":"The regional curriculum will be informed by  community input.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-3b70940a57cced7892ad0af2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":74,"originalCells":{"A":"doc-1787223639269-0-73","B":"draft","C":"New canonical rule","D":"This effort will be achieved through collaborations with NCWorks Career Centers,…","E":"Access and Use","F":"OP-04","G":"Escalate AI incidents","H":"4","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 73","P":"This effort will be achieved through collaborations with NCWorks Career Centers, community colleges,  public libraries, community centers, and other community anchor institutions and deployed in a phased approach to reach  all regions of the state.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-06ab36e3a10d4c020ff264ae","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":75,"originalCells":{"A":"doc-1787223639269-0-74","B":"draft","C":"New canonical rule","D":"This training will help residents build practical understanding of AI concepts,…","E":"Operations","F":"OU-01","G":"Block sensitive output disclosure","H":"4","I":"E0 — evidence","J":"Require evidence","K":"Policy / training / approval","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 74","P":"This training  will help residents build practical understanding of AI concepts, everyday digital tools, online safety, scam awareness, and  responsible AI use.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence."},"originalFormulas":{}},{"id":"ROW-4a7cd9659f16f7155691077b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":76,"originalCells":{"A":"doc-1787223639269-0-75","B":"draft","C":"Map existing","D":"Details: The state will partner with companies from key sectors in…","E":"Governance","F":"DP-03","G":"Block payment card numbers","H":"76","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"89","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 75","P":"Details:   The state will partner with companies from key sectors in North Carolina to define the core entry-level AI  competencies employers need and publish them for higher education institutions to review and update course material  to teach these desired skills.","Q":"Closest semantic and keyword match is DP-03 — Block payment card numbers. The source adds applicability and evidence context.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-674447b3241ac25a9ab2e284","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":77,"originalCells":{"A":"doc-1787223639269-0-76","B":"draft","C":"New canonical rule","D":"A feedback loop using hiring outcomes, employer demand, and worker feedback…","E":"Governance","F":"OU-04","G":"Require human validation for high-stakes advice","H":"6","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 76","P":"A feedback loop using hiring outcomes, employer demand, and worker feedback will allow  for continuous review and updates, keeping entry-level expectations current and strengthening the employment pipeline  from higher education to private sector.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-19230a72d1a7c6edd9a826a9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":78,"originalCells":{"A":"doc-1787223639269-0-77","B":"draft","C":"Map existing","D":"The state government will align government credentials and training with those…","E":"Data Protection","F":"DP-01","G":"Block credentials and secrets","H":"76","I":"E0 — evidence","J":"Require evidence","K":"Policy / training / approval","L":"Critical","M":"89","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 77","P":"The state government will align government credentials and training with those  employer requirements for continuity between sectors and will coordinate with partner companies to ensure the students  participating in the stackable curriculum can be placed into established entry-level roles.","Q":"Closest semantic and keyword match is DP-01 — Block credentials and secrets. The source adds applicability and evidence context.","R":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence."},"originalFormulas":{}},{"id":"ROW-db1955a080c20c5d8c4bc154","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":79,"originalCells":{"A":"doc-1787223639269-0-78","B":"draft","C":"New canonical rule","D":"This mutually beneficial program would allow the private sector to help…","E":"Governance","F":"OU-04","G":"Require human validation for high-stakes advice","H":"4","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 78","P":"This mutually beneficial program  would allow the private sector to help tailor   higher education toward the skillsets required in their workforces and create  direct   pipelines to hire for those skills.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-8eb71d75154950acec1adf4e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":80,"originalCells":{"A":"doc-1787223639269-0-79","B":"draft","C":"Map existing","D":"This recommendation will expand AI- focused registered apprenticeship tracks to address…","E":"Governance","F":"DP-03","G":"Block payment card numbers","H":"76","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"89","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 79","P":"This recommendation will expand AI-  focused registered apprenticeship tracks to address workforce shortages and create clear entry points for emerging talent","Q":"Closest semantic and keyword match is DP-03 — Block payment card numbers. The source adds applicability and evidence context.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-a16dd01b1372ccb87093baa5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"01 Proposed Expansions","row":81,"originalCells":{"A":"doc-1787223639269-0-80","B":"draft","C":"New canonical rule","D":"Partnering with N.C. higher education institutions, the state will coordinate AI…","E":"Governance","F":"DP-08","G":"Restrict education records","H":"5","I":"E2 — govern","J":"Warn / require","K":"Workflow / policy","L":"Medium","M":"67","N":"NC-statewide-ai-strategic-roadmap.pdf","O":"Directive 80","P":"Partnering with N.C. higher education institutions, the state will coordinate AI education and  exposure across all levels of education so that students graduate with the competencies needed for public sector careers.","Q":"The directive is normative but does not have a sufficiently close canonical rule; draft a new rule and require review.","R":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record."},"originalFormulas":{}},{"id":"ROW-86e3f4fc741d7b7c685846c2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":2,"originalCells":{"A":"DP-01","B":"Data Protection","C":"Block credentials and secrets","D":"Block or mask passwords, API keys, access tokens, private keys, signing secrets, and connection strings before transfer to an AI service.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + redacted match","J":"Critical","K":"Data Classification for AI","L":"Seed test secrets plus obfuscated variants; require zero raw secret in destination.","M":"All systems; allow only designated secret-management workflows.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-4e0e2a513a548d8dd7f3ca4b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":3,"originalCells":{"A":"DP-02","B":"Data Protection","C":"Block passwords and authentication answers","D":"Block passwords, passphrases, recovery codes, one-time codes, and authentication answers.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + redacted match","J":"Critical","K":"Data Classification for AI","L":"Test common and generated password formats without storing live credentials.","M":"All systems.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-b73e16e28eb998cbf5f4203c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":4,"originalCells":{"A":"DP-03","B":"Data Protection","C":"Block payment card numbers","D":"Block full PAN; optionally mask to last four only in approved support workflows.","E":"Block / mask","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + masked value","J":"Critical","K":"Data Classification for AI","L":"Use valid and invalid Luhn samples; test separators and OCR variants.","M":"Card data; PCI scope.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-20cebb4d9194a3771b8c6c6b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":5,"originalCells":{"A":"DP-04","B":"Data Protection","C":"Block CVV, CVC and PIN","D":"Block sensitive authentication data, including CVV/CVC, PIN and PIN blocks.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log","J":"Critical","K":"Data Classification for AI","L":"Test label/value pairs and contextual variants.","M":"Payment workflows.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-3a20d304024c3b2668816a2b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":6,"originalCells":{"A":"DP-05","B":"Data Protection","C":"Block national identifiers","D":"Block SSN and other configured national or government identifiers unless an approved regulated workflow explicitly permits them.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + redacted match","J":"Critical","K":"Privacy and Personal Data","L":"Test formatted, unformatted, and OCR variants; measure false positives.","M":"Configure by jurisdiction.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-0470b0b43ca98bfa57d43a5c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":7,"originalCells":{"A":"DP-06","B":"Data Protection","C":"Block bank-account data","D":"Block bank account, routing, IBAN, SWIFT and similar financial account identifiers unless approved and protected.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + redacted match","J":"Critical","K":"Privacy and Personal Data","L":"Test domestic routing/account formats in addition to IBAN.","M":"Financial services and payment workflows.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-543d2f615f6677dc525184fa","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":8,"originalCells":{"A":"DP-07","B":"Data Protection","C":"Restrict protected health information","D":"Block PHI in unapproved AI; allow only minimum-necessary, authorized processing on a contracted and configured service.","E":"Conditional block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + approved context + BAA evidence","J":"Critical","K":"Privacy and Personal Data","L":"Test identifiers plus diagnosis/treatment context and de-identified cases.","M":"HIPAA workflows; context-sensitive, not a blanket ‘no PII’ rule.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-82071b63dbc5fee0b9c7b7a0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":9,"originalCells":{"A":"DP-08","B":"Data Protection","C":"Restrict education records","D":"Block grades, transcripts, discipline records and student identifiers in unapproved AI; require authorized purpose and disclosure basis.","E":"Conditional block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + authorization record","J":"High","K":"Privacy and Personal Data","L":"Test student-record narratives and directory-information exceptions.","M":"Educational institutions.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-db53f16f70cb95ba2382cd88","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":10,"originalCells":{"A":"DP-09","B":"Data Protection","C":"Protect contact information","D":"Warn or block email, phone and postal address based on data classification, purpose, volume and approved service.","E":"Conditional warn/block","F":"E2/E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + context","J":"High","K":"Privacy and Personal Data","L":"Test single business contact, bulk lists, and sensitive-context combinations.","M":"Contextual; a single public business email may be permitted.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-8ab613b576bec5837cc83a8c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":11,"originalCells":{"A":"DP-10","B":"Data Protection","C":"Block biometric identifiers","D":"Block face templates, voiceprints, fingerprints, iris data and other biometric identifiers outside approved use.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Roadmap","I":"Decision log","J":"Critical","K":"Privacy and Personal Data","L":"Test text references and supported image/audio metadata.","M":"High-risk personal data.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-69d23cc85849f478ab07ec4d","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":12,"originalCells":{"A":"DP-11","B":"Data Protection","C":"Protect precise location","D":"Warn or block precise geolocation and sensitive movement history unless purpose, consent and service are approved.","E":"Conditional warn/block","F":"E2/E3","G":"Prompt + upload + response","H":"Roadmap","I":"Decision + approved purpose","J":"High","K":"Privacy and Personal Data","L":"Test coordinates, addresses, routes and location narratives.","M":"Configure precision and context thresholds.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-841c070198c06ad8b0aef2b7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":13,"originalCells":{"A":"DP-12","B":"Data Protection","C":"Block classified, CUI and FCI","D":"Block classified information, CUI/FCI markings and designated government data from unauthorized AI channels.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + classification match","J":"Critical","K":"Data Classification for AI","L":"Test markings, portion labels, headers, and contextual descriptions.","M":"Government and contractors.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-0f0e46d0bdbb6f0cab5550ff","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":14,"originalCells":{"A":"DP-13","B":"Data Protection","C":"Protect export-controlled and national-security data","D":"Block ITAR/EAR-controlled technical data and designated national-security information from unauthorized models, regions and persons.","E":"Conditional block","F":"E3","G":"Prompt + upload + response","H":"Roadmap","I":"Decision + jurisdiction + authorization","J":"Critical","K":"Data Classification for AI","L":"Test project codes, markings and controlled technical narratives.","M":"Requires enterprise classifications and jurisdiction rules.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-f6d57cc20085f5b18a8c7e75","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":15,"originalCells":{"A":"DP-14","B":"Data Protection","C":"Protect trade secrets and source code","D":"Block or require approval for proprietary algorithms, source code, product roadmaps and trade secrets sent to unapproved AI.","E":"Conditional block/approve","F":"E2/E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + repository/project context","J":"High","K":"IP, Copyright and Confidentiality","L":"Test code, design documents and organization-specific codewords.","M":"Enterprise-specific classification is required.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-90a68bb520a07568b91ed065","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":16,"originalCells":{"A":"DP-15","B":"Data Protection","C":"Protect architecture and vulnerability details","D":"Warn or block internal topology, system configuration, exploit paths, audit findings and unpatched vulnerabilities.","E":"Conditional warn/block","F":"E2/E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + recipient/service context","J":"High","K":"AI Security and Prompt Injection","L":"Test IPs, diagrams, vulnerabilities, findings and obfuscation.","M":"Permit approved remediation use on sanctioned systems.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-a4ee8af405c3a0a34fc223ab","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":17,"originalCells":{"A":"DP-16","B":"Data Protection","C":"Protect customer confidential data","D":"Block or approve customer records, contracts, support cases and tenant data according to contract, classification and purpose.","E":"Conditional block/approve","F":"E2/E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + customer/tenant context","J":"High","K":"IP, Copyright and Confidentiality","L":"Test structured and narrative customer data, including multi-record uploads.","M":"Requires customer and tenant identifiers.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-a9251a103bdcaeec733e212f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":18,"originalCells":{"A":"DP-17","B":"Data Protection","C":"Block MNPI and unreleased financials","D":"Block material nonpublic information, unreleased earnings, transactions and forecasts from external AI unless specifically authorized.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + matter code","J":"Critical","K":"IP, Copyright and Confidentiality","L":"Test earnings, M&A and deal narratives with organization codewords.","M":"Public companies and regulated financial workflows.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-5474eae2c46ac8f100593524","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":19,"originalCells":{"A":"DP-18","B":"Data Protection","C":"Protect privilege and investigations","D":"Warn or block attorney-client privileged material, work product, investigations, employee matters and protected audit content.","E":"Conditional block/approve","F":"E2/E3","G":"Prompt + upload + response","H":"Roadmap","I":"Decision + matter authorization","J":"High","K":"IP, Copyright and Confidentiality","L":"Test privilege legends, matter numbers and investigation narratives.","M":"Legal and HR workflows.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-782fab1dc36e02c65be974e5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":20,"originalCells":{"A":"AU-01","B":"Authorized Use","C":"Allow sanctioned AI services only","D":"Detect and block or redirect unapproved AI domains, desktop apps, APIs and embedded assistants.","E":"Block / redirect","F":"E3","G":"Network + browser + endpoint","H":"Partial","I":"Discovery and enforcement event","J":"Critical","K":"Approved AI Tools and Shadow AI","L":"Attempt use through approved and unapproved domains, aliases and API endpoints.","M":"Requires complete inventory and egress coverage.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-4d23040325fead0527a294ed","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":21,"originalCells":{"A":"AU-02","B":"Authorized Use","C":"Require strong authentication","D":"Require enterprise identity and MFA before sensitive AI use; deny unmanaged or anonymous sessions.","E":"Block","F":"E3","G":"Identity + session","H":"Roadmap","I":"IdP/config assertion + decision","J":"Critical","K":"Approved AI Tools and Shadow AI","L":"Test unmanaged device, personal account and MFA-bypass paths.","M":"Not provable from a policy document alone.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-38d46fe6306b41d54c973855","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":22,"originalCells":{"A":"AU-03","B":"Authorized Use","C":"Enforce role and data-class authorization","D":"Permit AI systems, models, data classes and capabilities only to authorized roles and groups.","E":"Block","F":"E3","G":"Identity + policy engine","H":"Roadmap","I":"Decision + entitlement snapshot","J":"Critical","K":"Approved AI Tools and Shadow AI","L":"Test role changes, leavers and restricted data classes.","M":"Requires identity and directory integration.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-c20d8c45b4ec95b6436511ea","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":23,"originalCells":{"A":"AU-04","B":"Authorized Use","C":"Allow approved use cases and models only","D":"Bind each high-risk use case to approved model/version, purpose, owner, data classes and risk decision.","E":"Block / approve","F":"E2/E3","G":"Use-case registry + gateway","H":"Roadmap","I":"Use-case approval + runtime context","J":"Critical","K":"AI Governance and Accountability","L":"Test unregistered purpose, model substitution and scope drift.","M":"All high-impact and regulated use cases.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-d26c38075eb4ffc2a789277b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":24,"originalCells":{"A":"AU-05","B":"Authorized Use","C":"Route by residency and retention constraints","D":"Block or reroute data when model region, storage, retention or subprocessors conflict with approved requirements.","E":"Block / route","F":"E3/E4","G":"Gateway + vendor metadata","H":"Roadmap","I":"Routing decision + vendor configuration","J":"High","K":"Vendor and AI Procurement","L":"Test region mismatch, retention settings and vendor changes.","M":"Jurisdiction- and contract-specific.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-b56697c2ec7805af5540f165","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":25,"originalCells":{"A":"AU-06","B":"Authorized Use","C":"Prevent provider training on enterprise content","D":"Require a contracted enterprise service and verified setting prohibiting provider training or secondary use where policy demands it.","E":"Block","F":"E3","G":"Vendor config + session","H":"Roadmap","I":"Contract + configuration assertion","J":"Critical","K":"Vendor and AI Procurement","L":"Test personal versus enterprise tenant and setting drift.","M":"Depends on provider contract and configuration.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-364d221b3a5228998310f120","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":26,"originalCells":{"A":"AU-07","B":"Authorized Use","C":"Prohibit account sharing","D":"Detect and prevent shared credentials, concurrent anomalous access and use of another person’s AI account.","E":"Block / alert","F":"E2/E3","G":"Identity + session analytics","H":"Roadmap","I":"Authentication and anomaly event","J":"High","K":"Approved AI Tools and Shadow AI","L":"Test shared-account and revoked-user scenarios.","M":"Requires identity telemetry.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-fec0174b736b55532640435b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":27,"originalCells":{"A":"AU-08","B":"Authorized Use","C":"Detect shadow AI and unmanaged plugins","D":"Continuously inventory AI web apps, APIs, browser extensions, connectors and plugins; alert on unknown services.","E":"Detect / block","F":"E1/E3","G":"Browser + endpoint + network","H":"Partial","I":"Inventory and alert","J":"High","K":"Approved AI Tools and Shadow AI","L":"Compare observed use to registry and test newly introduced domains.","M":"Current code sees only nine configured web surfaces.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-4dd87527564e9856d0fcb5dd","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":28,"originalCells":{"A":"IN-01","B":"Input Security","C":"Detect direct prompt injection and jailbreaks","D":"Block or isolate instructions that attempt to override policy, reveal hidden context or bypass safeguards.","E":"Block","F":"E3","G":"Prompt","H":"Partial","I":"Decision + attack class","J":"Critical","K":"AI Security and Prompt Injection","L":"Run multilingual, role-play, encoded and multi-turn attack suites.","M":"Tune to use case; preserve legitimate security testing in sandboxes.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-4a4a6b083fa3ff4f5c7bdf9f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":29,"originalCells":{"A":"IN-02","B":"Input Security","C":"Detect indirect prompt injection","D":"Treat files, web pages, email, RAG content and tool results as untrusted; block hidden instructions from driving actions.","E":"Block / isolate","F":"E3","G":"Upload + retrieval + tool result","H":"Roadmap","I":"Decision + source provenance","J":"Critical","K":"AI Security and Prompt Injection","L":"Test poisoned documents, web pages and retrieved chunks.","M":"Critical for RAG and agents.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-408d5455ddad39fd36c19849","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":30,"originalCells":{"A":"IN-03","B":"Input Security","C":"Detect obfuscated and multimodal attacks","D":"Normalize Unicode, encodings, invisible text, images, audio and document structure before rule evaluation.","E":"Block / isolate","F":"E3","G":"All inputs","H":"Roadmap","I":"Normalization and decision log","J":"High","K":"AI Security and Prompt Injection","L":"Test homoglyphs, zero-width text, base64, OCR and image-based injection.","M":"Requires modality-specific extraction.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-edf61709c7018dad70a3844a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":31,"originalCells":{"A":"IN-04","B":"Input Security","C":"Restrict harmful cyber requests","D":"Block malicious requests for credential theft, destructive exploitation or unauthorized access; route approved defensive testing to a controlled mode.","E":"Conditional block","F":"E3","G":"Prompt + tool call","H":"Roadmap","I":"Decision + approved test context","J":"Critical","K":"AI Security and Prompt Injection","L":"Test dual-use boundaries and approved red-team contexts.","M":"Context- and authorization-sensitive.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-d40071125eb37673ebb7ec2e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":32,"originalCells":{"A":"IN-05","B":"Input Security","C":"Quarantine unsafe files and malware","D":"Scan attachments for malware, active content, archive bombs and prohibited formats; block or quarantine before AI ingestion.","E":"Block / quarantine","F":"E3/E4","G":"Upload","H":"Roadmap","I":"Scan result + quarantine event","J":"Critical","K":"AI Security and Prompt Injection","L":"Test malware simulators, macros, encrypted archives and oversize files.","M":"Current build scans only readable text files ≤1 MB and does not prevent upload.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-528f215a93143808dd5b2168","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":33,"originalCells":{"A":"IN-06","B":"Input Security","C":"Prevent RAG and data poisoning","D":"Validate provenance, authorization and integrity before documents, embeddings, feedback or fine-tuning data enter an AI corpus.","E":"Block / quarantine","F":"E3/E4","G":"Ingestion pipeline","H":"Roadmap","I":"Provenance + integrity + decision","J":"Critical","K":"Data, Model and RAG Supply Chain","L":"Inject conflicting, malicious and unauthorized content; verify rejection and rollback.","M":"RAG, training, fine-tuning and memory stores.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-29067f0ed5669951ea1e016a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":34,"originalCells":{"A":"IN-07","B":"Input Security","C":"Enforce allowed intent and scope","D":"Constrain requests to the approved business purpose, user role and system capability; warn or block out-of-scope use.","E":"Warn / block","F":"E2/E3","G":"Prompt + use-case context","H":"Roadmap","I":"Decision + policy context","J":"High","K":"AI Acceptable Use","L":"Test plausible scope drift and role mismatch.","M":"Requires use-case and role context.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-c907aceb243a3fcf0f955b62","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":35,"originalCells":{"A":"IN-08","B":"Input Security","C":"Limit resource consumption","D":"Enforce prompt, token, file, query, rate, recursion and spend limits; stop runaway loops.","E":"Block / throttle","F":"E3/E4","G":"Gateway + agent runtime","H":"Roadmap","I":"Usage meter + throttle event","J":"High","K":"Agentic AI and Connectors","L":"Stress test long context, retries, tool loops and parallel calls.","M":"All paid or resource-constrained AI.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-c0f83a9010fbd14f20f5bc97","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":36,"originalCells":{"A":"OU-01","B":"Output Safety","C":"Block sensitive output disclosure","D":"Inspect outputs for secrets, regulated data, hidden context and unauthorized tenant/customer information before display or downstream use.","E":"Block / redact","F":"E3","G":"Response + tool result","H":"Roadmap","I":"Decision + redacted output","J":"Critical","K":"Prompt and Output Interaction","L":"Seed hidden sensitive data and verify it never reaches the user or tool.","M":"External AI responses are not intercepted in the current build.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-72ac21a552dc30830c79d569","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":37,"originalCells":{"A":"OU-02","B":"Output Safety","C":"Prevent hidden-context and system-prompt leakage","D":"Block disclosure of system prompts, hidden instructions, connector tokens, private retrieval context and chain-of-control metadata.","E":"Block / redact","F":"E3","G":"Response","H":"Roadmap","I":"Decision + leakage class","J":"Critical","K":"AI Security and Prompt Injection","L":"Run extraction attacks and canary-string tests.","M":"Especially important for hosted agents and RAG.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-601d81f57bf7202ab63cb0fa","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":38,"originalCells":{"A":"OU-03","B":"Output Safety","C":"Require evidence for factual claims","D":"For designated decisions, require citations or approved source grounding; flag unsupported, fabricated or stale claims.","E":"Warn / hold","F":"E2/E3","G":"Response","H":"Roadmap","I":"Claim-source links + verification result","J":"High","K":"Evaluation, Red Team and Benchmarking","L":"Test answerability, fabricated citations and stale sources.","M":"Apply by use case; not every creative task needs citations.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-a643234da24b287941f49293","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":39,"originalCells":{"A":"OU-04","B":"Output Safety","C":"Require human validation for high-stakes advice","D":"Do not let unreviewed AI output make or communicate medical, legal, financial, employment, housing, education or safety decisions.","E":"Hold for approval","F":"E2/E3","G":"Response + workflow","H":"Roadmap","I":"Reviewer identity + decision","J":"Critical","K":"High-Impact AI and Human Oversight","L":"Simulate consequential outputs; verify required review and fail-safe.","M":"Configure domains and qualified reviewers.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-df320a4529ea31fcf2ae9cbc","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":40,"originalCells":{"A":"OU-05","B":"Output Safety","C":"Detect discriminatory or unfair outcomes","D":"Hold or flag outputs that use protected traits, proxies or unjustified disparate treatment in consequential contexts.","E":"Hold / alert","F":"E2/E3","G":"Response + decision record","H":"Roadmap","I":"Fairness test + decision","J":"Critical","K":"Bias, Fairness and Civil Rights","L":"Test counterfactual pairs, subgroup performance and proxy features.","M":"Requires domain-specific legal and statistical review.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-5c81bd1c83021a272f2102c6","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":41,"originalCells":{"A":"OU-06","B":"Output Safety","C":"Block harassment, hate and abuse","D":"Block or safely transform hateful, harassing, demeaning or targeted abusive content under the organization’s safety standard.","E":"Block / transform","F":"E3/E4","G":"Response","H":"Roadmap","I":"Decision + safety category","J":"High","K":"AI Acceptable Use","L":"Run multilingual and contextual safety tests, including quoted material exceptions.","M":"Tune for lawful monitoring and support contexts.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-caa2266229df109ed98efd66","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":42,"originalCells":{"A":"OU-07","B":"Output Safety","C":"Block dangerous and illegal content","D":"Block actionable content that materially facilitates violence, self-harm, illegal activity or CBRN harm; route emergencies to approved support.","E":"Block / route","F":"E3/E4","G":"Prompt + response","H":"Roadmap","I":"Decision + escalation event","J":"Critical","K":"AI Acceptable Use","L":"Use controlled safety datasets and escalation drills.","M":"Requires carefully governed exceptions for research and safety teams.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-adb1d76f0b379c04faa70c43","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":43,"originalCells":{"A":"OU-08","B":"Output Safety","C":"Block insecure code from automated use","D":"Scan generated code for vulnerabilities, malware patterns, exposed secrets and unsafe dependencies before merge, execution or deployment.","E":"Hold / block","F":"E2/E3","G":"Response + CI/CD","H":"Roadmap","I":"Scan findings + approval","J":"High","K":"AI Secure Development Lifecycle","L":"Benchmark common weakness classes and dependency risks.","M":"Development and code-generation use cases.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-f64b0d859b2196619fb2c427","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":44,"originalCells":{"A":"OU-09","B":"Output Safety","C":"Sanitize and validate model output","D":"Treat model output as untrusted: enforce schema, encode content, parameterize commands and validate before execution or display.","E":"Transform / block","F":"E3/E4","G":"Response + consuming application","H":"Roadmap","I":"Validation result + rejected payload","J":"Critical","K":"AI Secure Development Lifecycle","L":"Test XSS, SQL/command injection, malformed JSON and policy bypass.","M":"Applications consuming model output.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-c6d05c26b16973a094cfd665","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":45,"originalCells":{"A":"OU-10","B":"Output Safety","C":"Protect intellectual property and licenses","D":"Detect likely copyrighted, licensed or third-party confidential material; require attribution, license check or human review before reuse.","E":"Warn / hold","F":"E2/E3","G":"Response","H":"Roadmap","I":"Similarity/license review record","J":"High","K":"IP, Copyright and Confidentiality","L":"Test verbatim regeneration, code-license conflicts and source attribution.","M":"Use-case and jurisdiction specific.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-98218b6ac291f30664af9ad7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":46,"originalCells":{"A":"OU-11","B":"Output Safety","C":"Prevent re-identification","D":"Block outputs that recombine, infer or expose identities from de-identified, aggregate or pseudonymous data.","E":"Block / hold","F":"E3","G":"Response","H":"Roadmap","I":"Privacy-risk result","J":"Critical","K":"Privacy and Personal Data","L":"Run linkage and uniqueness attacks against representative datasets.","M":"Analytics, synthetic data and health/research contexts.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-fc117ab8bb5f67c50e5963a2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":47,"originalCells":{"A":"OU-12","B":"Output Safety","C":"Disclose AI-generated or synthetic content","D":"Apply required AI-use notices, provenance metadata and machine-readable labels to designated content and interactions.","E":"Transform / require disclosure","F":"E3/E4","G":"Response + publication","H":"Roadmap","I":"Label/provenance record","J":"High","K":"Transparency, Disclosure and Provenance","L":"Verify labels survive export, reposting and supported transformations.","M":"Public-facing or regulated content.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-114fa87f83e261fe3af77418","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":48,"originalCells":{"A":"AG-01","B":"Agentic Controls","C":"Allowlisted tools and connectors only","D":"Permit only approved tools, MCP servers, plugins, APIs and connector operations for the use case and role.","E":"Block","F":"E3","G":"Agent tool gateway","H":"Roadmap","I":"Tool-policy decision","J":"Critical","K":"Agentic AI and Connectors","L":"Attempt unknown, renamed and newly installed tools.","M":"Agentic systems.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-984d6e85d569410134ef680a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":49,"originalCells":{"A":"AG-02","B":"Agentic Controls","C":"Enforce least privilege for agents","D":"Issue short-lived, scoped credentials; restrict data, action, tenant and environment permissions to the minimum necessary.","E":"Block","F":"E3","G":"Identity + tool gateway","H":"Roadmap","I":"Credential scope + decision","J":"Critical","K":"Agentic AI and Connectors","L":"Test privilege escalation, stale tokens and cross-environment access.","M":"Agentic systems.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-af0bdfd5e8ab37b795436268","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":50,"originalCells":{"A":"AG-03","B":"Agentic Controls","C":"Require approval for high-impact or irreversible actions","D":"Require step-up human confirmation before payments, submissions, deletions, permission changes, production actions or legal commitments.","E":"Hold for approval","F":"E2/E3","G":"Tool call","H":"Roadmap","I":"Action preview + approver + result","J":"Critical","K":"Agentic AI and Connectors","L":"Test each irreversible action and approval replay prevention.","M":"Agentic systems.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-6d3a2aa74b369264845b3b6c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":51,"originalCells":{"A":"AG-04","B":"Agentic Controls","C":"Prohibit autonomous consequential decisions","D":"Prevent agents from making final employment, credit, housing, education, healthcare, legal or similarly consequential decisions without authorized human determination.","E":"Block / hold","F":"E2/E3","G":"Decision + tool call","H":"Roadmap","I":"Human decision record","J":"Critical","K":"High-Impact AI and Human Oversight","L":"Test indirect actions and recommendation-to-decision handoffs.","M":"High-impact domains.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-26718331d45614880357c7c0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":52,"originalCells":{"A":"AG-05","B":"Agentic Controls","C":"Approve external communications","D":"Require approval before an agent sends email, messages, posts, tickets or other external communications in designated contexts.","E":"Hold for approval","F":"E2/E3","G":"Tool call","H":"Roadmap","I":"Preview + approver + sent artifact","J":"High","K":"Agentic AI and Connectors","L":"Test wrong recipient, sensitive content and reply-all scenarios.","M":"Configure trusted low-risk automations separately.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-bfd6445923d7861ee351edf5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":53,"originalCells":{"A":"AG-06","B":"Agentic Controls","C":"Approve destructive and permission-changing actions","D":"Require approval and recoverability before delete, overwrite, access-control, security-setting or production-change actions.","E":"Hold / block","F":"E2/E3","G":"Tool call","H":"Roadmap","I":"Diff/preview + approval + rollback reference","J":"Critical","K":"Agentic AI and Connectors","L":"Test deletion scope, permission escalation and rollback.","M":"Agentic systems.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-916fa5d8583e6e6f76ea0875","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":54,"originalCells":{"A":"AG-07","B":"Agentic Controls","C":"Enforce transaction and autonomy limits","D":"Apply amount, volume, recipient, duration, recursion, environment and cumulative-risk limits to agent actions.","E":"Block / throttle","F":"E3/E4","G":"Agent runtime","H":"Roadmap","I":"Meter + limit decision","J":"Critical","K":"Agentic AI and Connectors","L":"Test single and cumulative limit evasion.","M":"Agentic systems.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-a5219f55d99efc88d602ff84","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":55,"originalCells":{"A":"AG-08","B":"Agentic Controls","C":"Enforce tenant and context isolation","D":"Prevent retrieval, memory, cache, prompt or tool results from crossing user, customer, tenant, case or security boundaries.","E":"Block","F":"E3","G":"Retrieval + memory + tool gateway","H":"Roadmap","I":"Isolation test + decision","J":"Critical","K":"Data, Model and RAG Supply Chain","L":"Run cross-tenant canaries and confused-deputy tests.","M":"Multi-tenant and multi-case systems.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-eeed8d9a3aee4b5d21ac7040","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":56,"originalCells":{"A":"AG-09","B":"Agentic Controls","C":"Govern agent memory writes","D":"Validate, minimize and approve durable memory; prevent secrets, poisoned instructions and sensitive data from persistence.","E":"Block / approve","F":"E2/E3","G":"Memory write","H":"Roadmap","I":"Memory diff + provenance + decision","J":"High","K":"Agentic AI and Connectors","L":"Test poisoned memory, sensitive persistence and deletion.","M":"Systems with persistent memory.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-aa378e6ff029af789ef534db","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":57,"originalCells":{"A":"AG-10","B":"Agentic Controls","C":"Verify tool and package supply chain","D":"Pin, sign, scan and monitor model, tool, connector, MCP server, package and prompt dependencies; block untrusted versions.","E":"Block / quarantine","F":"E3/E4","G":"Build + runtime","H":"Roadmap","I":"SBOM/provenance + verification event","J":"Critical","K":"Data, Model and RAG Supply Chain","L":"Test tampered package, changed tool schema and revoked publisher.","M":"Applications and agents.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-a6a6aa3e4c4ce966234e2827","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":58,"originalCells":{"A":"OP-01","B":"Operations","C":"Log AI interactions and control decisions","D":"Record approved prompt/response metadata, rule outcomes, user/system, model/version, use case, time and action with privacy-aware minimization.","E":"Log","F":"E1","G":"All enforcement points","H":"Partial","I":"Tamper-evident audit event","J":"High","K":"AI Monitoring and Logging","L":"Verify completeness, integrity, access, retention and redaction.","M":"All governed systems; log content only where lawful and necessary.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-26db238193790b5b1e5f97d0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":59,"originalCells":{"A":"OP-02","B":"Operations","C":"Capture provenance and citations","D":"Preserve model/version, source documents, retrieval identifiers, tool calls and transformations for decisions and published content.","E":"Log / require","F":"E1/E3","G":"Response + workflow","H":"Roadmap","I":"Provenance record","J":"High","K":"Transparency, Disclosure and Provenance","L":"Trace a sample output end-to-end and validate source integrity.","M":"High-impact, factual and published outputs.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-fb6fd067e095726afc92217e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":60,"originalCells":{"A":"OP-03","B":"Operations","C":"Monitor control efficacy and model drift","D":"Measure precision, recall, bypass rate, false-positive burden, model/output drift and control coverage against thresholds.","E":"Monitor / gate","F":"E1/E3","G":"Evaluation + production telemetry","H":"Roadmap","I":"Metric series + threshold event","J":"Critical","K":"Evaluation, Red Team and Benchmarking","L":"Use labeled tests and production samples; investigate threshold breaches.","M":"All critical rules.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-887beb4293962f2da36053d7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":61,"originalCells":{"A":"OP-04","B":"Operations","C":"Escalate AI incidents","D":"Create and route incidents for critical blocks, suspected leakage, harmful output, control failure and policy evasion; preserve evidence.","E":"Alert / case","F":"E1/E4","G":"Runtime + SOC workflow","H":"Partial","I":"Incident/case record","J":"Critical","K":"AI Incident Response and Kill Switch","L":"Run tabletop and technical drills from detection through closure.","M":"All governed systems.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-94795e42825f39a59c19bfe7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":62,"originalCells":{"A":"OP-05","B":"Operations","C":"Provide kill switch and fail-safe","D":"Disable a model, connector, use case, rule exception or autonomous action path quickly; default safely when critical controls fail.","E":"Block / disable","F":"E4","G":"Gateway + admin plane","H":"Roadmap","I":"Kill event + authorization + recovery","J":"Critical","K":"AI Incident Response and Kill Switch","L":"Test scoped and global shutdown, fail-closed behavior and restoration.","M":"Critical and high-impact systems.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-aef351b0e7592d09d76a96bb","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":63,"originalCells":{"A":"OP-06","B":"Operations","C":"Reassess on material change","D":"Trigger tests, impact assessment and approval when model, data, prompt, tool, vendor, law, use case or risk profile changes.","E":"Hold release","F":"E2/E3","G":"Change pipeline","H":"Roadmap","I":"Change record + reassessment","J":"High","K":"AI Secure Development Lifecycle","L":"Change each dependency and verify the gate activates.","M":"All production AI.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-62ef684284b6095dd22629e4","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":64,"originalCells":{"A":"OP-07","B":"Operations","C":"Time-bound exceptions and waivers","D":"Require scope, owner, rationale, compensating controls, approval, expiry and automatic revocation for every exception.","E":"Approve / expire","F":"E2/E4","G":"Policy engine + workflow","H":"Roadmap","I":"Exception record + expiry event","J":"High","K":"Exceptions, Appeals and Risk Acceptance","L":"Create expired, overbroad and missing-owner exceptions; verify rejection.","M":"All rule families.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-6f656ea168f1e4099daaf3ba","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":65,"originalCells":{"A":"OP-08","B":"Operations","C":"Support feedback, appeal and override","D":"Provide affected users and operators a documented route to contest, correct, override or escalate AI decisions without retaliation.","E":"Workflow","F":"E2","G":"User experience + case management","H":"Roadmap","I":"Appeal + resolution record","J":"High","K":"Exceptions, Appeals and Risk Acceptance","L":"Test accessibility, timeliness and traceability of appeals.","M":"Consequential and user-facing AI.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-4c00f748af2c3330178d5750","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":66,"originalCells":{"A":"OP-09","B":"Operations","C":"Maintain AI inventory and ownership","D":"Continuously inventory AI systems, models, versions, use cases, owners, users, data, vendors, risk tier and status.","E":"Detect / require","F":"E1/E3","G":"Discovery + registry","H":"Partial","I":"Inventory record + reconciliation","J":"Critical","K":"AI Governance and Accountability","L":"Reconcile browser, endpoint, network, procurement and API observations.","M":"Enterprise-wide.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-13be3f757edac94e7691dd96","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":67,"originalCells":{"A":"OP-10","B":"Operations","C":"Monitor vendor and model supply chain","D":"Track vendor/model changes, subprocessors, incidents, terms, data use, performance and end-of-life; reassess affected rules.","E":"Monitor / gate","F":"E1/E3","G":"Vendor management + runtime","H":"Roadmap","I":"Vendor evidence + change event","J":"High","K":"Vendor and AI Procurement","L":"Simulate model version, term and subprocessor change.","M":"Third-party AI.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-51650ac5692827ed4fb7d477","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":68,"originalCells":{"A":"OP-11","B":"Operations","C":"Decommission safely and delete data","D":"Revoke access, export required records, delete prompts/files/embeddings/memory, terminate connectors and document residual risk.","E":"Automate / verify","F":"E4","G":"Admin + data lifecycle","H":"Roadmap","I":"Deletion certificate + access revocation","J":"High","K":"AI Decommissioning and Data Lifecycle","L":"Test deletion across primary, cache, backup and vendor scopes.","M":"Retired systems and use cases.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-28f058104d978bcff289784f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":69,"originalCells":{"A":"OP-12","B":"Operations","C":"Require predeployment evaluation and red team","D":"Do not release until required privacy, security, fairness, robustness, factuality, abuse and human-factors tests meet documented go/no-go thresholds.","E":"Hold release","F":"E3","G":"CI/CD + governance workflow","H":"Roadmap","I":"Test report + release decision","J":"Critical","K":"Evaluation, Red Team and Benchmarking","L":"Use versioned representative datasets; independently review high-impact systems.","M":"All production AI; depth based on risk.","N":"Baseline"},"originalFormulas":{}},{"id":"ROW-4927af9e9ba235a9f87bdf07","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":70,"originalCells":{"A":"NEW-001","B":"Governance","C":"Additionally, these goals will strengthen North Carolina’s economy by empowering our…","D":"Additionally, these goals will strengthen North Carolina’s economy by empowering  our workforce and businesses to deploy AI tools responsibly, supporting innovation and economic competitiveness, and  preparing communities for the economy of the future.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-6802e7fdb9c3138d3fd1f944","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":71,"originalCells":{"A":"NEW-002","B":"Output and Use","C":"To successfully implement most of the recommendations, the State will need…","D":"To successfully implement most of the recommendations, the State will need to realign its existing funding, and in  other cases, seek more resources from governmental and non-governmental sources.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-32c6baa2a2a104782c80709a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":72,"originalCells":{"A":"NEW-003","B":"Governance","C":"General Assembly shares our desire to safeguard public trust and empower…","D":"General Assembly shares our desire to safeguard public trust and empower the  workforce, and NCGA support will be crucial.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-8f9acebbc97a90ebe8dadd32","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":73,"originalCells":{"A":"NEW-004","B":"Governance","C":"To realize this ambitious vision, North Carolina state agencies will collaborate…","D":"To realize this ambitious vision, North Carolina state agencies will collaborate with higher education institutions, private employers,  nonprofits, and workforce partners to create pathways for success in an AI-driven future.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-7e38a82df6e3119991c9e2a0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":74,"originalCells":{"A":"NEW-005","B":"Operations","C":"Through these collective efforts, the state seeks to ensure that every…","D":"Through these collective efforts, the  state seeks to ensure that every North Carolinian has the opportunity to thrive in a landscape that will be shaped by advanced  technology.","E":"Detect / log","F":"E1 — observe","G":"Determine during design","H":"Proposed","I":"Event / log","J":"Medium","K":"Proposed policy mapping","L":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-b88b717824a82181df259e8c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":75,"originalCells":{"A":"NEW-006","B":"Operations","C":"Workforce Empowerment Ensure technology augments rather than replaces the workforce by…","D":"Workforce Empowerment  Ensure technology augments rather than replaces the workforce by preparing workers in all industries, including state  government, for an AI-enabled economy by upskilling, reskilling, and strengthening the worker safety net.","E":"Detect / log","F":"E1 — observe","G":"Determine during design","H":"Proposed","I":"Event / log","J":"Medium","K":"Proposed policy mapping","L":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-7ceb0e2684d9fec2887acd91","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":76,"originalCells":{"A":"NEW-007","B":"Governance","C":"Also must respect personal autonomy and dignity, maintaining people’s freedom to…","D":"Systems also must respect personal autonomy and  dignity, maintaining people’s freedom to think, choose, and act independently, and systems must prevent manipulation or restriction of choices.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-1ee0889551db573489cc8525","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":77,"originalCells":{"A":"NEW-008","B":"Governance","C":"Since the creation of the Executive Order, the Council has been…","D":"Since the creation of the  Executive Order, the Council has been focused on creating informed recommendations on policy, governance, ethics, and literacy to ensure the safe, transparent,  and fair adoption of artificial intelligence across the state and to develop recommendations to address the potential impact of AI on the workforce.","E":"Require evidence","F":"E0 — evidence","G":"Determine during design","H":"Proposed","I":"Policy / training / approval","J":"Medium","K":"Proposed policy mapping","L":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-dce2243867b9bea58a15da9a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":78,"originalCells":{"A":"NEW-009","B":"Governance","C":"The goals are grouped into three categories to ensure a clear…","D":"The  goals are grouped into three categories to ensure a clear and actionable framework that supports statewide safety, opportunity, and innovation:  1)   Protect   focuses on safeguarding North Carolina residents through responsible AI use and strong risk mitigation practices.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-4b22ee7af6d2b1f1511b2092","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":79,"originalCells":{"A":"NEW-010","B":"Governance","C":"Each of these recommendations has been created with an implementation plan…","D":"Each of these recommendations has been created with an implementation plan and timeline, recognizing that work will progress and be shared as it is  available.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-2178cc84871e6c12497d028f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":80,"originalCells":{"A":"NEW-011","B":"Governance","C":"The recommendations below were identified by the Council to improve AI…","D":"The recommendations below were identified by the Council to improve  AI policy, governance, ethics, and literacy for the state with the understanding that AI will continue to evolve.","E":"Require evidence","F":"E0 — evidence","G":"Determine during design","H":"Proposed","I":"Policy / training / approval","J":"Medium","K":"Proposed policy mapping","L":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-dd9b37827023891ae2e79757","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":81,"originalCells":{"A":"NEW-012","B":"Data Protection","C":"Details: As AI continues to reshape society, the state will explore…","D":"Details:   As AI continues to reshape society, the state will explore a package of statewide policies that address numerous  concerns enabled by AI technologies, including child safety and mental health, lack of privacy protections, and senior  citizen fraud and abuse.","E":"Detect / log","F":"E1 — observe","G":"Determine during design","H":"Proposed","I":"Event / log","J":"Medium","K":"Proposed policy mapping","L":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-a927da2d294d32c338b649a8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":82,"originalCells":{"A":"NEW-013","B":"Input and Content","C":"Child safety components will focus on foundational safety requirements that encourage…","D":"Child safety components will focus on foundational safety requirements that encourage non-  addictive designs and establish a standard duty of care.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-13ef5894969c1e5431b4dd0e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":83,"originalCells":{"A":"NEW-014","B":"Governance","C":"By 2029, approximately half of US jobs will be transformed by…","D":"By 2029, approximately half of US jobs will be   transformed by AI .","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-55228df98030ecf1a31795bb","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":84,"originalCells":{"A":"NEW-015","B":"Governance","C":"Details: North Carolina must proactively provide accessible pathways back into high-demand,…","D":"Details:   North Carolina must proactively provide accessible pathways back into high-demand, sustainable careers.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-8df0d2c5d48ac75dcc951a83","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":85,"originalCells":{"A":"NEW-016","B":"Access and Use","C":"This will be accomplished through identifying and supporting workers in roles…","D":"This will be accomplished through identifying and supporting workers in roles most vulnerable to automation and  partnering with employers, Commerce’s Labor and Economic Analysis Division, community colleges, local workforce  development boards, and NCWorks Career Centers to track labor-market signals and pinpoint high-risk areas of AI-driven  displacement.","E":"Require evidence","F":"E0 — evidence","G":"Determine during design","H":"Proposed","I":"Policy / training / approval","J":"Medium","K":"Proposed policy mapping","L":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-925515712f4d9d94af781757","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":86,"originalCells":{"A":"NEW-017","B":"Access and Use","C":"Embedding work-based learning opportunities and direct employer connections will accelerate reentry…","D":"Embedding work-based  learning opportunities and direct employer connections will accelerate reentry into private- and public-sector roles.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-ad082f1caa1aa2189d341e1a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":87,"originalCells":{"A":"NEW-018","B":"Governance","C":"Using displacement data and worker feedback will support the design of…","D":"Using  displacement data and worker feedback will support the design of career transition tracks tailored to the needs and  experiences of AI-impacted workers to avoid long-term unemployment.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-3439be719f2aafe6c4814ddd","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":88,"originalCells":{"A":"NEW-019","B":"Governance","C":"Additionally, tracking the re-skilling programs that successfully lead to meaningful employment…","D":"Additionally, tracking the re-skilling programs that  successfully lead to meaningful employment will help improve other reskilling tracks.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-f4afe9eb2f3bde75c8f1f3ca","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":89,"originalCells":{"A":"NEW-020","B":"Governance","C":"Details: North Carolina must be ready to detect and respond to…","D":"Details:   North Carolina must be ready to detect and respond to AI-driven labor disruptions early to stabilize the workforce.","E":"Detect / log","F":"E1 — observe","G":"Determine during design","H":"Proposed","I":"Event / log","J":"Medium","K":"Proposed policy mapping","L":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-f1953fc215ffbe487001d28f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":90,"originalCells":{"A":"NEW-021","B":"Governance","C":"This effort will be advanced through advocating for legislation to counteract…","D":"This effort will be advanced through advocating for legislation to counteract potential AI-driven labor disruptions and  to prepare for any such disruptions.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-8c746d001f4f8dfa3392995e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":91,"originalCells":{"A":"NEW-022","B":"Operations","C":"Worker Adjustment and Retraining Notification (WARN) data collection processes will help…","D":"Worker Adjustment and Retraining Notification  (WARN) data collection processes will help to explicitly capture AI-related job losses and use these insights to inform  retraining opportunities to avoid long-term unemployment.","E":"Require evidence","F":"E0 — evidence","G":"Determine during design","H":"Proposed","I":"Policy / training / approval","J":"Medium","K":"Proposed policy mapping","L":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-f1bef7b89783b4c4860e3161","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":92,"originalCells":{"A":"NEW-023","B":"Governance","C":"In parallel, partnering with higher education institutions will allow the collection…","D":"In parallel, partnering with higher education institutions will  allow the collection of more granular unemployment and program-enrollment data that can signal emerging displacement  trends and inform rapid intervention strategies to improve early detection and response.","E":"Detect / log","F":"E1 — observe","G":"Determine during design","H":"Proposed","I":"Event / log","J":"Medium","K":"Proposed policy mapping","L":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-ae3e67e750dd6a83a5603b26","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":93,"originalCells":{"A":"NEW-024","B":"Governance","C":"General Assembly Timeline: March 2027 Goal 3: Account for Resource Demands…","D":"General Assembly  Timeline:   March 2027  Goal 3: Account for Resource Demands and Impacts  Ensure appropriate environmental stewardship that balances community needs and public trust with the  demands that AI creates on land, water, and energy.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-7d3a660def7a0066f321cdfd","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":94,"originalCells":{"A":"NEW-025","B":"Governance","C":"These facilities serve as the backbone of AI, and as AI…","D":"These  facilities serve as the backbone of AI, and as AI continues to advance, the demand for data centers will only increase.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-d36c6d6799b3a8e021727fbc","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":95,"originalCells":{"A":"NEW-026","B":"Governance","C":"It is essential for states to thoroughly assess the economic opportunities…","D":"It is essential for states to thoroughly assess the economic opportunities data centers  bring alongside the impact these facilities have on communities to maximize benefits and reduce data center challenges.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-0c09346d7367350cbb7fd52f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":96,"originalCells":{"A":"NEW-027","B":"Operations","C":"8 Recommendation: Monitor and publicly disclose impacts of AI infrastructure on…","D":"8  Recommendation:  Monitor and publicly disclose impacts of AI infrastructure on communities using third-party evaluations.","E":"Detect / log","F":"E1 — observe","G":"Determine during design","H":"Proposed","I":"Event / log","J":"Medium","K":"Proposed policy mapping","L":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-27a6ee90d3033e587fa19858","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":97,"originalCells":{"A":"NEW-028","B":"Governance","C":"This recommendation calls for a resource monitoring program that uses independent,…","D":"This recommendation  calls for a resource monitoring program that uses independent, third-party evaluators to assess and publicly report the  environmental and community impacts of AI-related infrastructure, with a focus on land, water, energy, and public health  concerns.","E":"Detect / log","F":"E1 — observe","G":"Determine during design","H":"Proposed","I":"Event / log","J":"Medium","K":"Proposed policy mapping","L":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-fac6da77f651313ff2722cc9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":98,"originalCells":{"A":"NEW-029","B":"Output and Use","C":"Legislation would strengthen this effort by requiring standardized disclosure of environmental,…","D":"Legislation would strengthen this effort by requiring standardized disclosure of environmental, energy, and other baseline  consumption metrics from all AI data center developers and operators to ensure transparent and consistent tracking of  resource utilization.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-9a1973e5536ac23208f2ab3d","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":99,"originalCells":{"A":"NEW-030","B":"Governance","C":"General Assembly, Local Governments Timeline: June 2027 Goal 4: Reduce Fraud,…","D":"General Assembly, Local Governments  Timeline:   June 2027  Goal 4: Reduce Fraud, Manipulation, and Deception  Ensure 100% of state government-produced content abides by a content authenticity standard.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-973ac1ee3ddf1f71e074952c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":100,"originalCells":{"A":"NEW-031","B":"Governance","C":"Details: To ensure public confidence in official government communications, all state…","D":"Details:   To ensure public confidence in official government communications, all state agencies should verify the  authenticity of their communications with clear tracing of their origins.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-170f90e94ef6cfb2d4e51157","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":101,"originalCells":{"A":"NEW-032","B":"Governance","C":"Implementing a statewide content verification standard will strengthen public trust by…","D":"Implementing a statewide content verification  standard will strengthen public trust by assuring residents content is authentic, especially in times of emergency.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-34eab42b34c557810841329c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":102,"originalCells":{"A":"NEW-033","B":"Governance","C":"When AI is used to help generate official content, the standard…","D":"When AI is used to help generate official content, the standard  should also disclose how it was used to ensure transparency.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-4d340a13cfa3cd96d373b3e5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":103,"originalCells":{"A":"NEW-034","B":"Output and Use","C":"Community upskilling efforts, via the Advancing Community Upskilling goal later in…","D":"Community upskilling efforts, via the Advancing Community  Upskilling goal later in this framework, will include education on how to recognize verified content from government  sources.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-8e8f13f79ecc8bdf3bee6c27","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":104,"originalCells":{"A":"NEW-035","B":"Governance","C":"This upskilling plan will target all skill levels, including senior citizens,…","D":"This upskilling plan will target all skill levels, including senior citizens, students, and rural communities.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-84b398e1f7f746f4fb163e7c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":105,"originalCells":{"A":"NEW-036","B":"Input and Content","C":"With the state government’s support and backing, local governments and private…","D":"With the  state government’s support and backing, local governments and private sector organizations will also be encouraged to  adopt such standards, reducing the potential for misinformation campaigns.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-1a5cd35305d322d57744a814","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":106,"originalCells":{"A":"NEW-037","B":"Operations","C":"Some states publish all AI systems in their inventory, while others…","D":"Some states publish all AI systems in their inventory, while others focus  only on   high-risk systems .","E":"Detect / log","F":"E1 — observe","G":"Determine during design","H":"Proposed","I":"Event / log","J":"Medium","K":"Proposed policy mapping","L":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-8a28f59ae3f4c519d6b957b2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":107,"originalCells":{"A":"NEW-038","B":"Governance","C":"The state’s 2025 Executive Order 24 also requires the AI Accelerator…","D":"The state’s 2025   Executive Order 24   also requires the AI Accelerator to disclose all high-risk AI  use cases   to the public .","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-9f813ccbb388004e2f00b75c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":108,"originalCells":{"A":"NEW-039","B":"Output and Use","C":"24: Advancing Trustworthy Artificial Intelligence That Benefits All North Carolinians requires…","D":"24: Advancing Trustworthy Artificial Intelligence That Benefits All North Carolinians  requires the disclosure of high-risk AI use cases throughout state government, this initiative will strengthen public trust  by disclosing additional public-facing AI use.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"High","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-46a27197e07943dd4b12085f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":109,"originalCells":{"A":"NEW-040","B":"Governance","C":"Dynamic dashboards will ensure transparency across state government by providing as…","D":"Dynamic dashboards will ensure transparency across state government  by providing as much information as possible to the public while maintaining the security and integrity of systems.","E":"Require evidence","F":"E0 — evidence","G":"Determine during design","H":"Proposed","I":"Policy / training / approval","J":"Medium","K":"Proposed policy mapping","L":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-c7b6826d4a6f55026b9d97ba","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":110,"originalCells":{"A":"NEW-041","B":"Governance","C":"Dashboards will be updated regularly to reflect the most current information…","D":"Dashboards will be updated regularly to reflect the most current information related to AI tools and will be accessible, with  information presented in plain language to promote transparency.","E":"Require evidence","F":"E0 — evidence","G":"Determine during design","H":"Proposed","I":"Policy / training / approval","J":"Medium","K":"Proposed policy mapping","L":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-aa26960a5b505ead097d925d","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":111,"originalCells":{"A":"NEW-042","B":"Input and Content","C":"Feedback mechanisms will be available to measure public sentiment and improve…","D":"Feedback mechanisms will be available to measure  public sentiment and improve tools based on input.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-2804a8f9846c69b2c552b554","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":112,"originalCells":{"A":"NEW-043","B":"Operations","C":"Department of Information Technology, Agency AI Oversight Committees Timeline: December 2026…","D":"Department of Information Technology, Agency AI Oversight Committees  Timeline:   December 2026  Recommendation:  Maintain transparency, traceability, and human oversight for any use of AI in the administration of government benefits programs,  ensuring AI systems do not make final benefits determinations.","E":"Require evidence","F":"E0 — evidence","G":"Determine during design","H":"Proposed","I":"Policy / training / approval","J":"Medium","K":"Proposed policy mapping","L":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-a966d3d7c804cc29c95da065","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":113,"originalCells":{"A":"NEW-044","B":"Output and Use","C":"This recommendation calls for disclosure of AI utilization as any part…","D":"This recommendation calls for disclosure of AI utilization  as any part of a benefits eligibility process and guardrails to ensure that final benefits determination decisions are not  made by AI systems.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-088751a8c0693da0200ec304","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":114,"originalCells":{"A":"NEW-045","B":"Governance","C":"Additionally, residents should be given the opportunity to opt out of…","D":"Additionally, residents should be given the opportunity to opt out of their data being shared or used  in AI models beyond where required for program participation.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-d1edc2769af8dfbd7603632e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":115,"originalCells":{"A":"NEW-046","B":"Governance","C":"This initiative will ensure that the state can continue delivering vital…","D":"This initiative will ensure that the state  can continue delivering vital services to residents by defining and prioritizing critical statewide systems that use AI in the  event of system outages, failures, or attacks.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Critical","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-689eaed74ffb5baa7440d40b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":116,"originalCells":{"A":"NEW-047","B":"Governance","C":"The state will work in collaboration with utilities, security, and emergency…","D":"The state will work in collaboration with utilities, security, and emergency  response teams to design a plan to recover those systems, including through redundant architectures, where possible.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-4516039846daa897459958d9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":117,"originalCells":{"A":"NEW-048","B":"Governance","C":"Clear procedures must be documented for enabling, bypassing, or overriding AI…","D":"Clear procedures must be documented for enabling, bypassing, or overriding AI systems, and staff should be trained to  manually operate critical processes without AI assistance during outages.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Critical","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-1ca70911864178da83b6d0b0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":118,"originalCells":{"A":"NEW-049","B":"Operations","C":"Recommendation: Monitor, detect, and analyze ongoing AI threats and create a…","D":"Recommendation:  Monitor, detect, and analyze ongoing AI threats and create a mechanism to share risk landscape with trusted AI and cyber liaisons  in local government, as well as federal, peer state, and private sector partners.","E":"Detect / log","F":"E1 — observe","G":"Determine during design","H":"Proposed","I":"Event / log","J":"Medium","K":"Proposed policy mapping","L":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-39d48e35f200c47dcbeb3e73","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":119,"originalCells":{"A":"NEW-050","B":"Operations","C":"Details: This initiative will build on existing continuous monitoring and threat…","D":"Details:   This initiative will build on existing continuous monitoring and threat detection programs across state government  to identify emerging AI-related risks and alert trusted liaisons in state and local governments to act.","E":"Detect / log","F":"E1 — observe","G":"Determine during design","H":"Proposed","I":"Event / log","J":"Medium","K":"Proposed policy mapping","L":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-3847ac61ea7843c8c07be69f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":120,"originalCells":{"A":"NEW-051","B":"Governance","C":"Agencies will implement a software bill of materials for deployed AI…","D":"Agencies will  implement a software bill   of materials for deployed AI solutions that   map lineage of models, data,   and code to ensure  swift remediation.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-4b3b95082b01639387c014d0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":121,"originalCells":{"A":"NEW-052","B":"Data Protection","C":"Additionally, the state will distribute vetted AI frameworks and training modules…","D":"Additionally, the state will distribute vetted AI frameworks and training modules to local government partners to guarantee  proven, safe, and transparent AI security practices are leveraged statewide, including privacy by design.","E":"Require evidence","F":"E0 — evidence","G":"Determine during design","H":"Proposed","I":"Policy / training / approval","J":"Medium","K":"Proposed policy mapping","L":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-3b49e4de129f672711ac76c4","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":122,"originalCells":{"A":"NEW-053","B":"Data Protection","C":"National Guard, Local Governments Timeline: June 2027 Goal 8: Ensure Responsible…","D":"National Guard, Local  Governments  Timeline:   June 2027  Goal 8: Ensure Responsible Government AI Usage  Ensure AI systems used by state agencies meet standardized internal safety, privacy, security, reliability,  fairness, and explainability requirements.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"High","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-492d342002b1a654fd60aeb0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":123,"originalCells":{"A":"NEW-054","B":"Governance","C":"Recommendation: Establish minimum statewide trustworthy AI standards for all AI-enabled tools…","D":"Recommendation:  Establish minimum statewide trustworthy AI standards for all AI-enabled tools and systems that must be met before agencies","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-d4fd216b5ab043e0e74a32e0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":124,"originalCells":{"A":"NEW-055","B":"Access and Use","C":"However, AI presents fundamentally different challenges that these existing frameworks do…","D":"However, AI  presents fundamentally different challenges that these existing frameworks do not account for.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-f227e834f5bda200e578d39b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":125,"originalCells":{"A":"NEW-056","B":"Output and Use","C":"This initiative will create and implement a tiered governance model specific…","D":"This initiative will create  and implement a tiered governance model specific to AI, with tailored mitigation plans according to risk level that address  safety concerns including bias, accuracy, model degradation, and more.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"High","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-dc25d7d0c42bd239584ead22","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":126,"originalCells":{"A":"NEW-057","B":"Access and Use","C":"Regardless of risk level, mitigation plans will include ongoing monitoring requirements…","D":"Regardless of risk level, mitigation plans will  include ongoing monitoring requirements and accountability mechanisms for all AI-enabled systems.","E":"Detect / log","F":"E1 — observe","G":"Determine during design","H":"Proposed","I":"Event / log","J":"Medium","K":"Proposed policy mapping","L":"Generate a representative event and verify completeness, alert routing, retention, and access controls.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-8138891de2a5222f47e4dfea","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":127,"originalCells":{"A":"NEW-058","B":"Governance","C":"Recurring security testing of products will be conducted to check for…","D":"Recurring security  testing of products will be conducted to check for emerging threats and defend against vulnerabilities.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-f37c5ee8e184cc9634ee7722","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":128,"originalCells":{"A":"NEW-059","B":"Access and Use","C":"These liaisons must be given a sufficient level of authority to…","D":"These liaisons must  be given a sufficient level of authority to create accountability mechanisms to enforce the standards and governance  mechanisms established in the previous recommendation for this goal.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-c9a9bff521d9fbd8b30951f5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":129,"originalCells":{"A":"NEW-060","B":"Access and Use","C":"They will also be the main point of contact for all…","D":"They will also be the main point of contact for all  accountability escalation.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-9cd1bf02eb7d4c28dcb500f2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":130,"originalCells":{"A":"NEW-061","B":"Governance","C":"They will uphold whistleblower protections and coordinate across agencies in the…","D":"They will uphold   whistleblower protections   and coordinate  across agencies in the event of an emergency related to or impacting AI use.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-6913ea14b3088bee51b09bff","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":131,"originalCells":{"A":"NEW-062","B":"Access and Use","C":"This role will ensure shared learning, avoid wasted resources, and proactively…","D":"This role will ensure shared learning,  avoid wasted resources, and proactively address AI related threats and opportunities.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-391f5e88f75b7fca72134ab6","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":132,"originalCells":{"A":"NEW-063","B":"Governance","C":"Across the United States, communities are using various methods to ensure…","D":"Across the United States, communities are using various methods to ensure their members are AI literate.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-ce35c3eedd29a960d4f6ebf4","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":133,"originalCells":{"A":"NEW-064","B":"Access and Use","C":"The regional curriculum will be informed by community input","D":"The regional curriculum will be informed by  community input.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-28a7e3064d3eecabecb6a2a8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":134,"originalCells":{"A":"NEW-065","B":"Access and Use","C":"This effort will be achieved through collaborations with NCWorks Career Centers,…","D":"This effort will be achieved through collaborations with NCWorks Career Centers, community colleges,  public libraries, community centers, and other community anchor institutions and deployed in a phased approach to reach  all regions of the state.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-53e266dd8f7e694c53b3b15d","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":135,"originalCells":{"A":"NEW-066","B":"Operations","C":"This training will help residents build practical understanding of AI concepts,…","D":"This training  will help residents build practical understanding of AI concepts, everyday digital tools, online safety, scam awareness, and  responsible AI use.","E":"Require evidence","F":"E0 — evidence","G":"Determine during design","H":"Proposed","I":"Policy / training / approval","J":"Medium","K":"Proposed policy mapping","L":"Verify an approved artifact exists, is current, has an accountable owner, and is supported by operating evidence.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-244800d54cc634d808a75249","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":136,"originalCells":{"A":"NEW-067","B":"Governance","C":"A feedback loop using hiring outcomes, employer demand, and worker feedback…","D":"A feedback loop using hiring outcomes, employer demand, and worker feedback will allow  for continuous review and updates, keeping entry-level expectations current and strengthening the employment pipeline  from higher education to private sector.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-77993780fb9c2b5c83f420ff","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":137,"originalCells":{"A":"NEW-068","B":"Governance","C":"This mutually beneficial program would allow the private sector to help…","D":"This mutually beneficial program  would allow the private sector to help tailor   higher education toward the skillsets required in their workforces and create  direct   pipelines to hire for those skills.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-1bc27f562216e2988fd2aa57","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"02 Canonical Rules","row":138,"originalCells":{"A":"NEW-069","B":"Governance","C":"Partnering with N.C. higher education institutions, the state will coordinate AI…","D":"Partnering with N.C. higher education institutions, the state will coordinate AI education and  exposure across all levels of education so that students graduate with the competencies needed for public sector careers.","E":"Warn / require","F":"E2 — govern","G":"Determine during design","H":"Proposed","I":"Workflow / policy","J":"Medium","K":"Proposed policy mapping","L":"Test authorized, unauthorized, expired, and missing-approver paths; preserve the decision record.","M":"Derived from uploaded corpus","N":"draft"},"originalFormulas":{}},{"id":"ROW-49914a1a30cc35761326577f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":2,"originalCells":{"A":"NIST-AI-RMF","B":"NIST AI Risk Management Framework 1.0","C":"Voluntary framework","D":"All AI","E":"Govern, Map, Measure, Manage","F":"High","G":"Risk thresholds, testing, monitoring, human oversight","H":"Governance records, assessments, tests","I":"Current; revision underway","J":"https://www.nist.gov/itl/ai-risk-management-framework"},"originalFormulas":{}},{"id":"ROW-c1b210cedf7dfb1728d14938","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":3,"originalCells":{"A":"NIST-AI-600-1","B":"NIST AI 600-1 Generative AI Profile","C":"Voluntary profile","D":"Generative AI","E":"GAI risks and actions","F":"High","G":"Acceptable use, provider allowlist, PII/output monitoring, testing","H":"Go/no-go thresholds, evaluations, monitoring","I":"Published July 2024","J":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence"},"originalFormulas":{}},{"id":"ROW-9018d7e515c2f1822faf60aa","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":4,"originalCells":{"A":"NIST-CSF2","B":"NIST Cybersecurity Framework 2.0","C":"Voluntary framework","D":"Cybersecurity","E":"Govern, Identify, Protect, Detect, Respond, Recover","F":"High","G":"Identity, data security, monitoring, incident response","H":"Policies, configurations, logs, tests","I":"Current","J":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf"},"originalFormulas":{}},{"id":"ROW-68317dea1c9e9e7354699b2c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":5,"originalCells":{"A":"NIST-800-53","B":"NIST SP 800-53 Rev. 5","C":"Control catalog","D":"Federal and high-assurance systems","E":"Security and privacy control families","F":"High","G":"Access, information flow, logging, privacy, incident controls","H":"Control implementation and assessment evidence","I":"Rev. 5 Update 1","J":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final"},"originalFormulas":{}},{"id":"ROW-66672dfe819611200a31af6c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":6,"originalCells":{"A":"FEDRAMP","B":"FedRAMP Rev. 5 Baselines","C":"Federal authorization baseline","D":"Federal cloud services","E":"NIST 800-53 baselines + continuous monitoring","F":"High where applicable","G":"Identity, boundary, logging, monitoring","H":"SSP, assessment, POA&M, continuous monitoring","I":"Rev. 5","J":"https://www.fedramp.gov/archive/2023-05-30-rev-5-baselines-have-been-approved-and-released/"},"originalFormulas":{}},{"id":"ROW-45a24e599b202518d9f34128","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":7,"originalCells":{"A":"ISO-42001","B":"ISO/IEC 42001:2023","C":"Certifiable management-system standard","D":"AI management systems","E":"Governance, risk, lifecycle, controls","F":"High","G":"Operational controls depend on organizational context","H":"AIMS policies, objectives, audits, management review","I":"Current","J":"https://www.iso.org/standard/42001"},"originalFormulas":{}},{"id":"ROW-12fdb9ee95ac7581ebbf5aaa","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":8,"originalCells":{"A":"ISO-42005","B":"ISO/IEC 42005:2025","C":"International standard","D":"AI system impact assessment","E":"Impact assessment process","F":"High","G":"Assessment gates and reassessment triggers","H":"Impact assessment and decisions","I":"Published 2025","J":"https://www.iso.org/standard/42005"},"originalFormulas":{}},{"id":"ROW-e522e4b9072ec351c6018c26","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":9,"originalCells":{"A":"ISO-23894","B":"ISO/IEC 23894:2023","C":"Guidance","D":"AI risk management","E":"AI-specific risk guidance","F":"Medium","G":"Risk treatment drives rules","H":"Risk records and treatment evidence","I":"Current","J":"https://www.iso.org/standard/77304.html"},"originalFormulas":{}},{"id":"ROW-f77b9f7a2133acadb28dc942","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":10,"originalCells":{"A":"ISO-38507","B":"ISO/IEC 38507:2022","C":"Governance guidance","D":"Governing-body use of AI","E":"Governance implications","F":"Medium","G":"Accountability and oversight","H":"Governance decisions","I":"Current","J":"https://www.iso.org/standard/56641.html"},"originalFormulas":{}},{"id":"ROW-74e89b264cd0d3639e83b96b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":11,"originalCells":{"A":"ISO-5338","B":"ISO/IEC 5338:2023","C":"Lifecycle standard","D":"AI system lifecycle","E":"Lifecycle processes","F":"Medium","G":"Change, release, and retirement gates","H":"Lifecycle records","I":"Current","J":"https://www.iso.org/standard/81118.html"},"originalFormulas":{}},{"id":"ROW-bb31171011f15249eb85b6e8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":12,"originalCells":{"A":"ISO-24028","B":"ISO/IEC TR 24028:2020","C":"Technical report","D":"Trustworthiness in AI","E":"Trustworthiness overview","F":"Medium","G":"Informs criteria; does not define trust levels","H":"Assurance rationale","I":"Levels of trustworthiness are out of scope","J":"https://www.iso.org/standard/77608.html"},"originalFormulas":{}},{"id":"ROW-7ed3a0189d5718dbc2c950d9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":13,"originalCells":{"A":"EU-AI-ACT","B":"EU Artificial Intelligence Act","C":"Law","D":"AI placed or used in the EU","E":"Risk-based obligations","F":"High where applicable","G":"Prohibited use, logs, transparency, oversight, accuracy, cybersecurity","H":"Technical documentation, logs, assessments","I":"Consolidated text current 27 Jul 2026","J":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng"},"originalFormulas":{}},{"id":"ROW-1a41218581da4ee2a18f3eee","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":14,"originalCells":{"A":"GDPR","B":"EU General Data Protection Regulation","C":"Law","D":"EU personal-data processing","E":"Data protection principles and rights","F":"High where applicable","G":"Purpose, minimization, security, DPIA, automated decisions","H":"Records, DPIA, security evidence","I":"Current","J":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng"},"originalFormulas":{}},{"id":"ROW-5e9c9d169c886924b58a55f1","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":15,"originalCells":{"A":"HIPAA","B":"HIPAA Privacy and Security Rules","C":"U.S. federal law/regulation","D":"Covered entities and business associates","E":"PHI privacy and security","F":"High where applicable","G":"Prevent unauthorized PHI disclosure; access and audit controls","H":"Risk analysis, policies, access, logs","I":"Current","J":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html"},"originalFormulas":{}},{"id":"ROW-a93440b888063623943801d4","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":16,"originalCells":{"A":"PCI-DSS","B":"PCI DSS v4.0.1","C":"Industry contractual standard","D":"Cardholder-data environment","E":"Payment-account data security","F":"High where applicable","G":"PAN/SAD handling, access, monitoring","H":"Configuration, scan, test, audit evidence","I":"v4.0.1","J":"https://www.pcisecuritystandards.org/standards/pci-dss/"},"originalFormulas":{}},{"id":"ROW-b55e1d93b1faa7a915928601","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":17,"originalCells":{"A":"SOC2","B":"AICPA Trust Services Criteria","C":"Attestation criteria","D":"Service organizations","E":"Security, availability, processing integrity, confidentiality, privacy","F":"High commercially","G":"Confidentiality, logical access, monitoring","H":"Control design and operating evidence","I":"2017 TSC with 2022 points of focus","J":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022"},"originalFormulas":{}},{"id":"ROW-14c265f5d709b0bf9fa6c9af","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":18,"originalCells":{"A":"GLBA","B":"GLBA Safeguards Rule","C":"U.S. federal regulation","D":"Covered financial institutions","E":"Customer-information security program","F":"High where applicable","G":"MFA, access, encryption, monitoring","H":"System configuration and program evidence","I":"Current","J":"https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know"},"originalFormulas":{}},{"id":"ROW-1889a3af254f28761a9423fb","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":19,"originalCells":{"A":"FERPA","B":"Family Educational Rights and Privacy Act","C":"U.S. federal law/regulation","D":"Federally funded educational institutions","E":"Student education-record privacy","F":"High where applicable","G":"Prevent unauthorized record disclosure","H":"Consent and disclosure records","I":"Current","J":"https://studentprivacy.ed.gov/ferpa"},"originalFormulas":{}},{"id":"ROW-7e5f9ff79cd5a26ca5c56a30","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":20,"originalCells":{"A":"CCPA-CPRA","B":"California CCPA / CPRA Regulations","C":"California law/regulation","D":"Covered businesses","E":"Consumer privacy and automated decisionmaking","F":"High where applicable","G":"Sensitive-data restrictions, rights, ADMT governance","H":"Notices, risk assessments, response records","I":"Updated regulations effective 1 Jan 2026; ADMT obligations begin 1 Jan 2027","J":"https://cppa.ca.gov/regulations/ccpa_updates.html"},"originalFormulas":{}},{"id":"ROW-79f457400b49280d9f8e1043","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":21,"originalCells":{"A":"CO-AI","B":"Colorado AI laws and rulemaking","C":"State law/regulation","D":"Covered Colorado AI uses","E":"High-risk AI and chatbot safety","F":"Medium / High where applicable","G":"Disclosures, risk management, high-risk controls","H":"Impact assessments and consumer records","I":"SB26-189 effective 1 Jan 2027; monitor rulemaking","J":"https://coag.gov/ai/"},"originalFormulas":{}},{"id":"ROW-f8c9614ddce80a9270ae7bd7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":22,"originalCells":{"A":"TX-TRAIGA","B":"Texas Responsible Artificial Intelligence Governance Act","C":"State law","D":"Covered Texas AI actors","E":"AI practices and governance","F":"Medium / High where applicable","G":"Prohibited practices and disclosure duties","H":"Program and use-case evidence","I":"Current statutory text","J":"https://statutes.capitol.texas.gov/GetStatute.aspx?Code=BC&Value=552"},"originalFormulas":{}},{"id":"ROW-13f60aee9b891ed0fa920671","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":23,"originalCells":{"A":"OMB-M25-21","B":"OMB M-25-21 Federal AI Governance","C":"Federal executive policy","D":"U.S. federal agencies","E":"AI inventories, high-impact AI risk management","F":"High for agencies","G":"Testing, impact assessment, monitoring, independent review, human oversight","H":"Inventory, assessment, monitoring and waiver records","I":"Replaced M-24-10","J":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf"},"originalFormulas":{}},{"id":"ROW-9889e80711643a9e010639d9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":24,"originalCells":{"A":"OMB-M25-22","B":"OMB M-25-22 AI Acquisition","C":"Federal executive policy","D":"U.S. federal AI procurement","E":"Acquisition and vendor controls","F":"High for agencies","G":"Contractual, data, interoperability, performance controls","H":"Acquisition records and contract terms","I":"Current","J":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf"},"originalFormulas":{}},{"id":"ROW-70c761f1fca1627b685cb5c2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":25,"originalCells":{"A":"OWASP-LLM-2026","B":"OWASP Top 10 for LLM Applications 2026","C":"Security guidance","D":"LLM applications","E":"Top LLM application risks","F":"High","G":"Prompt injection, sensitive data, agency, supply chain, poisoning, output handling","H":"Threat tests, runtime events, remediation","I":"Released 3 Aug 2026","J":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/"},"originalFormulas":{}},{"id":"ROW-698d977448eda3fa0d5899ac","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"03 Framework Catalog","row":26,"originalCells":{"A":"SOX","B":"Sarbanes-Oxley Act / ICFR","C":"U.S. federal law and audit context","D":"Public-company financial reporting","E":"Internal control over financial reporting","F":"High where applicable","G":"Protect MNPI, audit evidence, and reporting integrity","H":"Control and audit evidence","I":"Current","J":"https://www.sec.gov/spotlight/sarbanes-oxley.htm"},"originalFormulas":{}},{"id":"ROW-6491eca3788e1a02d64f761b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":2,"originalCells":{"A":"POL-01","B":"AI Governance and Accountability","C":"Required","D":"Board/executive accountability, roles, risk appetite, inventory, metrics and reporting","E":"OP-09; AU-04; OP-07","F":"Policy + charter + minutes","G":"Chief AI / Risk Officer"},"originalFormulas":{}},{"id":"ROW-5b1bda2cc3542b5c905ad4d1","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":3,"originalCells":{"A":"POL-02","B":"AI Acceptable Use","C":"Required","D":"Permitted/prohibited uses, user duties, escalation, sanctions and safe-use expectations","E":"IN-07; OU-06; OU-07","F":"Policy + attestation","G":"CISO / Legal / HR"},"originalFormulas":{}},{"id":"ROW-1affd5855db1d50f805ce49f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":4,"originalCells":{"A":"POL-03","B":"Approved AI Tools and Shadow AI","C":"Required","D":"Sanctioned providers, personal-account restrictions, onboarding and discovery","E":"AU-01; AU-02; AU-08","F":"Policy + inventory + egress logs","G":"CISO / IT"},"originalFormulas":{}},{"id":"ROW-aa65f416409061dc11377921","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":5,"originalCells":{"A":"POL-04","B":"Data Classification for AI","C":"Required","D":"Which data classes may enter which AI systems under which conditions","E":"DP-01–DP-18; AU-05; AU-06","F":"Standard + decision matrix + DLP events","G":"Data Protection / Security"},"originalFormulas":{}},{"id":"ROW-8a92c8d4cac24824396ba285","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":6,"originalCells":{"A":"POL-05","B":"Prompt and Output Interaction","C":"Required","D":"Prompt hygiene, output review, citations, disclosure and publication rules","E":"OU-01–OU-12","F":"Policy + runtime events","G":"AI Product / Compliance"},"originalFormulas":{}},{"id":"ROW-129fbd0997f2bbdc126537c0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":7,"originalCells":{"A":"POL-06","B":"Privacy and Personal Data","C":"Required where personal data exists","D":"Purpose, minimization, lawful basis, DPIA, rights, retention and sensitive data","E":"DP-05–DP-11; OU-11","F":"Privacy policy + DPIA + configuration","G":"DPO / Privacy"},"originalFormulas":{}},{"id":"ROW-e1b586bc597848f2689c98f9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":8,"originalCells":{"A":"POL-07","B":"AI Security and Prompt Injection","C":"Required","D":"Threat model, injection defenses, input trust, secrets and vulnerability handling","E":"IN-01–IN-05; DP-15","F":"Security standard + tests + events","G":"CISO / AppSec"},"originalFormulas":{}},{"id":"ROW-008410384990db1fe08b3023","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":9,"originalCells":{"A":"POL-08","B":"High-Impact AI and Human Oversight","C":"Required for consequential use","D":"High-impact definition, required reviewers, fail-safe and prohibited autonomy","E":"OU-04; OU-05; AG-03; AG-04; OP-05","F":"Impact assessment + approval + logs","G":"Risk / Legal / Business owner"},"originalFormulas":{}},{"id":"ROW-b6a71b0de2f50d78b21fec0b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":10,"originalCells":{"A":"POL-09","B":"AI Impact Assessment and Risk Acceptance","C":"Required","D":"Intake, impact assessment, control selection, risk acceptance and reassessment","E":"AU-04; OP-06; OP-07","F":"Assessment + approval","G":"Enterprise Risk"},"originalFormulas":{}},{"id":"ROW-c821d31cff2c956332d4f6ed","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":11,"originalCells":{"A":"POL-10","B":"Evaluation, Red Team and Benchmarking","C":"Required","D":"Test dimensions, datasets, thresholds, independence, cadence and release gates","E":"OP-03; OP-12","F":"Test evidence","G":"AI Assurance / Model Risk"},"originalFormulas":{}},{"id":"ROW-dc6aae022c0dda931f92bee2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":12,"originalCells":{"A":"POL-11","B":"AI Monitoring and Logging","C":"Required","D":"Events, content minimization, metrics, alerting, access, integrity and retention","E":"OP-01–OP-03","F":"Logs + monitoring evidence","G":"Security Operations / Platform"},"originalFormulas":{}},{"id":"ROW-4433a7fd429009fcb4e64045","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":13,"originalCells":{"A":"POL-12","B":"AI Incident Response and Kill Switch","C":"Required","D":"AI incident taxonomy, escalation, containment, reporting, kill switch and recovery","E":"OP-04; OP-05","F":"Plan + drill + incident evidence","G":"CISO / Incident Response"},"originalFormulas":{}},{"id":"ROW-9a8eab0cdb305798c72f74df","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":14,"originalCells":{"A":"POL-13","B":"Vendor and AI Procurement","C":"Required for third parties","D":"Due diligence, DPA/BAA, training use, subprocessors, SLAs, audit, exit and change notice","E":"AU-05; AU-06; OP-10","F":"Contract + assessment","G":"Procurement / Legal / Security"},"originalFormulas":{}},{"id":"ROW-6da427ab8ef28a8b5efa80e0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":15,"originalCells":{"A":"POL-14","B":"Agentic AI and Connectors","C":"Required where tools/actions exist","D":"Tool allowlists, least privilege, approvals, limits, memory and transaction controls","E":"AG-01–AG-09; IN-08","F":"Policy + tool logs + approvals","G":"AI Platform / Security"},"originalFormulas":{}},{"id":"ROW-2e70a9e514569b8a44427c28","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":16,"originalCells":{"A":"POL-15","B":"AI Secure Development Lifecycle","C":"Required for built AI","D":"Threat modeling, design review, output handling, change, release and rollback","E":"OU-08; OU-09; OP-06; OP-12","F":"SDLC records + tests","G":"Engineering / AppSec"},"originalFormulas":{}},{"id":"ROW-4b13a6dba181d0e74da964eb","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":17,"originalCells":{"A":"POL-16","B":"Bias, Fairness and Civil Rights","C":"Required for people-impacting AI","D":"Protected groups, evaluation, accommodations, monitoring and remediation","E":"OU-05","F":"Fairness assessment + monitoring","G":"Legal / Model Risk"},"originalFormulas":{}},{"id":"ROW-33bfebb7d3c61d478df97677","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":18,"originalCells":{"A":"POL-17","B":"Transparency, Disclosure and Provenance","C":"Required for user-facing AI","D":"Notices, explainability, citations, synthetic-content labels and provenance","E":"OU-03; OU-12; OP-02","F":"Notices + provenance logs","G":"Product / Legal"},"originalFormulas":{}},{"id":"ROW-8cad1d1eb5ca428342ab260e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":19,"originalCells":{"A":"POL-18","B":"IP, Copyright and Confidentiality","C":"Required","D":"Trade secrets, customer data, privilege, copyright, license and publication review","E":"DP-14; DP-16–DP-18; OU-10","F":"Policy + review records","G":"Legal / Information Governance"},"originalFormulas":{}},{"id":"ROW-7cc4365a2762412fcdeb3337","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":20,"originalCells":{"A":"POL-19","B":"AI Training, Literacy and Competency","C":"Required","D":"Role-based literacy, operator competency, developer safety and executive duties","E":"Supports all rules","F":"Completion + assessment","G":"HR / Compliance"},"originalFormulas":{}},{"id":"ROW-7c1fd550d17c7e0b2a67f2dd","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":21,"originalCells":{"A":"POL-20","B":"Exceptions, Appeals and Risk Acceptance","C":"Required","D":"User appeal, operator override, risk acceptance, compensating controls and expiry","E":"OP-07; OP-08","F":"Workflow records","G":"Risk / Legal"},"originalFormulas":{}},{"id":"ROW-65a8e3a5fef53f86846dbf1f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":22,"originalCells":{"A":"POL-21","B":"AI Decommissioning and Data Lifecycle","C":"Required","D":"Retention, deletion, memory/vector cleanup, access revocation, records and exit","E":"OP-11","F":"Deletion and revocation evidence","G":"Data Governance / IT"},"originalFormulas":{}},{"id":"ROW-f37141b7245460bc587481fe","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":23,"originalCells":{"A":"POL-22","B":"Data, Model and RAG Supply Chain","C":"Required for RAG/training/custom models","D":"Provenance, authorization, poisoning defense, embedding isolation, dataset/model versioning","E":"IN-06; AG-08; AG-10","F":"Provenance + test + SBOM evidence","G":"Data / ML Platform / Security"},"originalFormulas":{}},{"id":"ROW-576de7c130ae3131625f07ab","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":26,"originalCells":{"A":"2, 2025, created the Council to advise on “AI strategy, policy,…","B":"draft","C":"2, 2025, created the Council to advise on “AI strategy, policy, and  training to ensure North Carolina becomes a national leader in AI literacy, governance, and deployment to the benefit of our  residents, communities, and economy.” This Roadmap puts the State of North Carolina and its partners on a path to meet  this high standard, and we are pleased to share it with you.","D":"AU-06","E":"Policy / training / approval","F":"NC-statewide-ai-strategic-roadmap.pdf"},"originalFormulas":{}},{"id":"ROW-2be506fc7bfae048f4f3d5cf","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":27,"originalCells":{"A":"AI Literacy Ensure all North Carolinians have the knowledge to understand,…","B":"draft","C":"AI Literacy  Ensure all North Carolinians have the knowledge to understand, use, and critically evaluate AI technologies, enabling  people to make informed choices about the technology in their lives.","D":"DP-02","E":"Policy / training / approval","F":"NC-statewide-ai-strategic-roadmap.pdf"},"originalFormulas":{}},{"id":"ROW-b8ee90af3c059599b83ab624","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"04 Internal Policies","row":28,"originalCells":{"A":"Details: This program will deploy free, foundational AI literacy learning opportunities…","B":"draft","C":"Details:   This program will deploy free, foundational AI literacy learning opportunities in all regions of North Carolina and  will be designed for residents of all backgrounds and skill levels, including the workforce, senior citizens, rural residents,  individuals with limited digital access, and other underserved communities.","D":"DP-01","E":"Policy / training / approval","F":"NC-statewide-ai-strategic-roadmap.pdf"},"originalFormulas":{}},{"id":"ROW-0b52ce36c97fb00aa1327198","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":2,"originalCells":{"A":"CUS-01","B":"Block named individuals’ or VIP data","C":"Organization-specific identifier lists","D":"DP-05; DP-09","E":"Regex/keyword/entity","F":"Block","G":"Privacy owner","H":"Needs strict access and false-positive testing"},"originalFormulas":{}},{"id":"ROW-de534a668d5b9afc7a353baf","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":3,"originalCells":{"A":"CUS-02","B":"Block client and project codewords","C":"Client names, codenames, deal rooms and matter numbers","D":"DP-14; DP-16; DP-18","E":"Keyword/entity/classification","F":"Block or approve","G":"Business data owner","H":"Often not present in external frameworks"},"originalFormulas":{}},{"id":"ROW-fc2719c75dfa1cf4c459b82f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":4,"originalCells":{"A":"CUS-03","B":"Restrict specific email domains","C":"Personal, competitor, customer or external domains","D":"AU-01; AG-05","E":"Domain/context","F":"Block or warn","G":"IT / Security","H":"May combine with recipient approval"},"originalFormulas":{}},{"id":"ROW-9a15ea95ee64873dd9c1b7ee","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":5,"originalCells":{"A":"CUS-04","B":"Restrict repositories and file paths","C":"Production repos, regulated shares, privileged folders","D":"DP-14; DP-16","E":"Path/repository metadata","F":"Block","G":"Engineering / Data owner","H":"Requires upload/source metadata"},"originalFormulas":{}},{"id":"ROW-6199d934896405fadeeafc5c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":6,"originalCells":{"A":"CUS-05","B":"Approved model and version list","C":"Enterprise-approved model IDs and release channels","D":"AU-04","E":"Allowlist","F":"Block","G":"AI governance","H":"Reassess on model change"},"originalFormulas":{}},{"id":"ROW-b9650087ae2f89219f0bdcd6","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":7,"originalCells":{"A":"CUS-06","B":"Approved geography and tenant","C":"Regions, tenant IDs, enterprise accounts and device posture","D":"AU-02; AU-05; AU-06","E":"Session/context","F":"Block","G":"Security / Privacy","H":"Needs identity and provider integration"},"originalFormulas":{}},{"id":"ROW-c22bf0e067e421380f42cf0a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":8,"originalCells":{"A":"CUS-07","B":"Required disclaimer by workflow","C":"Legal, medical, financial, support or public-facing wording","D":"OU-04; OU-12","E":"Use-case response template","F":"Transform/hold","G":"Legal / Product","H":"Do not treat disclaimer as a substitute for oversight"},"originalFormulas":{}},{"id":"ROW-134e8181c648fa80a210777c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":9,"originalCells":{"A":"CUS-08","B":"Transaction amount limits","C":"Dollar, quantity, frequency and cumulative limits","D":"AG-07","E":"Numeric/context","F":"Block/approve","G":"Finance / Risk","H":"Include cumulative and split-transaction detection"},"originalFormulas":{}},{"id":"ROW-a1238f3f910e719323a62d4d","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":10,"originalCells":{"A":"CUS-09","B":"Approved external recipients","C":"Domains, people, distribution lists and channels","D":"AG-05","E":"Identity/recipient allowlist","F":"Approve/block","G":"Business owner","H":"Resolve recipient identity before send"},"originalFormulas":{}},{"id":"ROW-d2569456e42c06216d188a20","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":11,"originalCells":{"A":"CUS-10","B":"Connector and tool allowlist","C":"Specific MCP servers, SaaS connectors, APIs and actions","D":"AG-01; AG-10","E":"Tool identity/version","F":"Block","G":"Platform security","H":"Pin publisher, schema and version"},"originalFormulas":{}},{"id":"ROW-9c031045835ea4ae4fe0bebc","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":12,"originalCells":{"A":"CUS-11","B":"Retention by use case","C":"Prompt, response, file, log, vector and memory retention","D":"AU-05; OP-11","E":"Use-case/configuration","F":"Configure/block","G":"Data governance","H":"Verify downstream copies and backups"},"originalFormulas":{}},{"id":"ROW-1e2e4db54c587516e09caa03","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":13,"originalCells":{"A":"CUS-12","B":"Production credential boundary","C":"Known production hosts, tokens, vault paths and environments","D":"DP-01; DP-15","E":"Keyword/regex/context","F":"Block","G":"Engineering / Security","H":"Seed only synthetic examples in tests"},"originalFormulas":{}},{"id":"ROW-20f564f2863722d2d8445b8a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":14,"originalCells":{"A":"CUS-13","B":"Oversize or unscannable attachment handling","C":"Encrypted, image-only, archive, binary and size thresholds","D":"IN-03; IN-05","E":"File metadata/scanner","F":"Block/quarantine","G":"Security","H":"Current build fails to enforce this"},"originalFormulas":{}},{"id":"ROW-2b0e28bd7bfd3e8fe80ae976","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":15,"originalCells":{"A":"CUS-14","B":"Business-specific prohibited advice","C":"Product suitability, underwriting, pricing, HR or safety boundaries","D":"IN-07; OU-04","E":"Semantic/use-case","F":"Hold/block","G":"Legal / Business owner","H":"Requires domain evaluation"},"originalFormulas":{}},{"id":"ROW-32126527062bd2b2e03d0aac","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":16,"originalCells":{"A":"CUS-15","B":"Required human approval groups","C":"Named roles/groups for defined actions and risk tiers","D":"AG-03; AG-04; OP-08","E":"Workflow/identity","F":"Approve","G":"Risk / Business owner","H":"Must handle delegation and conflicts"},"originalFormulas":{}},{"id":"ROW-72de606b934fd25a5109e8b6","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":17,"originalCells":{"A":"CUS-16","B":"Data-loss canaries","C":"Unique synthetic markers in hidden context, RAG and tenant data","D":"OU-01; OU-02; AG-08","E":"Canary/token","F":"Block/alert","G":"Security / AI assurance","H":"Use to test leakage without real sensitive data"},"originalFormulas":{}},{"id":"ROW-003117d4c6e30aede27dbecc","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":18,"originalCells":{"A":"CUS-17","B":"Brand and communications standard","C":"Tone, claims, regulated wording and approval thresholds","D":"OU-03; OU-12; AG-05","E":"Semantic/template","F":"Warn/hold","G":"Communications / Legal","H":"Separate brand preference from safety criticality"},"originalFormulas":{}},{"id":"ROW-2e4a786bd0a31d444f26e8f2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","sheet":"05 Custom Rules","row":19,"originalCells":{"A":"CUS-18","B":"Change blackout and release windows","C":"Freeze dates, required approvers and emergency path","D":"OP-06; OP-12","E":"Workflow/time","F":"Hold","G":"Engineering / Change management","H":"Useful for high-impact production systems"},"originalFormulas":{}},{"id":"ROW-777783df3cd9ef7062834bf5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":5,"originalCells":{"A":"NIST-AI-RMF","B":"NIST AI Risk Management Framework 1.0","C":"Voluntary framework","D":"All AI","E":"Govern, Map, Measure, Manage","F":"High","G":"Risk thresholds, testing, monitoring, human oversight","H":"Governance records, assessments, tests","I":"Current; revision underway","J":"https://www.nist.gov/itl/ai-risk-management-framework"},"originalFormulas":{}},{"id":"ROW-b1b626fe01bea60389a94799","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":6,"originalCells":{"A":"NIST-AI-600-1","B":"NIST AI 600-1 Generative AI Profile","C":"Voluntary profile","D":"Generative AI","E":"GAI risks and actions","F":"High","G":"Acceptable use, provider allowlist, PII/output monitoring, testing","H":"Go/no-go thresholds, evaluations, monitoring","I":"Published July 2024","J":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence"},"originalFormulas":{}},{"id":"ROW-04433aba3ef3442a7dc342ea","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":7,"originalCells":{"A":"NIST-CSF2","B":"NIST Cybersecurity Framework 2.0","C":"Voluntary framework","D":"Cybersecurity","E":"Govern, Identify, Protect, Detect, Respond, Recover","F":"High","G":"Identity, data security, monitoring, incident response","H":"Policies, configurations, logs, tests","I":"Current","J":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf"},"originalFormulas":{}},{"id":"ROW-9ebae7a1c19f9d988cfefe1e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":8,"originalCells":{"A":"NIST-800-53","B":"NIST SP 800-53 Rev. 5","C":"Control catalog","D":"Federal and high-assurance systems","E":"Security and privacy control families","F":"High","G":"Access, information flow, logging, privacy, incident controls","H":"Control implementation and assessment evidence","I":"Rev. 5 Update 1","J":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final"},"originalFormulas":{}},{"id":"ROW-b8bd9ba08111089522472a26","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":9,"originalCells":{"A":"FEDRAMP","B":"FedRAMP Rev. 5 Baselines","C":"Federal authorization baseline","D":"Federal cloud services","E":"NIST 800-53 baselines + continuous monitoring","F":"High where applicable","G":"Identity, boundary, logging, monitoring","H":"SSP, assessment, POA&M, continuous monitoring","I":"Rev. 5","J":"https://www.fedramp.gov/archive/2023-05-30-rev-5-baselines-have-been-approved-and-released/"},"originalFormulas":{}},{"id":"ROW-b29e0e95548020af5b6ccf75","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":10,"originalCells":{"A":"ISO-42001","B":"ISO/IEC 42001:2023","C":"Certifiable management-system standard","D":"AI management systems","E":"Governance, risk, lifecycle, controls","F":"High","G":"Operational controls depend on organizational context","H":"AIMS policies, objectives, audits, management review","I":"Current","J":"https://www.iso.org/standard/42001"},"originalFormulas":{}},{"id":"ROW-d00d7796973ad8d803836eb1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":11,"originalCells":{"A":"ISO-42005","B":"ISO/IEC 42005:2025","C":"International standard","D":"AI system impact assessment","E":"Impact assessment process","F":"High","G":"Assessment gates and reassessment triggers","H":"Impact assessment and decisions","I":"Published 2025","J":"https://www.iso.org/standard/42005"},"originalFormulas":{}},{"id":"ROW-956707b6e9f1a1157d10e2b3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":12,"originalCells":{"A":"ISO-23894","B":"ISO/IEC 23894:2023","C":"Guidance","D":"AI risk management","E":"AI-specific risk guidance","F":"Medium","G":"Risk treatment drives rules","H":"Risk records and treatment evidence","I":"Current","J":"https://www.iso.org/standard/77304.html"},"originalFormulas":{}},{"id":"ROW-cad3c07500071ecb6debed6c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":13,"originalCells":{"A":"ISO-38507","B":"ISO/IEC 38507:2022","C":"Governance guidance","D":"Governing-body use of AI","E":"Governance implications","F":"Medium","G":"Accountability and oversight","H":"Governance decisions","I":"Current","J":"https://www.iso.org/standard/56641.html"},"originalFormulas":{}},{"id":"ROW-616d2a735b78292c54f59a72","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":14,"originalCells":{"A":"ISO-5338","B":"ISO/IEC 5338:2023","C":"Lifecycle standard","D":"AI system lifecycle","E":"Lifecycle processes","F":"Medium","G":"Change, release, and retirement gates","H":"Lifecycle records","I":"Current","J":"https://www.iso.org/standard/81118.html"},"originalFormulas":{}},{"id":"ROW-3b6e80479929d9c2c44c106c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":15,"originalCells":{"A":"ISO-24028","B":"ISO/IEC TR 24028:2020","C":"Technical report","D":"Trustworthiness in AI","E":"Trustworthiness overview","F":"Medium","G":"Informs criteria; does not define trust levels","H":"Assurance rationale","I":"Levels of trustworthiness are out of scope","J":"https://www.iso.org/standard/77608.html"},"originalFormulas":{}},{"id":"ROW-35056b4a4fdc12e0f5d8634d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":16,"originalCells":{"A":"EU-AI-ACT","B":"EU Artificial Intelligence Act","C":"Law","D":"AI placed or used in the EU","E":"Risk-based obligations","F":"High where applicable","G":"Prohibited use, logs, transparency, oversight, accuracy, cybersecurity","H":"Technical documentation, logs, assessments","I":"Consolidated text current 27 Jul 2026","J":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng"},"originalFormulas":{}},{"id":"ROW-2fc3f9fc669c13e115f8440e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":17,"originalCells":{"A":"GDPR","B":"EU General Data Protection Regulation","C":"Law","D":"EU personal-data processing","E":"Data protection principles and rights","F":"High where applicable","G":"Purpose, minimization, security, DPIA, automated decisions","H":"Records, DPIA, security evidence","I":"Current","J":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng"},"originalFormulas":{}},{"id":"ROW-bfa5e24cc1091a56ae6e3610","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":18,"originalCells":{"A":"HIPAA","B":"HIPAA Privacy and Security Rules","C":"U.S. federal law/regulation","D":"Covered entities and business associates","E":"PHI privacy and security","F":"High where applicable","G":"Prevent unauthorized PHI disclosure; access and audit controls","H":"Risk analysis, policies, access, logs","I":"Current","J":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html"},"originalFormulas":{}},{"id":"ROW-1034aa6318910efd3b805700","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":19,"originalCells":{"A":"PCI-DSS","B":"PCI DSS v4.0.1","C":"Industry contractual standard","D":"Cardholder-data environment","E":"Payment-account data security","F":"High where applicable","G":"PAN/SAD handling, access, monitoring","H":"Configuration, scan, test, audit evidence","I":"v4.0.1","J":"https://www.pcisecuritystandards.org/standards/pci-dss/"},"originalFormulas":{}},{"id":"ROW-70fe013b1ed861bc1f0e269a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":20,"originalCells":{"A":"SOC2","B":"AICPA Trust Services Criteria","C":"Attestation criteria","D":"Service organizations","E":"Security, availability, processing integrity, confidentiality, privacy","F":"High commercially","G":"Confidentiality, logical access, monitoring","H":"Control design and operating evidence","I":"2017 TSC with 2022 points of focus","J":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022"},"originalFormulas":{}},{"id":"ROW-7322b54de38f7bb6a4573010","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":21,"originalCells":{"A":"GLBA","B":"GLBA Safeguards Rule","C":"U.S. federal regulation","D":"Covered financial institutions","E":"Customer-information security program","F":"High where applicable","G":"MFA, access, encryption, monitoring","H":"System configuration and program evidence","I":"Current","J":"https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know"},"originalFormulas":{}},{"id":"ROW-a119e473fbc724a9f3d4a2b4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":22,"originalCells":{"A":"FERPA","B":"Family Educational Rights and Privacy Act","C":"U.S. federal law/regulation","D":"Federally funded educational institutions","E":"Student education-record privacy","F":"High where applicable","G":"Prevent unauthorized record disclosure","H":"Consent and disclosure records","I":"Current","J":"https://studentprivacy.ed.gov/ferpa"},"originalFormulas":{}},{"id":"ROW-f69538d02437e555efcfb185","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":23,"originalCells":{"A":"CCPA-CPRA","B":"California CCPA / CPRA Regulations","C":"California law/regulation","D":"Covered businesses","E":"Consumer privacy and automated decisionmaking","F":"High where applicable","G":"Sensitive-data restrictions, rights, ADMT governance","H":"Notices, risk assessments, response records","I":"Updated regulations effective 1 Jan 2026; ADMT obligations begin 1 Jan 2027","J":"https://cppa.ca.gov/regulations/ccpa_updates.html"},"originalFormulas":{}},{"id":"ROW-4ecff7de664a84bb7dd2852a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":24,"originalCells":{"A":"CO-AI","B":"Colorado AI laws and rulemaking","C":"State law/regulation","D":"Covered Colorado AI uses","E":"High-risk AI and chatbot safety","F":"Medium / High where applicable","G":"Disclosures, risk management, high-risk controls","H":"Impact assessments and consumer records","I":"SB26-189 effective 1 Jan 2027; monitor rulemaking","J":"https://coag.gov/ai/"},"originalFormulas":{}},{"id":"ROW-d18d29a9d6086ffcafa78490","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":25,"originalCells":{"A":"TX-TRAIGA","B":"Texas Responsible Artificial Intelligence Governance Act","C":"State law","D":"Covered Texas AI actors","E":"AI practices and governance","F":"Medium / High where applicable","G":"Prohibited practices and disclosure duties","H":"Program and use-case evidence","I":"Current statutory text","J":"https://statutes.capitol.texas.gov/GetStatute.aspx?Code=BC&Value=552"},"originalFormulas":{}},{"id":"ROW-3f269d4ebd6704ea6e57097f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":26,"originalCells":{"A":"OMB-M25-21","B":"OMB M-25-21 Federal AI Governance","C":"Federal executive policy","D":"U.S. federal agencies","E":"AI inventories, high-impact AI risk management","F":"High for agencies","G":"Testing, impact assessment, monitoring, independent review, human oversight","H":"Inventory, assessment, monitoring and waiver records","I":"Replaced M-24-10","J":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf"},"originalFormulas":{}},{"id":"ROW-11e306224e302c8409f55ddd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":27,"originalCells":{"A":"OMB-M25-22","B":"OMB M-25-22 AI Acquisition","C":"Federal executive policy","D":"U.S. federal AI procurement","E":"Acquisition and vendor controls","F":"High for agencies","G":"Contractual, data, interoperability, performance controls","H":"Acquisition records and contract terms","I":"Current","J":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf"},"originalFormulas":{}},{"id":"ROW-938bc65cd2d8eb379c2074a1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":28,"originalCells":{"A":"OWASP-LLM-2026","B":"OWASP Top 10 for LLM Applications 2026","C":"Security guidance","D":"LLM applications","E":"Top LLM application risks","F":"High","G":"Prompt injection, sensitive data, agency, supply chain, poisoning, output handling","H":"Threat tests, runtime events, remediation","I":"Released 3 Aug 2026","J":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/"},"originalFormulas":{}},{"id":"ROW-6dbfd1e205fc4d3834e7ff51","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":29,"originalCells":{"A":"SOX","B":"Sarbanes-Oxley Act / ICFR","C":"U.S. federal law and audit context","D":"Public-company financial reporting","E":"Internal control over financial reporting","F":"High where applicable","G":"Protect MNPI, audit evidence, and reporting integrity","H":"Control and audit evidence","I":"Current","J":"https://www.sec.gov/spotlight/sarbanes-oxley.htm"},"originalFormulas":{}},{"id":"ROW-ad8e1243daaf62d6c9148402","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":30,"originalCells":{"A":"NIST-800-171","B":"NIST SP 800-171 Rev. 3","C":"Federal security requirements","D":"Nonfederal systems processing CUI","E":"Protection of controlled unclassified information","F":"High where CUI exists","G":"Access, flow control, authentication, logging, incident response, supply chain","H":"SSP, assessment, configuration and operating evidence","I":"Final May 2024; supersedes Rev. 2","J":"https://csrc.nist.gov/pubs/sp/800/171/r3/final"},"originalFormulas":{}},{"id":"ROW-1141d7110b74b56aad82a5b6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":31,"originalCells":{"A":"CMMC","B":"Cybersecurity Maturity Model Certification","C":"DoD contractual assessment framework","D":"Defense contractors processing FCI or CUI","E":"Contractor implementation and affirmation","F":"High when a contract clause applies","G":"FCI/CUI boundary, access, evidence, supplier flow-down","H":"SPRS status, assessment, affirmation, POA&M","I":"Phase I remains in effect; Phase II suspended 13 Jul 2026 pending review","J":"https://business.defense.gov/cmmc/"},"originalFormulas":{}},{"id":"ROW-0481455a2206d38034e4b4ba","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":32,"originalCells":{"A":"CJIS-6.1","B":"FBI CJIS Security Policy v6.1","C":"Criminal justice security policy","D":"Systems and parties accessing criminal justice information","E":"Security of CJI across agencies and service providers","F":"High where CJI exists","G":"Identity, encryption, access, audit, personnel and cloud controls","H":"Security addendum, configuration, logs and assessments","I":"Version 6.1 published 25 Jun 2026","J":"https://le.fbi.gov/file-repository/cjis_security_policy_v6-1_20260625.pdf/view"},"originalFormulas":{}},{"id":"ROW-f7fd4420c43cadaa2e7b3001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":33,"originalCells":{"A":"IRS-1075","B":"IRS Publication 1075","C":"Federal tax information safeguard requirements","D":"Agencies and contractors receiving federal tax information","E":"Confidentiality and integrity of FTI","F":"High where FTI exists","G":"Encryption, MFA, access, leakage prevention, sanitization and cloud isolation","H":"Safeguard reports, inspections, logs and POA&M","I":"Current IRS safeguard program; verify latest publication revision","J":"https://www.irs.gov/privacy-disclosure/safeguards-program"},"originalFormulas":{}},{"id":"ROW-4277eeeaf763ff7468b3a7b4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":34,"originalCells":{"A":"SECTION-508","B":"Revised Section 508 Standards","C":"Federal accessibility requirements","D":"ICT developed, procured, maintained or used by federal agencies","E":"Equivalent access for people with disabilities","F":"High for covered federal ICT","G":"Accessible interaction, content, documents and procurement","H":"Accessibility conformance report and testing","I":"Current Revised 508 Standards","J":"https://www.section508.gov/buy-sell/"},"originalFormulas":{}},{"id":"ROW-d2f32be2b1b5dc9d7955495f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":35,"originalCells":{"A":"HHS-PART2","B":"42 CFR Part 2 — SUD Patient Records","C":"U.S. federal regulation","D":"Part 2 programs, lawful holders and regulated disclosures","E":"Special confidentiality for substance-use-disorder records","F":"High where applicable","G":"Consent, use limits, redisclosure, proceedings and breach handling","H":"Consent, disclosure record, notice, access and incident evidence","I":"2024 final rule compliance required 16 Feb 2026","J":"https://www.hhs.gov/hipaa/part-2/index.html"},"originalFormulas":{}},{"id":"ROW-a64395257784a0f7e1d11c84","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":36,"originalCells":{"A":"ONC-HTI1","B":"ONC HTI-1 Algorithm Transparency","C":"Health IT certification regulation","D":"Developers of certified health IT with predictive decision support","E":"Algorithm transparency and risk information","F":"High for covered certified modules","G":"Source attributes, intervention risk management, fairness, validity and safety","H":"Certification artifacts, disclosures and real-world testing","I":"Final rule effective; review current ONC enforcement notices","J":"https://healthit.gov/regulations/hti-rules/hti-1-final-rule/"},"originalFormulas":{}},{"id":"ROW-7902cc3b6776f8059ad6e48d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":37,"originalCells":{"A":"FDA-AI-MD","B":"FDA AI-Enabled Medical Device Lifecycle Guidance","C":"Regulatory guidance / device requirements","D":"Developers and sponsors of AI-enabled medical devices","E":"Safety, effectiveness, transparency, bias and lifecycle change","F":"High for regulated device functions","G":"Intended use, validation, change control, monitoring and human factors","H":"Submission, validation, PCCP and postmarket evidence","I":"Use final requirements plus current FDA guidance; 2025 lifecycle guidance remains draft unless finalized","J":"https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-enabled-medical-devices"},"originalFormulas":{}},{"id":"ROW-4eebfaddfe6861574fe5260e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":38,"originalCells":{"A":"FRB-MRM-2026","B":"Interagency Revised Guidance on Model Risk Management","C":"U.S. banking supervisory guidance","D":"Banking organizations; most relevant above $30B for Federal Reserve supervision","E":"Risk-based model governance, validation and controls","F":"High for supervised model use","G":"Inventory, tiering, independent validation, change and monitoring","H":"Validation, challenge, findings, approvals and monitoring","I":"SR 26-2 superseded SR 11-7 on 17 Apr 2026","J":"https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm"},"originalFormulas":{}},{"id":"ROW-2648fe12dd0384dfad627d02","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":39,"originalCells":{"A":"NYDFS-500","B":"23 NYCRR Part 500 + DFS AI Cybersecurity Guidance","C":"New York financial cybersecurity regulation","D":"DFS-regulated entities","E":"Cybersecurity program and AI-related cyber risk","F":"High where licensed","G":"MFA, access, inventory, risk assessment, monitoring and incident response","H":"Certification, assessment, policy, configuration and incident records","I":"Amended regulation effective from Nov 2023 with phased dates","J":"https://www.dfs.ny.gov/industry_guidance/cybersecurity"},"originalFormulas":{}},{"id":"ROW-48be17815700adb48f3861b0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":40,"originalCells":{"A":"ECOA-REG-B","B":"ECOA / Regulation B Adverse Action Requirements","C":"U.S. federal consumer-credit law and regulation","D":"Creditors using models or AI in credit decisions","E":"Nondiscrimination and specific adverse-action reasons","F":"High for covered credit decisions","G":"Specific reasons, explainability, fairness, notice and records","H":"Decision factors, notices, validation, testing and complaints","I":"Technology does not remove adverse-action obligations","J":"https://www.consumerfinance.gov/archive/newsroom/cfpb-issues-guidance-on-credit-denials-by-lenders-using-artificial-intelligence/"},"originalFormulas":{}},{"id":"ROW-59d631f460f3601715cab310","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":41,"originalCells":{"A":"NAIC-AI","B":"NAIC Model Bulletin on AI Systems by Insurers","C":"State insurance regulatory model bulletin","D":"Insurers in adopting jurisdictions","E":"Written AI systems program and fair, accurate outcomes","F":"High where adopted by the relevant regulator","G":"Governance, risk, testing, third parties, fairness and consumer outcomes","H":"AIS program, inventory, validation, documentation and examination evidence","I":"Model bulletin adopted Dec 2023; state adoption must be checked","J":"https://content.naic.org/article/naic-members-approve-model-bulletin-use-ai-insurers"},"originalFormulas":{}},{"id":"ROW-c01d164deb866d8eb2726d49","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":42,"originalCells":{"A":"COPPA","B":"Children’s Online Privacy Protection Rule","C":"U.S. federal regulation","D":"Covered online services collecting data from children under 13","E":"Parental consent, minimization, disclosure and retention","F":"High where applicable","G":"Age/child detection, consent, third-party disclosure and deletion","H":"Consent, notice, data map, retention and deletion records","I":"FTC amendments finalized Jan 2025; verify applicable compliance date","J":"https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data"},"originalFormulas":{}},{"id":"ROW-dc59b939b8884195773a807e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":43,"originalCells":{"A":"NYC-LL144","B":"NYC Local Law 144 — AEDT","C":"New York City employment law","D":"Covered automated employment decision tools used for NYC candidates or employees","E":"Bias audit, publication and notice","F":"High where applicable","G":"Annual bias audit, notice, alternative process and disclosure","H":"Independent audit, published summary and notices","I":"Enforced since 5 Jul 2023","J":"https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page"},"originalFormulas":{}},{"id":"ROW-c07594d7774f422504e5f9ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":44,"originalCells":{"A":"IL-AIVIA","B":"Illinois Artificial Intelligence Video Interview Act","C":"Illinois employment law","D":"AI analysis of applicant video interviews for Illinois positions","E":"Notice, explanation, consent, sharing and deletion","F":"High where applicable","G":"Consent gate, transparency, access limits and deletion","H":"Notice, consent, sharing record, deletion request evidence","I":"Current Illinois statute","J":"https://www.ilga.gov/Legislation/PublicActs/PrinterFriendly/101-0260"},"originalFormulas":{}},{"id":"ROW-6865413e70818ef9afda1cfb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":45,"originalCells":{"A":"UK-DP-AI","B":"UK Data Protection Law + ICO AI Guidance","C":"Law plus regulator guidance","D":"Personal-data processing with a UK nexus","E":"Lawfulness, fairness, transparency, security and individual rights","F":"High where applicable","G":"DPIA, minimization, fairness, automated decisions and rights","H":"DPIA, notices, model documentation, tests and rights handling","I":"Reflect Data (Use and Access) Act 2025; some ICO AI guidance remains under review","J":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/about-this-guidance/"},"originalFormulas":{}},{"id":"ROW-53c17fdfdb05d320ef747afe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":46,"originalCells":{"A":"BR-LGPD","B":"Brazil LGPD + ANPD AI Guidance","C":"Brazilian data-protection law and regulator guidance","D":"Personal-data processing with a Brazilian nexus","E":"Purpose, necessity, transparency, security and automated decisions","F":"High where applicable","G":"Purpose limitation, data minimization, rights, review and GenAI data handling","H":"Legal basis, notices, impact records, security and request handling","I":"LGPD current; ANPD GenAI guidance continues to evolve","J":"https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/lgpd-en-lei-no-13-709-capa.pdf"},"originalFormulas":{}},{"id":"ROW-da1ad5c97fa11d12ccf111a2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":47,"originalCells":{"A":"AU-PRIVACY-AI","B":"Australia Privacy Act / APPs + OAIC AI Guidance","C":"Australian privacy law and regulator guidance","D":"APP entities developing or deploying AI with personal information","E":"Necessity, transparency, accuracy, security and high-risk use","F":"High where applicable","G":"Product due diligence, PIA, input/output data controls, accuracy and notice","H":"Privacy policy, PIA, consent, testing and vendor review","I":"OAIC guidance updated Jan 2025; automated-decision privacy-policy amendments commence 10 Dec 2026","J":"https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products"},"originalFormulas":{}},{"id":"ROW-0579fb48e563f6cfc629e7cf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":48,"originalCells":{"A":"SG-MODEL-AI","B":"Singapore Model AI Governance Framework","C":"Voluntary governance framework","D":"Private-sector AI deployment","E":"Human-centric, explainable, transparent and fair AI","F":"Recommended for Singapore operations","G":"Internal governance, risk-based human involvement, operations and communication","H":"Governance records, risk assessments, testing and disclosure","I":"Second edition and related implementation resources","J":"https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework"},"originalFormulas":{}},{"id":"ROW-31876febcca5a5de95a2d423","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":49,"originalCells":{"A":"DOJ-DSP","B":"DOJ Data Security Program — 28 CFR Part 202","C":"U.S. national-security regulation","D":"Covered transactions involving bulk U.S. sensitive or government-related data and countries of concern","E":"Prohibited and restricted data transactions","F":"High where transaction thresholds and counterparties trigger","G":"Counterparty screening, data classification, access, minimization and transfer controls","H":"Due diligence, contracts, audits, records and reports","I":"Effective 8 Apr 2025; affirmative due-diligence and audit duties effective Oct 2025","J":"https://www.justice.gov/nsd/data-security"},"originalFormulas":{}},{"id":"ROW-0d028bee6e20425b1df870f7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"04 Framework Catalog","row":50,"originalCells":{"A":"EAR","B":"U.S. Export Administration Regulations","C":"U.S. export-control regulation","D":"Controlled technology, source code, items, end users and end uses","E":"Exports, reexports, transfers and deemed exports","F":"High where controlled technology or parties are involved","G":"Classification, recipient/location screening, access and release controls","H":"Jurisdiction/classification, licenses, screening and transaction records","I":"Continuously updated; verify current EAR and license requirements","J":"https://www.bis.gov/regulations/ear/734"},"originalFormulas":{}},{"id":"ROW-dd7dd21a66734e7b97fcb5b0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":5,"originalCells":{"A":"DP-01","B":"Data Protection","C":"Block credentials and secrets","D":"Block or mask passwords, API keys, access tokens, private keys, signing secrets, and connection strings before transfer to an AI service.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + redacted match","J":"Critical","K":"Data Classification for AI","L":"Seed test secrets plus obfuscated variants; require zero raw secret in destination.","M":"All systems; allow only designated secret-management workflows.","N":"3"},"originalFormulas":{}},{"id":"ROW-d965a35a421e3fc6673c239f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":6,"originalCells":{"A":"DP-02","B":"Data Protection","C":"Block passwords and authentication answers","D":"Block passwords, passphrases, recovery codes, one-time codes, and authentication answers.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + redacted match","J":"Critical","K":"Data Classification for AI","L":"Test common and generated password formats without storing live credentials.","M":"All systems.","N":"3"},"originalFormulas":{}},{"id":"ROW-796761a8a9cf57da2fae3e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":7,"originalCells":{"A":"DP-03","B":"Data Protection","C":"Block payment card numbers","D":"Block full PAN; optionally mask to last four only in approved support workflows.","E":"Block / mask","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + masked value","J":"Critical","K":"Data Classification for AI","L":"Use valid and invalid Luhn samples; test separators and OCR variants.","M":"Card data; PCI scope.","N":"2"},"originalFormulas":{}},{"id":"ROW-caa534e1eb5c3613fe0591c1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":8,"originalCells":{"A":"DP-04","B":"Data Protection","C":"Block CVV, CVC and PIN","D":"Block sensitive authentication data, including CVV/CVC, PIN and PIN blocks.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log","J":"Critical","K":"Data Classification for AI","L":"Test label/value pairs and contextual variants.","M":"Payment workflows.","N":"2"},"originalFormulas":{}},{"id":"ROW-7a175ac95401f3abfaf8290d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":9,"originalCells":{"A":"DP-05","B":"Data Protection","C":"Block national identifiers","D":"Block SSN and other configured national or government identifiers unless an approved regulated workflow explicitly permits them.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + redacted match","J":"Critical","K":"Privacy and Personal Data","L":"Test formatted, unformatted, and OCR variants; measure false positives.","M":"Configure by jurisdiction.","N":"3"},"originalFormulas":{}},{"id":"ROW-b78aa7d9163467a76700c54a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":10,"originalCells":{"A":"DP-06","B":"Data Protection","C":"Block bank-account data","D":"Block bank account, routing, IBAN, SWIFT and similar financial account identifiers unless approved and protected.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + redacted match","J":"Critical","K":"Privacy and Personal Data","L":"Test domestic routing/account formats in addition to IBAN.","M":"Financial services and payment workflows.","N":"2"},"originalFormulas":{}},{"id":"ROW-eaf49299e5a27f3a04a39dee","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":11,"originalCells":{"A":"DP-07","B":"Data Protection","C":"Restrict protected health information","D":"Block PHI in unapproved AI; allow only minimum-necessary, authorized processing on a contracted and configured service.","E":"Conditional block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + approved context + BAA evidence","J":"Critical","K":"Privacy and Personal Data","L":"Test identifiers plus diagnosis/treatment context and de-identified cases.","M":"HIPAA workflows; context-sensitive, not a blanket ‘no PII’ rule.","N":"2"},"originalFormulas":{}},{"id":"ROW-2db24a210a103da03c6369d1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":12,"originalCells":{"A":"DP-08","B":"Data Protection","C":"Restrict education records","D":"Block grades, transcripts, discipline records and student identifiers in unapproved AI; require authorized purpose and disclosure basis.","E":"Conditional block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + authorization record","J":"High","K":"Privacy and Personal Data","L":"Test student-record narratives and directory-information exceptions.","M":"Educational institutions.","N":"2"},"originalFormulas":{}},{"id":"ROW-0b229efa77ef98b17d217b94","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":13,"originalCells":{"A":"DP-09","B":"Data Protection","C":"Protect contact information","D":"Warn or block email, phone and postal address based on data classification, purpose, volume and approved service.","E":"Conditional warn/block","F":"E2/E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + context","J":"High","K":"Privacy and Personal Data","L":"Test single business contact, bulk lists, and sensitive-context combinations.","M":"Contextual; a single public business email may be permitted.","N":"3"},"originalFormulas":{}},{"id":"ROW-2e8dd0f254a9bfc88a26ae93","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":14,"originalCells":{"A":"DP-10","B":"Data Protection","C":"Block biometric identifiers","D":"Block face templates, voiceprints, fingerprints, iris data and other biometric identifiers outside approved use.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Roadmap","I":"Decision log","J":"Critical","K":"Privacy and Personal Data","L":"Test text references and supported image/audio metadata.","M":"High-risk personal data.","N":"3"},"originalFormulas":{}},{"id":"ROW-a5189f5e4b5294c5256598fe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":15,"originalCells":{"A":"DP-11","B":"Data Protection","C":"Protect precise location","D":"Warn or block precise geolocation and sensitive movement history unless purpose, consent and service are approved.","E":"Conditional warn/block","F":"E2/E3","G":"Prompt + upload + response","H":"Roadmap","I":"Decision + approved purpose","J":"High","K":"Privacy and Personal Data","L":"Test coordinates, addresses, routes and location narratives.","M":"Configure precision and context thresholds.","N":"2"},"originalFormulas":{}},{"id":"ROW-de74c6dce98f94da3fdb5dfb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":16,"originalCells":{"A":"DP-12","B":"Data Protection","C":"Block classified, CUI and FCI","D":"Block classified information, CUI/FCI markings and designated government data from unauthorized AI channels.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision log + classification match","J":"Critical","K":"Data Classification for AI","L":"Test markings, portion labels, headers, and contextual descriptions.","M":"Government and contractors.","N":"2"},"originalFormulas":{}},{"id":"ROW-274105fb30057214d0562812","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":17,"originalCells":{"A":"DP-13","B":"Data Protection","C":"Protect export-controlled and national-security data","D":"Block ITAR/EAR-controlled technical data and designated national-security information from unauthorized models, regions and persons.","E":"Conditional block","F":"E3","G":"Prompt + upload + response","H":"Roadmap","I":"Decision + jurisdiction + authorization","J":"Critical","K":"Data Classification for AI","L":"Test project codes, markings and controlled technical narratives.","M":"Requires enterprise classifications and jurisdiction rules.","N":"2"},"originalFormulas":{}},{"id":"ROW-225037eab461099efc409e5c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":18,"originalCells":{"A":"DP-14","B":"Data Protection","C":"Protect trade secrets and source code","D":"Block or require approval for proprietary algorithms, source code, product roadmaps and trade secrets sent to unapproved AI.","E":"Conditional block/approve","F":"E2/E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + repository/project context","J":"High","K":"IP, Copyright and Confidentiality","L":"Test code, design documents and organization-specific codewords.","M":"Enterprise-specific classification is required.","N":"3"},"originalFormulas":{}},{"id":"ROW-7ce2bc4a6a65b5ec7ea32a1f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":19,"originalCells":{"A":"DP-15","B":"Data Protection","C":"Protect architecture and vulnerability details","D":"Warn or block internal topology, system configuration, exploit paths, audit findings and unpatched vulnerabilities.","E":"Conditional warn/block","F":"E2/E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + recipient/service context","J":"High","K":"AI Security and Prompt Injection","L":"Test IPs, diagrams, vulnerabilities, findings and obfuscation.","M":"Permit approved remediation use on sanctioned systems.","N":"3"},"originalFormulas":{}},{"id":"ROW-547168ebefb450617ee140e7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":20,"originalCells":{"A":"DP-16","B":"Data Protection","C":"Protect customer confidential data","D":"Block or approve customer records, contracts, support cases and tenant data according to contract, classification and purpose.","E":"Conditional block/approve","F":"E2/E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + customer/tenant context","J":"High","K":"IP, Copyright and Confidentiality","L":"Test structured and narrative customer data, including multi-record uploads.","M":"Requires customer and tenant identifiers.","N":"3"},"originalFormulas":{}},{"id":"ROW-6d330d498b040a50298e5096","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":21,"originalCells":{"A":"DP-17","B":"Data Protection","C":"Block MNPI and unreleased financials","D":"Block material nonpublic information, unreleased earnings, transactions and forecasts from external AI unless specifically authorized.","E":"Block","F":"E3","G":"Prompt + upload + response","H":"Partial","I":"Decision + matter code","J":"Critical","K":"IP, Copyright and Confidentiality","L":"Test earnings, M&A and deal narratives with organization codewords.","M":"Public companies and regulated financial workflows.","N":"2"},"originalFormulas":{}},{"id":"ROW-7df32d39977e00db5c854d8e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":22,"originalCells":{"A":"DP-18","B":"Data Protection","C":"Protect privilege and investigations","D":"Warn or block attorney-client privileged material, work product, investigations, employee matters and protected audit content.","E":"Conditional block/approve","F":"E2/E3","G":"Prompt + upload + response","H":"Roadmap","I":"Decision + matter authorization","J":"High","K":"IP, Copyright and Confidentiality","L":"Test privilege legends, matter numbers and investigation narratives.","M":"Legal and HR workflows.","N":"2"},"originalFormulas":{}},{"id":"ROW-2be72c12f0cb01e4a2b7dcaa","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":23,"originalCells":{"A":"AU-01","B":"Authorized Use","C":"Allow sanctioned AI services only","D":"Detect and block or redirect unapproved AI domains, desktop apps, APIs and embedded assistants.","E":"Block / redirect","F":"E3","G":"Network + browser + endpoint","H":"Partial","I":"Discovery and enforcement event","J":"Critical","K":"Approved AI Tools and Shadow AI","L":"Attempt use through approved and unapproved domains, aliases and API endpoints.","M":"Requires complete inventory and egress coverage.","N":"2"},"originalFormulas":{}},{"id":"ROW-a2c0d46f3e18438f105dc6d7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":24,"originalCells":{"A":"AU-02","B":"Authorized Use","C":"Require strong authentication","D":"Require enterprise identity and MFA before sensitive AI use; deny unmanaged or anonymous sessions.","E":"Block","F":"E3","G":"Identity + session","H":"Roadmap","I":"IdP/config assertion + decision","J":"Critical","K":"Approved AI Tools and Shadow AI","L":"Test unmanaged device, personal account and MFA-bypass paths.","M":"Not provable from a policy document alone.","N":"3"},"originalFormulas":{}},{"id":"ROW-3dc6adb58d7f098f9272c80d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":25,"originalCells":{"A":"AU-03","B":"Authorized Use","C":"Enforce role and data-class authorization","D":"Permit AI systems, models, data classes and capabilities only to authorized roles and groups.","E":"Block","F":"E3","G":"Identity + policy engine","H":"Roadmap","I":"Decision + entitlement snapshot","J":"Critical","K":"Approved AI Tools and Shadow AI","L":"Test role changes, leavers and restricted data classes.","M":"Requires identity and directory integration.","N":"2"},"originalFormulas":{}},{"id":"ROW-fcec3fc6725ce68924123608","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":26,"originalCells":{"A":"AU-04","B":"Authorized Use","C":"Allow approved use cases and models only","D":"Bind each high-risk use case to approved model/version, purpose, owner, data classes and risk decision.","E":"Block / approve","F":"E2/E3","G":"Use-case registry + gateway","H":"Roadmap","I":"Use-case approval + runtime context","J":"Critical","K":"AI Governance and Accountability","L":"Test unregistered purpose, model substitution and scope drift.","M":"All high-impact and regulated use cases.","N":"3"},"originalFormulas":{}},{"id":"ROW-cfe116723d32ad6326ee06b3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":27,"originalCells":{"A":"AU-05","B":"Authorized Use","C":"Route by residency and retention constraints","D":"Block or reroute data when model region, storage, retention or subprocessors conflict with approved requirements.","E":"Block / route","F":"E3/E4","G":"Gateway + vendor metadata","H":"Roadmap","I":"Routing decision + vendor configuration","J":"High","K":"Vendor and AI Procurement","L":"Test region mismatch, retention settings and vendor changes.","M":"Jurisdiction- and contract-specific.","N":"2"},"originalFormulas":{}},{"id":"ROW-99440280e23a02ddcb319ff1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":28,"originalCells":{"A":"AU-06","B":"Authorized Use","C":"Prevent provider training on enterprise content","D":"Require a contracted enterprise service and verified setting prohibiting provider training or secondary use where policy demands it.","E":"Block","F":"E3","G":"Vendor config + session","H":"Roadmap","I":"Contract + configuration assertion","J":"Critical","K":"Vendor and AI Procurement","L":"Test personal versus enterprise tenant and setting drift.","M":"Depends on provider contract and configuration.","N":"3"},"originalFormulas":{}},{"id":"ROW-73b5ab67a4373cbffdf61c3c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":29,"originalCells":{"A":"AU-07","B":"Authorized Use","C":"Prohibit account sharing","D":"Detect and prevent shared credentials, concurrent anomalous access and use of another person’s AI account.","E":"Block / alert","F":"E2/E3","G":"Identity + session analytics","H":"Roadmap","I":"Authentication and anomaly event","J":"High","K":"Approved AI Tools and Shadow AI","L":"Test shared-account and revoked-user scenarios.","M":"Requires identity telemetry.","N":"2"},"originalFormulas":{}},{"id":"ROW-70ffbddc19757b6b4bd3008f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":30,"originalCells":{"A":"AU-08","B":"Authorized Use","C":"Detect shadow AI and unmanaged plugins","D":"Continuously inventory AI web apps, APIs, browser extensions, connectors and plugins; alert on unknown services.","E":"Detect / block","F":"E1/E3","G":"Browser + endpoint + network","H":"Partial","I":"Inventory and alert","J":"High","K":"Approved AI Tools and Shadow AI","L":"Compare observed use to registry and test newly introduced domains.","M":"Current code sees only nine configured web surfaces.","N":"3"},"originalFormulas":{}},{"id":"ROW-33d75597df848b17c463a5ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":31,"originalCells":{"A":"IN-01","B":"Input Security","C":"Detect direct prompt injection and jailbreaks","D":"Block or isolate instructions that attempt to override policy, reveal hidden context or bypass safeguards.","E":"Block","F":"E3","G":"Prompt","H":"Partial","I":"Decision + attack class","J":"Critical","K":"AI Security and Prompt Injection","L":"Run multilingual, role-play, encoded and multi-turn attack suites.","M":"Tune to use case; preserve legitimate security testing in sandboxes.","N":"2"},"originalFormulas":{}},{"id":"ROW-f827b989613c49ac0be126bf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":32,"originalCells":{"A":"IN-02","B":"Input Security","C":"Detect indirect prompt injection","D":"Treat files, web pages, email, RAG content and tool results as untrusted; block hidden instructions from driving actions.","E":"Block / isolate","F":"E3","G":"Upload + retrieval + tool result","H":"Roadmap","I":"Decision + source provenance","J":"Critical","K":"AI Security and Prompt Injection","L":"Test poisoned documents, web pages and retrieved chunks.","M":"Critical for RAG and agents.","N":"2"},"originalFormulas":{}},{"id":"ROW-a69372f0d658fdbe12b8fd53","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":33,"originalCells":{"A":"IN-03","B":"Input Security","C":"Detect obfuscated and multimodal attacks","D":"Normalize Unicode, encodings, invisible text, images, audio and document structure before rule evaluation.","E":"Block / isolate","F":"E3","G":"All inputs","H":"Roadmap","I":"Normalization and decision log","J":"High","K":"AI Security and Prompt Injection","L":"Test homoglyphs, zero-width text, base64, OCR and image-based injection.","M":"Requires modality-specific extraction.","N":"2"},"originalFormulas":{}},{"id":"ROW-1d4de9b6515e28867aabb661","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":34,"originalCells":{"A":"IN-04","B":"Input Security","C":"Restrict harmful cyber requests","D":"Block malicious requests for credential theft, destructive exploitation or unauthorized access; route approved defensive testing to a controlled mode.","E":"Conditional block","F":"E3","G":"Prompt + tool call","H":"Roadmap","I":"Decision + approved test context","J":"Critical","K":"AI Security and Prompt Injection","L":"Test dual-use boundaries and approved red-team contexts.","M":"Context- and authorization-sensitive.","N":"2"},"originalFormulas":{}},{"id":"ROW-404738e71a852866a1f1a06b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":35,"originalCells":{"A":"IN-05","B":"Input Security","C":"Quarantine unsafe files and malware","D":"Scan attachments for malware, active content, archive bombs and prohibited formats; block or quarantine before AI ingestion.","E":"Block / quarantine","F":"E3/E4","G":"Upload","H":"Roadmap","I":"Scan result + quarantine event","J":"Critical","K":"AI Security and Prompt Injection","L":"Test malware simulators, macros, encrypted archives and oversize files.","M":"Current build scans only readable text files ≤1 MB and does not prevent upload.","N":"2"},"originalFormulas":{}},{"id":"ROW-9fc4252383688ede04d786ea","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":36,"originalCells":{"A":"IN-06","B":"Input Security","C":"Prevent RAG and data poisoning","D":"Validate provenance, authorization and integrity before documents, embeddings, feedback or fine-tuning data enter an AI corpus.","E":"Block / quarantine","F":"E3/E4","G":"Ingestion pipeline","H":"Roadmap","I":"Provenance + integrity + decision","J":"Critical","K":"Data, Model and RAG Supply Chain","L":"Inject conflicting, malicious and unauthorized content; verify rejection and rollback.","M":"RAG, training, fine-tuning and memory stores.","N":"3"},"originalFormulas":{}},{"id":"ROW-5f5c18f25000f9c536da18d5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":37,"originalCells":{"A":"IN-07","B":"Input Security","C":"Enforce allowed intent and scope","D":"Constrain requests to the approved business purpose, user role and system capability; warn or block out-of-scope use.","E":"Warn / block","F":"E2/E3","G":"Prompt + use-case context","H":"Roadmap","I":"Decision + policy context","J":"High","K":"AI Acceptable Use","L":"Test plausible scope drift and role mismatch.","M":"Requires use-case and role context.","N":"2"},"originalFormulas":{}},{"id":"ROW-09612dabcd00cb81ad1d05ba","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":38,"originalCells":{"A":"IN-08","B":"Input Security","C":"Limit resource consumption","D":"Enforce prompt, token, file, query, rate, recursion and spend limits; stop runaway loops.","E":"Block / throttle","F":"E3/E4","G":"Gateway + agent runtime","H":"Roadmap","I":"Usage meter + throttle event","J":"High","K":"Agentic AI and Connectors","L":"Stress test long context, retries, tool loops and parallel calls.","M":"All paid or resource-constrained AI.","N":"2"},"originalFormulas":{}},{"id":"ROW-60b11c0a5a8eb1d759b90a1d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":39,"originalCells":{"A":"OU-01","B":"Output Safety","C":"Block sensitive output disclosure","D":"Inspect outputs for secrets, regulated data, hidden context and unauthorized tenant/customer information before display or downstream use.","E":"Block / redact","F":"E3","G":"Response + tool result","H":"Roadmap","I":"Decision + redacted output","J":"Critical","K":"Prompt and Output Interaction","L":"Seed hidden sensitive data and verify it never reaches the user or tool.","M":"External AI responses are not intercepted in the current build.","N":"3"},"originalFormulas":{}},{"id":"ROW-8f98d8e0539ec18e9717c095","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":40,"originalCells":{"A":"OU-02","B":"Output Safety","C":"Prevent hidden-context and system-prompt leakage","D":"Block disclosure of system prompts, hidden instructions, connector tokens, private retrieval context and chain-of-control metadata.","E":"Block / redact","F":"E3","G":"Response","H":"Roadmap","I":"Decision + leakage class","J":"Critical","K":"AI Security and Prompt Injection","L":"Run extraction attacks and canary-string tests.","M":"Especially important for hosted agents and RAG.","N":"2"},"originalFormulas":{}},{"id":"ROW-05ae5b514ae5f63ada4d7746","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":41,"originalCells":{"A":"OU-03","B":"Output Safety","C":"Require evidence for factual claims","D":"For designated decisions, require citations or approved source grounding; flag unsupported, fabricated or stale claims.","E":"Warn / hold","F":"E2/E3","G":"Response","H":"Roadmap","I":"Claim-source links + verification result","J":"High","K":"Evaluation, Red Team and Benchmarking","L":"Test answerability, fabricated citations and stale sources.","M":"Apply by use case; not every creative task needs citations.","N":"2"},"originalFormulas":{}},{"id":"ROW-93855bbbe9a302b1f1006cdc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":42,"originalCells":{"A":"OU-04","B":"Output Safety","C":"Require human validation for high-stakes advice","D":"Do not let unreviewed AI output make or communicate medical, legal, financial, employment, housing, education or safety decisions.","E":"Hold for approval","F":"E2/E3","G":"Response + workflow","H":"Roadmap","I":"Reviewer identity + decision","J":"Critical","K":"High-Impact AI and Human Oversight","L":"Simulate consequential outputs; verify required review and fail-safe.","M":"Configure domains and qualified reviewers.","N":"3"},"originalFormulas":{}},{"id":"ROW-2cf11e533edb20d9d1dd9c78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":43,"originalCells":{"A":"OU-05","B":"Output Safety","C":"Detect discriminatory or unfair outcomes","D":"Hold or flag outputs that use protected traits, proxies or unjustified disparate treatment in consequential contexts.","E":"Hold / alert","F":"E2/E3","G":"Response + decision record","H":"Roadmap","I":"Fairness test + decision","J":"Critical","K":"Bias, Fairness and Civil Rights","L":"Test counterfactual pairs, subgroup performance and proxy features.","M":"Requires domain-specific legal and statistical review.","N":"3"},"originalFormulas":{}},{"id":"ROW-f603f5e29e916e93e964aafc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":44,"originalCells":{"A":"OU-06","B":"Output Safety","C":"Block harassment, hate and abuse","D":"Block or safely transform hateful, harassing, demeaning or targeted abusive content under the organization’s safety standard.","E":"Block / transform","F":"E3/E4","G":"Response","H":"Roadmap","I":"Decision + safety category","J":"High","K":"AI Acceptable Use","L":"Run multilingual and contextual safety tests, including quoted material exceptions.","M":"Tune for lawful monitoring and support contexts.","N":"1"},"originalFormulas":{}},{"id":"ROW-56e9b5df3e9b56a0997dcd8f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":45,"originalCells":{"A":"OU-07","B":"Output Safety","C":"Block dangerous and illegal content","D":"Block actionable content that materially facilitates violence, self-harm, illegal activity or CBRN harm; route emergencies to approved support.","E":"Block / route","F":"E3/E4","G":"Prompt + response","H":"Roadmap","I":"Decision + escalation event","J":"Critical","K":"AI Acceptable Use","L":"Use controlled safety datasets and escalation drills.","M":"Requires carefully governed exceptions for research and safety teams.","N":"2"},"originalFormulas":{}},{"id":"ROW-a918b603fd3d79a9824f1e6c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":46,"originalCells":{"A":"OU-08","B":"Output Safety","C":"Block insecure code from automated use","D":"Scan generated code for vulnerabilities, malware patterns, exposed secrets and unsafe dependencies before merge, execution or deployment.","E":"Hold / block","F":"E2/E3","G":"Response + CI/CD","H":"Roadmap","I":"Scan findings + approval","J":"High","K":"AI Secure Development Lifecycle","L":"Benchmark common weakness classes and dependency risks.","M":"Development and code-generation use cases.","N":"2"},"originalFormulas":{}},{"id":"ROW-b5b43ff186de61e4e9c8f991","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":47,"originalCells":{"A":"OU-09","B":"Output Safety","C":"Sanitize and validate model output","D":"Treat model output as untrusted: enforce schema, encode content, parameterize commands and validate before execution or display.","E":"Transform / block","F":"E3/E4","G":"Response + consuming application","H":"Roadmap","I":"Validation result + rejected payload","J":"Critical","K":"AI Secure Development Lifecycle","L":"Test XSS, SQL/command injection, malformed JSON and policy bypass.","M":"Applications consuming model output.","N":"2"},"originalFormulas":{}},{"id":"ROW-72e395c7218a6a4876304887","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":48,"originalCells":{"A":"OU-10","B":"Output Safety","C":"Protect intellectual property and licenses","D":"Detect likely copyrighted, licensed or third-party confidential material; require attribution, license check or human review before reuse.","E":"Warn / hold","F":"E2/E3","G":"Response","H":"Roadmap","I":"Similarity/license review record","J":"High","K":"IP, Copyright and Confidentiality","L":"Test verbatim regeneration, code-license conflicts and source attribution.","M":"Use-case and jurisdiction specific.","N":"2"},"originalFormulas":{}},{"id":"ROW-20682fe9bafd1d0abdfa8c4b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":49,"originalCells":{"A":"OU-11","B":"Output Safety","C":"Prevent re-identification","D":"Block outputs that recombine, infer or expose identities from de-identified, aggregate or pseudonymous data.","E":"Block / hold","F":"E3","G":"Response","H":"Roadmap","I":"Privacy-risk result","J":"Critical","K":"Privacy and Personal Data","L":"Run linkage and uniqueness attacks against representative datasets.","M":"Analytics, synthetic data and health/research contexts.","N":"2"},"originalFormulas":{}},{"id":"ROW-bf7bf2864cb170ef25ebd30d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":50,"originalCells":{"A":"OU-12","B":"Output Safety","C":"Disclose AI-generated or synthetic content","D":"Apply required AI-use notices, provenance metadata and machine-readable labels to designated content and interactions.","E":"Transform / require disclosure","F":"E3/E4","G":"Response + publication","H":"Roadmap","I":"Label/provenance record","J":"High","K":"Transparency, Disclosure and Provenance","L":"Verify labels survive export, reposting and supported transformations.","M":"Public-facing or regulated content.","N":"3"},"originalFormulas":{}},{"id":"ROW-1279c5b35f2939fb1cc43247","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":51,"originalCells":{"A":"AG-01","B":"Agentic Controls","C":"Allowlisted tools and connectors only","D":"Permit only approved tools, MCP servers, plugins, APIs and connector operations for the use case and role.","E":"Block","F":"E3","G":"Agent tool gateway","H":"Roadmap","I":"Tool-policy decision","J":"Critical","K":"Agentic AI and Connectors","L":"Attempt unknown, renamed and newly installed tools.","M":"Agentic systems.","N":"2"},"originalFormulas":{}},{"id":"ROW-a3ddaf09b3a72f0c72e8964e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":52,"originalCells":{"A":"AG-02","B":"Agentic Controls","C":"Enforce least privilege for agents","D":"Issue short-lived, scoped credentials; restrict data, action, tenant and environment permissions to the minimum necessary.","E":"Block","F":"E3","G":"Identity + tool gateway","H":"Roadmap","I":"Credential scope + decision","J":"Critical","K":"Agentic AI and Connectors","L":"Test privilege escalation, stale tokens and cross-environment access.","M":"Agentic systems.","N":"2"},"originalFormulas":{}},{"id":"ROW-10aac5610f8d61a3c39451f5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":53,"originalCells":{"A":"AG-03","B":"Agentic Controls","C":"Require approval for high-impact or irreversible actions","D":"Require step-up human confirmation before payments, submissions, deletions, permission changes, production actions or legal commitments.","E":"Hold for approval","F":"E2/E3","G":"Tool call","H":"Roadmap","I":"Action preview + approver + result","J":"Critical","K":"Agentic AI and Connectors","L":"Test each irreversible action and approval replay prevention.","M":"Agentic systems.","N":"3"},"originalFormulas":{}},{"id":"ROW-53dd84f34afc376b1c406ce7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":54,"originalCells":{"A":"AG-04","B":"Agentic Controls","C":"Prohibit autonomous consequential decisions","D":"Prevent agents from making final employment, credit, housing, education, healthcare, legal or similarly consequential decisions without authorized human determination.","E":"Block / hold","F":"E2/E3","G":"Decision + tool call","H":"Roadmap","I":"Human decision record","J":"Critical","K":"High-Impact AI and Human Oversight","L":"Test indirect actions and recommendation-to-decision handoffs.","M":"High-impact domains.","N":"3"},"originalFormulas":{}},{"id":"ROW-91f4c7ef9235e9f81ce06ed3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":55,"originalCells":{"A":"AG-05","B":"Agentic Controls","C":"Approve external communications","D":"Require approval before an agent sends email, messages, posts, tickets or other external communications in designated contexts.","E":"Hold for approval","F":"E2/E3","G":"Tool call","H":"Roadmap","I":"Preview + approver + sent artifact","J":"High","K":"Agentic AI and Connectors","L":"Test wrong recipient, sensitive content and reply-all scenarios.","M":"Configure trusted low-risk automations separately.","N":"2"},"originalFormulas":{}},{"id":"ROW-adf2e90caa19e3e99d364557","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":56,"originalCells":{"A":"AG-06","B":"Agentic Controls","C":"Approve destructive and permission-changing actions","D":"Require approval and recoverability before delete, overwrite, access-control, security-setting or production-change actions.","E":"Hold / block","F":"E2/E3","G":"Tool call","H":"Roadmap","I":"Diff/preview + approval + rollback reference","J":"Critical","K":"Agentic AI and Connectors","L":"Test deletion scope, permission escalation and rollback.","M":"Agentic systems.","N":"2"},"originalFormulas":{}},{"id":"ROW-68f5ef062c038e22495ed591","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":57,"originalCells":{"A":"AG-07","B":"Agentic Controls","C":"Enforce transaction and autonomy limits","D":"Apply amount, volume, recipient, duration, recursion, environment and cumulative-risk limits to agent actions.","E":"Block / throttle","F":"E3/E4","G":"Agent runtime","H":"Roadmap","I":"Meter + limit decision","J":"Critical","K":"Agentic AI and Connectors","L":"Test single and cumulative limit evasion.","M":"Agentic systems.","N":"1"},"originalFormulas":{}},{"id":"ROW-8cbb6da23d36aa1a0f0d3d85","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":58,"originalCells":{"A":"AG-08","B":"Agentic Controls","C":"Enforce tenant and context isolation","D":"Prevent retrieval, memory, cache, prompt or tool results from crossing user, customer, tenant, case or security boundaries.","E":"Block","F":"E3","G":"Retrieval + memory + tool gateway","H":"Roadmap","I":"Isolation test + decision","J":"Critical","K":"Data, Model and RAG Supply Chain","L":"Run cross-tenant canaries and confused-deputy tests.","M":"Multi-tenant and multi-case systems.","N":"2"},"originalFormulas":{}},{"id":"ROW-259c8693730cbe4b874ed25f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":59,"originalCells":{"A":"AG-09","B":"Agentic Controls","C":"Govern agent memory writes","D":"Validate, minimize and approve durable memory; prevent secrets, poisoned instructions and sensitive data from persistence.","E":"Block / approve","F":"E2/E3","G":"Memory write","H":"Roadmap","I":"Memory diff + provenance + decision","J":"High","K":"Agentic AI and Connectors","L":"Test poisoned memory, sensitive persistence and deletion.","M":"Systems with persistent memory.","N":"2"},"originalFormulas":{}},{"id":"ROW-9af6191d6f0ea49d3937a8c8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":60,"originalCells":{"A":"AG-10","B":"Agentic Controls","C":"Verify tool and package supply chain","D":"Pin, sign, scan and monitor model, tool, connector, MCP server, package and prompt dependencies; block untrusted versions.","E":"Block / quarantine","F":"E3/E4","G":"Build + runtime","H":"Roadmap","I":"SBOM/provenance + verification event","J":"Critical","K":"Data, Model and RAG Supply Chain","L":"Test tampered package, changed tool schema and revoked publisher.","M":"Applications and agents.","N":"2"},"originalFormulas":{}},{"id":"ROW-d47b427b0a53c7bac793a47d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":61,"originalCells":{"A":"OP-01","B":"Operations","C":"Log AI interactions and control decisions","D":"Record approved prompt/response metadata, rule outcomes, user/system, model/version, use case, time and action with privacy-aware minimization.","E":"Log","F":"E1","G":"All enforcement points","H":"Partial","I":"Tamper-evident audit event","J":"High","K":"AI Monitoring and Logging","L":"Verify completeness, integrity, access, retention and redaction.","M":"All governed systems; log content only where lawful and necessary.","N":"3"},"originalFormulas":{}},{"id":"ROW-411ceb959d0e3dc42db4309f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":62,"originalCells":{"A":"OP-02","B":"Operations","C":"Capture provenance and citations","D":"Preserve model/version, source documents, retrieval identifiers, tool calls and transformations for decisions and published content.","E":"Log / require","F":"E1/E3","G":"Response + workflow","H":"Roadmap","I":"Provenance record","J":"High","K":"Transparency, Disclosure and Provenance","L":"Trace a sample output end-to-end and validate source integrity.","M":"High-impact, factual and published outputs.","N":"2"},"originalFormulas":{}},{"id":"ROW-0dae86644d7e0892c43f8ad6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":63,"originalCells":{"A":"OP-03","B":"Operations","C":"Monitor control efficacy and model drift","D":"Measure precision, recall, bypass rate, false-positive burden, model/output drift and control coverage against thresholds.","E":"Monitor / gate","F":"E1/E3","G":"Evaluation + production telemetry","H":"Roadmap","I":"Metric series + threshold event","J":"Critical","K":"Evaluation, Red Team and Benchmarking","L":"Use labeled tests and production samples; investigate threshold breaches.","M":"All critical rules.","N":"3"},"originalFormulas":{}},{"id":"ROW-ef0314c91d4454e53a93b153","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":64,"originalCells":{"A":"OP-04","B":"Operations","C":"Escalate AI incidents","D":"Create and route incidents for critical blocks, suspected leakage, harmful output, control failure and policy evasion; preserve evidence.","E":"Alert / case","F":"E1/E4","G":"Runtime + SOC workflow","H":"Partial","I":"Incident/case record","J":"Critical","K":"AI Incident Response and Kill Switch","L":"Run tabletop and technical drills from detection through closure.","M":"All governed systems.","N":"2"},"originalFormulas":{}},{"id":"ROW-4d9ef81e7a1d864e0b1b7a0c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":65,"originalCells":{"A":"OP-05","B":"Operations","C":"Provide kill switch and fail-safe","D":"Disable a model, connector, use case, rule exception or autonomous action path quickly; default safely when critical controls fail.","E":"Block / disable","F":"E4","G":"Gateway + admin plane","H":"Roadmap","I":"Kill event + authorization + recovery","J":"Critical","K":"AI Incident Response and Kill Switch","L":"Test scoped and global shutdown, fail-closed behavior and restoration.","M":"Critical and high-impact systems.","N":"3"},"originalFormulas":{}},{"id":"ROW-0bf81f21814b84f8d4a6120e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":66,"originalCells":{"A":"OP-06","B":"Operations","C":"Reassess on material change","D":"Trigger tests, impact assessment and approval when model, data, prompt, tool, vendor, law, use case or risk profile changes.","E":"Hold release","F":"E2/E3","G":"Change pipeline","H":"Roadmap","I":"Change record + reassessment","J":"High","K":"AI Secure Development Lifecycle","L":"Change each dependency and verify the gate activates.","M":"All production AI.","N":"3"},"originalFormulas":{}},{"id":"ROW-426eb58154ac5c17eeb98ae3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":67,"originalCells":{"A":"OP-07","B":"Operations","C":"Time-bound exceptions and waivers","D":"Require scope, owner, rationale, compensating controls, approval, expiry and automatic revocation for every exception.","E":"Approve / expire","F":"E2/E4","G":"Policy engine + workflow","H":"Roadmap","I":"Exception record + expiry event","J":"High","K":"Exceptions, Appeals and Risk Acceptance","L":"Create expired, overbroad and missing-owner exceptions; verify rejection.","M":"All rule families.","N":"2"},"originalFormulas":{}},{"id":"ROW-6ade478d8add1c6d08ff4ac3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":68,"originalCells":{"A":"OP-08","B":"Operations","C":"Support feedback, appeal and override","D":"Provide affected users and operators a documented route to contest, correct, override or escalate AI decisions without retaliation.","E":"Workflow","F":"E2","G":"User experience + case management","H":"Roadmap","I":"Appeal + resolution record","J":"High","K":"Exceptions, Appeals and Risk Acceptance","L":"Test accessibility, timeliness and traceability of appeals.","M":"Consequential and user-facing AI.","N":"3"},"originalFormulas":{}},{"id":"ROW-b044e2b74aee570af6ea9ddb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":69,"originalCells":{"A":"OP-09","B":"Operations","C":"Maintain AI inventory and ownership","D":"Continuously inventory AI systems, models, versions, use cases, owners, users, data, vendors, risk tier and status.","E":"Detect / require","F":"E1/E3","G":"Discovery + registry","H":"Partial","I":"Inventory record + reconciliation","J":"Critical","K":"AI Governance and Accountability","L":"Reconcile browser, endpoint, network, procurement and API observations.","M":"Enterprise-wide.","N":"3"},"originalFormulas":{}},{"id":"ROW-9a3fb24f1ae7d8b47e64d741","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":70,"originalCells":{"A":"OP-10","B":"Operations","C":"Monitor vendor and model supply chain","D":"Track vendor/model changes, subprocessors, incidents, terms, data use, performance and end-of-life; reassess affected rules.","E":"Monitor / gate","F":"E1/E3","G":"Vendor management + runtime","H":"Roadmap","I":"Vendor evidence + change event","J":"High","K":"Vendor and AI Procurement","L":"Simulate model version, term and subprocessor change.","M":"Third-party AI.","N":"3"},"originalFormulas":{}},{"id":"ROW-0286ad5f4fefc00dbe6a41e0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":71,"originalCells":{"A":"OP-11","B":"Operations","C":"Decommission safely and delete data","D":"Revoke access, export required records, delete prompts/files/embeddings/memory, terminate connectors and document residual risk.","E":"Automate / verify","F":"E4","G":"Admin + data lifecycle","H":"Roadmap","I":"Deletion certificate + access revocation","J":"High","K":"AI Decommissioning and Data Lifecycle","L":"Test deletion across primary, cache, backup and vendor scopes.","M":"Retired systems and use cases.","N":"3"},"originalFormulas":{}},{"id":"ROW-8b735011c40a3883395d7b14","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"05 Canonical Rules","row":72,"originalCells":{"A":"OP-12","B":"Operations","C":"Require predeployment evaluation and red team","D":"Do not release until required privacy, security, fairness, robustness, factuality, abuse and human-factors tests meet documented go/no-go thresholds.","E":"Hold release","F":"E3","G":"CI/CD + governance workflow","H":"Roadmap","I":"Test report + release decision","J":"Critical","K":"Evaluation, Red Team and Benchmarking","L":"Use versioned representative datasets; independently review high-impact systems.","M":"All production AI; depth based on risk.","N":"3"},"originalFormulas":{}},{"id":"ROW-0436fe940afc1f3caff587d4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":5,"originalCells":{"A":"2","B":"GOVERN","C":"GOVERN 1","D":"GOVERN 1.1","E":"Legal and regulatory requirements involving AI are understood, managed, and documented.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"15","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-9f73993da6b03a23b7d79194","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":6,"originalCells":{"A":"3","B":"GOVERN","C":"GOVERN 1","D":"GOVERN 1.2","E":"The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"No direct runtime rule; retain as program control","K":"Approved document or workflow record","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-5eb3955963184e8440a784c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":7,"originalCells":{"A":"4","B":"GOVERN","C":"GOVERN 1","D":"GOVERN 1.3","E":"Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization’s risk tolerance.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"AU-04; OP-07","K":"Approved document or workflow record","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-dc7d966c3c4146ef15596712","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":8,"originalCells":{"A":"5","B":"GOVERN","C":"GOVERN 1","D":"GOVERN 1.4","E":"The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OU-12; OP-02; AU-04; OP-07","K":"Approved document or workflow record","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-ea24af928d62bd87fd41520a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":9,"originalCells":{"A":"6","B":"GOVERN","C":"GOVERN 1","D":"GOVERN 1.5","E":"Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; AU-03","K":"Metric, alert and review evidence","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-5feb54759bd5017430fbf9d1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":10,"originalCells":{"A":"7","B":"GOVERN","C":"GOVERN 1","D":"GOVERN 1.6","E":"Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"OP-09; AU-04; OP-07","K":"Control-specific evidence","L":"16","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-b37bd5ac4beebdf5f507f46d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":11,"originalCells":{"A":"8","B":"GOVERN","C":"GOVERN 1","D":"GOVERN 1.7","E":"Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization’s trustworthiness.","F":"System Configuration / Workflow","G":"Corrective","H":"E4","I":"Roadmap","J":"OP-11; OP-05","K":"Shutdown, deletion and revocation evidence","L":"7","M":"ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Can be automated with admin-plane integration and an approved workflow."},"originalFormulas":{}},{"id":"ROW-0f962003a74b184e10086459","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":12,"originalCells":{"A":"9","B":"GOVERN","C":"GOVERN 2","D":"GOVERN 2.1","E":"Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"AU-03; OP-01; OP-02","K":"Approved document or workflow record","L":"8","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-940acef05c5ae58b41b4d7bb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":13,"originalCells":{"A":"10","B":"GOVERN","C":"GOVERN 2","D":"GOVERN 2.2","E":"The organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.","F":"Human Competency","G":"Directive","H":"E0","I":"Evidence only","J":"AU-03; Supporting policy POL-19","K":"Training completion + competency result","L":"15","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Human evidence; no runtime transaction to intercept."},"originalFormulas":{}},{"id":"ROW-d85079a2e23f7b879098b87b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":14,"originalCells":{"A":"11","B":"GOVERN","C":"GOVERN 2","D":"GOVERN 2.3","E":"Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"AU-03","K":"Approved document or workflow record","L":"15","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-e429c6ba34a217c4dc797ca5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":15,"originalCells":{"A":"12","B":"GOVERN","C":"GOVERN 3","D":"GOVERN 3.1","E":"Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds).","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"OP-06","K":"Control-specific evidence","L":"8","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-ca06a56725a9dbb4e85e92d3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":16,"originalCells":{"A":"13","B":"GOVERN","C":"GOVERN 3","D":"GOVERN 3.2","E":"Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"AU-03","K":"Approved document or workflow record","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-2bc6849411b4998161149591","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":17,"originalCells":{"A":"14","B":"GOVERN","C":"GOVERN 4","D":"GOVERN 4.1","E":"Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"No direct runtime rule; retain as program control","K":"Control-specific evidence","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-29810b95d42030e15e397513","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":18,"originalCells":{"A":"15","B":"GOVERN","C":"GOVERN 4","D":"GOVERN 4.2","E":"Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-8d0d0965a44f90ae3d3cc0f1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":19,"originalCells":{"A":"16","B":"GOVERN","C":"GOVERN 4","D":"GOVERN 4.3","E":"Organizational practices are in place to enable AI testing, identification of incidents, and information sharing.","F":"Continuous Detection / Monitoring","G":"Detective / Corrective","H":"E1–E4","I":"Partial","J":"OP-04; OP-05; OP-12; OP-03","K":"Incident + escalation + recovery evidence","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Current events help, but enterprise response and kill-switch workflows are missing."},"originalFormulas":{}},{"id":"ROW-b60b338d8fff0d68d9595662","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":20,"originalCells":{"A":"17","B":"GOVERN","C":"GOVERN 5","D":"GOVERN 5.1","E":"Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"OP-08","K":"Control-specific evidence","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-500750772273410954396052","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":21,"originalCells":{"A":"18","B":"GOVERN","C":"GOVERN 5","D":"GOVERN 5.2","E":"Mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"OP-08","K":"Control-specific evidence","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-f2810d3df144aca110dc06bf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":22,"originalCells":{"A":"19","B":"GOVERN","C":"GOVERN 6","D":"GOVERN 6.1","E":"Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights.","F":"Third-Party / Contractual","G":"Preventive / Detective","H":"E1–E3","I":"Roadmap","J":"OP-10; AG-10","K":"Due diligence + contract + monitoring","L":"16","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Requires vendor and supply-chain integration beyond prompt inspection."},"originalFormulas":{}},{"id":"ROW-91cd0e78dca275cb050bc3e4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":23,"originalCells":{"A":"20","B":"GOVERN","C":"GOVERN 6","D":"GOVERN 6.2","E":"Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk.","F":"Third-Party / Contractual","G":"Preventive / Detective","H":"E1–E3","I":"Roadmap","J":"OP-04; OP-05; OP-10; AG-10","K":"Due diligence + contract + monitoring","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Requires vendor and supply-chain integration beyond prompt inspection."},"originalFormulas":{}},{"id":"ROW-ca6d60a53efb1424563b6a40","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":24,"originalCells":{"A":"21","B":"MAP","C":"MAP 1","D":"MAP 1.1","E":"Intended purposes, potentially beneficial uses, context specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented.\n\nConsiderations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related Test & Evaluation, Validation & Verification (TEVV) and system metrics.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; OP-12; OP-06; OP-01; OP-02","K":"Metric, alert and review evidence","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-3e236e8e79989911c2fd421c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":25,"originalCells":{"A":"22","B":"MAP","C":"MAP 1","D":"MAP 1.2","E":"Interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. Opportunities for interdisciplinary collaboration are prioritized.","F":"Human Competency","G":"Directive","H":"E0","I":"Evidence only","J":"Supporting policy POL-19; OP-01; OP-02","K":"Training completion + competency result","L":"14","M":"ISO 24028; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Human evidence; no runtime transaction to intercept."},"originalFormulas":{}},{"id":"ROW-2642411dbdc41cc222fca79c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":26,"originalCells":{"A":"23","B":"MAP","C":"MAP 1","D":"MAP 1.3","E":"The organization’s mission and relevant goals for AI technology are understood and documented.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"7","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-728f022e48f96ce22c44c008","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":27,"originalCells":{"A":"24","B":"MAP","C":"MAP 1","D":"MAP 1.4","E":"The business value or context of business use has been clearly defined or – in the case of assessing existing AI systems – re-evaluated.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03","K":"Versioned evaluation plan, dataset and results","L":"8","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-228008b865cc93f7efc74508","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":28,"originalCells":{"A":"25","B":"MAP","C":"MAP 1","D":"MAP 1.5","E":"Organizational risk tolerances are determined and documented.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"AU-04; OP-07; OP-01; OP-02","K":"Approved document or workflow record","L":"14","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-5bdf52fb7f0644485ccbf76e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":29,"originalCells":{"A":"26","B":"MAP","C":"MAP 1","D":"MAP 1.6","E":"System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. \n\nDesign decisions take socio-technical implications into account to address AI risks.","F":"Transaction Prevention / Monitoring","G":"Preventive / Detective","H":"E1–E3","I":"Partial","J":"DP-07–DP-18; OU-01","K":"Decision logs + configuration + efficacy tests","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; OWASP (source says 2025)","N":"A subset can become content rules; broad control effectiveness still needs evidence and integration."},"originalFormulas":{}},{"id":"ROW-b687ed4ac9e7e0f057c79e9a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":30,"originalCells":{"A":"27","B":"MAP","C":"MAP 2","D":"MAP 2.1","E":"The specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders).","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"No direct runtime rule; retain as program control","K":"Control-specific evidence","L":"8","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-3457b56c6f9c22d6c58a0baf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":31,"originalCells":{"A":"28","B":"MAP","C":"MAP 2","D":"MAP 2.2","E":"Information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans is documented. \n\nDocumentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"8","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-8d1f0528e35d17f32d1081b0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":32,"originalCells":{"A":"29","B":"MAP","C":"MAP 2","D":"MAP 2.3","E":"Scientific integrity and Test & Evaluation, Validation & Verification (TEVV) considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"8","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-7abdda5765327e2160582453","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":33,"originalCells":{"A":"30","B":"MAP","C":"MAP 3","D":"MAP 3.1","E":"Potential benefits of intended AI system functionality and performance are examined and documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"6","M":"ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-60e3318a68cac27c12559032","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":34,"originalCells":{"A":"31","B":"MAP","C":"MAP 3","D":"MAP 3.2","E":"Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness – as connected to organizational risk tolerance\n– are examined and documented.","F":"Continuous Detection / Monitoring","G":"Detective / Corrective","H":"E1–E4","I":"Partial","J":"OP-04; OP-05; AU-04; OP-07; OP-01","K":"Incident + escalation + recovery evidence","L":"9","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Current events help, but enterprise response and kill-switch workflows are missing."},"originalFormulas":{}},{"id":"ROW-99eb80abcd3c1d44a589d360","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":35,"originalCells":{"A":"32","B":"MAP","C":"MAP 3","D":"MAP 3.3","E":"Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"9","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-97d81ae3de38e0218032e5e3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":36,"originalCells":{"A":"33","B":"MAP","C":"MAP 3","D":"MAP 3.4","E":"Processes for operator and practitioner proficiency with AI system performance and trustworthiness – and relevant technical standards and certifications – are defined, assessed, and documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"7","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-76805fc34d55894ec497dd54","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":37,"originalCells":{"A":"34","B":"MAP","C":"MAP 3","D":"MAP 3.5","E":"Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.","F":"Workflow / Process","G":"Preventive / Corrective","H":"E2","I":"Roadmap","J":"OU-04; AU-04; OP-01; OP-02","K":"Assessment, approval, appeal or override record","L":"8","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Requires a workflow engine and accountable human decision."},"originalFormulas":{}},{"id":"ROW-89cd18091d66246918ad37a6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":38,"originalCells":{"A":"35","B":"MAP","C":"MAP 4","D":"MAP 4.1","E":"Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.","F":"Third-Party / Contractual","G":"Preventive / Detective","H":"E1–E3","I":"Roadmap","J":"OP-10; AG-10; OP-01; OP-02","K":"Due diligence + contract + monitoring","L":"16","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Requires vendor and supply-chain integration beyond prompt inspection."},"originalFormulas":{}},{"id":"ROW-8d92ce095c217473492c4e22","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":39,"originalCells":{"A":"36","B":"MAP","C":"MAP 4","D":"MAP 4.2","E":"Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented.","F":"Third-Party / Contractual","G":"Preventive / Detective","H":"E1–E3","I":"Roadmap","J":"OP-10; AG-10; OP-01; OP-02","K":"Due diligence + contract + monitoring","L":"15","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; OWASP (source says 2025)","N":"Requires vendor and supply-chain integration beyond prompt inspection."},"originalFormulas":{}},{"id":"ROW-f4c59e325c73d53d771eb0d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":40,"originalCells":{"A":"37","B":"MAP","C":"MAP 5","D":"MAP 5.1","E":"Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.","F":"Continuous Detection / Monitoring","G":"Detective / Corrective","H":"E1–E4","I":"Partial","J":"OP-04; OP-05; OP-08; OP-01; OP-02","K":"Incident + escalation + recovery evidence","L":"16","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Current events help, but enterprise response and kill-switch workflows are missing."},"originalFormulas":{}},{"id":"ROW-b629a2051b5c632ad1bb94f3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":41,"originalCells":{"A":"38","B":"MAP","C":"MAP 5","D":"MAP 5.2","E":"Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-08; OP-01; OP-02","K":"Approved document or workflow record","L":"16","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-be066ff450282829b661b44e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":42,"originalCells":{"A":"39","B":"MEASURE","C":"MEASURE 1","D":"MEASURE 1.1","E":"Approaches and metrics for measurement of AI risks enumerated during the MAP function are selected for implementation starting with the most significant AI risks. \n\nThe risks or trustworthiness characteristics that will not – or cannot – be measured are properly documented.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; OP-01; OP-02","K":"Metric, alert and review evidence","L":"16","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-e9675d2ee0cb25ece3b514e4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":43,"originalCells":{"A":"40","B":"MEASURE","C":"MEASURE 1","D":"MEASURE 1.2","E":"Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities.","F":"Continuous Detection / Monitoring","G":"Detective / Corrective","H":"E1–E4","I":"Partial","J":"OP-04; OP-05; OP-03; OP-06","K":"Incident + escalation + recovery evidence","L":"15","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; OWASP (source says 2025)","N":"Current events help, but enterprise response and kill-switch workflows are missing."},"originalFormulas":{}},{"id":"ROW-9699ec5de84fe84fb76cb9ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":44,"originalCells":{"A":"41","B":"MEASURE","C":"MEASURE 1","D":"MEASURE 1.3","E":"Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. \n\nDomain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"AU-04; OP-07; OP-06","K":"Control-specific evidence","L":"15","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-bbec2b17d56289a7f5c25b53","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":45,"originalCells":{"A":"42","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.1","E":"Test sets, metrics, and details about the tools used during Test & Evaluation, Validation & Verification (TEVV) are documented.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; OP-12; OP-01; OP-02","K":"Metric, alert and review evidence","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-f2f376a1c6d3742ab5caaf24","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":46,"originalCells":{"A":"43","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.2","E":"Evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03","K":"Versioned evaluation plan, dataset and results","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-cacf9d8dedfae0415462a084","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":47,"originalCells":{"A":"44","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.3","E":"AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). \n\nMeasures are documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"14","M":"ISO 24028; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-5061fcbdbff52f60847681b9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":48,"originalCells":{"A":"45","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.4","E":"The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03","K":"Metric, alert and review evidence","L":"16","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-310c8c5db55e1862198e9662","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":49,"originalCells":{"A":"46","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.5","E":"The AI system to be deployed is demonstrated to be valid and reliable. \n\nLimitations of the generalizability beyond the conditions under which the technology was developed are documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"15","M":"ISO 24028; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-958bacc56d9f333cc38d965e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":50,"originalCells":{"A":"47","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.6","E":"The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; IN-01–IN-06; OP-12; AU-04; OP-07","K":"Metric, alert and review evidence","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-4b791ac97fd57b8f09ff28ae","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":51,"originalCells":{"A":"48","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.7","E":"AI system security and resilience – as identified in the MAP function – are evaluated and documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"IN-01–IN-06; OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-1f2732a147132cb5e67eddd5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":52,"originalCells":{"A":"49","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.8","E":"Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OU-04; AU-04; OP-01; OP-02","K":"Approved document or workflow record","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-e9009361c6e3c47a613fff2d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":53,"originalCells":{"A":"50","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.9","E":"The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OU-12; OP-02; OP-12; OP-03; OP-01","K":"Versioned evaluation plan, dataset and results","L":"16","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-439c4005cd304715243aab49","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":54,"originalCells":{"A":"51","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.10","E":"Privacy risk of the AI system – as identified in the MAP function – is examined and documented.","F":"Transaction Prevention / Monitoring","G":"Preventive / Detective","H":"E1–E3","I":"Partial","J":"DP-07–DP-18; OU-01; OP-01; OP-02","K":"Decision logs + configuration + efficacy tests","L":"17","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"A subset can become content rules; broad control effectiveness still needs evidence and integration."},"originalFormulas":{}},{"id":"ROW-a28b0288d9744e7ead699a22","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":55,"originalCells":{"A":"52","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.11","E":"Fairness and bias – as identified in the MAP function – are evaluated and results are documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OU-05; OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-d9cdbbf9522be0ec6296a202","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":56,"originalCells":{"A":"53","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.12","E":"Environmental impact and sustainability of AI model training and management activities – as identified in the MAP function – are assessed and documented.","F":"Human Competency","G":"Directive","H":"E0","I":"Evidence only","J":"Supporting policy POL-19; OP-01; OP-02","K":"Training completion + competency result","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Human evidence; no runtime transaction to intercept."},"originalFormulas":{}},{"id":"ROW-610433a8b0c33456d6be5839","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":57,"originalCells":{"A":"54","B":"MEASURE","C":"MEASURE 2","D":"MEASURE 2.13","E":"Effectiveness of the employed Test & Evaluation, Validation & Verification (TEVV) metrics and processes in the MEASURE function are evaluated and documented.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; OP-12; OP-01; OP-02","K":"Metric, alert and review evidence","L":"16","M":"ISO 24028; ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-8a6c73181832884f50e05fb6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":58,"originalCells":{"A":"55","B":"MEASURE","C":"MEASURE 3","D":"MEASURE 3.1","E":"Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"16","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-cd6f275cf3add1eca391fc9f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":59,"originalCells":{"A":"56","B":"MEASURE","C":"MEASURE 3","D":"MEASURE 3.2","E":"Risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03","K":"Metric, alert and review evidence","L":"14","M":"ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-305b90ddf698d05e612090ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":60,"originalCells":{"A":"57","B":"MEASURE","C":"MEASURE 3","D":"MEASURE 3.3","E":"Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; OP-08; OP-12","K":"Metric, alert and review evidence","L":"16","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-897ea52a20ce5cc7040a9541","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":61,"originalCells":{"A":"58","B":"MEASURE","C":"MEASURE 4","D":"MEASURE 4.1","E":"Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"16","M":"ISO 24028; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-58449d955527149a0f179ec0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":62,"originalCells":{"A":"59","B":"MEASURE","C":"MEASURE 4","D":"MEASURE 4.2","E":"Measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. \n\nResults are documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-06; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"16","M":"ISO 24028; ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-7ef5787cde66b74accddd8ee","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":63,"originalCells":{"A":"60","B":"MEASURE","C":"MEASURE 4","D":"MEASURE 4.3","E":"Measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context relevant risks and trustworthiness characteristics are identified and documented.","F":"Assurance / Testing","G":"Detective","H":"E0–E1","I":"Roadmap","J":"OP-12; OP-03; OP-01; OP-02","K":"Versioned evaluation plan, dataset and results","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Needs representative tests and acceptance thresholds rather than a simple content rule."},"originalFormulas":{}},{"id":"ROW-a0ededd04da90b3308ea08a2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":64,"originalCells":{"A":"61","B":"MANAGE","C":"MANAGE 1","D":"MANAGE 1.1","E":"A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"No direct runtime rule; retain as program control","K":"Control-specific evidence","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-e87514e04a71bd3f97ac3669","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":65,"originalCells":{"A":"62","B":"MANAGE","C":"MANAGE 1","D":"MANAGE 1.2","E":"Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"15","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-5995a1802cb23a347425edfa","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":66,"originalCells":{"A":"63","B":"MANAGE","C":"MANAGE 1","D":"MANAGE 1.3","E":"Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. \n\nRisk response options can include mitigating, transferring, avoiding, or accepting.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-8df57b7038b2a41a57860b74","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":67,"originalCells":{"A":"64","B":"MANAGE","C":"MANAGE 1","D":"MANAGE 1.4","E":"Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented.","F":"Document / Policy or Workflow","G":"Directive","H":"E0–E2","I":"Evidence only","J":"OP-01; OP-02","K":"Approved document or workflow record","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Defines the control environment; does not itself prove technical enforcement."},"originalFormulas":{}},{"id":"ROW-a73cd2fac4b46ad456ff5692","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":68,"originalCells":{"A":"65","B":"MANAGE","C":"MANAGE 2","D":"MANAGE 2.1","E":"Resources required to manage AI risks are taken into account – along with viable non-AI alternative systems, approaches, or methods – to reduce the magnitude or likelihood of potential impacts.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"No direct runtime rule; retain as program control","K":"Control-specific evidence","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-aaf6c152c12d314855752277","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":69,"originalCells":{"A":"66","B":"MANAGE","C":"MANAGE 2","D":"MANAGE 2.2","E":"Mechanisms are in place and applied to sustain the value of deployed AI systems.","F":"Workflow / Process","G":"Directive / Preventive","H":"E0–E2","I":"Evidence only","J":"No direct runtime rule; retain as program control","K":"Control-specific evidence","L":"15","M":"ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Holistic TAIM control; determine implementation after use-case applicability assessment."},"originalFormulas":{}},{"id":"ROW-197aa13b5f5bdbea22bbf129","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":70,"originalCells":{"A":"67","B":"MANAGE","C":"MANAGE 2","D":"MANAGE 2.3","E":"Procedures are followed to respond to and recover from a previously unknown risk when it is identified.","F":"Continuous Detection / Monitoring","G":"Detective / Corrective","H":"E1–E4","I":"Partial","J":"OP-04; OP-05","K":"Incident + escalation + recovery evidence","L":"15","M":"ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Current events help, but enterprise response and kill-switch workflows are missing."},"originalFormulas":{}},{"id":"ROW-544e28a698bfcb54f1d58363","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":71,"originalCells":{"A":"68","B":"MANAGE","C":"MANAGE 2","D":"MANAGE 2.4","E":"Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.","F":"System Configuration / Workflow","G":"Corrective","H":"E4","I":"Roadmap","J":"OP-11; OP-05; OP-12; OP-03; AU-03","K":"Shutdown, deletion and revocation evidence","L":"15","M":"ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Can be automated with admin-plane integration and an approved workflow."},"originalFormulas":{}},{"id":"ROW-b412d5ef3e2994ceae39c8ee","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":72,"originalCells":{"A":"69","B":"MANAGE","C":"MANAGE 3","D":"MANAGE 3.1","E":"AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.","F":"Third-Party / Contractual","G":"Preventive / Detective","H":"E1–E3","I":"Roadmap","J":"OP-03; OP-10; AG-10; OP-01; OP-02","K":"Due diligence + contract + monitoring","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Requires vendor and supply-chain integration beyond prompt inspection."},"originalFormulas":{}},{"id":"ROW-0663263ddaf79118d84e7fe8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":73,"originalCells":{"A":"70","B":"MANAGE","C":"MANAGE 3","D":"MANAGE 3.2","E":"Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance.","F":"Third-Party / Contractual","G":"Preventive / Detective","H":"E1–E3","I":"Roadmap","J":"OP-03; OP-10; AG-10","K":"Due diligence + contract + monitoring","L":"15","M":"ISO 23053; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Requires vendor and supply-chain integration beyond prompt inspection."},"originalFormulas":{}},{"id":"ROW-4e39214407569385f3678edd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":74,"originalCells":{"A":"71","B":"MANAGE","C":"MANAGE 4","D":"MANAGE 4.1","E":"Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.","F":"System Configuration / Workflow","G":"Corrective","H":"E4","I":"Roadmap","J":"OP-11; OP-05; OP-04; OP-03; OP-08","K":"Shutdown, deletion and revocation evidence","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Can be automated with admin-plane integration and an approved workflow."},"originalFormulas":{}},{"id":"ROW-3fa4568ddb90364310f79558","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":75,"originalCells":{"A":"72","B":"MANAGE","C":"MANAGE 4","D":"MANAGE 4.2","E":"Measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors.","F":"Continuous Detection / Monitoring","G":"Detective","H":"E1","I":"Partial","J":"OP-03; OP-06","K":"Metric, alert and review evidence","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Some activity metrics exist; efficacy, drift and threshold evidence remain roadmap."},"originalFormulas":{}},{"id":"ROW-dd6c7a2621768727bb6aed5f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"07 TAIM Control Map","row":76,"originalCells":{"A":"73","B":"MANAGE","C":"MANAGE 4","D":"MANAGE 4.3","E":"Incidents and errors are communicated to relevant AI actors, including affected communities. \n\nProcesses for tracking, responding to, and recovering from incidents and errors are followed and documented.","F":"Continuous Detection / Monitoring","G":"Detective / Corrective","H":"E1–E4","I":"Partial","J":"OP-04; OP-05; OP-01; OP-02","K":"Incident + escalation + recovery evidence","L":"16","M":"ISO 23053; ISO 23894; ISO 5338; ISO 38507; ISO 22989; NIST CSF 2.0; COBIT 5; HIPAA; PCI DSS; SOC 2; EU AI Act; GDPR; Legacy U.S. federal AI bundle; ISO 42001; U.S. state laws; OWASP (source says 2025)","N":"Current events help, but enterprise response and kill-switch workflows are missing."},"originalFormulas":{}},{"id":"ROW-9901ffd8b126f69ae63350de","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":5,"originalCells":{"A":"POL-01","B":"AI Governance and Accountability","C":"Required","D":"Board/executive accountability, roles, risk appetite, inventory, metrics and reporting","E":"OP-09; AU-04; OP-07","F":"Policy + charter + minutes","G":"Chief AI / Risk Officer"},"originalFormulas":{}},{"id":"ROW-9ad78af677a3b5d9759b887b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":6,"originalCells":{"A":"POL-02","B":"AI Acceptable Use","C":"Required","D":"Permitted/prohibited uses, user duties, escalation, sanctions and safe-use expectations","E":"IN-07; OU-06; OU-07","F":"Policy + attestation","G":"CISO / Legal / HR"},"originalFormulas":{}},{"id":"ROW-29a4b876563a7c5e5f61740b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":7,"originalCells":{"A":"POL-03","B":"Approved AI Tools and Shadow AI","C":"Required","D":"Sanctioned providers, personal-account restrictions, onboarding and discovery","E":"AU-01; AU-02; AU-08","F":"Policy + inventory + egress logs","G":"CISO / IT"},"originalFormulas":{}},{"id":"ROW-9bf2bc3adbab1e2dee12f515","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":8,"originalCells":{"A":"POL-04","B":"Data Classification for AI","C":"Required","D":"Which data classes may enter which AI systems under which conditions","E":"DP-01–DP-18; AU-05; AU-06","F":"Standard + decision matrix + DLP events","G":"Data Protection / Security"},"originalFormulas":{}},{"id":"ROW-6e8f3330f289fef5ba84007b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":9,"originalCells":{"A":"POL-05","B":"Prompt and Output Interaction","C":"Required","D":"Prompt hygiene, output review, citations, disclosure and publication rules","E":"OU-01–OU-12","F":"Policy + runtime events","G":"AI Product / Compliance"},"originalFormulas":{}},{"id":"ROW-4f74fcc4966dbbe7f66ef362","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":10,"originalCells":{"A":"POL-06","B":"Privacy and Personal Data","C":"Required where personal data exists","D":"Purpose, minimization, lawful basis, DPIA, rights, retention and sensitive data","E":"DP-05–DP-11; OU-11","F":"Privacy policy + DPIA + configuration","G":"DPO / Privacy"},"originalFormulas":{}},{"id":"ROW-06ea9c0f28a4eea7435052c8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":11,"originalCells":{"A":"POL-07","B":"AI Security and Prompt Injection","C":"Required","D":"Threat model, injection defenses, input trust, secrets and vulnerability handling","E":"IN-01–IN-05; DP-15","F":"Security standard + tests + events","G":"CISO / AppSec"},"originalFormulas":{}},{"id":"ROW-8461d2b174b2762e1f10a709","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":12,"originalCells":{"A":"POL-08","B":"High-Impact AI and Human Oversight","C":"Required for consequential use","D":"High-impact definition, required reviewers, fail-safe and prohibited autonomy","E":"OU-04; OU-05; AG-03; AG-04; OP-05","F":"Impact assessment + approval + logs","G":"Risk / Legal / Business owner"},"originalFormulas":{}},{"id":"ROW-a4fae60a4a57a31922c2a920","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":13,"originalCells":{"A":"POL-09","B":"AI Impact Assessment and Risk Acceptance","C":"Required","D":"Intake, impact assessment, control selection, risk acceptance and reassessment","E":"AU-04; OP-06; OP-07","F":"Assessment + approval","G":"Enterprise Risk"},"originalFormulas":{}},{"id":"ROW-7b50d19a31477ee41f8cb382","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":14,"originalCells":{"A":"POL-10","B":"Evaluation, Red Team and Benchmarking","C":"Required","D":"Test dimensions, datasets, thresholds, independence, cadence and release gates","E":"OP-03; OP-12","F":"Test evidence","G":"AI Assurance / Model Risk"},"originalFormulas":{}},{"id":"ROW-88027e060a43088933d7dcb2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":15,"originalCells":{"A":"POL-11","B":"AI Monitoring and Logging","C":"Required","D":"Events, content minimization, metrics, alerting, access, integrity and retention","E":"OP-01–OP-03","F":"Logs + monitoring evidence","G":"Security Operations / Platform"},"originalFormulas":{}},{"id":"ROW-e26a3fd76ddae25c27ca89e9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":16,"originalCells":{"A":"POL-12","B":"AI Incident Response and Kill Switch","C":"Required","D":"AI incident taxonomy, escalation, containment, reporting, kill switch and recovery","E":"OP-04; OP-05","F":"Plan + drill + incident evidence","G":"CISO / Incident Response"},"originalFormulas":{}},{"id":"ROW-32190cdcaac6e3c194494884","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":17,"originalCells":{"A":"POL-13","B":"Vendor and AI Procurement","C":"Required for third parties","D":"Due diligence, DPA/BAA, training use, subprocessors, SLAs, audit, exit and change notice","E":"AU-05; AU-06; OP-10","F":"Contract + assessment","G":"Procurement / Legal / Security"},"originalFormulas":{}},{"id":"ROW-d2d29450870cc664076fa776","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":18,"originalCells":{"A":"POL-14","B":"Agentic AI and Connectors","C":"Required where tools/actions exist","D":"Tool allowlists, least privilege, approvals, limits, memory and transaction controls","E":"AG-01–AG-09; IN-08","F":"Policy + tool logs + approvals","G":"AI Platform / Security"},"originalFormulas":{}},{"id":"ROW-696891ccaa6f91b05ddfeccf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":19,"originalCells":{"A":"POL-15","B":"AI Secure Development Lifecycle","C":"Required for built AI","D":"Threat modeling, design review, output handling, change, release and rollback","E":"OU-08; OU-09; OP-06; OP-12","F":"SDLC records + tests","G":"Engineering / AppSec"},"originalFormulas":{}},{"id":"ROW-e6709fcf212e2ab6475067c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":20,"originalCells":{"A":"POL-16","B":"Bias, Fairness and Civil Rights","C":"Required for people-impacting AI","D":"Protected groups, evaluation, accommodations, monitoring and remediation","E":"OU-05","F":"Fairness assessment + monitoring","G":"Legal / Model Risk"},"originalFormulas":{}},{"id":"ROW-9510c4e7c88ba4e81c0e5afe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":21,"originalCells":{"A":"POL-17","B":"Transparency, Disclosure and Provenance","C":"Required for user-facing AI","D":"Notices, explainability, citations, synthetic-content labels and provenance","E":"OU-03; OU-12; OP-02","F":"Notices + provenance logs","G":"Product / Legal"},"originalFormulas":{}},{"id":"ROW-b736746ce58ff7dff8147ef4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":22,"originalCells":{"A":"POL-18","B":"IP, Copyright and Confidentiality","C":"Required","D":"Trade secrets, customer data, privilege, copyright, license and publication review","E":"DP-14; DP-16–DP-18; OU-10","F":"Policy + review records","G":"Legal / Information Governance"},"originalFormulas":{}},{"id":"ROW-03d32467ac99155fdf032dcc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":23,"originalCells":{"A":"POL-19","B":"AI Training, Literacy and Competency","C":"Required","D":"Role-based literacy, operator competency, developer safety and executive duties","E":"Supports all rules","F":"Completion + assessment","G":"HR / Compliance"},"originalFormulas":{}},{"id":"ROW-ea4881077d96488697007098","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":24,"originalCells":{"A":"POL-20","B":"Exceptions, Appeals and Risk Acceptance","C":"Required","D":"User appeal, operator override, risk acceptance, compensating controls and expiry","E":"OP-07; OP-08","F":"Workflow records","G":"Risk / Legal"},"originalFormulas":{}},{"id":"ROW-bc50ae9819bd430da4ac55e5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":25,"originalCells":{"A":"POL-21","B":"AI Decommissioning and Data Lifecycle","C":"Required","D":"Retention, deletion, memory/vector cleanup, access revocation, records and exit","E":"OP-11","F":"Deletion and revocation evidence","G":"Data Governance / IT"},"originalFormulas":{}},{"id":"ROW-40ebb345161d52b7ba4b367a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":26,"originalCells":{"A":"POL-22","B":"Data, Model and RAG Supply Chain","C":"Required for RAG/training/custom models","D":"Provenance, authorization, poisoning defense, embedding isolation, dataset/model versioning","E":"IN-06; AG-08; AG-10","F":"Provenance + test + SBOM evidence","G":"Data / ML Platform / Security"},"originalFormulas":{}},{"id":"ROW-cb4466fb39da00773f5837d1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":27,"originalCells":{"A":"POL-23","B":"AI Records, Retention and Legal Hold","C":"Context-required when triggered","D":"Records, investigations, public administration, regulated decisions, or material business evidence","E":"OP-01; OP-02; OP-09; OP-11; DP-18; OP-13","F":"Schedule + retention configuration + hold record + deletion certificate","G":"Records / Legal / Data Governance"},"originalFormulas":{}},{"id":"ROW-1718f0c9978bf5fc219dc0c7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":28,"originalCells":{"A":"POL-24","B":"AI Accessibility and Inclusive Design","C":"Context-required when triggered","D":"Federal or public-sector ICT, public-facing AI, or people-impacting use","E":"OU-04; OU-05; OU-12; OP-12; OU-13","F":"Accessibility requirements + ACR/VPAT + test results + exception record","G":"Accessibility / Product / Procurement"},"originalFormulas":{}},{"id":"ROW-0aeece3e966f9aa9680570c7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":29,"originalCells":{"A":"POL-25","B":"Automated Employment and Workforce Decisions","C":"Context-required when triggered","D":"AI influences recruitment, hiring, promotion, monitoring, scheduling, pay or termination","E":"OU-04; OU-05; OU-12; OP-02; OP-03; OP-08; OP-12; OP-14; OU-14; OP-18","F":"Use inventory + notice/consent + bias audit + publication + decision logs","G":"HR / Employment Legal / Model Risk"},"originalFormulas":{}},{"id":"ROW-41848ba037cecf3e8d074e48","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":30,"originalCells":{"A":"POL-26","B":"Consumer Credit and Adverse Action","C":"Context-required when triggered","D":"AI makes or supports credit, pricing, limit, servicing or collection decisions","E":"OU-03; OU-04; OU-05; OP-02; OP-03; OP-08; OP-12; OU-14; OP-17","F":"Model documentation + validation + decision factors + notices + complaints","G":"Fair Lending / Compliance / Model Risk"},"originalFormulas":{}},{"id":"ROW-3719da1cc331838f2d2a68af","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":31,"originalCells":{"A":"POL-27","B":"Clinical AI and Patient Safety","C":"Context-required when triggered","D":"AI supports diagnosis, treatment, triage, clinical workflow, medical devices or patient communication","E":"DP-07; OU-03; OU-04; OU-05; OP-03; OP-05; OP-06; OP-12; OP-15","F":"Intended-use statement + validation + reviewer logs + monitoring + safety events","G":"Clinical Safety / Quality / Privacy"},"originalFormulas":{}},{"id":"ROW-45aa92b9107cc8cbe91ca0f3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":32,"originalCells":{"A":"POL-28","B":"Child and Youth AI Safety","C":"Context-required when triggered","D":"Children or students interact with AI or their data is processed","E":"DP-08; DP-09; DP-10; DP-11; OU-06; OU-07; OU-12; OP-08; DP-19; OU-15","F":"Age assessment + consent + data map + safety tests + deletion evidence","G":"Privacy / Trust & Safety / Education Legal"},"originalFormulas":{}},{"id":"ROW-28b0a5c33e58b821b626ba3f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":33,"originalCells":{"A":"POL-29","B":"Public-Sector Due Process and Citizen Services","C":"Context-required when triggered","D":"AI affects benefits, licensing, enforcement, investigations, justice or other government decisions","E":"OU-04; OU-05; OU-12; AG-03; AG-04; OP-02; OP-08; OP-09; OP-16; AG-11; OP-18","F":"Impact assessment + notice + decision record + approvals + appeal outcomes","G":"Program Integrity / Civil Rights / General Counsel"},"originalFormulas":{}},{"id":"ROW-6a4a9297afc1dff568ae4ffe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":34,"originalCells":{"A":"POL-30","B":"Specially Regulated Data Handling Addendum","C":"Context-required when triggered","D":"CUI, classified, criminal justice, federal tax, SUD or export-controlled data enters the AI environment","E":"DP-07; DP-12; DP-13; AU-03; AU-05; OP-01; OP-09; OP-11; AU-09","F":"Handling matrix + labels + boundary config + access logs + inspections","G":"Security / Privacy / Records / Program Owner"},"originalFormulas":{}},{"id":"ROW-ded5b9688f80dee7b6ae0dc6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":35,"originalCells":{"A":"POL-31","B":"AI Model Risk Management and Independent Validation","C":"Context-required when triggered","D":"Models materially influence financial, insurance, safety or high-impact decisions","E":"OU-03; OU-05; OP-03; OP-06; OP-12; OP-17","F":"Tiering + model inventory + validation + findings + approvals","G":"Model Risk / Internal Audit / Business Owner"},"originalFormulas":{}},{"id":"ROW-2d79421af7c52328a7ca4a2b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":36,"originalCells":{"A":"POL-32","B":"Cross-Border AI Data and Sovereignty","C":"Context-required when triggered","D":"AI providers, support, training, administrators or data stores cross national boundaries","E":"AU-05; AU-06; DP-09; DP-10; DP-11; OP-10; AU-10","F":"Data map + transfer assessment + screening + contracts + audit records","G":"Privacy / Export / Security / Procurement"},"originalFormulas":{}},{"id":"ROW-26f367f6054ab2f27911fdd6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":37,"originalCells":{"A":"POL-33","B":"Automated Decision Transparency and Registry","C":"Context-required when triggered","D":"High-impact, public-facing, regulated or externally consequential AI","E":"OU-12; OP-02; OP-09; OP-18","F":"Registry + disclosures + approval + discovery/reconciliation logs","G":"AI Governance / Legal / Product"},"originalFormulas":{}},{"id":"ROW-507b6a8b1ea536981893e60a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"08 Internal Policies","row":38,"originalCells":{"A":"POL-34","B":"AI Research, Human Subjects and Scientific Integrity","C":"Context-required when triggered","D":"AI research uses identifiable human data, interacts with participants, or informs regulated research","E":"DP-07; DP-09; OU-03; OP-12; OP-19","F":"Protocol + ethics approval + consent + data authorization + reproducibility record","G":"Research Integrity / IRB / Privacy"},"originalFormulas":{}},{"id":"ROW-146862f47812b9ae26370fd0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":5,"originalCells":{"A":"CUS-01","B":"Block named individuals’ or VIP data","C":"Organization-specific identifier lists","D":"DP-05; DP-09","E":"Regex/keyword/entity","F":"Block","G":"Privacy owner","H":"Needs strict access and false-positive testing"},"originalFormulas":{}},{"id":"ROW-5bcf96047fa08ae2b6b65181","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":6,"originalCells":{"A":"CUS-02","B":"Block client and project codewords","C":"Client names, codenames, deal rooms and matter numbers","D":"DP-14; DP-16; DP-18","E":"Keyword/entity/classification","F":"Block or approve","G":"Business data owner","H":"Often not present in external frameworks"},"originalFormulas":{}},{"id":"ROW-e171c2189c16d39a96f2d435","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":7,"originalCells":{"A":"CUS-03","B":"Restrict specific email domains","C":"Personal, competitor, customer or external domains","D":"AU-01; AG-05","E":"Domain/context","F":"Block or warn","G":"IT / Security","H":"May combine with recipient approval"},"originalFormulas":{}},{"id":"ROW-d0055a995dd63ecb14457966","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":8,"originalCells":{"A":"CUS-04","B":"Restrict repositories and file paths","C":"Production repos, regulated shares, privileged folders","D":"DP-14; DP-16","E":"Path/repository metadata","F":"Block","G":"Engineering / Data owner","H":"Requires upload/source metadata"},"originalFormulas":{}},{"id":"ROW-4b46219e8a7fdf2cc64ead8d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":9,"originalCells":{"A":"CUS-05","B":"Approved model and version list","C":"Enterprise-approved model IDs and release channels","D":"AU-04","E":"Allowlist","F":"Block","G":"AI governance","H":"Reassess on model change"},"originalFormulas":{}},{"id":"ROW-f664083a9316edadae58f202","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":10,"originalCells":{"A":"CUS-06","B":"Approved geography and tenant","C":"Regions, tenant IDs, enterprise accounts and device posture","D":"AU-02; AU-05; AU-06","E":"Session/context","F":"Block","G":"Security / Privacy","H":"Needs identity and provider integration"},"originalFormulas":{}},{"id":"ROW-1e0906bdfeb07642f5a6383c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":11,"originalCells":{"A":"CUS-07","B":"Required disclaimer by workflow","C":"Legal, medical, financial, support or public-facing wording","D":"OU-04; OU-12","E":"Use-case response template","F":"Transform/hold","G":"Legal / Product","H":"Do not treat disclaimer as a substitute for oversight"},"originalFormulas":{}},{"id":"ROW-358af18f7ff4b1f1c7f15e49","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":12,"originalCells":{"A":"CUS-08","B":"Transaction amount limits","C":"Dollar, quantity, frequency and cumulative limits","D":"AG-07","E":"Numeric/context","F":"Block/approve","G":"Finance / Risk","H":"Include cumulative and split-transaction detection"},"originalFormulas":{}},{"id":"ROW-eed4acdd05169ae1cdae0fb0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":13,"originalCells":{"A":"CUS-09","B":"Approved external recipients","C":"Domains, people, distribution lists and channels","D":"AG-05","E":"Identity/recipient allowlist","F":"Approve/block","G":"Business owner","H":"Resolve recipient identity before send"},"originalFormulas":{}},{"id":"ROW-5a3968734969f3630d199818","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":14,"originalCells":{"A":"CUS-10","B":"Connector and tool allowlist","C":"Specific MCP servers, SaaS connectors, APIs and actions","D":"AG-01; AG-10","E":"Tool identity/version","F":"Block","G":"Platform security","H":"Pin publisher, schema and version"},"originalFormulas":{}},{"id":"ROW-7773147c27bee4f47c98927a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":15,"originalCells":{"A":"CUS-11","B":"Retention by use case","C":"Prompt, response, file, log, vector and memory retention","D":"AU-05; OP-11","E":"Use-case/configuration","F":"Configure/block","G":"Data governance","H":"Verify downstream copies and backups"},"originalFormulas":{}},{"id":"ROW-3b4da8214b1f36c3e923b379","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":16,"originalCells":{"A":"CUS-12","B":"Production credential boundary","C":"Known production hosts, tokens, vault paths and environments","D":"DP-01; DP-15","E":"Keyword/regex/context","F":"Block","G":"Engineering / Security","H":"Seed only synthetic examples in tests"},"originalFormulas":{}},{"id":"ROW-486bdf06094cab5c7d69c090","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":17,"originalCells":{"A":"CUS-13","B":"Oversize or unscannable attachment handling","C":"Encrypted, image-only, archive, binary and size thresholds","D":"IN-03; IN-05","E":"File metadata/scanner","F":"Block/quarantine","G":"Security","H":"Current build fails to enforce this"},"originalFormulas":{}},{"id":"ROW-287d7228f241422587f79a55","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":18,"originalCells":{"A":"CUS-14","B":"Business-specific prohibited advice","C":"Product suitability, underwriting, pricing, HR or safety boundaries","D":"IN-07; OU-04","E":"Semantic/use-case","F":"Hold/block","G":"Legal / Business owner","H":"Requires domain evaluation"},"originalFormulas":{}},{"id":"ROW-429d00686051b551dcfbf5a0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":19,"originalCells":{"A":"CUS-15","B":"Required human approval groups","C":"Named roles/groups for defined actions and risk tiers","D":"AG-03; AG-04; OP-08","E":"Workflow/identity","F":"Approve","G":"Risk / Business owner","H":"Must handle delegation and conflicts"},"originalFormulas":{}},{"id":"ROW-cc2b90de75c6c003dad3133a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":20,"originalCells":{"A":"CUS-16","B":"Data-loss canaries","C":"Unique synthetic markers in hidden context, RAG and tenant data","D":"OU-01; OU-02; AG-08","E":"Canary/token","F":"Block/alert","G":"Security / AI assurance","H":"Use to test leakage without real sensitive data"},"originalFormulas":{}},{"id":"ROW-d471d3023dda79c592f484ab","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":21,"originalCells":{"A":"CUS-17","B":"Brand and communications standard","C":"Tone, claims, regulated wording and approval thresholds","D":"OU-03; OU-12; AG-05","E":"Semantic/template","F":"Warn/hold","G":"Communications / Legal","H":"Separate brand preference from safety criticality"},"originalFormulas":{}},{"id":"ROW-444feafe1a5e5ebbe1b862a2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"09 Custom Rule Backlog","row":22,"originalCells":{"A":"CUS-18","B":"Change blackout and release windows","C":"Freeze dates, required approvers and emergency path","D":"OP-06; OP-12","E":"Workflow/time","F":"Hold","G":"Engineering / Change management","H":"Useful for high-impact production systems"},"originalFormulas":{}},{"id":"ROW-e89882f4eefed12da4a6a681","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":5,"originalCells":{"A":"GAP-01","B":"Coverage claim mismatch","C":"High","D":"User described ten AI systems; code contains nine adapters.","E":"Inventory and scope integrity","F":"Confirm the intended tenth system; drive UI count from adapter registry.","G":"OP-09","H":"Open"},"originalFormulas":{}},{"id":"ROW-79bf705493f1a4867cbe7d1f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":6,"originalCells":{"A":"GAP-02","B":"External response not intercepted","C":"Critical","D":"Third-party AI outputs are not scanned, redacted or held.","E":"Sensitive disclosure, misinformation, unsafe output","F":"Add response interception/gateway integration and OU rules.","G":"OU-01–OU-12","H":"Open"},"originalFormulas":{}},{"id":"ROW-83d8fb607f22481006351f8b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":7,"originalCells":{"A":"GAP-03","B":"Uploads are not stopped","C":"Critical","D":"Readable text files ≤1 MB are scanned/logged, but upload events are not prevented.","E":"Sensitive data and malicious document ingestion","F":"Block/quarantine before upload; cover binary, archive, OCR and oversize files.","G":"DP; IN-02; IN-03; IN-05","H":"Open"},"originalFormulas":{}},{"id":"ROW-6a33478c7459f33bbf72cf77","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":8,"originalCells":{"A":"GAP-04","B":"Fail-open enforcement","C":"Critical","D":"Engine errors, timeouts and selector misses allow the request to continue.","E":"Critical rule bypass","F":"Use severity-aware fail-closed behavior, health checks and user-visible safe fallback.","G":"OP-05; all Critical rules","H":"Open"},"originalFormulas":{}},{"id":"ROW-9dfadb8ba2471597b45b6e88","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":9,"originalCells":{"A":"GAP-05","B":"Limited detector set","C":"High","D":"Built-ins cover email, phone, credit card, SSN, IBAN, IP and secrets only.","E":"Uncovered regulated and enterprise data","F":"Add bank routing/account, PHI, biometrics, location, CUI, privilege, MNPI and organization entities.","G":"DP-01–DP-18","H":"Open"},"originalFormulas":{}},{"id":"ROW-ba9782a79b141b74dece3f09","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":10,"originalCells":{"A":"GAP-06","B":"No identity or device context","C":"Critical","D":"No SSO, MFA, role, group, tenant or managed-device assertion is used.","E":"Unauthorized AI use and data access","F":"Integrate IdP/device posture and enforce AU-02/AU-03/AU-06.","G":"AU-02; AU-03; AU-06","H":"Open"},"originalFormulas":{}},{"id":"ROW-26401adce5181a1a07a0d722","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":11,"originalCells":{"A":"GAP-07","B":"No exceptions lifecycle","C":"High","D":"No scoped approval, compensating control, expiry or auto-revocation model.","E":"Permanent bypasses and audit gaps","F":"Implement versioned exceptions with owner, scope and expiry.","G":"OP-07","H":"Open"},"originalFormulas":{}},{"id":"ROW-872a502497c8d2f6ff76c86b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":12,"originalCells":{"A":"GAP-08","B":"No unified evidence store","C":"High","D":"Runtime events exist, but evidence types, integrity, retention and framework claims are not modeled holistically.","E":"Weak auditability","F":"Create evidence objects linked to rule, control, system, period and assessor.","G":"OP-01; score model","H":"Open"},"originalFormulas":{}},{"id":"ROW-04a4c63c824966582beed548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":13,"originalCells":{"A":"GAP-09","B":"No agent-action enforcement","C":"Critical","D":"No tool-call, connector, transaction, recipient or destructive-action controls.","E":"Excessive agency and irreversible harm","F":"Add agent gateway and AG-01–AG-10.","G":"AG-01–AG-10","H":"Open"},"originalFormulas":{}},{"id":"ROW-c049d1f90cd63d56973d42f0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":14,"originalCells":{"A":"GAP-10","B":"No rule version/effective dates","C":"High","D":"Rules lack formal versions, applicability conditions, tests, approvals and effective dates.","E":"Uncontrolled policy changes","F":"Add rule lifecycle states, versioning, deployment and rollback.","G":"OP-06; OP-12","H":"Open"},"originalFormulas":{}},{"id":"ROW-973c5b6015e711024ce42074","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":15,"originalCells":{"A":"GAP-11","B":"No tenant or case isolation","C":"Critical","D":"No explicit tenant, customer, matter or RAG-context boundary.","E":"Cross-tenant leakage","F":"Enforce context isolation and canary tests.","G":"AG-08; OU-01","H":"Open"},"originalFormulas":{}},{"id":"ROW-1ec6547dac8ceabb2330aa59","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":16,"originalCells":{"A":"GAP-12","B":"No efficacy metrics","C":"Critical","D":"No precision, recall, bypass, drift or false-positive thresholds are evidenced.","E":"Controls may appear enabled but fail","F":"Build representative eval sets and release/monitoring thresholds.","G":"OP-03; OP-12","H":"Open"},"originalFormulas":{}},{"id":"ROW-69499a990ce891a907c15b02","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":17,"originalCells":{"A":"GAP-13","B":"No classification-label integration","C":"High","D":"Runtime decisions do not consume enterprise DLP labels, repositories, matters or data owners.","E":"Context-blind rules","F":"Integrate DLP/classification and organization entities.","G":"DP-07–DP-18","H":"Open"},"originalFormulas":{}},{"id":"ROW-6e526396730d34d704b91578","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":18,"originalCells":{"A":"GAP-14","B":"Adherence terminology overclaims","C":"High","D":"The UI divides enabled chat policies by total framework controls and calls it adherence.","E":"Misleading compliance claim","F":"Rename to ‘chat-control coverage’; never represent it as compliance or framework adherence.","G":"Scoring model","H":"Open"},"originalFormulas":{}},{"id":"ROW-45aed31520c3c771b367cd86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":19,"originalCells":{"A":"GAP-15","B":"Framework seed scope is narrow","C":"Medium","D":"Only ten U.S.-centric seed frameworks and 35 disabled starter policies are in code.","E":"Incomplete AI and international coverage","F":"Add NIST AI RMF/GAI, EU AI Act, GDPR, ISO, OWASP 2026 and current state/federal policy mappings.","G":"Framework catalog","H":"Open"},"originalFormulas":{}},{"id":"ROW-f09aed123818246514cd99f3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":20,"originalCells":{"A":"GAP-16","B":"Current-source drift","C":"High","D":"TAIM references OWASP 2025 and a White House EO category; EO 14110 was rescinded and OWASP 2026 is current.","E":"Stale obligations and guidance","F":"Version sources; mark superseded material; monitor authoritative updates.","G":"Framework catalog; Sources","H":"Open"},"originalFormulas":{}},{"id":"ROW-f5e9250ee5fb2d2496494829","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":21,"originalCells":{"A":"GAP-17","B":"Extracted rules can be semantically unsafe","C":"High","D":"Document extraction may convert broad nouns/directives into keyword or semantic rules without applicability context.","E":"Overblocking, underblocking, false compliance","F":"Require applicability, owner, decision table, test set and approval before activation.","G":"Rule lifecycle","H":"Open"},"originalFormulas":{}},{"id":"ROW-7760ac3c00f781c033953718","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"11 Implementation Gaps","row":22,"originalCells":{"A":"GAP-18","B":"Local logs and admin separation","C":"High","D":"Local-only storage can lack centralized integrity, retention, separation of duties and enterprise investigation access.","E":"Evidence loss or tampering","F":"Add signed export/central collection, RBAC and retention controls while preserving privacy.","G":"OP-01; OP-04","H":"Open"},"originalFormulas":{}},{"id":"ROW-e531517e75ff6c1ea9d2721f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":5,"originalCells":{"A":"nist-csf-2","B":"NIST CSF","C":"106","D":"subcategories","E":"Credentials & API keys","F":"Authentication secrets, API keys and tokens must never be shared in messages.","G":"pii_builtin","H":"secret","I":"block","J":"high","K":"PR.AA — Identity Management & Access Control","L":"DP-01 / DP-02","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-95bdf4ef8e71ed1f8da8bc9e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":6,"originalCells":{"A":"nist-csf-2","B":"NIST CSF","C":"106","D":"subcategories","E":"Internal IP addresses","F":"Do not disclose internal network addresses to outside parties.","G":"pii_builtin","H":"ip","I":"warn","J":"medium","K":"PR.IR — Technology Infrastructure Resilience","L":"DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-8d0849663cd435b444347c01","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":7,"originalCells":{"A":"nist-csf-2","B":"NIST CSF","C":"106","D":"subcategories","E":"Incident details stay internal","F":"Do not discuss active security incidents with anyone outside the response team.","G":"semantic","I":"warn","J":"high","K":"RS.CO — Incident Response Communication","L":"OP-04","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-4c7b126ab1150cbab527e52c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":8,"originalCells":{"A":"nist-csf-2","B":"NIST CSF","C":"106","D":"subcategories","E":"Vulnerability details","F":"Never share details of unpatched security vulnerabilities with anyone outside the company.","G":"semantic","I":"warn","J":"high","K":"ID.RA — Risk Assessment","L":"DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-89ee5d0d815e2c04f504daf4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":9,"originalCells":{"A":"nist-800-53","B":"NIST 800-53","C":"1189","D":"controls & enhancements (Rev 5)","E":"Authenticator content","F":"Passwords, keys and other authenticators must not be transmitted in plain text.","G":"pii_builtin","H":"secret","I":"block","J":"high","K":"IA-5 — Authenticator Management","L":"DP-01 / DP-02","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-54a0cda710cc0ac226446bb2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":10,"originalCells":{"A":"nist-800-53","B":"NIST 800-53","C":"1189","D":"controls & enhancements (Rev 5)","E":"PII in messages (SSN)","F":"Social Security numbers are personally identifiable information and must not be shared.","G":"pii_builtin","H":"ssn","I":"block","J":"high","K":"PT-2 / SI-19 — PII Processing & De-identification","L":"DP-05","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-3398f9b98a01b2c82243a490","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":11,"originalCells":{"A":"nist-800-53","B":"NIST 800-53","C":"1189","D":"controls & enhancements (Rev 5)","E":"System configuration details","F":"Do not reveal system configuration or architecture details to unauthorized parties.","G":"semantic","I":"warn","J":"medium","K":"CM-8 / SC-7 — System Inventory & Boundary Protection","L":"DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-c38cc466e1d28fe7580bc966","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":12,"originalCells":{"A":"nist-800-53","B":"NIST 800-53","C":"1189","D":"controls & enhancements (Rev 5)","E":"Controlled Unclassified Information","F":"Controlled Unclassified Information must not leave authorized channels.","G":"keyword","H":"CUI","I":"warn","J":"high","K":"AC-4 — Information Flow Enforcement","L":"DP-12","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-c064988b42aeccde475a2fbe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":13,"originalCells":{"A":"soc2","B":"SOC 2","C":"61","D":"Trust Services Criteria","E":"Customer data confidentiality","F":"Customer data must not be disclosed to unauthorized parties.","G":"semantic","I":"warn","J":"high","K":"CC6.1 / C1.1 — Logical Access & Confidentiality","L":"DP-16","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-d91e8e2c081aaaa400d5a26d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":14,"originalCells":{"A":"soc2","B":"SOC 2","C":"61","D":"Trust Services Criteria","E":"Production credentials","F":"Production credentials and access tokens must never be shared.","G":"pii_builtin","H":"secret","I":"block","J":"high","K":"CC6.1 — Logical & Physical Access Controls","L":"DP-01 / DP-02","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-09a9c737170c0eaf9734804f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":15,"originalCells":{"A":"soc2","B":"SOC 2","C":"61","D":"Trust Services Criteria","E":"Customer contact details","F":"Customer email addresses are confidential customer data.","G":"pii_builtin","H":"email","I":"warn","J":"medium","K":"C1.1 — Confidential Information Identification","L":"DP-09","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-79f5105a5614c9263ce987a0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":16,"originalCells":{"A":"soc2","B":"SOC 2","C":"61","D":"Trust Services Criteria","E":"Security findings stay internal","F":"Do not share audit findings or control gaps outside the engagement.","G":"semantic","I":"warn","J":"medium","K":"CC4.2 — Internal Control Evaluations","L":"DP-18 / DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-ec127003a0d28e1c2d007c85","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":17,"originalCells":{"A":"hipaa","B":"HIPAA","C":"54","D":"Security Rule standards & implementation specs","E":"SSNs in health records","F":"Social Security numbers are PHI identifiers and must not be disclosed.","G":"pii_builtin","H":"ssn","I":"block","J":"high","K":"45 CFR §164.514(b) — De-identification","L":"DP-05","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-8d4888969b27d0e629cf009c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":18,"originalCells":{"A":"hipaa","B":"HIPAA","C":"54","D":"Security Rule standards & implementation specs","E":"Patient contact information","F":"Patient phone numbers are PHI identifiers.","G":"pii_builtin","H":"phone","I":"warn","J":"high","K":"45 CFR §164.514(b)(2) — Identifiers","L":"DP-07","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-b8e1564c743132220f350fa0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":19,"originalCells":{"A":"hipaa","B":"HIPAA","C":"54","D":"Security Rule standards & implementation specs","E":"Patient email addresses","F":"Patient email addresses are PHI identifiers.","G":"pii_builtin","H":"email","I":"warn","J":"high","K":"45 CFR §164.514(b)(2) — Identifiers","L":"DP-07","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-b3df80072b3e1b6c3c76eb6b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":20,"originalCells":{"A":"hipaa","B":"HIPAA","C":"54","D":"Security Rule standards & implementation specs","E":"Protected health information","F":"Never reveal a patient\\u2019s diagnosis, illness, treatment plan or prescribed medication.","G":"semantic","I":"block","J":"high","K":"45 CFR §164.502 — Uses & Disclosures of PHI","L":"DP-07","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-0fc6e47ceb3fd0833dcd0f4b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":21,"originalCells":{"A":"pci-dss-4","B":"PCI DSS","C":"280","D":"testable requirements (v4.0 incl. appendices)","E":"Primary account numbers","F":"Payment card numbers (PAN) must never appear in messages or logs.","G":"pii_builtin","H":"credit_card","I":"block","J":"high","K":"Req. 3.4 — PAN Rendered Unreadable","L":"DP-03","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-d3b71ee6cccb14b8cab0c71b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":22,"originalCells":{"A":"pci-dss-4","B":"PCI DSS","C":"280","D":"testable requirements (v4.0 incl. appendices)","E":"Card verification codes","F":"CVV/CVC codes must never be stored or transmitted after authorization.","G":"keyword","H":"cvv, cvc, card verification","I":"block","J":"high","K":"Req. 3.3.1 — Sensitive Authentication Data","L":"DP-04","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-78719549d6f65a288a70090d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":23,"originalCells":{"A":"pci-dss-4","B":"PCI DSS","C":"280","D":"testable requirements (v4.0 incl. appendices)","E":"Cardholder data environment","F":"Never describe the cardholder data environment, its architecture or network layout to outside parties.","G":"semantic","I":"warn","J":"medium","K":"Req. 1.2 — Network Security Controls","L":"DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-8cefef221161f5459b7ccc99","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":24,"originalCells":{"A":"ccpa","B":"CCPA","C":"10","D":"core statutory obligations","E":"Consumer email addresses","F":"Consumer email addresses are personal information under the CCPA.","G":"pii_builtin","H":"email","I":"warn","J":"medium","K":"Cal. Civ. Code §1798.140(v) — Personal Information","L":"DP-09","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-ec3492acce5ebbcad4dfe3e4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":25,"originalCells":{"A":"ccpa","B":"CCPA","C":"10","D":"core statutory obligations","E":"Consumer phone numbers","F":"Consumer phone numbers are personal information under the CCPA.","G":"pii_builtin","H":"phone","I":"warn","J":"medium","K":"Cal. Civ. Code §1798.140(v) — Personal Information","L":"DP-09","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-f18954c14a4219e9ea924d9b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":26,"originalCells":{"A":"ccpa","B":"CCPA","C":"10","D":"core statutory obligations","E":"Selling personal information","F":"Do not share or sell consumer personal information without an opt-out path.","G":"semantic","I":"warn","J":"high","K":"Cal. Civ. Code §1798.120 — Right to Opt Out","L":"Review required","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-9b72c07bea974cf12dc2bd30","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":27,"originalCells":{"A":"ccpa","B":"CCPA","C":"10","D":"core statutory obligations","E":"SSNs of consumers","F":"Social Security numbers require heightened protection under the CPRA.","G":"pii_builtin","H":"ssn","I":"block","J":"high","K":"Cal. Civ. Code §1798.81.5 — Reasonable Security","L":"DP-05","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-00d87bbfab67a923114bb38e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":28,"originalCells":{"A":"glba","B":"GLBA","C":"9","D":"Safeguards Rule program elements","E":"Bank account numbers","F":"Customer account and routing numbers are nonpublic personal information.","G":"pii_builtin","H":"iban","I":"block","J":"high","K":"Safeguards Rule, 16 CFR 314.4","L":"DP-06","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-71e8ffd025b963adcc1c4b9f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":29,"originalCells":{"A":"glba","B":"GLBA","C":"9","D":"Safeguards Rule program elements","E":"Card numbers of customers","F":"Customer payment card numbers are nonpublic personal information.","G":"pii_builtin","H":"credit_card","I":"block","J":"high","K":"Safeguards Rule, 16 CFR 314.4","L":"DP-03","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-793bfcc68cb26b4abab508df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":30,"originalCells":{"A":"glba","B":"GLBA","C":"9","D":"Safeguards Rule program elements","E":"Customer financial information","F":"Do not disclose customer balances, transactions or credit information.","G":"semantic","I":"block","J":"high","K":"Privacy Rule, 16 CFR 313.10","L":"DP-06","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-66539e6f26ec87bbe11a9bc1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":31,"originalCells":{"A":"sox","B":"SOX","C":"17","D":"COSO 2013 internal-control principles","E":"Unreleased financial results","F":"Never share unreleased financial results, revenue numbers or earnings figures before they are announced.","G":"semantic","I":"block","J":"high","K":"§409 — Real-Time Issuer Disclosures / Reg FD","L":"DP-17","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-32df96ed3abceadd78b3abbf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":32,"originalCells":{"A":"sox","B":"SOX","C":"17","D":"COSO 2013 internal-control principles","E":"Material nonpublic information","F":"Never share material nonpublic information such as unannounced mergers, acquisitions or deals.","G":"semantic","I":"block","J":"high","K":"§302 — Corporate Responsibility for Reports","L":"DP-17","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-1e6816d1ec7869f6c78a5755","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":33,"originalCells":{"A":"sox","B":"SOX","C":"17","D":"COSO 2013 internal-control principles","E":"Audit workpapers","F":"Audit workpapers and drafts must not circulate outside the audit team.","G":"keyword","H":"audit workpaper, workpapers","I":"warn","J":"medium","K":"§802 — Records Retention","L":"DP-18 / DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-c596af87ddb04c45eff80f0c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":34,"originalCells":{"A":"fedramp","B":"FedRAMP","C":"323","D":"Moderate-baseline controls","E":"Federal system credentials","F":"Credentials for federal information systems must never be shared.","G":"pii_builtin","H":"secret","I":"block","J":"high","K":"IA-5 — Authenticator Management","L":"DP-01 / DP-02","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-838a3b36ebb7fd868602dd89","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":35,"originalCells":{"A":"fedramp","B":"FedRAMP","C":"323","D":"Moderate-baseline controls","E":"Authorization boundary details","F":"Do not describe the authorization boundary or POA&M items externally.","G":"semantic","I":"warn","J":"medium","K":"CA-3 — Information Exchange","L":"DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-01ec318fcaa13fa5c44171ad","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":36,"originalCells":{"A":"fedramp","B":"FedRAMP","C":"323","D":"Moderate-baseline controls","E":"Federal metadata addresses","F":"Do not expose internal government system IP addresses.","G":"pii_builtin","H":"ip","I":"warn","J":"medium","K":"SC-7 — Boundary Protection","L":"DP-15","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-9395f1cfac7c8957e195fd8a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":37,"originalCells":{"A":"ferpa","B":"FERPA","C":"31","D":"regulatory sections (34 CFR 99)","E":"Student records","F":"Do not disclose grades, transcripts or disciplinary records of students.","G":"semantic","I":"block","J":"high","K":"34 CFR §99.30 — Prior Consent to Disclose","L":"DP-08","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-5298209f409bdc7952ce82e2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":38,"originalCells":{"A":"ferpa","B":"FERPA","C":"31","D":"regulatory sections (34 CFR 99)","E":"Student SSNs","F":"Student Social Security numbers are protected identifiers.","G":"pii_builtin","H":"ssn","I":"block","J":"high","K":"34 CFR §99.3 — Personally Identifiable Information","L":"DP-05","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-af4ab4dfdf0104a164195ce3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"12 Code Seed Crosswalk","row":39,"originalCells":{"A":"ferpa","B":"FERPA","C":"31","D":"regulatory sections (34 CFR 99)","E":"Student contact details","F":"Student email addresses require directory-information handling.","G":"pii_builtin","H":"email","I":"warn","J":"medium","K":"34 CFR §99.37 — Directory Information","L":"DP-08","M":"Disabled","N":"Chat-addressable seed only; review applicability and test before enabling."},"originalFormulas":{}},{"id":"ROW-723c6f53d9af0c34c3c60c8d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":5,"originalCells":{"A":"NIST-AI-RMF","B":"NIST AI Risk Management Framework 1.0","C":"Current; revision underway","D":"https://www.nist.gov/itl/ai-risk-management-framework","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-cabcf78a76fd24ca003186b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":6,"originalCells":{"A":"NIST-AI-600-1","B":"NIST AI 600-1 Generative AI Profile","C":"Published July 2024","D":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-29d3486160cd65d5f0105802","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":7,"originalCells":{"A":"NIST-CSF2","B":"NIST Cybersecurity Framework 2.0","C":"Current","D":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-87ade4455de5bee96da0d4d4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":8,"originalCells":{"A":"NIST-800-53","B":"NIST SP 800-53 Rev. 5","C":"Rev. 5 Update 1","D":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-bd93a6a23b73f73d1877fa7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":9,"originalCells":{"A":"FEDRAMP","B":"FedRAMP Rev. 5 Baselines","C":"Rev. 5","D":"https://www.fedramp.gov/archive/2023-05-30-rev-5-baselines-have-been-approved-and-released/","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-7deff5e867302c090b508bf9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":10,"originalCells":{"A":"ISO-42001","B":"ISO/IEC 42001:2023","C":"Current","D":"https://www.iso.org/standard/42001","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-9258166bda5ef211934003eb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":11,"originalCells":{"A":"ISO-42005","B":"ISO/IEC 42005:2025","C":"Published 2025","D":"https://www.iso.org/standard/42005","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-213273a7e6825bfc832b1ac8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":12,"originalCells":{"A":"ISO-23894","B":"ISO/IEC 23894:2023","C":"Current","D":"https://www.iso.org/standard/77304.html","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-8e2b57ca38ac752211982427","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":13,"originalCells":{"A":"ISO-38507","B":"ISO/IEC 38507:2022","C":"Current","D":"https://www.iso.org/standard/56641.html","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-f630cfd300d79a80856d51e7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":14,"originalCells":{"A":"ISO-5338","B":"ISO/IEC 5338:2023","C":"Current","D":"https://www.iso.org/standard/81118.html","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-23be4b66866a98ea224800af","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":15,"originalCells":{"A":"ISO-24028","B":"ISO/IEC TR 24028:2020","C":"Levels of trustworthiness are out of scope","D":"https://www.iso.org/standard/77608.html","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-108081788dd247a0c4103aeb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":16,"originalCells":{"A":"EU-AI-ACT","B":"EU Artificial Intelligence Act","C":"Consolidated text current 27 Jul 2026","D":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-11c15131928a0186a899fd50","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":17,"originalCells":{"A":"GDPR","B":"EU General Data Protection Regulation","C":"Current","D":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-87ec29517bb6f98f620a9cb5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":18,"originalCells":{"A":"HIPAA","B":"HIPAA Privacy and Security Rules","C":"Current","D":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-0878eb783e475bae84c5d1ce","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":19,"originalCells":{"A":"PCI-DSS","B":"PCI DSS v4.0.1","C":"v4.0.1","D":"https://www.pcisecuritystandards.org/standards/pci-dss/","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-d6d04c1d550ccd808ca741d7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":20,"originalCells":{"A":"SOC2","B":"AICPA Trust Services Criteria","C":"2017 TSC with 2022 points of focus","D":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-ad2dda4a47909d1716f949a2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":21,"originalCells":{"A":"GLBA","B":"GLBA Safeguards Rule","C":"Current","D":"https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-e1af5f85af93f8e5737f06e0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":22,"originalCells":{"A":"FERPA","B":"Family Educational Rights and Privacy Act","C":"Current","D":"https://studentprivacy.ed.gov/ferpa","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-3d13b97eba5f66a7e905d84c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":23,"originalCells":{"A":"CCPA-CPRA","B":"California CCPA / CPRA Regulations","C":"Updated regulations effective 1 Jan 2026; ADMT obligations begin 1 Jan 2027","D":"https://cppa.ca.gov/regulations/ccpa_updates.html","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-c30a780babb1867fdc0384af","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":24,"originalCells":{"A":"CO-AI","B":"Colorado AI laws and rulemaking","C":"SB26-189 effective 1 Jan 2027; monitor rulemaking","D":"https://coag.gov/ai/","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-e2d830466ab99ccbba64ba73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":25,"originalCells":{"A":"TX-TRAIGA","B":"Texas Responsible Artificial Intelligence Governance Act","C":"Current statutory text","D":"https://statutes.capitol.texas.gov/GetStatute.aspx?Code=BC&Value=552","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-efb19504deecd7b81a028eca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":26,"originalCells":{"A":"OMB-M25-21","B":"OMB M-25-21 Federal AI Governance","C":"Replaced M-24-10","D":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-16f1dec94349ddab3f60e58e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":27,"originalCells":{"A":"OMB-M25-22","B":"OMB M-25-22 AI Acquisition","C":"Current","D":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-f7e376de3df6821eec1f5565","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":28,"originalCells":{"A":"OWASP-LLM-2026","B":"OWASP Top 10 for LLM Applications 2026","C":"Released 3 Aug 2026","D":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-9be8ad8e05dec59d0e046a17","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":29,"originalCells":{"A":"SOX","B":"Sarbanes-Oxley Act / ICFR","C":"Current","D":"https://www.sec.gov/spotlight/sarbanes-oxley.htm","E":"Primary / authoritative source","F":"Verify applicability with counsel or qualified assessor; framework mapping is not a legal conclusion."},"originalFormulas":{}},{"id":"ROW-fa5aa960671b2ed3783ad3e1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":30,"originalCells":{"A":"EO-14110-RESCISSION","B":"Initial Rescissions of Harmful Executive Orders and Actions","C":"EO 14110 listed as revoked on 20 Jan 2025","D":"https://www.whitehouse.gov/presidential-actions/2025/01/initial-rescissions-of-harmful-executive-orders-and-actions/","E":"Official White House source","F":"Treat prior EO 14110 mappings as historical/superseded, not current authority."},"originalFormulas":{}},{"id":"ROW-1c3a12de44f535e4a6fddee0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":31,"originalCells":{"A":"CO-SB26-189","B":"Colorado SB26-189","C":"Signed May 2026; effective 1 Jan 2027","D":"https://leg.colorado.gov/bills/sb26-189","E":"Official legislature source","F":"Revises/re-enacts Colorado AI requirements; monitor implementing rules."},"originalFormulas":{}},{"id":"ROW-ea3b58e664c1bf890acc5229","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":32,"originalCells":{"A":"OMB-M26-04","B":"OMB M-26-04","C":"Current federal agency LLM procurement/use principles","D":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf","E":"Official White House source","F":"Federal-agency applicability; includes transparency and evaluation expectations."},"originalFormulas":{}},{"id":"ROW-e74ee1c6736e72557b9d1180","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":33,"originalCells":{"A":"NIST-800-171","B":"NIST SP 800-171 Rev. 3","C":"Final May 2024; supersedes Rev. 2","D":"https://csrc.nist.gov/pubs/sp/800/171/r3/final","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-7734dc8054e1aa3bb0a065d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":34,"originalCells":{"A":"CMMC","B":"Cybersecurity Maturity Model Certification","C":"Phase I remains in effect; Phase II suspended 13 Jul 2026 pending review","D":"https://business.defense.gov/cmmc/","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-eef331643b6ffd3347d26eeb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":35,"originalCells":{"A":"CJIS-6.1","B":"FBI CJIS Security Policy v6.1","C":"Version 6.1 published 25 Jun 2026","D":"https://le.fbi.gov/file-repository/cjis_security_policy_v6-1_20260625.pdf/view","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-d18a6606f8b36e7bb230a45d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":36,"originalCells":{"A":"IRS-1075","B":"IRS Publication 1075","C":"Current IRS safeguard program; verify latest publication revision","D":"https://www.irs.gov/privacy-disclosure/safeguards-program","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-5ba7c6c0bcfdef3e32230b33","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":37,"originalCells":{"A":"SECTION-508","B":"Revised Section 508 Standards","C":"Current Revised 508 Standards","D":"https://www.section508.gov/buy-sell/","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-60f380e380e028f310f349dc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":38,"originalCells":{"A":"HHS-PART2","B":"42 CFR Part 2 — SUD Patient Records","C":"2024 final rule compliance required 16 Feb 2026","D":"https://www.hhs.gov/hipaa/part-2/index.html","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-98d5fe2378e545f5d99b52d4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":39,"originalCells":{"A":"ONC-HTI1","B":"ONC HTI-1 Algorithm Transparency","C":"Final rule effective; review current ONC enforcement notices","D":"https://healthit.gov/regulations/hti-rules/hti-1-final-rule/","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-8fa6d3355c67d7270eeba24a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":40,"originalCells":{"A":"FDA-AI-MD","B":"FDA AI-Enabled Medical Device Lifecycle Guidance","C":"Use final requirements plus current FDA guidance; 2025 lifecycle guidance remains draft unless finalized","D":"https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-enabled-medical-devices","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-ae3d01d10e21253761a95aab","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":41,"originalCells":{"A":"FRB-MRM-2026","B":"Interagency Revised Guidance on Model Risk Management","C":"SR 26-2 superseded SR 11-7 on 17 Apr 2026","D":"https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-fae6056afae43fd05040754d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":42,"originalCells":{"A":"NYDFS-500","B":"23 NYCRR Part 500 + DFS AI Cybersecurity Guidance","C":"Amended regulation effective from Nov 2023 with phased dates","D":"https://www.dfs.ny.gov/industry_guidance/cybersecurity","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-62811e3885ce0bca184cef26","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":43,"originalCells":{"A":"ECOA-REG-B","B":"ECOA / Regulation B Adverse Action Requirements","C":"Technology does not remove adverse-action obligations","D":"https://www.consumerfinance.gov/archive/newsroom/cfpb-issues-guidance-on-credit-denials-by-lenders-using-artificial-intelligence/","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-d79b285e8d97b5c1a7d317bf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":44,"originalCells":{"A":"NAIC-AI","B":"NAIC Model Bulletin on AI Systems by Insurers","C":"Model bulletin adopted Dec 2023; state adoption must be checked","D":"https://content.naic.org/article/naic-members-approve-model-bulletin-use-ai-insurers","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-e0bdcdf9a1d21918ea492969","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":45,"originalCells":{"A":"COPPA","B":"Children’s Online Privacy Protection Rule","C":"FTC amendments finalized Jan 2025; verify applicable compliance date","D":"https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-finalizes-changes-childrens-privacy-rule-limiting-companies-ability-monetize-kids-data","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-881c96aa63df52c7c1a0757b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":46,"originalCells":{"A":"NYC-LL144","B":"NYC Local Law 144 — AEDT","C":"Enforced since 5 Jul 2023","D":"https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-63e4a8237ff7fde83912a8cc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":47,"originalCells":{"A":"IL-AIVIA","B":"Illinois Artificial Intelligence Video Interview Act","C":"Current Illinois statute","D":"https://www.ilga.gov/Legislation/PublicActs/PrinterFriendly/101-0260","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-500ba8c96af3728e7884db43","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":48,"originalCells":{"A":"UK-DP-AI","B":"UK Data Protection Law + ICO AI Guidance","C":"Reflect Data (Use and Access) Act 2025; some ICO AI guidance remains under review","D":"https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/artificial-intelligence/guidance-on-ai-and-data-protection/about-this-guidance/","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-3b5874ab31e922cea4ca7adc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":49,"originalCells":{"A":"BR-LGPD","B":"Brazil LGPD + ANPD AI Guidance","C":"LGPD current; ANPD GenAI guidance continues to evolve","D":"https://www.gov.br/anpd/pt-br/centrais-de-conteudo/outros-documentos-e-publicacoes-institucionais/lgpd-en-lei-no-13-709-capa.pdf","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-d96847232d467814681317f3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":50,"originalCells":{"A":"AU-PRIVACY-AI","B":"Australia Privacy Act / APPs + OAIC AI Guidance","C":"OAIC guidance updated Jan 2025; automated-decision privacy-policy amendments commence 10 Dec 2026","D":"https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-aa1b50b906f7485b2663cf61","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":51,"originalCells":{"A":"SG-MODEL-AI","B":"Singapore Model AI Governance Framework","C":"Second edition and related implementation resources","D":"https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-ed26e563ccec20d9fb0f14ec","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":52,"originalCells":{"A":"DOJ-DSP","B":"DOJ Data Security Program — 28 CFR Part 202","C":"Effective 8 Apr 2025; affirmative due-diligence and audit duties effective Oct 2025","D":"https://www.justice.gov/nsd/data-security","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-8b33503d26da2c737177ca6b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"13 Sources","row":53,"originalCells":{"A":"EAR","B":"U.S. Export Administration Regulations","C":"Continuously updated; verify current EAR and license requirements","D":"https://www.bis.gov/regulations/ear/734","E":"Primary / authoritative source","F":"Profile-triggered candidate. Confirm entity, data, transaction, jurisdiction, contract, adoption, threshold and current-version applicability before reliance."},"originalFormulas":{}},{"id":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":2,"originalCells":{"A":"GOVERN","B":"GOVERN 1","C":"Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively.","D":"GOVERN 1.1","E":"Legal and regulatory requirements involving AI are understood, managed, and documented.","F":"Are legal and regulatory requirements involving AI understood, managed, and documented?","G":"Ensure that legal and regulatory requirements involving AI are understood, managed, and documented.","J":"✓","K":"✓","L":"✓","N":"7.1\n8.7\n9.11.1","P":"5.4.1 - ISO 31000:2018\n5.4.2 - ISO 31000:2018","Q":"6.1.1.3\n6.3.4.3\n6.3.8.3\n6.4.1.3\n6.4.2.3\n6.4.3.3\n6.4.8.2\n6.4.8.3\n6.4.17\n6.4.3","R":"5.1\n5.5\n6.1\n6.4\n6.6.1\n6.7.3\nA.1.2\nA.1.3\nA.1.4","S":"3.5.2\n5.15.1\n5.15.5\n5.17\n5.18\n5.19.5.4\n5.19.7.3\n6.2.2\n8.1\n","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","Y":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"4.1 - Understanding the organization and its context\n6.2 - AI objectives and planning to achieve them\nB.2.2 - AI policy\nB.2.4 - Review of the AI policy","AK":"Alabama: Enacted facial recognition restrictions (2022) and laws against sexual and political deepfakes (2024).\nAlaska: No significant AI-specific legislation enacted as of April 2025.\nArkansas: Proposed bills (HB127, SB59) to criminalize deceptive deepfakes in elections and require AI chatbot disclosures.\nCalifornia: Deepfake regulations (electoral and sexual), chatbot disclosures, bias audits for criminal justice agencies; vetoed AI safety bill (Sept 2024); exploring AI avatars for court rulings.\nIdaho: Bill introduced that requires AI chatbot disclosures in consumer transactions (2025).\nKansas: No significant AI-specific legislation enacted as of April 2025.\nMississippi: Enacted political and sexual deepfake laws (2024).\nMissouri: No significant AI-specific legislation enacted as of April 2025.\nMontana: No significant AI-specific legislation enacted as of April 2025.\nNebraska: No significant AI-specific legislation enacted as of April 2025.\nNew Hampshire: Prohibits Department of Motor Vehicles use of Facial recognition technology (2014/2016); sexual deepfake and election fraud laws (2024).\nOhio: No significant AI-specific legislation enacted as of April 2025.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA establishes many new statutory requirements for legal compliance in use, deployment, and prohibited uses of AI (e.g., manipulation, discrimination, certain biometrics).\nUtah: AI Policy Act (2024): UAIPA liability cannot be transferred to AI reinforces NIST's accountability even when AI is involved; legal responsibility must be maintained."},"originalFormulas":{}},{"id":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":3,"originalCells":{"D":"GOVERN 1.2","E":"The characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices.","F":"Are the characteristics of trustworthy AI integrated into organizational policies, processes, procedures, and practices?","G":"Ensure that the characteristics of trustworthy AI are integrated into organizational policies, processes, procedures, and practices.","J":"✓","K":"✓","L":"✓","N":"9.2\n9.3\n9.4","O":"3.3.3\n6.5.5.1\n6.5.5.5\n8.7","P":"5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","Q":"5.1\n5.2\n6.3.8.3\n6.4.2.3\n6.4.3.1\n6.4.11.1\nA.2.3\n","R":"6","S":"5.15","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","Y":"✓","AB":"GV.RR-03\nGV.SC-01\n","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.9.3 - Objectives for responsible use of AI system\nB.6.1.2 - Objectives for responsible development of AI system\nB.6.1.3 - Processes for responsible design and development of AI systems\nB.10.3 - Suppliers\nB.2.2 - AI policy\n4.4 - AI management system\n5.2 - AI Policy","AK":"Colorado: Colorado AI Act (2024): CAIA requires alignment with NIST AI RMF and ISO 42001, which codifies adherence to trustworthy AI characteristics and risk frameworks.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute."},"originalFormulas":{}},{"id":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":4,"originalCells":{"D":"GOVERN 1.3","E":"Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization’s risk tolerance.","F":"Are processes, procedures, and practices  in place to determine the needed level of risk management activities based on the organization’s risk tolerance?","G":"Ensure that processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization’s risk tolerance.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.4","O":"8.1","P":"6.4.3.2 - ISO 31000:2018","Q":"5.3\n6.3.4\n6.4.3.1","R":"5.3\n6.7","S":"6.1\n6.2.2\n6.2.5\n6.2.6\n6.2.7\n9.4\nAnnex A","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","Y":"✓","AB":"GV.RM-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.2 - AI risk assessment_x000D_\n6.1.1 - General_x000D_\n6.1.3 - AI risk treatment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute."},"originalFormulas":{}},{"id":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":5,"originalCells":{"D":"GOVERN 1.4","E":"The risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.","F":"Are the risk management process and its outcomes established through transparent policies, procedures, and other controls based on organizational risk priorities?","G":"Ensure that the risk management process and its outcomes are established through transparent policies, procedures, and other controls based on organizational risk priorities.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.4","O":"8.5","P":"6.4.2.6","Q":"5.3\n6.3.4\n6.3.5.3\n6.4.3.1","R":"6.7","S":"6.1","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","Y":"✓","AB":"GV.PO-01","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment_x000D_\n8.3 - AI risk treatment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA applies to government and covered healthcare disclosure, prohibits dark patterns, mandates transparency when AI is in use.\n"},"originalFormulas":{}},{"id":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":6,"originalCells":{"D":"GOVERN 1.5","E":"Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.","F":"Are ongoing monitoring and periodic review of the risk management process and its outcomes planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review?","G":"Ensure that ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities clearly defined, including determining the frequency of periodic review.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.4","O":"6.3\n8.7","P":"6.6 - ISO 31000:2018\n5.4.3 - ISO 31000:2018","Q":"5.4.1\n5.4.3\n6.1.1.2\n6.1.2\n6.2.1\n6.2.2\n6.2.3.2\n6.2.4.2\n6.2.5.2\n6.2.6.2\n6.3.1.2\n6.3.2.2\n6.3.3.2\n6.3.4.2\n6.3.5.2\n6.3.6.2\n6.3.7\n6.3.8.2\n6.4.1.2\n6.4.2.2\n6.4.3.2\n6.4.4\n6.4.5\n6.4.6\n6.4.7.2\n6.4.8.2\n6.4.9.2\n6.4.10\n6.4.11.2\n6.4.12.2\n6.4.14.2\n6.4.15.2\n6.4.16.2\n6.4.17.2\n","R":"6.2\n6.3\n6.5\n6.7.1\n6.7.2\n6.7.3\nA.1.3\nA.1.4\nA.2","S":"5.19","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","Y":"✓","AB":"GV.OV-01","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"8.2 - AI risk assessment_x000D_\n8.3 - AI risk treatment_x000D_\n8.4 - AI system impact assessment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute."},"originalFormulas":{}},{"id":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":7,"originalCells":{"D":"GOVERN 1.6","E":"Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.","F":"Are mechanisms in place to inventory AI systems and resourced according to organizational risk priorities?","G":"Ensure that mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.","J":"✓","K":"✓","L":"✓","M":"✓","N":"6.3","P":"6.3.1","Q":"5.1\n6.2.3.3\n6.2.4.1\n6.2.4.3\n6.2.6.3\n6.3.1.1\n","R":"4.3\n5.3\n6.3\n6.7.3","S":"6.2.2","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","Y":"✓","AB":"ID.AM-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.4.5 - System and computing resources_x000D_\nB.4.3 - Data resources_x000D_\nB.4.4 - Tooling resources_x000D_\nB.4.6 - Human resources_x000D_\nB.4.2 - Resource documentation","AK":"Connecticut: Established AI Task Force (2023); developing \"AI Bill of Rights\"; mandates annual inventory of state AI systems.\nNew Jersey: Governor's AI Task Force to study impact (2023).\nOklahoma: Governor's AI task force to study and develop policy recommendations (2023).\nPennsylvania: Generative AI Governing Board to guide policy, use, and deployment (2023).\nSouth Carolina: House AI study special committee (2024).\nWest Virginia: 2023 supply chain and AI hearing.\nWyoming: Select committee discussing synthetic media regulations (2023).","AL":"LLM03 Supply Chain\n\nNote: An AI inventory supports dependency visibility, third-party oversight, and control of external systems and models. It helps reduce supply-chain risk."},"originalFormulas":{}},{"id":"ROW-866ed5a608cb779efd53f138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":8,"originalCells":{"D":"GOVERN 1.7","E":"Processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization’s trustworthiness.","F":"Are processes and procedures in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization’s trustworthiness?","G":"Ensure that processes and procedures are in place for decommissioning and phasing out AI systems safely and in a manner that does not increase risks or decrease the organization’s trustworthiness.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/govern-1-7","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","Q":"5.3\n6.3.3.3\n6.4.8.2\n6.4.8.3\n6.4.17.1\n","R":"4.3\n5.3","S":"6.1\n6.2.9","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","Z":"✓","AJ":"B.6.2.6 - AI system operation and monitoring","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","AL":"LLM03 Supply Chain\nLLM06 Excessive Agency\n\nNote: Safe retirement removes old models, residual access, and obsolete dependencies. That directly reduces supply-chain exposure and leftover autonomous behavior."},"originalFormulas":{}},{"id":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":9,"originalCells":{"B":"GOVERN 2","C":"Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained for mapping, measuring, and managing AI risks.","D":"GOVERN 2.1","E":"Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.","F":"Are roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks documented and are clear to individuals and teams throughout the organization?","G":"Ensure that roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.","J":"✓","K":"✓","L":"✓","N":"6.1","O":"6.1","P":"5.4.5 - ISO 3100:2018\n6.2 ISO 3100:2015","Q":"6.2.4.3\n6.4.2.3\n6.4.7.3\n6.4.9.4","R":"4.1\n6.2\n6.3\n6.7.1\n6.7.3\nA2","S":"5.19","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","AJ":"9.1 - Monitoring, measurement, analysis, and evaluation\n5.3 - Roles, responsibilities and authorities\n7.1 - Resources\n7.2 - Competence\n7.3 - Awareness\n7.4 - Communication\nB.3.2 - AI roles and responsibilities","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA establishes AG enforcement, complaints portal, and state advisory council with defined statutory responsibilities."},"originalFormulas":{}},{"id":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":10,"originalCells":{"D":"GOVERN 2.2","E":"The organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.","F":"Do the organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements?","G":"Ensure that the organization’s personnel and partners receive AI risk management training to enable them to perform their duties and responsibilities consistent with related policies, procedures, and agreements.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/govern-2-2","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.4","P":"5.4.1 - ISO 31000:2018","Q":"6.4.12.1","R":"4.1\n4.3\n5.1\n6.7.2\n6.7.5\nA.1.3","S":"6.2.2","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","Y":"✓","AB":"PR.AT-01\nPR.AT-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"7.2 - Competence","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute."},"originalFormulas":{}},{"id":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":11,"originalCells":{"D":"GOVERN 2.3","E":"Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.","F":"Does executive leadership of the organization take responsibility for decisions about risks associated with AI system development and deployment?","G":"Ensure that executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.","J":"✓","K":"✓","L":"✓","M":"✓","O":"A.2.2.3","P":"5.5","Q":"6.3.4.3\n6.4.3.3","R":"6.6.1","S":"6.2.2","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","Y":"✓","AB":"GV.RM-04\nGV.RR-01","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"5.1 - Leadership and commitment\n9.3.1 - General\n9.3.2 - Management review inputs\n9.3.3 - Management review results\n5.2 - AI Policy\nB.2.2 - AI Policy","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute."},"originalFormulas":{}},{"id":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":12,"originalCells":{"B":"GOVERN 3","C":"Workforce diversity, equity, inclusion, and accessibility processes are prioritized in the mapping, measuring, and managing of AI risks throughout the lifecycle.","D":"GOVERN 3.1","E":"Decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds).","F":"Are decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds)?","G":"Ensure that decision-making related to mapping, measuring, and managing AI risks throughout the lifecycle is informed by a diverse team (e.g., diversity of demographics, disciplines, experience, expertise, and backgrounds).","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/govern-3-1","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.1","O":"7.2","P":"6.2 - ISO 31000:2018","Q":"6.3.3","R":"6.1\n6.3\n6.5\n6.7.1\n6.7.2\n6.7.3\nAnnex A","S":"6.2.2","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","W":"✓","X":"✓","AA":"✓","AJ":"B.4.6 - Human resources_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute."},"originalFormulas":{}},{"id":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":13,"originalCells":{"D":"GOVERN 3.2","E":"Policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.","F":"Are policies and procedures in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems?","G":"Ensure that policies and procedures are in place to define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.1","O":"8.1","P":"5.4.3 - ISO 31000:2018","Q":"5.3","R":"4.3\n6.2\n6.6.2\n6.7.4\n","S":"3.1.5\n3.1.16\n3.3.3\n5.1\n5.13\n7.1\n7.4.3","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","AB":"GV.SC-01","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.9.3 - Objectives for responsible use of AI system_x000D_\nB.4.6 - Human resources_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\n7.2 - Competence_x000D_\nB.3.2 - Management review inputs","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","AL":"LLM06 Excessive Agency\nLLM05 Improper Output Handling\nLLM09 Misinformation\n\nNote: Human oversight boundaries directly reduce over-automation, unsafe output use, and unchecked misleading output."},"originalFormulas":{}},{"id":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":14,"originalCells":{"B":"GOVERN 4","C":"Organizational teams are committed to a culture that considers and communicates AI risk.","D":"GOVERN 4.1","E":"Organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts.","F":"Are organizational policies and practices in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts?","G":"Ensure that organizational policies and practices are in place to foster a critical thinking and safety-first mindset in the design, development, deployment, and uses of AI systems to minimize potential negative impacts.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.3","O":"8.1","P":"6.3.3\n6.4.2.6\n6.4.3.2","Q":"6.3.4.3\n6.4.3.3\n6.4.17.1","R":"4.3\n6.7.3","S":"3.5.16\n5.15.2\n5.15.3\nAnnex A","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","Z":"✓","AB":"ID.AM-05\nID.RA-04\nID.RA-05\nID.RA-07\nDE.AE-04","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.5.2 - AI system impact assessment process\nB.6.1.2 - Objectives for responsible development of AI system\nB.6.1.3 - Processes for responsible design and development of AI systems\nB.6.2.4 - AI system verification and validation\nB.9.2 - Processes for responsible use of AI systems\nB.9.3 - Objectives for responsible use of AI system\nB.10.3 - Suppliers\nB.5.4 - Assessing AI system impact on individuals and groups of individuals","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\n\nNote: A safety-first mindset reduces blind acceptance of model output and encourages verification before downstream use."},"originalFormulas":{}},{"id":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":15,"originalCells":{"D":"GOVERN 4.2","E":"Organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.","F":"Do organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and do they communicate about the impacts more broadly?","G":"Ensure that organizational teams document the risks and potential impacts of the AI technology they design, develop, deploy, evaluate, and use, and they communicate about the impacts more broadly.","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.2","O":"3.1.4","P":"5.2","Q":"6.3.8.3\n6.4.2.3","R":"4.2\n4.3\n5.5\n6.1\n6.3\n6.5\n6.6.1\n6.7.2\n6.7.4\n6.7.5","S":"5.18","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","Z":"✓","AB":"ID.AM-05\nID.RA-04\nID.RA-05\nID.RA-07\nDE.AE-04","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.8.5 - Information for interested parties_x000D_\n7.4 - Communication_x000D_\n6.1.4 - AI system impact assessment_x000D_\nB.5.5 - Assessing societal impacts of AI systems","AK":"Colorado: Colorado AI Act (2024): CAIA requires public disclosure and notification to consumers when HRAIS (High Risk AI Systems) are used, so NIST builds transparency into system operation and consumer rights.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is implicit on where use or deployment of AI in a prohibited or high-risk context is banned or must be reported.\nUtah: AI Policy Act (2024): UAIPA requirement for mandatory GenAI disclosure at first interaction (regulated occupations and consumer settings) maps as NIST requires communication of AI system involvement and its risks​; UAIPA liability cannot be transferred to AI reinforces NIST's accountability even when AI is involved; legal responsibility must be maintained."},"originalFormulas":{}},{"id":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":16,"originalCells":{"D":"GOVERN 4.3","E":"Organizational practices are in place to enable AI testing, identification of incidents, and information sharing.","F":"Are organizational practices in place to enable AI testing, identification of incidents, and information sharing?","G":"Ensure that organizational practices are in place to enable AI testing, identification of incidents, and information sharing.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.5","O":"3.1.4\n6.4\n7.2\n8.2\n8.4\n8.5","P":"6.4.2.4","Q":"6.4.15.3\n6.4.16.1","R":"4.3\n6.7.4","S":"3.5.10\n5.15.4\n6.2.6","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","Z":"✓","AB":"RS.CO-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users_x000D_\nB.8.3 - External reporting_x000D_\nB.8.4 - Communication of incidents_x000D_\nB.8.5 - Information for interested parties_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","AL":"LLM01 Prompt Injection\nLLM04 Data and Model Poisoning\nLLM05 Improper Output Handling\nLLM09 Misinformation\n\nNote: Testing and incident sharing directly help detect adversarial prompting, poisoning, bad outputs, and repeated misinformation patterns."},"originalFormulas":{}},{"id":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":17,"originalCells":{"B":"GOVERN 5","C":"Processes are in place for robust engagement with relevant AI actors.","D":"GOVERN 5.1","E":"Organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks.","F":"Are organizational policies and practices in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks?","G":"Ensure that organizational policies and practices are in place to collect, consider, prioritize, and integrate feedback from those external to the team that developed or deployed the AI system regarding the potential individual and societal impacts related to AI risks.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.2","O":"7.6\n","P":"5.4.5 - ISO 3100:2018\n6.2 - ISO 3100:2015","Q":"5.1\n6.4.3.3","R":"4.3\n5.1\n5.2.3\n5.4\n5.5\n6.5\n6.7.2\nA.1.3\nA.1.4\nA.3","S":"5.11.4\n5.18\n8.6.2","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","Z":"✓","AB":"DE.AE-04","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.10.4 - Customers_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.8.3 - External reporting","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.\nUtah: AI Policy Act (2024): UAIPA establishes an Office of AI Policy, which institutionalizes stakeholder engagement and public sector governance for ongoing oversight.","AL":"LLM09 Misinformation\nLLM05 Improper Output Handling\n\nNote: External feedback helps surface harmful or misleading outputs that internal teams may miss."},"originalFormulas":{}},{"id":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":18,"originalCells":{"D":"GOVERN 5.2","E":"Mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation.","F":"Are mechanisms established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation?","G":"Ensure that mechanisms are established to enable the team that developed or deployed AI systems to regularly incorporate adjudicated feedback from relevant AI actors into system design and implementation.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.4.2\n9.10.5","O":"8.1\n8.4\n8.5","P":"5.4.5 - ISO 3100:2018\n6.2 - ISO 3100:2015","Q":"5.1\n5.3\n6.3.5.3\n6.4.5\n6.4.9.1\n6.4.12.3\n6.4.15.3\n6.4.16.3","R":"5.2.3\n5.4","S":"5.11.4\n5.18\n8.6.2","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","Z":"✓","AB":"RS.CO-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.8.3 - External reporting_x000D_\nB.10.4 - Customers_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.\nUtah: AI Policy Act (2024): UAIPA establishes an Office of AI Policy, which institutionalizes stakeholder engagement and public sector governance for ongoing oversight.","AL":"LLM09 Misinformation\nLLM05 Improper Output Handling\n\nNote: Closing the feedback loop helps correct recurring falsehoods and output-handling weaknesses."},"originalFormulas":{}},{"id":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":19,"originalCells":{"B":"GOVERN 6","C":"Policies and procedures are in place to address AI risks and benefits arising from third-party software and data and other supply chain issues.","D":"GOVERN 6.1","E":"Policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights.","F":"Are policies and procedures in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights?","G":"Ensure that policies and procedures are in place that address AI risks associated with third-party entities, including risks of infringement of a third-party’s intellectual property or other rights.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/govern-6-1","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.5","P":"5.4.1 - ISO 31000:2018","Q":"6.4.3.3\n","R":"5.5\n6.4\nA.3","S":"8.6.1","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","Z":"✓","AB":"GV.SC-05","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.10.2 - Allocating responsibilities_x000D_\nB.10.3 - Suppliers","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","AL":"LLM03 Supply Chain\n\nNote: Third-party entity risk is a direct supply-chain issue because it covers vendors, hosted services, and external dependencies."},"originalFormulas":{}},{"id":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":20,"originalCells":{"D":"GOVERN 6.2","E":"Contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk.","F":"Are contingency processes in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk?","G":"Ensure that contingency processes are in place to handle failures or incidents in third-party data or AI systems deemed to be high-risk.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/govern-6-2","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.1","O":"8.3","P":"5.4.1 - ISO 31000:2018","Q":"6.4.15.3\n","R":"6.7.5","S":"5.15.4","T":"To ensure a purpose-driven culture focused on risk understanding and management.","U":"✓","V":"✓","X":"✓","Y":"✓","Z":"✓","AB":"GV.SC-10","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.10.2 - Allocating responsibilities_x000D_\nB.10.3 - Suppliers","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","AL":"LLM03 Supply Chain\nLLM10 Unbounded Consumption\n\nNote: Contingency planning addresses dependency failures and service overuse when upstream systems fail or become unavailable."},"originalFormulas":{}},{"id":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":21,"originalCells":{"A":"MAP","B":"MAP 1","C":"Context is established and understood.","D":"MAP 1.1","E":"Intended purposes, potentially beneficial uses, context specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented.\n\nConsiderations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related Test & Evaluation, Validation & Verification (TEVV) and system metrics.","F":"Are intended purposes, potentially beneficial uses, context specific laws, norms and expectations, and prospective settings in which the AI system will be deployed understood and documented?\n\nDo considerations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related Test & Evaluation, Validation & Verification (TEVV) and system metrics?","G":"Ensure that intended purposes, potentially beneficial uses, context specific laws, norms and expectations, and prospective settings in which the AI system will be deployed are understood and documented.\n\nEnsure that considerations include: the specific set or types of users along with their expectations; potential positive and negative impacts of system uses to individuals, communities, organizations, society, and the planet; assumptions and related limitations about AI system purposes, uses, and risks across the development or product AI lifecycle; and related Test & Evaluation, Validation & Verification (TEVV) and system metrics.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.6","O":"6.3\n6.5.1\n6.5.5\n8.2\n8.5\n8.8\n","P":"6.4.2.6\n6.5.2 - ISO 31000:2018\n","Q":"5.2\n6.3.4.3\n6.4.2.1\n6.4.13.1\n6.4.15.3\n6.4.17.1\nA.2.5","R":"4.2\n4.3\n5.3\n6.4\n6.7.4\n6.7.5","S":"5.13\n5.15.2\n5.16\n5.17\n6.2.2\n7.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"PR.PS-06","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.4 - AI system impact assessment_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","AK":"Arizona: Supreme Court uses AI avatars for judicial transparency (2025); laws against sexual and political deepfakes (2024); SB640 (2025) requires chatbot disclosure in consumer interactions.\nColorado: Colorado AI Act (2024): CAIA requires public disclosure and notification to consumers when HRAIS (High Risk AI Systems) are used, so NIST maps consequential use contexts and provides system knowledge boundaries.\nNevada: SB2203 requires AI company registration and misinformation frameworks; proposed synthetic media disclosure for elections (2025).\nNew Mexico: Proposed AI regulations to regulate child profiling (2024).\nNorth Dakota: HB1167 proposed AI election disclaimers (2025).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA requires clear disclosure, bans deployment for certain uses (e.g., behavioral manipulation, social scoring by government).\nUtah: AI Policy Act (2024): UAIPA is a context-specific law and ​mapping this disclosure requirement into the AI’s deployment context aligns with this subcategory relating to knowledge limits and human oversight of AI.","AL":"LLM02 Sensitive Information Disclosure\nLLM06 Excessive Agency\nLLM09 Misinformation\n\nNote: Knowing the use context helps bound what data is exposed, what the system may do, and how misleading output could harm users."},"originalFormulas":{}},{"id":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":22,"originalCells":{"D":"MAP 1.2","E":"Interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. Opportunities for interdisciplinary collaboration are prioritized.","F":"Are interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation documented? \n\nAre opportunities for interdisciplinary collaboration prioritized?","G":"Ensure that interdisciplinary AI actors, competencies, skills, and capacities for establishing context reflect demographic diversity and broad domain and user experience expertise, and their participation is documented. \n\nEnsure that opportunities for interdisciplinary collaboration are prioritized.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-1-2","J":"✓","K":"✓","L":"✓","N":"9.8","Q":"5.1\n6.2.3.3\n6.2.4.1\n6.2.4.3\n6.2.6.1\n6.2.6.3\n6.4.9.4\n","R":"A.1.3","S":"5.1\n6.2.2","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"PR.AT-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.4.6 - Human resources_x000D_\n7.2 - Competence","AK":"Utah: AI Policy Act (2024): Requirement for prominent GenAI disclosure in professions requiring state licensure, such as healthcare, accounting, and law ties directly to disclosure of AI involvement and ensuring the user knows the limits of GenAI's role."},"originalFormulas":{}},{"id":"ROW-eafc5c95da5c20fd5e339a23","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":23,"originalCells":{"D":"MAP 1.3","E":"The organization’s mission and relevant goals for AI technology are understood and documented.","F":"Are the organization’s mission and relevant goals for AI technology understood and documented?","G":"Ensure that the organization’s mission and relevant goals for AI technology are understood and documented.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-1-3","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.1","O":"6.2.1\n6.3\n7.6\n8.1\n8.8","Q":"6.4.1\n6.4.13.1\nA.2.5","R":"4.1\nA.1.1\nA.1.4\nA.2","S":"6.2.2","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","X":"✓","AJ":"4.1 - Understanding the organization and its context_x000D_\n5.2 - AI Policy_x000D_\n6.2 - AI objectives and planning to achieve them_x000D_\n7.5.3 - Control of documented information_x000D_\n7.3 - Awareness_x000D_\n7.4 - Communication","AL":"LLM06 Excessive Agency\nLLM09 Misinformation\n\nNote: A clear mission limits inappropriate autonomy and reduces off-goal output behavior."},"originalFormulas":{}},{"id":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":24,"originalCells":{"D":"MAP 1.4","E":"The business value or context of business use has been clearly defined or – in the case of assessing existing AI systems – re-evaluated.","F":"Have the business value or context of business use been clearly defined or – in the case of assessing existing AI systems – re-evaluated?","G":"Ensure that the business value or context of business use has been clearly defined or – in the case of assessing existing AI systems – re-evaluated.","J":"✓","K":"✓","L":"✓","M":"✓","N":"6.2\n8.8.2.5","O":"8.2\n","P":"5.4.1\n5.4.2","Q":"6.1.1.3\n6.2.3.3\n6.2.4.1\n6.3.2.1\n6.4.1","R":"5.4\nA.1.2\nA.3","S":"5.10\n6.2.2\n7.1\n7.4.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","X":"✓","AJ":"5.1 - Leadership and commitment_x000D_\n4.1 - Understanding the organization and its context_x000D_\nB.2.2 - Customers_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.9.4 - Intended use of the AI system_x000D_\nB.6.2.2 - AI system requirements and specification","AL":"LLM06 Excessive Agency\nLLM09 Misinformation\n\nNote: Defining intended use helps constrain deployment scope and reduces misuse-driven false output."},"originalFormulas":{}},{"id":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":25,"originalCells":{"D":"MAP 1.5","E":"Organizational risk tolerances are determined and documented.","F":"Are organizational risk tolerances determined and documented?","G":"Ensure that organizational risk tolerances are determined and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.4","P":"5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","Q":"6.3.4","R":"4.2\n4.3\n5.5\n6.6.1\n6.7.1\n6.7.2\n6.7.3\n6.7.5\nA.1.4\nA.2","S":"5.18\n6.1\n6.2.2\n6.2.3\n6.2.4\n6.2.5\n6.2.6\n6.2.7\n6.2.8\n9.4\nAnnex A","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","X":"✓","Y":"✓","AB":"GV.RM-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.1 - Objective"},"originalFormulas":{}},{"id":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":26,"originalCells":{"D":"MAP 1.6","E":"System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. \n\nDesign decisions take socio-technical implications into account to address AI risks.","F":"Are system requirements (e.g., “the system shall respect the privacy of its users”) elicited from and understood by relevant AI actors?\n\nDoes design decisions take socio-technical implications into account to address AI risks?","G":"Ensure that system requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. \n\nEnsure that design decisions take socio-technical implications into account to address AI risks.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-1-6","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.5","O":"8.3","P":"5.4.1 - ISO 31000:2018","Q":"6.3.4.3\n6.4.1.3\n6.4.3.3\n6.4.8.3\n6.4.17.3","R":"5.3\n6.4\n6.6.2\n6.7.2\n6.7.3\n6.7.5\nA.3","S":"3.2.11\n3.5.14\n3.5.15\n3.5.16\n5.15.8\n5.19\n6.2\n6.1\n6.2.2\n8.6.2\nAnnex A","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","X":"✓","Y":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.2 - AI system requirements and specification_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","AL":"LLM02 Sensitive Information Disclosure\nLLM07 System Prompt Leakage\nLLM06 Excessive Agency\n\nNote: Privacy and output-boundary requirements directly reduce leakage and unsafe autonomous behavior."},"originalFormulas":{}},{"id":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":27,"originalCells":{"B":"MAP 2","C":"Categorization of the AI system is performed.","D":"MAP 2.1","E":"The specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders).","F":"Are the specific tasks and methods used to implement the tasks that the AI system will support defined (e.g., classifiers, generative models, recommenders)?","G":"Ensure that the specific tasks and methods used to implement the tasks that the AI system will support are defined (e.g., classifiers, generative models, recommenders).","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.3\n9.7","O":"6.1\n6.2\n6.5.3.2.8\n6.5.5.1\n6.5.5.6\n7.3","Q":"5.1\n5.4.2\n6.1.1.3\n6.1.2.3\n6.2.3.3\n6.2.4.3\n6.2.5.3\n6.2.6.3\n6.3.1.3\n6.3.2.3\n6.3.3.3\n6.4.8.3","R":"3.2.1\n5.2.1\n5.4\n6.3\nA.1.4","S":"3.1.14\n3.1.24\n3.1.29\n3.1.35\n5.1\n5.2\n5.5\n5.11.1\n5.19.5.1\n7.2\n8.2\n8.6.2\n8.7.2\n9.1\n9.2.2.1\n10.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AJ":"B.6.2.3 - Documentation of AI system design and development_x000D_\nB.4.2 - Resource documentation_x000D_\nB.4.3 - Data resources_x000D_\nB.4.4 - Tooling resources_x000D_\nB.4.5 - System and computing resources_x000D_\nB.4.6 - Human resources","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","AL":"LLM06 Excessive Agency\nLLM05 Improper Output Handling\nLLM09 Misinformation\n\nNote: The architecture choice determines output handling, autonomy, and hallucination risk."},"originalFormulas":{}},{"id":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":28,"originalCells":{"D":"MAP 2.2","E":"Information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans is documented. \n\nDocumentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions.","F":"Is information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans documented?\n\nDoes documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions?","G":"Ensure that information about the AI system’s knowledge limits and how system output may be utilized and overseen by humans is documented. \n\nEnsure that documentation provides sufficient information to assist relevant AI actors when making decisions and taking subsequent actions.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.11.3","O":"6.5.3.2.7","Q":"5.1","R":"5.1\n5.2.1\n5.2.3\n6.3\n6.5\n6.6.1","S":"5.4\n5.15.8\n7.3\n8.1\n8.5.1\n8.5.2","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AJ":"B.6.2.7 - AI system technical documentation_x000D_\nB.9.3 - Objectives for responsible use of AI system_x000D_\nB.8.2 - System documentation and information for users","AK":"Colorado: Colorado AI Act (2024): CAIA requires public disclosure and notification to consumers when HRAIS (High Risk AI Systems) are used, so NIST maps consequential use contexts and provides system knowledge boundaries.\nFlorida: Unlawful to possess AI-generated child pornography (2024); established tech modernization council to study and monitor the development and deployment of AI systems.\nHawaii: SB640 Chatbot disclosure mandates; prohibits discriminatory algorithmic eligibility determinations (2025).\nIowa: Sexual deepfake laws enacted in 2024; appropriated $2.8M to expand AI-related degree programs (SF2435).\nLouisiana: Laws against child sexual deepfakes (2023); created technology and cybersecurity committee AI impact study (2023).\nMassachusetts: Facial recognition technology restrictions for law enforcement (2020).\nVirginia: HB2094 Synthetic media disclaimer requirements for elections (2025); SB741 facial recognition technology legalization (2022).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.\nUtah: AI Policy Act (2024): UAIPA is a context-specific law and ​mapping this disclosure requirement into the AI’s deployment context aligns with this subcategory relating to knowledge limits and human oversight of AI.","AL":"LLM09 Misinformation\nLLM06 Excessive Agency\n\nNote: Explicitly defining limitations and oversight is a direct control against over-reliance and unsafe use of output."},"originalFormulas":{}},{"id":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":29,"originalCells":{"D":"MAP 2.3","E":"Scientific integrity and Test & Evaluation, Validation & Verification (TEVV) considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.","F":"Are scientific integrity and Test & Evaluation, Validation & Verification (TEVV) considerations identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation?","G":"Ensure that scientific integrity and Test & Evaluation, Validation & Verification (TEVV) considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-2-3","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.3","O":"6.4\n6.5.3.1\n8.2\n8.4\n8.5\n8.6\n8.8\n","Q":"5.3\n6.3.1.3\n6.4.13\n6.4.14\nA.2.5\nA.3","R":"4.3\n6.6.1\n6.6.2","S":"3.5.17\n5.10\n5.11.9.2\n5.16\n6.1\n6.2.3\n6.2.4","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AJ":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.7.2 - Data for development and enhancement of AI system_x000D_\nB.7.3 - Acquisition of data_x000D_\nB.7.4 - Quality of data for AI systems_x000D_\nB.7.5 - Data provenance_x000D_\nB.7.6 - Data preparation_x000D_\nB.6.2.4 - AI system verification and validation","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","AL":"LLM04 Data and Model Poisoning\nLLM09 Misinformation\nLLM08 Vector and Embedding Weaknesses\n\nNote: Weak data selection and poor validation are upstream causes of poisoned models, misleading behavior, and retrieval weaknesses."},"originalFormulas":{}},{"id":"ROW-723912eb26a85e142966be86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":30,"originalCells":{"B":"MAP 3","C":"AI capabilities, targeted usage, goals, and expected benefits and costs compared with appropriate benchmarks are understood.","D":"MAP 3.1","E":"Potential benefits of intended AI system functionality and performance are examined and documented.","F":"Are potential benefits of intended AI system functionality and performance  examined and documented?","G":"Ensure that potential benefits of intended AI system functionality and performance are examined and documented.","J":"✓","K":"✓","L":"✓","M":"✓","O":"3.1.4\n6.3\n6.4\n6.5.1\n6.5.3.1\n6.5.3.2\n6.5.5.6\n6.5.5.7\n6.5.5.8\n7.2\n7.4\n7.6\n8.2\n8.3\n8.4\n8.5\n8.7\n8.8","Q":"5.3","R":"5.2.3\n5.3","S":"3.1.29\n3.5.9\n3.5.18\n5.13\n5.15.1\n5.15.2\n5.16\n5.17\n6.2.2\n7.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AA":"✓","AJ":"B.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols."},"originalFormulas":{}},{"id":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":31,"originalCells":{"D":"MAP 3.2","E":"Potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness – as connected to organizational risk tolerance\n– are examined and documented.","F":"Are potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness – as connected to organizational risk tolerance – examined and documented?","G":"Ensure that potential costs, including non-monetary costs, which result from expected or realized AI errors or system functionality and trustworthiness – as connected to organizational risk tolerance – are examined and documented.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-3-2","J":"✓","K":"✓","L":"✓","M":"✓","N":"8.10\n9.8\n","O":"6.5.4.1\n6.5.4.2\n7.4","P":"6.4.2.6","Q":"6.4.3.3\n6.4.12.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","R":"4.2\n6.4\n","S":"6.2.2\n6.2.6\n7.4.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AA":"✓","AJ":"B.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\n8.2 - AI risk assessment_x000D_\n8.3 - AI risk treatment_x000D_\n8.4 - AI system impact assessment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","AL":"LLM09 Misinformation\nLLM05 Improper Output Handling\n\nNote: Evaluating cost of errors highlights the impact of false or unsafe outputs and supports stronger safeguards."},"originalFormulas":{}},{"id":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":32,"originalCells":{"D":"MAP 3.3","E":"Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.","F":"Is targeted application scope specified and documented based on the system’s capability, established context, and AI system categorization?","G":"Ensure that targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.3.4","O":"6.5.3.2.1\n6.5.3.2.3.2\n8.4","P":"6.3.2 - ISO 31000:2018\n6.3.3 - ISO 31000:2018","Q":"5.3\n6.2.3.3\n6.4.2.1\n6.4.12.1\n6.4.15.3\n6.4.16.1\nA.2.4\nA.2.7\n","R":"5.5\n6.5\n6.6.2\n6.7.4","S":"3.7.1\n8.7.2\n9.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AA":"✓","AJ":"4.3 - Determining the scope of the AI management system_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","AL":"LLM06 Excessive Agency\nLLM01 Prompt Injection\n\nNote: Narrower scope limits abuse surface and reduces the opportunity for prompt-based misuse."},"originalFormulas":{}},{"id":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":33,"originalCells":{"D":"MAP 3.4","E":"Processes for operator and practitioner proficiency with AI system performance and trustworthiness – and relevant technical standards and certifications – are defined, assessed, and documented.","F":"Are processes for operator and practitioner proficiency with AI system performance and trustworthiness – and relevant technical standards and certifications – defined, assessed, and documented?","G":"Ensure that processes for operator and practitioner proficiency with AI system performance and trustworthiness – and relevant technical standards and certifications – are defined, assessed, and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"6.3","O":"8.1","Q":"5.3\n6.3.4.3\n6.4.11.1\n6.4.15.1","R":"6.6.2","S":"5.15.1\n5.15.2\n5.19.5.4\n5.19.5.5","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AA":"✓","AJ":"7.2 - Competence_x000D_\nB.4.6 - Human resources","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols."},"originalFormulas":{}},{"id":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":34,"originalCells":{"D":"MAP 3.5","E":"Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.","F":"Are processes for human oversight defined, assessed, and documented in accordance with organizational policies from the GOVERN function?","G":"Ensure that processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-3-5","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","P":"5.4.3 - ISO 31000:2018","Q":"6.3.4.3\n6.4.3.3\n6.4.14.1","R":"3.2.1\n4.3\n5.1\n5.3\n5.4\n5.5\n6.2\n6.3\n6.5\n6.7.3\nA.1.1\nA.1.3\nA.1.4","S":"5.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Z":"✓","AA":"✓","AJ":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","AL":"LLM06 Excessive Agency\nLLM05 Improper Output Handling\nLLM09 Misinformation\n\nNote: Human review is directly relevant to preventing unchecked autonomy and untrusted output."},"originalFormulas":{}},{"id":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":35,"originalCells":{"B":"MAP 4","C":"Risks and benefits are mapped for all components of the AI system including third-party software and data.","D":"MAP 4.1","E":"Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.","F":"Are approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights?","G":"Ensure that approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-4-1","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.1","P":"5.4.1 - ISO 31000:2018\n5.6 - ISO 31000:2018","Q":"6.1.1.3\n6.4.1.3\n6.4.3.3\n6.4.8.2\n6.4.8.3\n6.4.17.1","R":"5.5\n6.4\nA.3","S":"5.15.1\n5.17","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Y":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"4.1 - Understanding the organization and its context_x000D_\nB.2.2 - AI policy_x000D_\nB.9.2 - Processes for responsible use of AI systems_x000D_\nB.9.4 - Intended use of the AI system","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. Explicit in TRAIGA: biometric consent, privacy violation, unlawful discrimination, deepfake/child exploitation, etc.","AL":"LLM03 Supply Chain\nLLM04 Data and Model Poisoning\n\nNote: Third-party components and data are classic supply-chain and poisoning entry points."},"originalFormulas":{}},{"id":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":36,"originalCells":{"D":"MAP 4.2","E":"Internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented.","F":"Are internal risk controls for components of the AI system, including third-party AI technologies, identified and documented?","G":"Ensure that internal risk controls for components of the AI system, including third-party AI technologies, are identified and documented.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/map-4-2","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.4","P":"5.4.1 - ISO 31000:2018","Q":"6.4.8.3","R":"6.7.2","S":"6.1","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","Y":"✓","AB":"ID.RA-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users_x000D_\nB.10.3 - Suppliers","AL":"LLM03 Supply Chain\nLLM04 Data and Model Poisoning\nLLM08 Vector and Embedding Weaknesses\n\nNote: Internal controls on components directly reduce third-party dependency risk and poisoned or weak retrieval components."},"originalFormulas":{}},{"id":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":37,"originalCells":{"B":"MAP 5","C":"Impacts to individuals, groups, communities, organizations, and society are characterized.","D":"MAP 5.1","E":"Likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.","F":"Are likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data identified and documented?","G":"Ensure that likelihood and magnitude of each identified impact (both potentially beneficial and harmful) based on expected use, past uses of AI systems in similar contexts, public incident reports, feedback from those external to the team that developed or deployed the AI system, or other data are identified and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.4.2\n9.10.5\n","P":"6.3.4 - ISO 31000:2018\n6.4.2.6\n6.4.3.2\n6.4.3.3","Q":"6.3.8.3\n6.4.2.3","R":"3.2.2\n6.7.3","S":"5.15.7\n5.18","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.2 - AI risk assessment_x000D_\nB.5.2 - AI system impact assessment process","AK":"Colorado: Colorado AI Act (2024): CAIA prohibits algorithmic discrimination in high-risk areas (jobs, loans, housing, etc.) and NIST requires identification of group-level impacts and high-risk decision contexts.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA includes complaint process and AG assessment of harm where statutory lines crossed.","AL":"LLM09 Misinformation\nLLM05 Improper Output Handling\nLLM06 Excessive Agency\n\nNote: Impact assessment helps identify where misleading output, unsafe output handling, or over-autonomy would cause the most harm."},"originalFormulas":{}},{"id":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":38,"originalCells":{"D":"MAP 5.2","E":"Practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented.","F":"Are practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts in place and documented?","G":"Ensure that practices and personnel for supporting regular engagement with relevant AI actors and integrating feedback about positive, negative, and unanticipated impacts are in place and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.4.2\n9.10.5\n","P":"ISO 31000:2018, Clause 4","Q":"6.3.8.3\n6.4.1.3","R":"4.3\n5.1\n5.5\n6.7.2","S":"5.18\n5.19","T":"To ensure sufficient contextual knowledge about AI system impacts to inform an initial go/no-go decision about whether to design, develop, or deploy an AI system.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"ID.RA-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.8.3 - External reporting","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. The Texas AI Council created under TRAIGA has a mandate to advise, review, and integrate feedback.","AL":"LLM09 Misinformation\nLLM05 Improper Output Handling\n\nNote: User and stakeholder feedback often reveals output errors and harmful behaviors not visible internally."},"originalFormulas":{}},{"id":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":39,"originalCells":{"A":"MEASURE","B":"MEASURE 1","C":"Appropriate methods and metrics are identified and applied.","D":"MEASURE 1.1","E":"Approaches and metrics for measurement of AI risks enumerated during the MAP function are selected for implementation starting with the most significant AI risks. \n\nThe risks or trustworthiness characteristics that will not – or cannot – be measured are properly documented.","F":"Are approaches and metrics for measurement of AI risks enumerated during the MAP function selected for implementation starting with the most significant AI risks? \n\nAre the risks or trustworthiness characteristics that will not – or cannot – be measured properly documented?","G":"Ensure that approaches and metrics for measurement of AI risks enumerated during the MAP function are selected for implementation starting with the most significant AI risks. \n\nEnsure that the risks or trustworthiness characteristics that will not – or cannot – be measured are properly documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.3\n5.4\n6.4\n","O":"8.1","Q":"6.4.3.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","R":"4.3\n5.5\n6.4\n6.6.2\n6.7.2","S":"5.15.2\n6.2.2\n8.1","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AB":"ID.RA-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.1 - General_x000D_\n6.1.2 - AI risk assessment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM04 Data and Model Poisoning\nLLM09 Misinformation\nLLM05 Improper Output Handling\nLLM10 Unbounded Consumption\n\nNote: Prioritizing measurement for the most significant risks directly supports detection of poisoned behavior, false output, unsafe output handling, and resource abuse."},"originalFormulas":{}},{"id":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":40,"originalCells":{"D":"MEASURE 1.2","E":"Appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities.","F":"Are appropriateness of AI metrics and effectiveness of existing controls regularly assessed and updated, including reports of errors and potential impacts on affected communities?","G":"Ensure that appropriateness of AI metrics and effectiveness of existing controls are regularly assessed and updated, including reports of errors and potential impacts on affected communities.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.4","O":"6.5.5","Q":"6.4.12.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","R":"4.3\n6.1\n6.4\n6.7.3","S":"5.15.2\n6.2.2\n8.1","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AB":"GV.OV-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.4 - AI system verification and validation_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.5 - Assessing societal impacts of AI systems","AL":"LLM04 Data and Model Poisoning\nLLM09 Misinformation\nLLM05 Improper Output Handling\nLLM10 Unbounded Consumption\n\nNote: Ongoing metric review is directly relevant to drift, recurring errors, output quality, and anomalous consumption patterns."},"originalFormulas":{}},{"id":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":41,"originalCells":{"D":"MEASURE 1.3","E":"Internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. \n\nDomain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance.","F":"Are internal experts who did not serve as front-line developers for the system and/or independent assessors involved in regular assessments and updates?\n\nAre domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities consulted in support of assessments as necessary per organizational risk tolerance?","G":"Ensure that internal experts who did not serve as front-line developers for the system and/or independent assessors are involved in regular assessments and updates. \n\nEnsure that domain experts, users, AI actors external to the team that developed or deployed the AI system, and affected communities are consulted in support of assessments as necessary per organizational risk tolerance.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/measure-1-3","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.2","P":"5.4.1 - ISO 31000:2018\n6.4.1 - ISO 31000:2018\n6.7","Q":"6.4.7.1\n6.4.7.3\n6.4.9.4","R":"4.3\n5.2.3\n6.4","S":"5.19.1\n5.19.5.1\n5.19.5.4\n6.2.8","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AB":"GV.SC-07","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.2 - AI risk assessment_x000D_\n9.2.2 - Internal audit programme_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements."},"originalFormulas":{}},{"id":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":42,"originalCells":{"B":"MEASURE 2","C":"AI systems are evaluated for trustworthy characteristics.","D":"MEASURE 2.1","E":"Test sets, metrics, and details about the tools used during Test & Evaluation, Validation & Verification (TEVV) are documented.","F":"Are test sets, metrics, and details about the tools used during Test & Evaluation, Validation & Verification (TEVV) documented?","G":"Ensure that test sets, metrics, and details about the tools used during Test & Evaluation, Validation & Verification (TEVV) are documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.5","O":"6.5\n8.3\n8.8\nA.3.2","P":"5.4.3","Q":"6.4.11.3","R":"4.3\n6.6.1\n6.6.2","S":"3.2.15\n5.11.8","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"ID.IM-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.8.4 - Communication of incidents_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.4.2 - Resource documentation","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements."},"originalFormulas":{}},{"id":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":43,"originalCells":{"D":"MEASURE 2.2","E":"Evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population.","F":"Do evaluations involving human subjects meet applicable requirements (including human subject protection) and  representative of the relevant population?","G":"Ensure that evaluations involving human subjects meet applicable requirements (including human subject protection) and are representative of the relevant population.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.6","O":"8.2","P":"6.6","Q":"6.4.2.3","R":"6.5","S":"5.19.6.2\n6.2.2","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.4 - AI system verification and validation","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements."},"originalFormulas":{}},{"id":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":44,"originalCells":{"D":"MEASURE 2.3","E":"AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). \n\nMeasures are documented.","F":"Are AI system performance or assurance criteria measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s)? \n\nAre measures documented?","G":"Ensure that AI system performance or assurance criteria are measured qualitatively or quantitatively and demonstrated for conditions similar to deployment setting(s). \n\nEnsure that measures are documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.6","Q":"6.3.8","R":"6.6.2","S":"3.1.25","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OV-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.7.4 - Quality of data for AI systems_x000D_\nB.6.2.6 - AI system operation and monitoring","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements."},"originalFormulas":{}},{"id":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":45,"originalCells":{"D":"MEASURE 2.4","E":"The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.","F":"Are the functionality and behavior of the AI system and its components – as identified in the MAP function –  monitored when in production?","G":"Ensure that the functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.1\n8.8.3\n9.9","O":"5","Q":"6.4.3.1","R":"5.2.3","S":"5.15.5\n5.16","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"RC.RP-04","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"9.1 - Monitoring, measurement, analysis, and evaluation_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.8 - AI system recording of event logs","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM04 Data and Model Poisoning\nLLM09 Misinformation\nLLM05 Improper Output Handling\nLLM10 Unbounded Consumption\n\nNote: Production monitoring helps detect degraded, manipulated, unsafe, or resource-abusive behavior after deployment."},"originalFormulas":{}},{"id":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":46,"originalCells":{"D":"MEASURE 2.5","E":"The AI system to be deployed is demonstrated to be valid and reliable. \n\nLimitations of the generalizability beyond the conditions under which the technology was developed are documented.","F":"Is the AI system to be deployed demonstrated to be valid and reliable?\n\nAre limitations of the generalizability beyond the conditions under which the technology was developed documented?","G":"Ensure that the AI system to be deployed is demonstrated to be valid and reliable. \n\nEnsure that limitations of the generalizability beyond the conditions under which the technology was developed are documented.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/measure-2-5","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.7\n9.11.2","Q":"5.1\n6.3.4.3\n6.4.11\n6.4.13\n6.4.14\nA.2.5\nA.3\n\n","R":"6.6.1","S":"3.5.9\n3.5.16\n5.15.2\n5.15.3\n5.15.4","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"PR.IR-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.4 - AI system verification and validation_x000D_\nB.6.2.5 - AI system deployment_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM01 Prompt Injection\nLLM07 System Prompt Leakage\nLLM06 Excessive Agency\n\nNote: Adversarial testing directly targets instruction manipulation, hidden-prompt exposure, and unsafe tool-using behavior."},"originalFormulas":{}},{"id":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":47,"originalCells":{"D":"MEASURE 2.6","E":"The AI system is evaluated regularly for safety risks – as identified in the MAP function. The AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. Safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.","F":"Is the AI system evaluated regularly for safety risks – as identified in the MAP function? \n\nIs the AI system to be deployed demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits?\n\nDoes safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures?","G":"Ensure that the AI system is evaluated regularly for safety risks – as identified in the MAP function. \n\nEnsure that the AI system to be deployed is demonstrated to be safe, its residual negative risk does not exceed the risk tolerance, and it can fail safely, particularly if made to operate beyond its knowledge limits. \n\nEnsure that safety metrics reflect system reliability and robustness, real-time monitoring, and response times for AI system failures.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/measure-2-6","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.2\n9.9\n9.11.3","O":"8.1","P":"5.6 - ISO 31000:2018","Q":"6.3.4.3","R":"6.7.2\n6.7.3","S":"Annex A","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.RM-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.8 - AI system recording of event logs_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\n8.2 - AI risk assessment","AK":"Colorado: Colorado AI Act (2024): CAIA is a comprehensive AI law addressing algorithmic discrimination (effective Feb 1, 2026); facial recognition guidelines for government use.\nMaine: Prohibits facial recognition technology use for law enforcement (2021).\nSouth Dakota: Sexual deepfake laws targeting child pornography (2024).\nTennessee: ELVIS Act (2024) against voice cloning; requires universities and local school boards to adopt AI-use policies by 2025.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA requires agencies (and in specific healthcare contexts) to prevent and detect prohibited/harmful use, and the AG can require removal/suspension of systems in violation.\nUtah: AI Policy Act (2024): Consumer protections; focus on vulnerable populations.\nWashington: Biometric consent laws (2017); political ad disclosure (2023); sexual deepfake law (2024).","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM06 Excessive Agency\nLLM10 Unbounded Consumption\n\nNote: Safety evaluation, failure behavior, and runtime monitoring are most relevant to unsafe outputs, misleading results, and runaway behavior."},"originalFormulas":{}},{"id":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":48,"originalCells":{"D":"MEASURE 2.7","E":"AI system security and resilience – as identified in the MAP function – are evaluated and documented.","F":"Are AI system security and resilience – as identified in the MAP function – evaluated and documented?","G":"Ensure that AI system security and resilience – as identified in the MAP function – are evaluated and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"8.2\n9.7\n5.4","O":"8.1","P":"5.4.1 - ISO 31000:2018","Q":"6.4.3.3","R":"4.3\n5.3\n6.4\n6.6.2\n6.7.2\n6.7.3\n6.7.5","S":"3.5.10\n3.5.16\n5.15.2\n5.15.3\n5.15.4","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.RM-06","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.7.2 - Data for development and enhancement of AI system_x000D_\nB.3.2 - AI roles and responsibilities_x000D_\nB.2.3 - Alignment with other organizational policies_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.6.2.3 - Documentation of AI system design and development_x000D_\nB.9.3 - Objectives for responsible use of AI system","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA’s language on “intentional violations,” and AG’s power to require information about model/data/metrics in case of complaints.","AL":"LLM01 Prompt Injection\nLLM04 Data and Model Poisoning\nLLM03 Supply Chain\nLLM10 Unbounded Consumption\nLLM05 Improper Output Handling\nLLM07 System Prompt Leakage\nLLM08 Vector and Embedding Weaknesses\n\nNote: Security and resilience evaluation is directly relevant to compromised dependencies, poisoned components, and harmful outputs."},"originalFormulas":{}},{"id":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":49,"originalCells":{"D":"MEASURE 2.8","E":"Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.","F":"Are risks associated with transparency and accountability – as identified in the MAP function – examined and documented?","G":"Ensure that risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"7.1\n9.2","O":"8.1","P":"5.4.1 - ISO 31000:2018","Q":"5.3\n6.3.4.3\n6.3.8.3\n6.4.3.3\n6.4.9.3\n6.4.14.3","R":"4.1\n4.2\n4.3\n5.3\n6.2\n6.3\n6.6.1\n6.7.2\n6.7.3\n6.7.4\nA.1.3","S":"3.5.2\n3.5.14\n3.5.15\n3.5.16\n5.15.8\n5.18\n6.1\n6.2.2\n7.4.1\n","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.RR-01","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.7.2 - Data for development and enhancement of AI system_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.9.3 - Objectives for responsible use of AI system_x000D_\n6.1.2 - AI risk assessment","AK":"Colorado: Colorado AI Act (2024): CAIA requires a duty to report algorithmic discrimination risk to Attorney General and NIST captures transparency/accountability risks and mandates traceable incident responses.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.\nUtah: AI Policy Act (2024): Requirement for prominent GenAI disclosure in professions requiring state licensure, such as healthcare, accounting, and law is part of this transparency/accountability dimension. Ensuring it's implemented and traceable fits this subcategory around evaluating transparency and accountability risks—whether disclosure mechanisms function correctly."},"originalFormulas":{}},{"id":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":50,"originalCells":{"D":"MEASURE 2.9","E":"The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.","F":"Is the AI model explained, validated, and documented, and AI system output interpreted within its context – as identified in the MAP function – to inform responsible use and governance?","G":"Ensure that the AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.3.4\n9.3.6\n9.10.2","O":"8.1","Q":"6.4.3.3\n6.4.9.3","R":"4.2\n5.5\n6.4\n6.7.1\n6.7.3\n6.7.4\n","S":"3.5.7\n5.15.6\n6.1","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.RR-01","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.7.5 - Data provenance_x000D_\nB.6.2.5 - AI system deployment_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM02 Sensitive Information Disclosure\n \nNote: Validation and contextual interpretation help prevent unsafe downstream use of incorrect, misleading, or sensitive output."},"originalFormulas":{}},{"id":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":51,"originalCells":{"D":"MEASURE 2.10","E":"Privacy risk of the AI system – as identified in the MAP function – is examined and documented.","F":"Is privacy risk of the AI system – as identified in the MAP function – examined and documented?","G":"Ensure that privacy risk of the AI system – as identified in the MAP function – is examined and documented.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/measure-2-10","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.6\n9.10.4","O":"8.1","P":"5.4.1 - ISO 31000:2018","Q":"5.1\n6.3.4.3\n6.4.1.3\n6.4.3.3\n6.4.8.3\n6.4.17.3\n","R":"5.3\n6.4\n6.6.2\n6.7.2\n6.7.3\n6.7.5\nA.3","S":"5.19.6.2\n6.1\n6.2.2\n8.6.2\nAnnex A","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.5.2 - AI system impact assessment process_x000D_\nB.7.2 - Data for development and enhancement of AI system_x000D_\nB.7.3 - Acquisition of data_x000D_\nB.2.3 - Alignment with other organizational policies","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is explicitly required for biometric data and anti-discrimination; other forms encouraged as best practice.","AL":"LLM02 Sensitive Information Disclosure\n\nNote: Privacy risk evaluation maps directly to disclosure of personal, training, or confidential information."},"originalFormulas":{}},{"id":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":52,"originalCells":{"D":"MEASURE 2.11","E":"Fairness and bias – as identified in the MAP function – are evaluated and results are documented.","F":"Are fairness and bias – as identified in the MAP function – evaluated and results documented?","G":"Ensure that Fairness and bias – as identified in the MAP\nfunction – are evaluated and results are documented.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/measure-2-11","J":"✓","K":"✓","L":"✓","M":"✓","N":"8.4","O":"6.3\n8.1\n8.3\nA.2.2.2","P":"5.4.1 - ISO 31000:2018","Q":"5.1\n6.3.4.3\n6.3.8.3\n6.4.3.3\n6.4.14.3\n","R":"4.2\n5.4\n6.4\n6.5\n6.7.2\n6.7.4\n","S":"3.2.2\n3.5.4\n5.10\n5.15.9\n7.4.1\nAnnex A\n","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.5.5 - Assessing societal impacts of AI systems_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals","AK":"Georgia: Early sexual deepfake laws (2021 and 2024); considering AI profiling bills.\nIllinois: Biometric Information Privacy Act (2008); restricts AI use in hiring process; sexual deepfake laws (2023-2024).\nMichigan: Election deepfake laws (2023).\nNew York: Criminalized sexual deepfakes (2023); requires disclaimers for political deepfakes (2024).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is explicitly required for biometric data and anti-discrimination; other forms encouraged as best practice."},"originalFormulas":{}},{"id":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":53,"originalCells":{"D":"MEASURE 2.12","E":"Environmental impact and sustainability of AI model training and management activities – as identified in the MAP function – are assessed and documented.","F":"Are environmental impact and sustainability of AI model training and management activities – as identified in the MAP function – assessed and documented?","G":"Ensure that environmental impact and sustainability of AI model training and management activities – as identified in the MAP function – are assessed and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"5.5\n8.7\n9.10.5","O":"6.2.7\n","P":"6.4.2\n6.4.3","Q":"6.4.2.3\n6.4.17.1","R":"6.5\n6.7.4","S":"5.15.2\n6.2.2","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.5.5 - Assessing societal impacts of AI systems_x000D_\nB.4.5 - System and computing resources","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements."},"originalFormulas":{}},{"id":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":54,"originalCells":{"D":"MEASURE 2.13","E":"Effectiveness of the employed Test & Evaluation, Validation & Verification (TEVV) metrics and processes in the MEASURE function are evaluated and documented.","F":"Is effectiveness of the employed Test & Evaluation, Validation & Verification (TEVV) metrics and processes in the MEASURE function evaluated and documented?","G":"Ensure that effectiveness of the employed Test & Evaluation, Validation & Verification (TEVV) metrics and processes in the MEASURE function are evaluated and documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.3\n","O":"8.2","P":"5.4.4","Q":"6.3.8","R":"4.3\n6.6.1\n6.6.2","S":"6.2.6","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OV-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements."},"originalFormulas":{}},{"id":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":55,"originalCells":{"B":"MEASURE 3","C":"Mechanisms for tracking identified AI risks over time are in place.","D":"MEASURE 3.1","E":"Approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts.","F":"Are approaches, personnel, and documentation in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts?","G":"Ensure that approaches, personnel, and documentation are in place to regularly identify and track existing, unanticipated, and emergent AI risks based on factors such as intended and actual performance in deployed contexts.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2.5","O":"8.7","Q":"6.4.3.3\n6.4.12.3\n6.4.13.3\n6.4.15.3\n6.4.16.1","R":"6.7","S":"3.5.11\n5.18\n6.1\n6.2.2\n6.2.3\n6.2.4\n6.2.5\n6.2.6\n6.2.7\n6.2.8\n7.4.3\nAnnex A","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"ID.IM-01\nID.IM-02\nID.IM-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"8.2 - AI risk assessment_x000D_\n4.4 - AI management system_x000D_\n8.4 - AI system impact assessment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM04 Data and Model Poisoning\nLLM09 Misinformation\nLLM05 Improper Output Handling\n\nNote: Ongoing tracking of emergent risks is most relevant to drift, degradation, and incorrect or unsafe behavior in production."},"originalFormulas":{}},{"id":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":56,"originalCells":{"D":"MEASURE 3.2","E":"Risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available.","F":"Are risk tracking approaches considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available?","G":"Ensure that risk tracking approaches are considered for settings where AI risks are difficult to assess using currently available measurement techniques or where metrics are not yet available.","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","Q":"6.4.3.3\n6.4.11.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","R":"5.3\n6.7","S":"6.1\n6.2.4\n6.2.6\n6.2.8","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"ID.RA-06\nID.RA-07","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.8 - AI system recording of event logs_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\n10.1 - Continual improvement","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements."},"originalFormulas":{}},{"id":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":57,"originalCells":{"D":"MEASURE 3.3","E":"Feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.","F":"Are feedback processes for end users and impacted communities to report problems and appeal system outcomes established and integrated into AI system evaluation metrics?","G":"Ensure that feedback processes for end users and impacted communities to report problems and appeal system outcomes are established and integrated into AI system evaluation metrics.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.4.2","O":"7.6","Q":"6.4.2.3\n6.4.15.3","R":"5.2.3\n5.4","S":"5.19.6.3","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OC-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.8.2 - System documentation and information for users_x000D_\nB.8.4 - Communication of incidents_x000D_\nB.8.3 - External reporting","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM06 Excessive Agency\n\nNote: User and community feedback helps identify harmful outputs, bad outcomes, and inappropriate autonomous behavior."},"originalFormulas":{}},{"id":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":58,"originalCells":{"B":"MEASURE 4","C":"Feedback about efficacy of measurement is gathered and assessed.","D":"MEASURE 4.1","E":"Measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. Approaches are documented.","F":"Are measurement approaches for identifying AI risks connected to deployment context(s) and informed through consultation with domain experts and other end users?\n\nAre approaches documented?","G":"Ensure that measurement approaches for identifying AI risks are connected to deployment context(s) and informed through consultation with domain experts and other end users. \n\nEnsure that approaches are documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.4.2","P":"5.4.5","Q":"6.4.2.1","R":"4.1\n4.3\n5.5\n6.1\n6.2\n6.4\n6.5\n6.6.1\n6.7.1\nA.1.3\nA.3","S":"6.2.6","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"ID.RA-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.6.2.4 - AI system verification and validation_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\n9.1 - Monitoring, measurement, analysis, and evaluation","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM02 Sensitive Information Disclosure\n\nNote: Context-aware measurement informed by experts improves detection of misleading, unsafe, or privacy-invasive system behavior."},"originalFormulas":{}},{"id":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":59,"originalCells":{"D":"MEASURE 4.2","E":"Measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. \n\nResults are documented.","F":"Are measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle  informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended? \n\nAre results documented?","G":"Ensure that measurement results regarding AI system trustworthiness in deployment context(s) and across the AI lifecycle are informed by input from domain experts and relevant AI actors to validate whether the system is performing consistently as intended. \n\nEnsure that results are documented.","J":"✓","K":"✓","L":"✓","M":"✓","N":"9.10.2","O":"7.7","Q":"6.4.7.1\n6.4.7.3\n6.4.9.4","R":"4.1\n4.3\n5.5\n6.1\n6.2\n6.4\n6.5\n6.6.1\n6.7.1\nA.1.3\nA.3","S":"6.2.6","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"ID.RA-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"9.1 - Monitoring, measurement, analysis, and evaluation_x000D_\nB.8.2 - System documentation and information for users_x000D_\n9.2.1 - General_x000D_\nB.8.3 - External reporting","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM06 Excessive Agency\n\nNote: Expert validation of trustworthiness in deployment context helps detect output inconsistency and unsafe autonomy."},"originalFormulas":{}},{"id":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":60,"originalCells":{"D":"MEASURE 4.3","E":"Measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context relevant risks and trustworthiness characteristics are identified and documented.","F":"Are measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context relevant risks and trustworthiness characteristics identified and documented?","G":"Ensure that measurable performance improvements or declines based on consultations with relevant AI actors, including affected communities, and field data about context relevant risks and trustworthiness characteristics are identified and documented.","J":"✓","K":"✓","L":"✓","M":"✓","O":"7.2","P":"5.4.5 - ISO 31000:2018\n6.2 - ISO 31000:2018","Q":"6.2.5.3\n6.3.1.3\n6.3.5.3\n6.4.3.1\n6.4.3.3\n6.4.9.3\n6.4.12.3\n6.4.13.3\n6.4.14.1\n6.4.14.3\n6.4.15.1\n","R":"6.1","S":"6.1\n6.2.7","T":"To ensure objective, repeatable, or scalable test, evaluation, verification, and validation (TEVV) processes including metrics, methods, and methodologies are in place, followed, and documented.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"ID.RA-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"9.3.1 - General_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.7 - AI system technical documentation","AK":"Delaware: Created AI Commission (2024); requires annual inventory of generative AI use and identification of high-risk areas.\nIndiana: Studying AI risks through Commerce and Economic Development Committee (2023).\nKentucky: Interim Committee briefing on AI bias and impact on jobs (2023).\nMaryland: HB1314 (2025): Prohibits AI denial of healthcare prior authorizations (effective Jan 1, 2026).\nMinnesota: Restricts AI use in entertainment industry (2025); drone facial recognition technology warrant requirements for law enforcement use (2020).\nNorth Carolina: Sexual deepfake laws (2024); $3.5M AI healthcare study funding.\nOregon: Political campaign AI disclosure (2024); facial recognition technology prohibition for police bodycams (2015).\nRhode Island: Lawmakers requires AI system review (2023).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.\nVermont: Moratorium on facial recognition technology expect for investigating child sexual exploitation (2019 and 2021); sexual deepfake laws (2024).\nWisconsin: AI workforce and election task forces (2023); political and sexual deepfake laws (2024).","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM06 Excessive Agency\n\nNote: Expert validation of trustworthiness in deployment context helps detect output inconsistency and unsafe autonomy."},"originalFormulas":{}},{"id":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":61,"originalCells":{"A":"MANAGE","B":"MANAGE 1","C":"AI risks based on assessments and other analytical output from the MAP and MEASURE functions are prioritized, responded to, and managed.","D":"MANAGE 1.1","E":"A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed.","F":"Is a determination made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed?","G":"Ensure that a determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed.","J":"✓","K":"✓","L":"✓","M":"✓","O":"6.5.3.5\n7.6\n8.5","P":"6.4.3.2\n6.7","Q":"6.4.13.1\n6.4.17.1\nA.2.5","R":"4.2\n4.3\n5.3\n6.4\n6.7.4\n6.7.5","S":"3.1.35\n5.3\n5.11.4\n5.14.3\n6.1\n6.2.8\n7.1\n8.2\n8.3","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.OC-04","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.9.3 - Objectives for responsible use of AI system_x000D_\nB.9.2 - Processes for responsible use of AI systems_x000D_\nB.9.4 - Intended use of the AI system_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.4 - AI system verification and validation","AK":"Colorado: Colorado AI Act (2024): CAIA requires impact assessments and risk management programs for deployers and NIST formalizes risk treatments and post-deployment monitoring.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM06 Excessive Agency\n\nNote: Determining go/no-go suitability depends heavily on whether output behavior, accuracy, and autonomy are acceptable."},"originalFormulas":{}},{"id":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":62,"originalCells":{"D":"MANAGE 1.2","E":"Treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods.","F":"Is treatment of documented AI risks prioritized based on impact, likelihood, and available resources or methods?","G":"Ensure that treatment of documented AI risks is prioritized based on impact, likelihood, and available resources or methods.","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","P":"6.1 - ISO 31000:2018\n6.4.3.3\n6.5.1 - ISO 31000:2018\n6.5.2 - ISO 310008:2018\n6.5.3 - ISO 31000:2018","Q":"6.3.4.3","R":"6.4\n6.7","S":"6.1\n6.2.2\n6.2.3\n6.2.4\n6.2.5\n6.2.8","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"GV.RM-06","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"9.3.3 - Management review results_x000D_\n6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment_x000D_\n6.1.4 - AI system impact assessment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors."},"originalFormulas":{}},{"id":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":63,"originalCells":{"D":"MANAGE 1.3","E":"Responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. \n\nRisk response options can include mitigating, transferring, avoiding, or accepting.","F":"Are responses to the AI risks deemed high priority, as identified by the MAP function, developed, planned, and documented?\n\nDoes risk response options include mitigating, transferring, avoiding, or accepting?","G":"Ensure that responses to the AI risks deemed high priority, as identified by the MAP function, are developed, planned, and documented. \n\nEnsure that risk response options include mitigating, transferring, avoiding, or accepting.","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","P":"6.5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","Q":"6.3.4.3","R":"6.5\n6.7.5","S":"Annex A","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"GV.RM-06","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"6.1.1 - General_x000D_\n6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment_x000D_\n6.1.4 - AI system impact assessment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA requires remediation where prohibited activities are discovered (with notice/cure periods).\nUtah: AI Policy Act (2024): UAIPA establishes a Regulatory Sandbox (AI Learning Laboratory), which supports experimental testing with oversight; allows measured, temporary deviations from full compliance.","AL":"LLM01 Prompt Injection\nLLM02 Sensitive Information Disclosure\nLLM03 Supply Chain\nLLM04 Data and Model Poisoning\nLLM05 Improper Output Handling\nLLM06 Excessive Agency\nLLM07 System Prompt Leakage\nLLM08 Vector and Embedding Weaknesses\nLLM09 Misinformation\nLLM10 Unbounded Consumption\n\nNote: Response planning can address the full set of major OWASP LLM risks depending on the selected treatment strategy."},"originalFormulas":{}},{"id":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":64,"originalCells":{"D":"MANAGE 1.4","E":"Negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented.","F":"Are negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users documented?","G":"Ensure that negative residual risks (defined as the sum of all unmitigated risks) to both downstream acquirers of AI systems and end users are documented.","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","P":"6.5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","Q":"6.3.4.3\n6.4.1.3","R":"3.2.2\n5.5","S":"5.18","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"GV.RM-06","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM02 Sensitive Information Disclosure\n\nNote: Residual risk documentation is especially relevant when harmful outputs, misinformation, or exposure could reach downstream users."},"originalFormulas":{}},{"id":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":65,"originalCells":{"B":"MANAGE 2","C":"Strategies to maximize AI benefits and minimize negative impacts are planned, prepared, implemented, documented, and informed by input from relevant AI actors.","D":"MANAGE 2.1","E":"Resources required to manage AI risks are taken into account – along with viable non-AI alternative systems, approaches, or methods – to reduce the magnitude or likelihood of potential impacts.","F":"Are resources required to manage AI risks taken into account – along with viable non-AI alternative systems, approaches, or methods – to reduce the magnitude or likelihood of potential impacts?","G":"Ensure that resources required to manage AI risks are taken into account – along with viable non-AI alternative systems, approaches, or methods – to reduce the magnitude or likelihood of potential impacts.","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","P":"5.4.3 - ISO 31000:2018\n5.4.4 - ISO 31000:2018","Q":"6.3.4","R":"6.7.3","S":"5.18","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"GV.RM-06","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.4.2 - Resource documentation_x000D_\n7.1 - Resources","AK":"Colorado: Colorado AI Act (2024): CAIA requires impact assessments and risk management programs for deployers and NIST formalizes risk treatments and post-deployment monitoring.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","AL":"LLM03 Supply Chain\nLLM04 Data and Model Poisoning\nLLM10 Unbounded Consumption\n\nNote: Resource planning and alternative methods help reduce reliance on vulnerable components and limit operational abuse."},"originalFormulas":{}},{"id":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":66,"originalCells":{"D":"MANAGE 2.2","E":"Mechanisms are in place and applied to sustain the value of deployed AI systems.","F":"Are mechanisms in place and applied to sustain the value of deployed AI systems?","G":"Ensure that mechanisms are in place and applied to sustain the value of deployed AI systems.","J":"✓","K":"✓","L":"✓","M":"✓","P":"5.4.1 - ISO 31000:2018\n6.4.2.2","Q":"6.4.2.3\n6.4.13.3","R":"4.1","S":"5.15.1","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"GV.RM-06","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.3.3 - Reporting of concerns_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.7.2 - Data for development and enhancement of AI system_x000D_\n7.1 - Resources_x000D_\n10.1 - Continual improvement","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.\nUtah: AI Policy Act (2024): UAIPA establishes a Regulatory Sandbox (AI Learning Laboratory), which supports experimental testing with oversight; allows measured, temporary deviations from full compliance.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM06 Excessive Agency\n\nNote: Sustaining value in deployment usually requires managing bad outputs, drift, and unchecked agent behavior."},"originalFormulas":{}},{"id":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":67,"originalCells":{"D":"MANAGE 2.3","E":"Procedures are followed to respond to and recover from a previously unknown risk when it is identified.","F":"Are procedures followed to respond to and recover from a previously unknown risk when it is identified?","G":"Procedures are followed to respond to and recover from a previously unknown risk when it is identified.","J":"✓","K":"✓","L":"✓","M":"✓","P":"5.2\n5.3","Q":"6.4.15.3\n6.4.16.1\n","R":"4.2","S":"3.5.10\n5.15.4","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"RC.RP-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"10.2 - Nonconformity and corrective action_x000D_\n6.1.1 - General_x000D_\n6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA states that if notified by AG, systems must be suspended or removed to avoid liability. AG has statutory removal/cure enforcement power.","AL":"LLM03 Supply Chain\nLLM04 Data and Model Poisoning\nLLM05 Improper Output Handling\nLLM06 Excessive Agency\nLLM09 Misinformation\nLLM10 Unbounded Consumption\n\nNote: Recovery from a previously unknown risk commonly involves poisoned inputs, degraded behavior, unsafe output, or runaway consumption."},"originalFormulas":{}},{"id":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":68,"originalCells":{"D":"MANAGE 2.4","E":"Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.","F":"Are mechanisms in place and applied, and responsibilities assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use?","G":"Mechanisms are in place and applied, and responsibilities are assigned and understood, to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/manage-2-4","J":"✓","K":"✓","L":"✓","M":"✓","P":"6.3.4 - ISO 31000:2018\n6.4.2.4\n6.4.2.5\n6.4.2.6\n6.5.2 - ISO 31000:2018","Q":"6.4.17.1","R":"3.2.3\n6.7\n","S":"3.1.22\n5.17\n6.1\n6.2.9\nAnnex A","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","W":"✓","X":"✓","Y":"✓","Z":"✓","AA":"✓","AB":"RC.RP-02","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.9.4 - Intended use of the AI system_x000D_\nB.8.2 - System documentation and information for users_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA states that if notified by AG, systems must be suspended or removed to avoid liability. AG has statutory removal/cure enforcement power.","AL":"LLM05 Improper Output Handling\nLLM06 Excessive Agency\nLLM09 Misinformation\nLLM10 Unbounded Consumption\n\nNote: Deactivating systems inconsistent with intended use directly addresses unsafe output, autonomy, and resource overuse."},"originalFormulas":{}},{"id":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":69,"originalCells":{"B":"MANAGE 3","C":"AI risks and benefits from third-party entities are managed.","D":"MANAGE 3.1","E":"AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.","F":"Are AI risks and benefits from third-party resources regularly monitored, and risk controls applied and documented?","G":"Ensure that AI risks and benefits from third-party resources are regularly monitored, and risk controls are applied and documented.","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.1","P":"5.4.1","Q":"6.3.5.3\n6.3.8.3","R":"6.7.2","S":"6.1\n6.2.4\n6.2.6\n6.2.8","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"GV.SC-07","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.10.3 - Suppliers_x000D_\nB.10.2 - Allocating responsibilities","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA imposes statutory liability, including for deployers using third-party AI or datasets if laws are violated (biometric, child protection, unlawful discrimination, etc.).","AL":"LLM03 Supply Chain\nLLM04 Data and Model Poisoning\nLLM02 Sensitive Information Disclosure\n\nNote: Third-party resource monitoring directly addresses vendor, model, and supply-chain risks."},"originalFormulas":{}},{"id":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":70,"originalCells":{"D":"MANAGE 3.2","E":"Pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance.","F":"Are pre-trained models which are used for development monitored as part of AI system regular monitoring and maintenance?","G":"Ensure that pre-trained models which are used for development are monitored as part of AI system regular monitoring and maintenance.","J":"✓","K":"✓","L":"✓","M":"✓","O":"3.1.3\n3.1.4\n6.2.1\n6.2.2\n6.3\n6.5.1\n6.5.3\n6.5.5\n7.2\n7.3\n7.4\n7.7\n8.4\n8.5\n8.6\n8.7\nA.2.2.3","Q":"5.3\n6.1.1.3\n6.3.4","R":"A.1.3","S":"3.3.10\n3.3.14\n5.11.6\n5.11.7\n5.11.8\n5.11.9.1\n8.6.2\n10.4","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"GV.SC-07","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"B.4.4 - Tooling resources_x000D_\nB.6.2.6 - AI system operation and monitoring","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","AL":"LLM03 Supply Chain\nLLM04 Data and Model Poisoning\nLLM09 Misinformation\n\nNote: Monitoring pre-trained models helps detect upstream compromise, poisoning, or quality degradation."},"originalFormulas":{}},{"id":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":71,"originalCells":{"B":"MANAGE 4","C":"Risk treatments, including response and recovery, and communication plans for the identified and measured AI risks are documented and monitored regularly.","D":"MANAGE 4.1","E":"Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.","F":"Are post-deployment AI system monitoring plans implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management?","G":"Ensure that post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.","J":"✓","K":"✓","L":"✓","M":"✓","O":"8.2\n8.6","P":"5.4.2\n6.6 - ISO 31000:2018","Q":"6.4.15\n6.4.16","R":"5.2.3","S":"6.1\n6.2.9\nAnnex A","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"GV.SC-07","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"9.2.1 - General_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.8.3 - External reporting_x000D_\nB.10.4 - Customers","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","AL":"LLM01 Prompt Injection\nLLM02 Sensitive Information Disclosure\nLLM05 Improper Output Handling\nLLM06 Excessive Agency\nLLM07 System Prompt Leakage\nLLM09 Misinformation\nLLM10 Unbounded Consumption\n\nNote: Post-deployment monitoring with appeals, override, incident response, recovery, and decommissioning covers most operational LLM risk classes."},"originalFormulas":{}},{"id":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":72,"originalCells":{"D":"MANAGE 4.2","E":"Measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors.","F":"Are measurable activities for continual improvements integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors?","G":"Ensure that measurable activities for continual improvements are integrated into AI system updates and include regular engagement with interested parties, including relevant AI actors.","J":"✓","K":"✓","L":"✓","M":"✓","O":"6.5.4.1\n7.4\nA.3.2\nA.3.4","P":"5.7.1 ISO 31000:2018\n5.7.2 - ISO 31000:2018","Q":"6.1.2.3\n6.4.14","R":"6.2\n6.7.4","S":"6.1\n6.2.7","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"ID.IM-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"9.3.3 - Management review results_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring","AK":"Colorado: Colorado AI Act (2024): CAIA requires impact assessments and risk management programs for deployers and NIST formalizes risk treatments and post-deployment monitoring.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","AL":"LLM05 Improper Output Handling\nLLM06 Excessive Agency\nLLM09 Misinformation\n\nNote: Continual improvement and stakeholder engagement help reduce recurring harmful outputs and unsafe behavior over time."},"originalFormulas":{}},{"id":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"99 TAIM Source","row":73,"originalCells":{"D":"MANAGE 4.3","E":"Incidents and errors are communicated to relevant AI actors, including affected communities. \n\nProcesses for tracking, responding to, and recovering from incidents and errors are followed and documented.","F":"Are incidents and errors communicated to relevant AI actors, including affected communities?\n\nAre processes for tracking, responding to, and recovering from incidents and errors followed and documented?","G":"Ensure that incidents and errors are communicated to relevant AI actors, including affected communities. \n\nEnsure that processes for tracking, responding to, and recovering from incidents and errors are followed and documented.","H":"✓","I":"https://ai-incidents.projectcerebellum.com/taim/manage-4-3","J":"✓","K":"✓","L":"✓","M":"✓","O":"3.1.4\nA.2.2.2","P":"6.5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","Q":"6.4.3.3\n6.4.15.3","R":"4.3\n6.1\n6.4\n6.7.3","S":"6.2.6","T":"To ensure that plans for prioritizing risk and regular monitoring and improvement are in place.","U":"✓","V":"✓","Y":"✓","Z":"✓","AB":"RC.CO-03","AC":"✓","AD":"✓","AE":"✓","AF":"✓","AG":"✓","AH":"✓","AI":"✓","AJ":"9.3.2 - Management review inputs_x000D_\nB.8.5 - Information for interested parties_x000D_\nB.6.2.6 - AI system operation and monitoring","AK":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","AL":"LLM05 Improper Output Handling\nLLM09 Misinformation\nLLM02 Sensitive Information Disclosure\n\nNote: Communicating incidents and errors is most relevant when bad output, misinformation, or disclosure affects users and communities."},"originalFormulas":{}},{"id":"ROW-96a38ebab06ea9cb3a65a994","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":5,"originalCells":{"A":"POL-01","B":"AI Governance and Accountability","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required","F":"Core baseline","H":"OP-09; AU-04; OP-07","J":"1","K":"Missing","L":"0","M":"High","N":"Policy + charter + minutes","O":"Chief AI / Risk Officer"},"originalFormulas":{"L5":"IF(K5=\"Missing\",0,IF(K5=\"Draft\",20,IF(K5=\"Approved\",40,IF(K5=\"Implemented\",65,IF(K5=\"Operating\",85,IF(K5=\"Tested\",100,0))))))"}},{"id":"ROW-9ca2c025b0be78c5fa53efc4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":6,"originalCells":{"A":"POL-02","B":"AI Acceptable Use","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required","F":"Core baseline","H":"IN-07; OU-06; OU-07","J":"1","K":"Missing","L":"0","M":"High","N":"Policy + attestation","O":"CISO / Legal / HR"},"originalFormulas":{"L6":"IF(K6=\"Missing\",0,IF(K6=\"Draft\",20,IF(K6=\"Approved\",40,IF(K6=\"Implemented\",65,IF(K6=\"Operating\",85,IF(K6=\"Tested\",100,0))))))"}},{"id":"ROW-1883b9fcaf40536aa40f98d7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":7,"originalCells":{"A":"POL-03","B":"Approved AI Tools and Shadow AI","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required","F":"Core baseline","H":"AU-01; AU-02; AU-08","J":"1","K":"Missing","L":"0","M":"High","N":"Policy + inventory + egress logs","O":"CISO / IT"},"originalFormulas":{"L7":"IF(K7=\"Missing\",0,IF(K7=\"Draft\",20,IF(K7=\"Approved\",40,IF(K7=\"Implemented\",65,IF(K7=\"Operating\",85,IF(K7=\"Tested\",100,0))))))"}},{"id":"ROW-64cf0ed804f6f5363102ae87","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":8,"originalCells":{"A":"POL-04","B":"Data Classification for AI","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required","F":"Core baseline","H":"DP-01; DP-02; DP-03; DP-04; DP-05; DP-06; DP-07; DP-08; DP-09; DP-10; DP-11; DP-12; DP-13; DP-14; DP-15; DP-16; DP-17; DP-18; AU-05; AU-06","J":"1","K":"Missing","L":"0","M":"High","N":"Standard + decision matrix + DLP events","O":"Data Protection / Security"},"originalFormulas":{"L8":"IF(K8=\"Missing\",0,IF(K8=\"Draft\",20,IF(K8=\"Approved\",40,IF(K8=\"Implemented\",65,IF(K8=\"Operating\",85,IF(K8=\"Tested\",100,0))))))"}},{"id":"ROW-ceaf917e903e8907ab081b0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":9,"originalCells":{"A":"POL-05","B":"Prompt and Output Interaction","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required","F":"Core baseline","H":"OU-01; OU-02; OU-03; OU-04; OU-05; OU-06; OU-07; OU-08; OU-09; OU-10; OU-11; OU-12","J":"1","K":"Missing","L":"0","M":"High","N":"Policy + runtime events","O":"AI Product / Compliance"},"originalFormulas":{"L9":"IF(K9=\"Missing\",0,IF(K9=\"Draft\",20,IF(K9=\"Approved\",40,IF(K9=\"Implemented\",65,IF(K9=\"Operating\",85,IF(K9=\"Tested\",100,0))))))"}},{"id":"ROW-220b71b05d69c729b91f6c15","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":10,"originalCells":{"A":"POL-06","B":"Privacy and Personal Data","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required where personal data exists","F":"Core baseline","H":"DP-05; DP-06; DP-07; DP-08; DP-09; DP-10; DP-11; OU-11","J":"1","K":"Missing","L":"0","M":"High","N":"Privacy policy + DPIA + configuration","O":"DPO / Privacy"},"originalFormulas":{"L10":"IF(K10=\"Missing\",0,IF(K10=\"Draft\",20,IF(K10=\"Approved\",40,IF(K10=\"Implemented\",65,IF(K10=\"Operating\",85,IF(K10=\"Tested\",100,0))))))"}},{"id":"ROW-77ec1167bfad52f3f9c58084","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":11,"originalCells":{"A":"POL-07","B":"AI Security and Prompt Injection","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required","F":"Core baseline","H":"IN-01; IN-02; IN-03; IN-04; IN-05; DP-15","J":"1","K":"Missing","L":"0","M":"High","N":"Security standard + tests + events","O":"CISO / AppSec"},"originalFormulas":{"L11":"IF(K11=\"Missing\",0,IF(K11=\"Draft\",20,IF(K11=\"Approved\",40,IF(K11=\"Implemented\",65,IF(K11=\"Operating\",85,IF(K11=\"Tested\",100,0))))))"}},{"id":"ROW-c3a4023c8ece1262261f76ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":12,"originalCells":{"A":"POL-08","B":"High-Impact AI and Human Oversight","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required for consequential use","F":"Core baseline","H":"OU-04; OU-05; AG-03; AG-04; OP-05","J":"1","K":"Missing","L":"0","M":"High","N":"Impact assessment + approval + logs","O":"Risk / Legal / Business owner"},"originalFormulas":{"L12":"IF(K12=\"Missing\",0,IF(K12=\"Draft\",20,IF(K12=\"Approved\",40,IF(K12=\"Implemented\",65,IF(K12=\"Operating\",85,IF(K12=\"Tested\",100,0))))))"}},{"id":"ROW-f10db7a3fc71cd58d20f9b9a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":13,"originalCells":{"A":"POL-09","B":"AI Impact Assessment and Risk Acceptance","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required","F":"Core baseline","H":"AU-04; OP-06; OP-07","J":"1","K":"Missing","L":"0","M":"High","N":"Assessment + approval","O":"Enterprise Risk"},"originalFormulas":{"L13":"IF(K13=\"Missing\",0,IF(K13=\"Draft\",20,IF(K13=\"Approved\",40,IF(K13=\"Implemented\",65,IF(K13=\"Operating\",85,IF(K13=\"Tested\",100,0))))))"}},{"id":"ROW-f57ae840ce101882a829a7b6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":14,"originalCells":{"A":"POL-10","B":"Evaluation, Red Team and Benchmarking","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required","F":"Core baseline","H":"OP-03; OP-12","J":"1","K":"Missing","L":"0","M":"High","N":"Test evidence","O":"AI Assurance / Model Risk"},"originalFormulas":{"L14":"IF(K14=\"Missing\",0,IF(K14=\"Draft\",20,IF(K14=\"Approved\",40,IF(K14=\"Implemented\",65,IF(K14=\"Operating\",85,IF(K14=\"Tested\",100,0))))))"}},{"id":"ROW-7220351995c84a97eb742df1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":15,"originalCells":{"A":"POL-11","B":"AI Monitoring and Logging","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required","F":"Core baseline","H":"OP-01; OP-02; OP-03","J":"1","K":"Missing","L":"0","M":"High","N":"Logs + monitoring evidence","O":"Security Operations / Platform"},"originalFormulas":{"L15":"IF(K15=\"Missing\",0,IF(K15=\"Draft\",20,IF(K15=\"Approved\",40,IF(K15=\"Implemented\",65,IF(K15=\"Operating\",85,IF(K15=\"Tested\",100,0))))))"}},{"id":"ROW-4fd103fa040bc68a148e5205","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":16,"originalCells":{"A":"POL-12","B":"AI Incident Response and Kill Switch","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required","F":"Core baseline","H":"OP-04; OP-05","J":"1","K":"Missing","L":"0","M":"High","N":"Plan + drill + incident evidence","O":"CISO / Incident Response"},"originalFormulas":{"L16":"IF(K16=\"Missing\",0,IF(K16=\"Draft\",20,IF(K16=\"Approved\",40,IF(K16=\"Implemented\",65,IF(K16=\"Operating\",85,IF(K16=\"Tested\",100,0))))))"}},{"id":"ROW-05d4495743694292dd58efc5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":17,"originalCells":{"A":"POL-13","B":"Vendor and AI Procurement","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required for third parties","F":"Core baseline","H":"AU-05; AU-06; OP-10","J":"1","K":"Missing","L":"0","M":"High","N":"Contract + assessment","O":"Procurement / Legal / Security"},"originalFormulas":{"L17":"IF(K17=\"Missing\",0,IF(K17=\"Draft\",20,IF(K17=\"Approved\",40,IF(K17=\"Implemented\",65,IF(K17=\"Operating\",85,IF(K17=\"Tested\",100,0))))))"}},{"id":"ROW-55413a8273bc58566f8b0c7d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":18,"originalCells":{"A":"POL-14","B":"Agentic AI and Connectors","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required where tools/actions exist","F":"Core baseline","H":"AG-01; AG-02; AG-03; AG-04; AG-05; AG-06; AG-07; AG-08; AG-09; IN-08","J":"1","K":"Missing","L":"0","M":"High","N":"Policy + tool logs + approvals","O":"AI Platform / Security"},"originalFormulas":{"L18":"IF(K18=\"Missing\",0,IF(K18=\"Draft\",20,IF(K18=\"Approved\",40,IF(K18=\"Implemented\",65,IF(K18=\"Operating\",85,IF(K18=\"Tested\",100,0))))))"}},{"id":"ROW-ac9757141b31b29e4a097326","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":19,"originalCells":{"A":"POL-15","B":"AI Secure Development Lifecycle","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required for built AI","F":"Core baseline","H":"OU-08; OU-09; OP-06; OP-12","J":"1","K":"Missing","L":"0","M":"High","N":"SDLC records + tests","O":"Engineering / AppSec"},"originalFormulas":{"L19":"IF(K19=\"Missing\",0,IF(K19=\"Draft\",20,IF(K19=\"Approved\",40,IF(K19=\"Implemented\",65,IF(K19=\"Operating\",85,IF(K19=\"Tested\",100,0))))))"}},{"id":"ROW-3fe25bf3408d412c42601d11","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":20,"originalCells":{"A":"POL-16","B":"Bias, Fairness and Civil Rights","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required for people-impacting AI","F":"Core baseline","H":"OU-05","J":"1","K":"Missing","L":"0","M":"High","N":"Fairness assessment + monitoring","O":"Legal / Model Risk"},"originalFormulas":{"L20":"IF(K20=\"Missing\",0,IF(K20=\"Draft\",20,IF(K20=\"Approved\",40,IF(K20=\"Implemented\",65,IF(K20=\"Operating\",85,IF(K20=\"Tested\",100,0))))))"}},{"id":"ROW-96ddd6557299ae7b26f47285","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":21,"originalCells":{"A":"POL-17","B":"Transparency, Disclosure and Provenance","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required for user-facing AI","F":"Core baseline","H":"OU-03; OU-12; OP-02","J":"1","K":"Missing","L":"0","M":"High","N":"Notices + provenance logs","O":"Product / Legal"},"originalFormulas":{"L21":"IF(K21=\"Missing\",0,IF(K21=\"Draft\",20,IF(K21=\"Approved\",40,IF(K21=\"Implemented\",65,IF(K21=\"Operating\",85,IF(K21=\"Tested\",100,0))))))"}},{"id":"ROW-a4efbc2c172662e109cef298","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":22,"originalCells":{"A":"POL-18","B":"IP, Copyright and Confidentiality","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required","F":"Core baseline","H":"DP-14; DP-16; DP-17; DP-18; OU-10","J":"1","K":"Missing","L":"0","M":"High","N":"Policy + review records","O":"Legal / Information Governance"},"originalFormulas":{"L22":"IF(K22=\"Missing\",0,IF(K22=\"Draft\",20,IF(K22=\"Approved\",40,IF(K22=\"Implemented\",65,IF(K22=\"Operating\",85,IF(K22=\"Tested\",100,0))))))"}},{"id":"ROW-94a4333985fd902c69308e09","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":23,"originalCells":{"A":"POL-19","B":"AI Training, Literacy and Competency","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required","F":"Core baseline","H":"DP-01; DP-02; DP-03; DP-04; DP-05; DP-06; DP-07; DP-08; DP-09; DP-10; DP-11; DP-12; DP-13; DP-14; DP-15; DP-16; DP-17; DP-18; AU-01; AU-02; AU-03; AU-04; AU-05; AU-06; AU-07; AU-08; IN-01; IN-02; IN-03; IN-04; IN-05; IN-06; IN-07; IN-08; OU-01; OU-02; OU-03; OU-04; OU-05; OU-06; OU-07; OU-08; OU-09; OU-10; OU-11; OU-12; AG-01; AG-02; AG-03; AG-04; AG-05; AG-06; AG-07; AG-08; AG-09; AG-10; OP-01; OP-02; OP-03; OP-04; OP-05; OP-06; OP-07; OP-08; OP-09; OP-10; OP-11; OP-12","J":"1","K":"Missing","L":"0","M":"High","N":"Completion + assessment","O":"HR / Compliance"},"originalFormulas":{"L23":"IF(K23=\"Missing\",0,IF(K23=\"Draft\",20,IF(K23=\"Approved\",40,IF(K23=\"Implemented\",65,IF(K23=\"Operating\",85,IF(K23=\"Tested\",100,0))))))"}},{"id":"ROW-1ebb42d047010ea3d1abe124","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":24,"originalCells":{"A":"POL-20","B":"Exceptions, Appeals and Risk Acceptance","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required","F":"Core baseline","H":"OP-07; OP-08","J":"1","K":"Missing","L":"0","M":"High","N":"Workflow records","O":"Risk / Legal"},"originalFormulas":{"L24":"IF(K24=\"Missing\",0,IF(K24=\"Draft\",20,IF(K24=\"Approved\",40,IF(K24=\"Implemented\",65,IF(K24=\"Operating\",85,IF(K24=\"Tested\",100,0))))))"}},{"id":"ROW-279c9f0d0cd7ab461ddd5e51","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":25,"originalCells":{"A":"POL-21","B":"AI Decommissioning and Data Lifecycle","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required","F":"Core baseline","H":"OP-11","J":"1","K":"Missing","L":"0","M":"High","N":"Deletion and revocation evidence","O":"Data Governance / IT"},"originalFormulas":{"L25":"IF(K25=\"Missing\",0,IF(K25=\"Draft\",20,IF(K25=\"Approved\",40,IF(K25=\"Implemented\",65,IF(K25=\"Operating\",85,IF(K25=\"Tested\",100,0))))))"}},{"id":"ROW-e3679e05b5d9735c093f4df4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":26,"originalCells":{"A":"POL-22","B":"Data, Model and RAG Supply Chain","C":"Core 22","D":"Core enterprise AI policy baseline","E":"Required for RAG/training/custom models","F":"Core baseline","H":"IN-06; AG-08; AG-10","J":"1","K":"Missing","L":"0","M":"High","N":"Provenance + test + SBOM evidence","O":"Data / ML Platform / Security"},"originalFormulas":{"L26":"IF(K26=\"Missing\",0,IF(K26=\"Draft\",20,IF(K26=\"Approved\",40,IF(K26=\"Implemented\",65,IF(K26=\"Operating\",85,IF(K26=\"Tested\",100,0))))))"}},{"id":"ROW-d2ae9e51445e85e9a5838004","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":27,"originalCells":{"A":"POL-23","B":"AI Records, Retention and Legal Hold","C":"Profile expansion","D":"Records, investigations, public administration, regulated decisions, or material business evidence","E":"Context-required when triggered","F":"Await profile","G":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","H":"OP-01; OP-02; OP-09; OP-11; DP-18","I":"OP-13","J":"3","K":"Missing","L":"0","M":"High","N":"Schedule + retention configuration + hold record + deletion certificate","O":"Records / Legal / Data Governance"},"originalFormulas":{"L27":"IF(K27=\"Missing\",0,IF(K27=\"Draft\",20,IF(K27=\"Approved\",40,IF(K27=\"Implemented\",65,IF(K27=\"Operating\",85,IF(K27=\"Tested\",100,0))))))"}},{"id":"ROW-364f293c73297acd9ad6f2b0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":28,"originalCells":{"A":"POL-24","B":"AI Accessibility and Inclusive Design","C":"Profile expansion","D":"Federal or public-sector ICT, public-facing AI, or people-impacting use","E":"Context-required when triggered","F":"Triggered in seed scope","G":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","H":"OU-04; OU-05; OU-12; OP-12","I":"OU-13","J":"3","K":"Missing","L":"0","M":"High","N":"Accessibility requirements + ACR/VPAT + test results + exception record","O":"Accessibility / Product / Procurement"},"originalFormulas":{"L28":"IF(K28=\"Missing\",0,IF(K28=\"Draft\",20,IF(K28=\"Approved\",40,IF(K28=\"Implemented\",65,IF(K28=\"Operating\",85,IF(K28=\"Tested\",100,0))))))"}},{"id":"ROW-7c7208cfbd6be32aee6cc43d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":29,"originalCells":{"A":"POL-25","B":"Automated Employment and Workforce Decisions","C":"Profile expansion","D":"AI influences recruitment, hiring, promotion, monitoring, scheduling, pay or termination","E":"Context-required when triggered","F":"Await profile","G":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","H":"OU-04; OU-05; OU-12; OP-02; OP-03; OP-08; OP-12","I":"OP-14; OU-14; OP-18","J":"3","K":"Missing","L":"0","M":"High","N":"Use inventory + notice/consent + bias audit + publication + decision logs","O":"HR / Employment Legal / Model Risk"},"originalFormulas":{"L29":"IF(K29=\"Missing\",0,IF(K29=\"Draft\",20,IF(K29=\"Approved\",40,IF(K29=\"Implemented\",65,IF(K29=\"Operating\",85,IF(K29=\"Tested\",100,0))))))"}},{"id":"ROW-ff6bed5cb4999e2c64ed126f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":30,"originalCells":{"A":"POL-26","B":"Consumer Credit and Adverse Action","C":"Profile expansion","D":"AI makes or supports credit, pricing, limit, servicing or collection decisions","E":"Context-required when triggered","F":"Await profile","G":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","H":"OU-03; OU-04; OU-05; OP-02; OP-03; OP-08; OP-12","I":"OU-14; OP-17","J":"3","K":"Missing","L":"0","M":"High","N":"Model documentation + validation + decision factors + notices + complaints","O":"Fair Lending / Compliance / Model Risk"},"originalFormulas":{"L30":"IF(K30=\"Missing\",0,IF(K30=\"Draft\",20,IF(K30=\"Approved\",40,IF(K30=\"Implemented\",65,IF(K30=\"Operating\",85,IF(K30=\"Tested\",100,0))))))"}},{"id":"ROW-f17ad0b8f8631254ac307260","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":31,"originalCells":{"A":"POL-27","B":"Clinical AI and Patient Safety","C":"Profile expansion","D":"AI supports diagnosis, treatment, triage, clinical workflow, medical devices or patient communication","E":"Context-required when triggered","F":"Await profile","G":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","H":"DP-07; OU-03; OU-04; OU-05; OP-03; OP-05; OP-06; OP-12","I":"OP-15","J":"3","K":"Missing","L":"0","M":"High","N":"Intended-use statement + validation + reviewer logs + monitoring + safety events","O":"Clinical Safety / Quality / Privacy"},"originalFormulas":{"L31":"IF(K31=\"Missing\",0,IF(K31=\"Draft\",20,IF(K31=\"Approved\",40,IF(K31=\"Implemented\",65,IF(K31=\"Operating\",85,IF(K31=\"Tested\",100,0))))))"}},{"id":"ROW-d7be2e212ffe99f49066c043","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":32,"originalCells":{"A":"POL-28","B":"Child and Youth AI Safety","C":"Profile expansion","D":"Children or students interact with AI or their data is processed","E":"Context-required when triggered","F":"Await profile","G":"COPPA; FERPA; EU-AI-ACT","H":"DP-08; DP-09; DP-10; DP-11; OU-06; OU-07; OU-12; OP-08","I":"DP-19; OU-15","J":"3","K":"Missing","L":"0","M":"High","N":"Age assessment + consent + data map + safety tests + deletion evidence","O":"Privacy / Trust & Safety / Education Legal"},"originalFormulas":{"L32":"IF(K32=\"Missing\",0,IF(K32=\"Draft\",20,IF(K32=\"Approved\",40,IF(K32=\"Implemented\",65,IF(K32=\"Operating\",85,IF(K32=\"Tested\",100,0))))))"}},{"id":"ROW-d83f848af5d7b43eed8895e4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":33,"originalCells":{"A":"POL-29","B":"Public-Sector Due Process and Citizen Services","C":"Profile expansion","D":"AI affects benefits, licensing, enforcement, investigations, justice or other government decisions","E":"Context-required when triggered","F":"Await profile","G":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","H":"OU-04; OU-05; OU-12; AG-03; AG-04; OP-02; OP-08; OP-09","I":"OP-16; AG-11; OP-18","J":"3","K":"Missing","L":"0","M":"High","N":"Impact assessment + notice + decision record + approvals + appeal outcomes","O":"Program Integrity / Civil Rights / General Counsel"},"originalFormulas":{"L33":"IF(K33=\"Missing\",0,IF(K33=\"Draft\",20,IF(K33=\"Approved\",40,IF(K33=\"Implemented\",65,IF(K33=\"Operating\",85,IF(K33=\"Tested\",100,0))))))"}},{"id":"ROW-683d9e80f269c2b0122d1f21","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":34,"originalCells":{"A":"POL-30","B":"Specially Regulated Data Handling Addendum","C":"Profile expansion","D":"CUI, classified, criminal justice, federal tax, SUD or export-controlled data enters the AI environment","E":"Context-required when triggered","F":"Await profile","G":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","H":"DP-07; DP-12; DP-13; AU-03; AU-05; OP-01; OP-09; OP-11","I":"AU-09","J":"3","K":"Missing","L":"0","M":"High","N":"Handling matrix + labels + boundary config + access logs + inspections","O":"Security / Privacy / Records / Program Owner"},"originalFormulas":{"L34":"IF(K34=\"Missing\",0,IF(K34=\"Draft\",20,IF(K34=\"Approved\",40,IF(K34=\"Implemented\",65,IF(K34=\"Operating\",85,IF(K34=\"Tested\",100,0))))))"}},{"id":"ROW-ea283be9b23ef77d1ea41b7b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":35,"originalCells":{"A":"POL-31","B":"AI Model Risk Management and Independent Validation","C":"Profile expansion","D":"Models materially influence financial, insurance, safety or high-impact decisions","E":"Context-required when triggered","F":"Triggered in seed scope","G":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","H":"OU-03; OU-05; OP-03; OP-06; OP-12","I":"OP-17","J":"3","K":"Missing","L":"0","M":"High","N":"Tiering + model inventory + validation + findings + approvals","O":"Model Risk / Internal Audit / Business Owner"},"originalFormulas":{"L35":"IF(K35=\"Missing\",0,IF(K35=\"Draft\",20,IF(K35=\"Approved\",40,IF(K35=\"Implemented\",65,IF(K35=\"Operating\",85,IF(K35=\"Tested\",100,0))))))"}},{"id":"ROW-6a98ed4ee6db3f3a8b90dd1a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":36,"originalCells":{"A":"POL-32","B":"Cross-Border AI Data and Sovereignty","C":"Profile expansion","D":"AI providers, support, training, administrators or data stores cross national boundaries","E":"Context-required when triggered","F":"Await profile","G":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","H":"AU-05; AU-06; DP-09; DP-10; DP-11; OP-10","I":"AU-10","J":"3","K":"Missing","L":"0","M":"High","N":"Data map + transfer assessment + screening + contracts + audit records","O":"Privacy / Export / Security / Procurement"},"originalFormulas":{"L36":"IF(K36=\"Missing\",0,IF(K36=\"Draft\",20,IF(K36=\"Approved\",40,IF(K36=\"Implemented\",65,IF(K36=\"Operating\",85,IF(K36=\"Tested\",100,0))))))"}},{"id":"ROW-408a190a4b93808cc6c3d0c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":37,"originalCells":{"A":"POL-33","B":"Automated Decision Transparency and Registry","C":"Profile expansion","D":"High-impact, public-facing, regulated or externally consequential AI","E":"Context-required when triggered","F":"Await profile","G":"EU-AI-ACT; ONC-HTI1; NYC-LL144; OMB-M25-21; CO-AI","H":"OU-12; OP-02; OP-09","I":"OP-18","J":"3","K":"Missing","L":"0","M":"High","N":"Registry + disclosures + approval + discovery/reconciliation logs","O":"AI Governance / Legal / Product"},"originalFormulas":{"L37":"IF(K37=\"Missing\",0,IF(K37=\"Draft\",20,IF(K37=\"Approved\",40,IF(K37=\"Implemented\",65,IF(K37=\"Operating\",85,IF(K37=\"Tested\",100,0))))))"}},{"id":"ROW-c6b71e5305881f1f5a5956bd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"17 Expanded Policies","row":38,"originalCells":{"A":"POL-34","B":"AI Research, Human Subjects and Scientific Integrity","C":"Profile expansion","D":"AI research uses identifiable human data, interacts with participants, or informs regulated research","E":"Context-required when triggered","F":"Await profile","G":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","H":"DP-07; DP-09; OU-03; OP-12","I":"OP-19","J":"3","K":"Missing","L":"0","M":"High","N":"Protocol + ethics approval + consent + data authorization + reproducibility record","O":"Research Integrity / IRB / Privacy"},"originalFormulas":{"L38":"IF(K38=\"Missing\",0,IF(K38=\"Draft\",20,IF(K38=\"Approved\",40,IF(K38=\"Implemented\",65,IF(K38=\"Operating\",85,IF(K38=\"Tested\",100,0))))))"}},{"id":"ROW-597ca0bc93ff7503f1d4f3b3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":5,"originalCells":{"A":"POL-01","B":"AI Governance and Accountability","C":"Core 22","D":"Policy control","E":"POL-01-C01","F":"Board/executive accountability, roles, risk appetite, inventory, metrics and reporting","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Policy + charter + minutes","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-bedde3dbc5180d0eadf9f86b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":9,"originalCells":{"A":"POL-02","B":"AI Acceptable Use","C":"Core 22","D":"Policy control","E":"POL-02-C01","F":"Permitted/prohibited uses, user duties, escalation, sanctions and safe-use expectations","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Policy + attestation","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-2959b8d807f47f3dfa234a64","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":13,"originalCells":{"A":"POL-03","B":"Approved AI Tools and Shadow AI","C":"Core 22","D":"Policy control","E":"POL-03-C01","F":"Sanctioned providers, personal-account restrictions, onboarding and discovery","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Policy + inventory + egress logs","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-61f5de8cd7f0791b5a3d7b8b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":17,"originalCells":{"A":"POL-04","B":"Data Classification for AI","C":"Core 22","D":"Policy control","E":"POL-04-C01","F":"Which data classes may enter which AI systems under which conditions","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Standard + decision matrix + DLP events","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-899fb0ad39a0a9d36f86c53c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":38,"originalCells":{"A":"POL-05","B":"Prompt and Output Interaction","C":"Core 22","D":"Policy control","E":"POL-05-C01","F":"Prompt hygiene, output review, citations, disclosure and publication rules","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Policy + runtime events","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-fbf09e1837957a999acb3d56","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":51,"originalCells":{"A":"POL-06","B":"Privacy and Personal Data","C":"Core 22","D":"Policy control","E":"POL-06-C01","F":"Purpose, minimization, lawful basis, DPIA, rights, retention and sensitive data","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Privacy policy + DPIA + configuration","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-03ce43e426703e875ebe88a6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":60,"originalCells":{"A":"POL-07","B":"AI Security and Prompt Injection","C":"Core 22","D":"Policy control","E":"POL-07-C01","F":"Threat model, injection defenses, input trust, secrets and vulnerability handling","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Security standard + tests + events","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-8f4d73b156a9e22a6f860177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":67,"originalCells":{"A":"POL-08","B":"High-Impact AI and Human Oversight","C":"Core 22","D":"Policy control","E":"POL-08-C01","F":"High-impact definition, required reviewers, fail-safe and prohibited autonomy","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Impact assessment + approval + logs","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-6288afa17e01f971a94dd449","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":73,"originalCells":{"A":"POL-09","B":"AI Impact Assessment and Risk Acceptance","C":"Core 22","D":"Policy control","E":"POL-09-C01","F":"Intake, impact assessment, control selection, risk acceptance and reassessment","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Assessment + approval","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-1e23d360e89c1062cb69a0aa","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":77,"originalCells":{"A":"POL-10","B":"Evaluation, Red Team and Benchmarking","C":"Core 22","D":"Policy control","E":"POL-10-C01","F":"Test dimensions, datasets, thresholds, independence, cadence and release gates","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Test evidence","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-2f20b20c9af57fd935635e4b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":80,"originalCells":{"A":"POL-11","B":"AI Monitoring and Logging","C":"Core 22","D":"Policy control","E":"POL-11-C01","F":"Events, content minimization, metrics, alerting, access, integrity and retention","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Logs + monitoring evidence","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-9dc5e6b16b05a7499a88af03","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":84,"originalCells":{"A":"POL-12","B":"AI Incident Response and Kill Switch","C":"Core 22","D":"Policy control","E":"POL-12-C01","F":"AI incident taxonomy, escalation, containment, reporting, kill switch and recovery","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Plan + drill + incident evidence","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-10f898dcd48405d3f2d17587","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":87,"originalCells":{"A":"POL-13","B":"Vendor and AI Procurement","C":"Core 22","D":"Policy control","E":"POL-13-C01","F":"Due diligence, DPA/BAA, training use, subprocessors, SLAs, audit, exit and change notice","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Contract + assessment","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-948256b154e3a3184c37e4c3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":91,"originalCells":{"A":"POL-14","B":"Agentic AI and Connectors","C":"Core 22","D":"Policy control","E":"POL-14-C01","F":"Tool allowlists, least privilege, approvals, limits, memory and transaction controls","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Policy + tool logs + approvals","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-6038ba62eb95f6a745d8985f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":102,"originalCells":{"A":"POL-15","B":"AI Secure Development Lifecycle","C":"Core 22","D":"Policy control","E":"POL-15-C01","F":"Threat modeling, design review, output handling, change, release and rollback","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"SDLC records + tests","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-91676a6ed461ccc5b613a7b2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":107,"originalCells":{"A":"POL-16","B":"Bias, Fairness and Civil Rights","C":"Core 22","D":"Policy control","E":"POL-16-C01","F":"Protected groups, evaluation, accommodations, monitoring and remediation","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Fairness assessment + monitoring","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-ab37f01cac1d33c794f6a189","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":109,"originalCells":{"A":"POL-17","B":"Transparency, Disclosure and Provenance","C":"Core 22","D":"Policy control","E":"POL-17-C01","F":"Notices, explainability, citations, synthetic-content labels and provenance","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Notices + provenance logs","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-723871d2f34954cba70298c9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":113,"originalCells":{"A":"POL-18","B":"IP, Copyright and Confidentiality","C":"Core 22","D":"Policy control","E":"POL-18-C01","F":"Trade secrets, customer data, privilege, copyright, license and publication review","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Policy + review records","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-82c755ed78b6023ed1c742ae","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":119,"originalCells":{"A":"POL-19","B":"AI Training, Literacy and Competency","C":"Core 22","D":"Policy control","E":"POL-19-C01","F":"Role-based literacy, operator competency, developer safety and executive duties","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Completion + assessment","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-ba68a24115344b264aff3b77","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":188,"originalCells":{"A":"POL-20","B":"Exceptions, Appeals and Risk Acceptance","C":"Core 22","D":"Policy control","E":"POL-20-C01","F":"User appeal, operator override, risk acceptance, compensating controls and expiry","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Workflow records","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-971ad6a5ea6eca36c040f8d4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":191,"originalCells":{"A":"POL-21","B":"AI Decommissioning and Data Lifecycle","C":"Core 22","D":"Policy control","E":"POL-21-C01","F":"Retention, deletion, memory/vector cleanup, access revocation, records and exit","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Deletion and revocation evidence","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-3e39c91e7192c375260741bd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":193,"originalCells":{"A":"POL-22","B":"Data, Model and RAG Supply Chain","C":"Core 22","D":"Policy control","E":"POL-22-C01","F":"Provenance, authorization, poisoning defense, embedding isolation, dataset/model versioning","G":"Policy baseline control","H":"Document / Policy","I":"Governance & accountability","J":"Core enterprise baseline","K":"Provenance + test + SBOM evidence","L":"Approved baseline design"},"originalFormulas":{}},{"id":"ROW-b660e156aee27955c0564f9f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":197,"originalCells":{"A":"POL-23","B":"AI Records, Retention and Legal Hold","C":"Profile expansion","D":"Policy control","E":"POL-23-C01","F":"Classify prompts, outputs, decisions, approvals and control events against an approved records schedule.","G":"New policy control / evidence","H":"Workflow / System Configuration","I":"Governance & accountability","J":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","K":"Schedule + retention configuration + hold record + deletion certificate","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-4349a56a85220a7e22902e5e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":198,"originalCells":{"A":"POL-23","B":"AI Records, Retention and Legal Hold","C":"Profile expansion","D":"Policy control","E":"POL-23-C02","F":"Prevent deletion or alteration while a legal, audit or investigation hold is active.","G":"New policy control / evidence","H":"System Configuration","I":"Enforcement & prevention","J":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","K":"Schedule + retention configuration + hold record + deletion certificate","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-b5c77a28ee8f204248c0cf53","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":199,"originalCells":{"A":"POL-23","B":"AI Records, Retention and Legal Hold","C":"Profile expansion","D":"Policy control","E":"POL-23-C03","F":"Verify deletion across chat history, logs, vector stores, memory, backups and downstream evidence stores.","G":"New policy control / evidence","H":"Assurance / Testing","I":"Evidence & independent assurance","J":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","K":"Schedule + retention configuration + hold record + deletion certificate","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-bd68e135dd3dc591bbad92d7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":206,"originalCells":{"A":"POL-24","B":"AI Accessibility and Inclusive Design","C":"Profile expansion","D":"Policy control","E":"POL-24-C01","F":"Define accessible interaction and output requirements for each AI interface, document type and supported modality.","G":"New policy control / evidence","H":"Document / Policy","I":"Governance & accountability","J":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","K":"Accessibility requirements + ACR/VPAT + test results + exception record","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-48d7266963f51e7e07bf6a49","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":207,"originalCells":{"A":"POL-24","B":"AI Accessibility and Inclusive Design","C":"Profile expansion","D":"Policy control","E":"POL-24-C02","F":"Test keyboard, screen-reader, caption, contrast, cognitive and alternative-channel needs before release.","G":"New policy control / evidence","H":"Assurance / Testing","I":"Evidence & independent assurance","J":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","K":"Accessibility requirements + ACR/VPAT + test results + exception record","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-a154e81f2366fbde55071873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":208,"originalCells":{"A":"POL-24","B":"AI Accessibility and Inclusive Design","C":"Profile expansion","D":"Policy control","E":"POL-24-C03","F":"Provide an equivalent human or non-AI path when an AI experience is not accessible or fails.","G":"New policy control / evidence","H":"Workflow / Process","I":"Monitoring, response & resilience","J":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","K":"Accessibility requirements + ACR/VPAT + test results + exception record","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-9dfd7e849d8d1c9642c36f1f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":214,"originalCells":{"A":"POL-25","B":"Automated Employment and Workforce Decisions","C":"Profile expansion","D":"Policy control","E":"POL-25-C01","F":"Inventory each employment decision in which AI substantially assists or replaces human judgment.","G":"New policy control / evidence","H":"Workflow / Process","I":"Applicable control coverage","J":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","K":"Use inventory + notice/consent + bias audit + publication + decision logs","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-c6d3e12cf0651a8c4bede3c8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":215,"originalCells":{"A":"POL-25","B":"Automated Employment and Workforce Decisions","C":"Profile expansion","D":"Policy control","E":"POL-25-C02","F":"Complete required notice, consent, accommodation and alternative-process steps before covered use.","G":"New policy control / evidence","H":"Transaction Warning / Approval","I":"Enforcement & prevention","J":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","K":"Use inventory + notice/consent + bias audit + publication + decision logs","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-9550de0296df063d63803859","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":216,"originalCells":{"A":"POL-25","B":"Automated Employment and Workforce Decisions","C":"Profile expansion","D":"Policy control","E":"POL-25-C03","F":"Run independent bias audits on the required cadence and prevent use after expiration or material change.","G":"New policy control / evidence","H":"Assurance / Testing","I":"Evidence & independent assurance","J":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","K":"Use inventory + notice/consent + bias audit + publication + decision logs","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-92c1f546bfb6de4054c33821","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":227,"originalCells":{"A":"POL-26","B":"Consumer Credit and Adverse Action","C":"Profile expansion","D":"Policy control","E":"POL-26-C01","F":"Preserve the actual principal factors used for each credit decision and map them to notice language.","G":"New policy control / evidence","H":"System Configuration","I":"Enforcement & prevention","J":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","K":"Model documentation + validation + decision factors + notices + complaints","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-48ad15e4b2c7db6eca771777","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":228,"originalCells":{"A":"POL-26","B":"Consumer Credit and Adverse Action","C":"Profile expansion","D":"Policy control","E":"POL-26-C02","F":"Prohibit model use when specific and accurate adverse-action reasons cannot be produced.","G":"New policy control / evidence","H":"Transaction Prevention","I":"Enforcement & prevention","J":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","K":"Model documentation + validation + decision factors + notices + complaints","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-18f97f08a5872325214eaa2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":229,"originalCells":{"A":"POL-26","B":"Consumer Credit and Adverse Action","C":"Profile expansion","D":"Policy control","E":"POL-26-C03","F":"Validate discrimination, accuracy, stability and reason-code fidelity with effective independent challenge.","G":"New policy control / evidence","H":"Assurance / Testing","I":"Evidence & independent assurance","J":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","K":"Model documentation + validation + decision factors + notices + complaints","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-b16f769c94eb751c9254bc77","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":239,"originalCells":{"A":"POL-27","B":"Clinical AI and Patient Safety","C":"Profile expansion","D":"Policy control","E":"POL-27-C01","F":"Define intended use, excluded uses, population, environment and qualified reviewer for each clinical AI system.","G":"New policy control / evidence","H":"Workflow / Process","I":"Governance & accountability","J":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","K":"Intended-use statement + validation + reviewer logs + monitoring + safety events","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-c07473ec7c89817e50a86d9b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":240,"originalCells":{"A":"POL-27","B":"Clinical AI and Patient Safety","C":"Profile expansion","D":"Policy control","E":"POL-27-C02","F":"Prevent use outside validated indication, population, data quality or operating conditions.","G":"New policy control / evidence","H":"Transaction Prevention","I":"Enforcement & prevention","J":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","K":"Intended-use statement + validation + reviewer logs + monitoring + safety events","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-2afc8979fe0f0865098c4138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":241,"originalCells":{"A":"POL-27","B":"Clinical AI and Patient Safety","C":"Profile expansion","D":"Policy control","E":"POL-27-C03","F":"Monitor safety, bias, performance degradation and clinical overrides with stop criteria.","G":"New policy control / evidence","H":"Continuous Detection / Monitoring","I":"Monitoring, response & resilience","J":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","K":"Intended-use statement + validation + reviewer logs + monitoring + safety events","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-d95fc88d64ce4e8747127416","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":251,"originalCells":{"A":"POL-28","B":"Child and Youth AI Safety","C":"Profile expansion","D":"Policy control","E":"POL-28-C01","F":"Determine whether the experience is child-directed and apply the governing age, consent and school-authorization rule.","G":"New policy control / evidence","H":"Workflow / Process","I":"Applicable control coverage","J":"COPPA; FERPA; EU-AI-ACT","K":"Age assessment + consent + data map + safety tests + deletion evidence","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-13df7ddb0e903396c050d9e6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":252,"originalCells":{"A":"POL-28","B":"Child and Youth AI Safety","C":"Profile expansion","D":"Policy control","E":"POL-28-C02","F":"Minimize youth data, disable manipulative engagement and block unapproved third-party disclosure or training.","G":"New policy control / evidence","H":"Transaction Prevention","I":"Enforcement & prevention","J":"COPPA; FERPA; EU-AI-ACT","K":"Age assessment + consent + data map + safety tests + deletion evidence","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-b9f171bb55a90e9eae81c39f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":253,"originalCells":{"A":"POL-28","B":"Child and Youth AI Safety","C":"Profile expansion","D":"Policy control","E":"POL-28-C03","F":"Provide age-appropriate explanations, reporting and escalation paths for unsafe interactions.","G":"New policy control / evidence","H":"Transaction Warning / Approval","I":"Monitoring, response & resilience","J":"COPPA; FERPA; EU-AI-ACT","K":"Age assessment + consent + data map + safety tests + deletion evidence","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-4d27ab3f5918435455585bb4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":264,"originalCells":{"A":"POL-29","B":"Public-Sector Due Process and Citizen Services","C":"Profile expansion","D":"Policy control","E":"POL-29-C01","F":"Identify decisions that affect rights, benefits, liberty, access to services or legal status and prohibit unsupported automation.","G":"New policy control / evidence","H":"Workflow / Process","I":"Applicable control coverage","J":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","K":"Impact assessment + notice + decision record + approvals + appeal outcomes","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-a92aba8f46217633c0fba0b2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":265,"originalCells":{"A":"POL-29","B":"Public-Sector Due Process and Citizen Services","C":"Profile expansion","D":"Policy control","E":"POL-29-C02","F":"Require understandable notice, reviewable rationale, qualified human review and an effective appeal path.","G":"New policy control / evidence","H":"Transaction Warning / Approval","I":"Enforcement & prevention","J":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","K":"Impact assessment + notice + decision record + approvals + appeal outcomes","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-24c9208eba2e169b1f50d5d2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":266,"originalCells":{"A":"POL-29","B":"Public-Sector Due Process and Citizen Services","C":"Profile expansion","D":"Policy control","E":"POL-29-C03","F":"Require dual authorization before an agent executes a coercive or irreversible government action.","G":"New policy control / evidence","H":"Transaction Prevention","I":"Enforcement & prevention","J":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","K":"Impact assessment + notice + decision record + approvals + appeal outcomes","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-6f2ce89095e627c56f05dffe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":278,"originalCells":{"A":"POL-30","B":"Specially Regulated Data Handling Addendum","C":"Profile expansion","D":"Policy control","E":"POL-30-C01","F":"Apply a machine-readable data handling label and approved-purpose matrix before any AI access.","G":"New policy control / evidence","H":"System Configuration","I":"Enforcement & prevention","J":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","K":"Handling matrix + labels + boundary config + access logs + inspections","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-3ec37b706115b72a056d3ccd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":279,"originalCells":{"A":"POL-30","B":"Specially Regulated Data Handling Addendum","C":"Profile expansion","D":"Policy control","E":"POL-30-C02","F":"Route only to approved identity, region, tenant, boundary, provider and contract combinations.","G":"New policy control / evidence","H":"Transaction Prevention","I":"Enforcement & prevention","J":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","K":"Handling matrix + labels + boundary config + access logs + inspections","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-6b20d82cb7deb5073aa7f80b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":280,"originalCells":{"A":"POL-30","B":"Specially Regulated Data Handling Addendum","C":"Profile expansion","D":"Policy control","E":"POL-30-C03","F":"Continuously reconcile labeled records, recipients, access and retention against the governing addendum.","G":"New policy control / evidence","H":"Continuous Detection / Monitoring","I":"Monitoring, response & resilience","J":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","K":"Handling matrix + labels + boundary config + access logs + inspections","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-ae39945e9dca8fcae07dfc99","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":290,"originalCells":{"A":"POL-31","B":"AI Model Risk Management and Independent Validation","C":"Profile expansion","D":"Policy control","E":"POL-31-C01","F":"Tier models by materiality, complexity, opacity, use and potential harm and assign validation cadence.","G":"New policy control / evidence","H":"Workflow / Process","I":"Governance & accountability","J":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","K":"Tiering + model inventory + validation + findings + approvals","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-ae5907835ecddd942a3d8e01","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":291,"originalCells":{"A":"POL-31","B":"AI Model Risk Management and Independent Validation","C":"Profile expansion","D":"Policy control","E":"POL-31-C02","F":"Require sufficiently independent validation and effective challenge before use and after material change.","G":"New policy control / evidence","H":"Assurance / Testing","I":"Evidence & independent assurance","J":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","K":"Tiering + model inventory + validation + findings + approvals","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-a720ec7ed772e31748155f5b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":292,"originalCells":{"A":"POL-31","B":"AI Model Risk Management and Independent Validation","C":"Profile expansion","D":"Policy control","E":"POL-31-C03","F":"Track limitations, compensating controls, findings, expiry and accountable acceptance in the model inventory.","G":"New policy control / evidence","H":"Workflow / Process","I":"Monitoring, response & resilience","J":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","K":"Tiering + model inventory + validation + findings + approvals","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-122b607d7b07be41aeff4057","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":299,"originalCells":{"A":"POL-32","B":"Cross-Border AI Data and Sovereignty","C":"Profile expansion","D":"Policy control","E":"POL-32-C01","F":"Map model, provider, support, telemetry, training and subprocessors to actual data locations and access countries.","G":"New policy control / evidence","H":"Workflow / Process","I":"Applicable control coverage","J":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","K":"Data map + transfer assessment + screening + contracts + audit records","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-35502741aa7590781fd8f4e9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":300,"originalCells":{"A":"POL-32","B":"Cross-Border AI Data and Sovereignty","C":"Profile expansion","D":"Policy control","E":"POL-32-C02","F":"Screen counterparty, country, data category, volume and transfer mechanism before routing or granting access.","G":"New policy control / evidence","H":"Transaction Prevention","I":"Enforcement & prevention","J":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","K":"Data map + transfer assessment + screening + contracts + audit records","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-64bfc6528dc38316d939add4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":301,"originalCells":{"A":"POL-32","B":"Cross-Border AI Data and Sovereignty","C":"Profile expansion","D":"Policy control","E":"POL-32-C03","F":"Reassess transfers when a provider, subprocessor, model region or legal mechanism changes.","G":"New policy control / evidence","H":"Continuous Detection / Monitoring","I":"Monitoring, response & resilience","J":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","K":"Data map + transfer assessment + screening + contracts + audit records","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-fa3e011dd0bba2c808289eb2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":309,"originalCells":{"A":"POL-33","B":"Automated Decision Transparency and Registry","C":"Profile expansion","D":"Policy control","E":"POL-33-C01","F":"Register each covered automated decision system, purpose, owner, population, data, model and effective dates.","G":"New policy control / evidence","H":"Workflow / Process","I":"Governance & accountability","J":"EU-AI-ACT; ONC-HTI1; NYC-LL144; OMB-M25-21; CO-AI","K":"Registry + disclosures + approval + discovery/reconciliation logs","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-1ef294b209ba6792c36c1a47","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":310,"originalCells":{"A":"POL-33","B":"Automated Decision Transparency and Registry","C":"Profile expansion","D":"Policy control","E":"POL-33-C02","F":"Publish or deliver the required notice, system description, contact, rights and risk information.","G":"New policy control / evidence","H":"Transaction Warning / Approval","I":"Enforcement & prevention","J":"EU-AI-ACT; ONC-HTI1; NYC-LL144; OMB-M25-21; CO-AI","K":"Registry + disclosures + approval + discovery/reconciliation logs","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-3a9f3a84ccce1fd53cd82d90","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":311,"originalCells":{"A":"POL-33","B":"Automated Decision Transparency and Registry","C":"Profile expansion","D":"Policy control","E":"POL-33-C03","F":"Detect unregistered systems and stale disclosures and route them to remediation.","G":"New policy control / evidence","H":"Continuous Detection / Monitoring","I":"Monitoring, response & resilience","J":"EU-AI-ACT; ONC-HTI1; NYC-LL144; OMB-M25-21; CO-AI","K":"Registry + disclosures + approval + discovery/reconciliation logs","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-471a5982079f9dbe85af9a7a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":316,"originalCells":{"A":"POL-34","B":"AI Research, Human Subjects and Scientific Integrity","C":"Profile expansion","D":"Policy control","E":"POL-34-C01","F":"Determine whether the activity is research involving human participants or identifiable human data and route it to the required review.","G":"New policy control / evidence","H":"Workflow / Process","I":"Applicable control coverage","J":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","K":"Protocol + ethics approval + consent + data authorization + reproducibility record","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-b902e9ba3501ba900ac1863b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":317,"originalCells":{"A":"POL-34","B":"AI Research, Human Subjects and Scientific Integrity","C":"Profile expansion","D":"Policy control","E":"POL-34-C02","F":"Enforce protocol, consent, data-use, publication and model-reuse limits throughout the research lifecycle.","G":"New policy control / evidence","H":"System Configuration","I":"Enforcement & prevention","J":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","K":"Protocol + ethics approval + consent + data authorization + reproducibility record","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-b63f57bc66539e58bd083b8d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"18 Policy Rule Lineage","row":318,"originalCells":{"A":"POL-34","B":"AI Research, Human Subjects and Scientific Integrity","C":"Profile expansion","D":"Policy control","E":"POL-34-C03","F":"Require reproducibility, provenance, statistical validation and disclosure of AI assistance in scientific outputs.","G":"New policy control / evidence","H":"Assurance / Testing","I":"Evidence & independent assurance","J":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","K":"Protocol + ethics approval + consent + data authorization + reproducibility record","L":"Context-triggered design"},"originalFormulas":{}},{"id":"ROW-15b95804fbe20e27a83cf2e4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"19 Canonical Expansion","row":5,"originalCells":{"A":"DP-19","B":"Data Protection","C":"Enforce age, consent and parental authorization","D":"Before collecting or disclosing youth data, verify the applicable age rule, capture valid consent, enforce purpose limits, and honor revocation and deletion.","E":"Block / require approval","F":"E2/E3","G":"Intake + prompt + upload + data store","H":"Critical","I":"Consent decision + age band + deletion event","J":"Proposed new canonical","K":"Proposed — review required","L":"POL-28","M":"COPPA; FERPA; EU-AI-ACT","N":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission."},"originalFormulas":{}},{"id":"ROW-2a8137ca0825e1a9dfeb17a0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"19 Canonical Expansion","row":6,"originalCells":{"A":"AU-09","B":"Authorized Use","C":"Enforce sector-purpose and disclosure authorization","D":"Attach purpose, recipient and use labels to specially regulated records and block processing outside the authorized sector workflow.","E":"Block / require approval","F":"E3","G":"Prompt + upload + retrieval + tool call","H":"Critical","I":"Authorization context + decision log","J":"Proposed new canonical","K":"Proposed — review required","L":"POL-30","M":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","N":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission."},"originalFormulas":{}},{"id":"ROW-9e2bc5d6883eb4cd6dd4365e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"19 Canonical Expansion","row":7,"originalCells":{"A":"AU-10","B":"Authorized Use","C":"Restrict cross-border bulk-sensitive-data transactions","D":"Screen counterparty, country, data category and volume; block prohibited transfers and require security conditions for restricted transactions.","E":"Block / require approval","F":"E3/E4","G":"Provider routing + export + support access","H":"Critical","I":"Screening + threshold calculation + transfer decision","J":"Proposed new canonical","K":"Proposed — review required","L":"POL-32","M":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","N":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission."},"originalFormulas":{}},{"id":"ROW-4540717a2d2e6debabd64e61","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"19 Canonical Expansion","row":8,"originalCells":{"A":"OU-13","B":"Output Safety","C":"Provide an accessible equivalent interaction and output","D":"AI interfaces and generated content must preserve an accessible, tested path that provides equivalent information and action without disability-based exclusion.","E":"Gate / alert","F":"E2/E3","G":"Interface + output + publication","H":"High","I":"Accessibility test + conformance record","J":"Proposed new canonical","K":"Proposed — review required","L":"POL-24","M":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","N":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission."},"originalFormulas":{}},{"id":"ROW-c0fe41ce0bc2c88a46398a9d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"19 Canonical Expansion","row":9,"originalCells":{"A":"OU-14","B":"Output Safety","C":"Provide specific reasons and notice for consequential adverse decisions","D":"Do not finalize a covered adverse decision unless specific, accurate reasons and required notices can be generated from preserved decision factors.","E":"Block / require approval","F":"E3","G":"Decision output + notice","H":"Critical","I":"Decision factors + notice + delivery record","J":"Proposed new canonical","K":"Proposed — review required","L":"POL-25; POL-26","M":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR; ECOA-REG-B; FRB-MRM-2026; GLBA","N":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission."},"originalFormulas":{}},{"id":"ROW-90b23577a2eb05531f8e3261","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"19 Canonical Expansion","row":10,"originalCells":{"A":"OU-15","B":"Output Safety","C":"Apply child-safe response and escalation controls","D":"Detect child-directed contexts, constrain unsafe or manipulative responses, and route safety concerns to an approved adult or specialist process.","E":"Block / require approval","F":"E2/E3","G":"Prompt + response + escalation","H":"Critical","I":"Age/context decision + response control + escalation","J":"Proposed new canonical","K":"Proposed — review required","L":"POL-28","M":"COPPA; FERPA; EU-AI-ACT","N":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission."},"originalFormulas":{}},{"id":"ROW-f0dbc6d7fe91002217172a97","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"19 Canonical Expansion","row":11,"originalCells":{"A":"OP-13","B":"Operations","C":"Enforce records retention, legal hold and defensible deletion","D":"Classify AI interactions and decisions as records, apply approved retention and legal holds, and produce verified deletion at expiry.","E":"Gate / alert","F":"E3/E4","G":"Log + evidence store + model memory","H":"High","I":"Retention class + hold + deletion certificate","J":"Proposed new canonical","K":"Proposed — review required","L":"POL-23","M":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","N":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission."},"originalFormulas":{}},{"id":"ROW-d4924fc54b366323d675248d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"19 Canonical Expansion","row":12,"originalCells":{"A":"OP-14","B":"Operations","C":"Run required independent bias audit and disclosure","D":"Block covered employment or other deployments when an in-scope independent bias audit is missing, stale, failed, or not disclosed as required.","E":"Block / require approval","F":"E2/E3","G":"Release gate + use-case registry","H":"Critical","I":"Audit + independence + publication + validity date","J":"Proposed new canonical","K":"Proposed — review required","L":"POL-25","M":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","N":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission."},"originalFormulas":{}},{"id":"ROW-bcb632ce4ca7dbd0b0a9bcec","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"19 Canonical Expansion","row":13,"originalCells":{"A":"OP-15","B":"Operations","C":"Validate clinical intended use and require qualified review","D":"Constrain clinical AI to validated intended use, approved population and operating conditions, with qualified review before patient-impacting action.","E":"Block / require approval","F":"E3","G":"Release + clinical workflow + output","H":"Critical","I":"Intended-use match + validation + reviewer decision","J":"Proposed new canonical","K":"Proposed — review required","L":"POL-27","M":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","N":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission."},"originalFormulas":{}},{"id":"ROW-9333c0f20d9760d550b04d90","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"19 Canonical Expansion","row":14,"originalCells":{"A":"OP-16","B":"Operations","C":"Preserve public-sector due process and decision record","D":"For government decisions affecting rights or benefits, require notice, reviewability, appeal, preserved rationale and a non-automated fallback where required.","E":"Block / require approval","F":"E2/E3","G":"Decision workflow","H":"Critical","I":"Notice + rationale + reviewer + appeal record","J":"Proposed new canonical","K":"Proposed — review required","L":"POL-29","M":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","N":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission."},"originalFormulas":{}},{"id":"ROW-22a687f6e6dbd28f0335faeb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"19 Canonical Expansion","row":15,"originalCells":{"A":"OP-17","B":"Operations","C":"Require independent model validation and effective challenge","D":"A model cannot enter or remain in material use without risk-tiered independent validation, tracked findings and accountable approval.","E":"Gate / alert","F":"E2/E3","G":"Release + periodic review","H":"High","I":"Validation + challenge + findings + approval","J":"Proposed new canonical","K":"Proposed — review required","L":"POL-26; POL-31","M":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR; NAIC-AI; ISO-42005; NIST-AI-RMF","N":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission."},"originalFormulas":{}},{"id":"ROW-94bbfb10610f2fb3dfc40fa6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"19 Canonical Expansion","row":16,"originalCells":{"A":"OP-18","B":"Operations","C":"Register automated decisions and required public disclosures","D":"Maintain a current registry of covered automated decision systems and publish or deliver required system, purpose, risk and contact disclosures.","E":"Gate / alert","F":"E1/E2","G":"Inventory + publication","H":"High","I":"Registry record + disclosure artifact + timestamp","J":"Proposed new canonical","K":"Proposed — review required","L":"POL-25; POL-29; POL-33","M":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR; OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; ONC-HTI1; CO-AI","N":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission."},"originalFormulas":{}},{"id":"ROW-eae77152a76c10a3841754bc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"19 Canonical Expansion","row":17,"originalCells":{"A":"OP-19","B":"Operations","C":"Require ethics approval for human-subject AI research","D":"Block research involving people or identifiable human data until required ethics or IRB review, consent terms and data controls are approved.","E":"Gate / alert","F":"E2/E3","G":"Research intake + data access","H":"High","I":"Protocol + approval + consent + data authorization","J":"Proposed new canonical","K":"Proposed — review required","L":"POL-34","M":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","N":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission."},"originalFormulas":{}},{"id":"ROW-90e42764c49f2e96fd5a394b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","sheet":"19 Canonical Expansion","row":18,"originalCells":{"A":"AG-11","B":"Agentic Controls","C":"Require dual authorization for coercive public-sector actions","D":"An AI agent may not execute detention, enforcement, benefits termination, sanction or comparable coercive action without two qualified, accountable authorizations.","E":"Block / require approval","F":"E3","G":"Tool call + transaction","H":"Critical","I":"Two approvals + action log + scope","J":"Proposed new canonical","K":"Proposed — review required","L":"POL-29","M":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","N":"Check for semantic duplicate, narrower overlay, and cross-system portability before admission."},"originalFormulas":{}},{"id":"ROW-MD-3ea5aca0efd5aba3f77b","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":1,"lineEnd":10,"originalCells":{"A":"# TAIMScore™ — Trusted AI Model Score\n\n**Framework Version:** 1.0\n**Source:** HISPI Project Cerebellum\n**Structure:** Aligned to NIST AI RMF 1.0 (NIST AI 100-1, January 2023)\n**Standards Alignment:** NIST AI RMF 1.0, ISO/IEC 42001:2023, SOC 2 Type II, EU AI Act 2024\n\n---\n\n## What TAIMScore Is"},"originalFormulas":{}},{"id":"ROW-MD-b761613efc4ffafe745d","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":10,"lineEnd":24,"originalCells":{"A":"## What TAIMScore Is\n\nTAIMScore™ is an enterprise AI maturity and risk assessment framework developed under HISPI Project Cerebellum. It provides organizations with a structured, scored methodology to assess the trustworthiness, governance, and risk posture of AI systems deployed within their environment.\n\nTAIMScore maps directly onto the NIST AI Risk Management Framework (NIST AI 100-1) — its four functions (GOVERN, MAP, MEASURE, MANAGE), 19 categories, and 72 subcategories are the NIST AI RMF structure applied with enterprise scoring methodology and automation hooks.\n\n**Primary use cases:**\n- Enterprise AI governance programs\n- Regulatory readiness assessments (NIST, ISO 42001, EU AI Act, FedRAMP)\n- Third-party AI vendor due diligence\n- Board-level AI risk reporting\n- Federal agency AI procurement evaluation\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-f0080fd475deff4c13ce","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":25,"lineEnd":35,"originalCells":{"A":"## The 4 Functions\n\n| Function | ID Range | Purpose |\n|----------|----------|---------|\n| GOVERN | GV-1 through GV-6 | Establishes accountability, culture, and policies that frame all AI risk work |\n| MAP | MP-1 through MP-5 | Identifies and classifies AI risks in context |\n| MEASURE | MS-1 through MS-4 | Analyzes and tracks AI risks quantitatively |\n| MANAGE | MG-1 through MG-4 | Prioritizes, responds to, and monitors AI risks |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-878ea00c342bb4a0c8bd","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":36,"lineEnd":174,"originalCells":{"A":"## GOVERN Function (GV)\n\nThe GOVERN function establishes the organizational policies, processes, and culture required to enable responsible AI risk management across the full lifecycle.\n\n### GV-1: Policies, Processes, Procedures, and Practices\n\n**Purpose:** Organizational policies and practices are in place to govern AI risk.\n\n**Subcategories:**\n\n**GV-1.1** — Organizational policies and practices are in place to plan, prioritize, govern, and monitor AI risk management activities.\n- Requires documented AI governance charter or policy\n- Must define scope of AI systems covered\n- Must assign accountability for AI risk oversight\n- GOVERN component: Policy Engine — loads framework, tracks compliance posture\n\n**GV-1.2** — Organizational teams are committed to a culture that considers and communicates AI risks.\n- Requires executive-level AI risk acknowledgment\n- Requires training and awareness program for AI risk\n- GOVERN component: Awareness module, council deliberation records\n\n**GV-1.3** — Organizational leadership takes responsibility for decisions about risks associated with AI system development and deployment.\n- Requires named AI risk owner at leadership level\n- Requires escalation path for high-risk AI decisions\n- GOVERN component: Role assignment, accountability ledger\n\n**GV-1.4** — Organizational teams are committed to transparent organizational practices and policies.\n- Requires disclosure framework for AI system use\n- Requires stakeholder communication plan\n- GOVERN component: Disclosure report generator\n\n**GV-1.5** — Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review.\n- Requires defined review cadence (minimum annual)\n- Requires metrics for monitoring effectiveness\n- GOVERN component: Continuous monitoring dashboard, alert engine\n\n**GV-1.6** — Policies and procedures are in place for the organizational risk governance and oversight of AI systems developed, used, or acquired from third parties, and for risk management of AI-specific supply chain issues including third-party data and AI components.\n- Requires third-party AI vendor assessment process\n- Requires AI supply chain risk policy\n- GOVERN component: Third-party assess mode, vendor registry\n\n---\n\n### GV-2: Accountability Structures\n\n**Purpose:** Accountability is established across the AI lifecycle.\n\n**Subcategories:**\n\n**GV-2.1** — Roles and responsibilities and organizational accountabilities for personnel involved with the design, development, deployment, assessment and monitoring of AI systems are established.\n- Requires RACI matrix for AI roles\n- Requires defined responsibilities for data scientists, ML engineers, risk officers, legal, compliance\n- GOVERN component: Role registry, accountability matrix\n\n**GV-2.2** — The risk or legal review function is documented and accountable to senior leadership.\n- Requires documented reporting structure for AI legal/risk function\n- GOVERN component: Governance structure documentation\n\n**GV-2.3** — Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.\n- Requires board-level or C-suite AI risk acknowledgment records\n- GOVERN component: Executive attestation module\n\n---\n\n### GV-3: Workforce Diversity, Equity, Inclusion, and Accessibility\n\n**Purpose:** Diverse teams reduce AI bias and improve risk detection.\n\n**Subcategories:**\n\n**GV-3.1** — Organizational policies and practices are in place to foster a critical thinking culture.\n- Requires documented process for raising AI risk concerns\n- Requires psychological safety mechanisms\n- GOVERN component: Risk flagging interface, anonymous reporting channel\n\n**GV-3.2** — Policies, practices, and mechanisms are in place for the training and certification of AI personnel.\n- Requires defined AI literacy curriculum\n- Requires certification tracking for key roles\n- GOVERN component: Training tracker, certification registry\n\n**GV-3.3** — Fairness and bias — human factors and diversity considerations exist in organizational policies and practices across the AI lifecycle.\n- Requires demographic diversity analysis in AI teams\n- Requires process for incorporating diverse perspectives in AI design\n- GOVERN component: Diversity and inclusion assessment panel\n\n---\n\n### GV-4: Organizational Teams Are Committed\n\n**Purpose:** Cross-functional commitment to AI risk management is embedded.\n\n**Subcategories:**\n\n**GV-4.1** — Organizational policies and practices are in place to foster AI risk awareness and to create a culture of trustworthy, responsible AI.\n- Requires AI ethics principles documented and socialized\n- Requires leadership messaging on responsible AI\n- GOVERN component: Culture assessment, policy publication engine\n\n**GV-4.2** — Organizational teams document the risks and potential impacts of AI technologies applied to their functions and using their data.\n- Requires business unit AI risk registers\n- Requires impact documentation per AI use case\n- GOVERN component: Risk register, per-system risk ledger\n\n---\n\n### GV-5: Organizational Risk Strategy\n\n**Purpose:** AI risk tolerance and strategy are defined and integrated with enterprise risk.\n\n**Subcategories:**\n\n**GV-5.1** — Organizational risk policies include and are inclusive of AI risks.\n- Requires AI risk integrated into enterprise risk management framework\n- GOVERN component: ERM integration module, risk appetite statement\n\n**GV-5.2** — Risk tolerance for the development and deployment of AI systems — including organizational risk tolerance for known trustworthiness limitations of AI systems — is established, communicated, and regularly reviewed.\n- Requires documented risk tolerance thresholds by AI risk category\n- Requires regular board/leadership review of AI risk tolerance\n- GOVERN component: Risk tolerance dashboard, threshold alert engine\n\n---\n\n### GV-6: Policies and Procedures\n\n**Purpose:** Legal, compliance, and governance requirements are integrated into AI processes.\n\n**Subcategories:**\n\n**GV-6.1** — Policies and procedures are in place for the identification and documentation of legal requirements related to AI use, including international requirements for AI systems used in multiple jurisdictions.\n- Requires legal inventory of applicable AI regulations per jurisdiction\n- Requires documentation of AI system jurisdictional scope\n- GOVERN component: Regulatory mapping engine, jurisdiction tracker\n\n**GV-6.2** — Organizational risk policies are inclusive of regulatory compliance and legal requirements.\n- Requires AI compliance program covering NIST, ISO, EU AI Act, FedRAMP as applicable\n- GOVERN component: Compliance gap tracker, standard alignment report\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-2b026bea0a42cc99a15f","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":40,"lineEnd":78,"originalCells":{"A":"### GV-1: Policies, Processes, Procedures, and Practices\n\n**Purpose:** Organizational policies and practices are in place to govern AI risk.\n\n**Subcategories:**\n\n**GV-1.1** — Organizational policies and practices are in place to plan, prioritize, govern, and monitor AI risk management activities.\n- Requires documented AI governance charter or policy\n- Must define scope of AI systems covered\n- Must assign accountability for AI risk oversight\n- GOVERN component: Policy Engine — loads framework, tracks compliance posture\n\n**GV-1.2** — Organizational teams are committed to a culture that considers and communicates AI risks.\n- Requires executive-level AI risk acknowledgment\n- Requires training and awareness program for AI risk\n- GOVERN component: Awareness module, council deliberation records\n\n**GV-1.3** — Organizational leadership takes responsibility for decisions about risks associated with AI system development and deployment.\n- Requires named AI risk owner at leadership level\n- Requires escalation path for high-risk AI decisions\n- GOVERN component: Role assignment, accountability ledger\n\n**GV-1.4** — Organizational teams are committed to transparent organizational practices and policies.\n- Requires disclosure framework for AI system use\n- Requires stakeholder communication plan\n- GOVERN component: Disclosure report generator\n\n**GV-1.5** — Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review.\n- Requires defined review cadence (minimum annual)\n- Requires metrics for monitoring effectiveness\n- GOVERN component: Continuous monitoring dashboard, alert engine\n\n**GV-1.6** — Policies and procedures are in place for the organizational risk governance and oversight of AI systems developed, used, or acquired from third parties, and for risk management of AI-specific supply chain issues including third-party data and AI components.\n- Requires third-party AI vendor assessment process\n- Requires AI supply chain risk policy\n- GOVERN component: Third-party assess mode, vendor registry\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-3441a62cc7f57fa0610f","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":79,"lineEnd":99,"originalCells":{"A":"### GV-2: Accountability Structures\n\n**Purpose:** Accountability is established across the AI lifecycle.\n\n**Subcategories:**\n\n**GV-2.1** — Roles and responsibilities and organizational accountabilities for personnel involved with the design, development, deployment, assessment and monitoring of AI systems are established.\n- Requires RACI matrix for AI roles\n- Requires defined responsibilities for data scientists, ML engineers, risk officers, legal, compliance\n- GOVERN component: Role registry, accountability matrix\n\n**GV-2.2** — The risk or legal review function is documented and accountable to senior leadership.\n- Requires documented reporting structure for AI legal/risk function\n- GOVERN component: Governance structure documentation\n\n**GV-2.3** — Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.\n- Requires board-level or C-suite AI risk acknowledgment records\n- GOVERN component: Executive attestation module\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-a195ad5a2b50e6ad5997","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":100,"lineEnd":122,"originalCells":{"A":"### GV-3: Workforce Diversity, Equity, Inclusion, and Accessibility\n\n**Purpose:** Diverse teams reduce AI bias and improve risk detection.\n\n**Subcategories:**\n\n**GV-3.1** — Organizational policies and practices are in place to foster a critical thinking culture.\n- Requires documented process for raising AI risk concerns\n- Requires psychological safety mechanisms\n- GOVERN component: Risk flagging interface, anonymous reporting channel\n\n**GV-3.2** — Policies, practices, and mechanisms are in place for the training and certification of AI personnel.\n- Requires defined AI literacy curriculum\n- Requires certification tracking for key roles\n- GOVERN component: Training tracker, certification registry\n\n**GV-3.3** — Fairness and bias — human factors and diversity considerations exist in organizational policies and practices across the AI lifecycle.\n- Requires demographic diversity analysis in AI teams\n- Requires process for incorporating diverse perspectives in AI design\n- GOVERN component: Diversity and inclusion assessment panel\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-5fa067a7fb762fbbd16f","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":123,"lineEnd":140,"originalCells":{"A":"### GV-4: Organizational Teams Are Committed\n\n**Purpose:** Cross-functional commitment to AI risk management is embedded.\n\n**Subcategories:**\n\n**GV-4.1** — Organizational policies and practices are in place to foster AI risk awareness and to create a culture of trustworthy, responsible AI.\n- Requires AI ethics principles documented and socialized\n- Requires leadership messaging on responsible AI\n- GOVERN component: Culture assessment, policy publication engine\n\n**GV-4.2** — Organizational teams document the risks and potential impacts of AI technologies applied to their functions and using their data.\n- Requires business unit AI risk registers\n- Requires impact documentation per AI use case\n- GOVERN component: Risk register, per-system risk ledger\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-18020d0781a1d8ff2173","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":141,"lineEnd":157,"originalCells":{"A":"### GV-5: Organizational Risk Strategy\n\n**Purpose:** AI risk tolerance and strategy are defined and integrated with enterprise risk.\n\n**Subcategories:**\n\n**GV-5.1** — Organizational risk policies include and are inclusive of AI risks.\n- Requires AI risk integrated into enterprise risk management framework\n- GOVERN component: ERM integration module, risk appetite statement\n\n**GV-5.2** — Risk tolerance for the development and deployment of AI systems — including organizational risk tolerance for known trustworthiness limitations of AI systems — is established, communicated, and regularly reviewed.\n- Requires documented risk tolerance thresholds by AI risk category\n- Requires regular board/leadership review of AI risk tolerance\n- GOVERN component: Risk tolerance dashboard, threshold alert engine\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-0fcfbe96d8f2fa430301","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":158,"lineEnd":174,"originalCells":{"A":"### GV-6: Policies and Procedures\n\n**Purpose:** Legal, compliance, and governance requirements are integrated into AI processes.\n\n**Subcategories:**\n\n**GV-6.1** — Policies and procedures are in place for the identification and documentation of legal requirements related to AI use, including international requirements for AI systems used in multiple jurisdictions.\n- Requires legal inventory of applicable AI regulations per jurisdiction\n- Requires documentation of AI system jurisdictional scope\n- GOVERN component: Regulatory mapping engine, jurisdiction tracker\n\n**GV-6.2** — Organizational risk policies are inclusive of regulatory compliance and legal requirements.\n- Requires AI compliance program covering NIST, ISO, EU AI Act, FedRAMP as applicable\n- GOVERN component: Compliance gap tracker, standard alignment report\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-04b3708e53d5745a9577","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":175,"lineEnd":300,"originalCells":{"A":"## MAP Function (MP)\n\nThe MAP function establishes the context for AI risk assessment — categorizing systems, identifying stakeholders, and framing the risks present.\n\n### MP-1: Context Is Established\n\n**Purpose:** The organizational context and AI system context are documented before risk assessment.\n\n**Subcategories:**\n\n**MP-1.1** — Intended purpose, potentially beneficial uses, context of use, and risks of AI systems are understood and documented.\n- Requires documented AI system purpose statement\n- Requires identification of intended use cases and out-of-scope uses\n- GOVERN component: System inventory, use case registry\n\n**MP-1.2** — Scientific findings, technical standards, and trustworthiness of AI systems are understood, documented, and communicated.\n- Requires technical documentation of AI model architecture, training data, and performance characteristics\n- GOVERN component: Technical fact sheet generator, model card integration\n\n**MP-1.3** — Potential benefits of intended AI system deployment — including financial, societal, and broadly beneficial uses — are examined and documented.\n- Requires documented benefits analysis per AI system\n- GOVERN component: Benefits documentation module\n\n**MP-1.4** — Risks or harms of deployed AI systems — and their potential consequences to individuals, groups, communities, organizations, and society — are examined and documented.\n- Requires impact assessment covering affected individuals and groups\n- Requires documentation of high-risk harm scenarios\n- GOVERN component: Harm assessment module, impact ledger\n\n**MP-1.5** — Likelihood and magnitude of each identified AI system risk or impact are estimated and documented.\n- Requires risk likelihood and magnitude scoring methodology\n- GOVERN component: Risk scoring engine, probability-impact matrix\n\n**MP-1.6** — Risks or harms from third-party use of the organization's data or AI systems, including data provenance, data quality, and supply chain risks, are documented.\n- Requires third-party data risk documentation\n- GOVERN component: Data provenance tracker, supply chain risk register\n\n---\n\n### MP-2: Scientific Basis of AI Risk\n\n**Purpose:** AI risks are classified and framed relative to accepted scientific knowledge.\n\n**Subcategories:**\n\n**MP-2.1** — Scientific community norms for validating AI risks and potential impacts are followed.\n- Requires model validation methodology documentation\n- Requires reference to peer-reviewed standards and research\n- GOVERN component: Validation methodology registry\n\n**MP-2.2** — Risk classifications are defined by the organization and used in AI risk classification decisions.\n- Requires defined risk taxonomy (e.g., low/medium/high/critical)\n- Requires documented classification criteria\n- GOVERN component: Risk taxonomy engine, classification workflow\n\n**MP-2.3** — AI system risk and benefit analysis incorporates considerations of affected individuals and groups.\n- Requires stakeholder impact analysis covering affected populations\n- GOVERN component: Stakeholder mapping module\n\n---\n\n### MP-3: AI Capabilities and Limitations\n\n**Purpose:** AI system capabilities, limitations, and trustworthiness properties are documented.\n\n**Subcategories:**\n\n**MP-3.1** — Potential impacts of bias are characterized in data, models, and downstream uses and impacts are documented.\n- Requires bias analysis of training data and model outputs\n- Requires documentation of known bias characteristics\n- GOVERN component: Bias assessment module, bias report generator\n\n**MP-3.2** — Scientific methods — including those from risk sciences, harm sciences, and social sciences — are used to inform bias assessments and documentation.\n- Requires peer-reviewed or validated bias assessment methodology\n- GOVERN component: Methodology documentation, validation records\n\n**MP-3.3** — Processes for operator and user feedback about AI system performance and trustworthiness are established and integrated into AI system updates.\n- Requires feedback channel for operators and users to report AI performance issues\n- Requires process to incorporate feedback into system updates\n- GOVERN component: Feedback intake module, change management integration\n\n---\n\n### MP-4: Risks Are Prioritized\n\n**Purpose:** Identified risks are triaged and prioritized for response.\n\n**Subcategories:**\n\n**MP-4.1** — The organization's risk tolerance for the AI system under consideration is established, communicated, and incorporated into the risk identification and classification process.\n- Requires risk tolerance applied at system level\n- GOVERN component: Per-system risk tolerance configuration\n\n**MP-4.2** — Risk levels of AI systems at deployment are documented per risk classification and tolerance levels.\n- Requires system-level risk rating at deployment\n- GOVERN component: Deployment risk certification, risk ledger\n\n---\n\n### MP-5: Organizational Risk Management\n\n**Purpose:** AI risk management is integrated with enterprise risk management processes.\n\n**Subcategories:**\n\n**MP-5.1** — Likelihood of encountering AI risks given use of AI and organizational risk tolerances is determined.\n- Requires probability analysis of AI risk exposure\n- GOVERN component: Exposure analysis module\n\n**MP-5.2** — Organizations are transparent about known limitations and where knowledge is incomplete.\n- Requires documented limitations section in AI system documentation\n- GOVERN component: Limitations register, transparency report\n\n**MP-5.3** — Organizational risk policies include and are inclusive of AI risks.\n- Requires AI risk explicitly included in enterprise risk policies\n- GOVERN component: Policy integration audit\n\n**MP-5.4** — Risk tolerance for the development and deployment of AI systems is established, communicated, and regularly reviewed.\n- Requires formal risk tolerance review cadence\n- GOVERN component: Risk tolerance review scheduler, review records\n\n**MP-5.5** — Practices and documentation establish how identified risks will be addressed and where they fall in the organization's risk management framework.\n- Requires documented risk treatment methodology\n- GOVERN component: Risk treatment tracker, treatment workflow engine\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-28d77104e1d39d95e320","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":179,"lineEnd":212,"originalCells":{"A":"### MP-1: Context Is Established\n\n**Purpose:** The organizational context and AI system context are documented before risk assessment.\n\n**Subcategories:**\n\n**MP-1.1** — Intended purpose, potentially beneficial uses, context of use, and risks of AI systems are understood and documented.\n- Requires documented AI system purpose statement\n- Requires identification of intended use cases and out-of-scope uses\n- GOVERN component: System inventory, use case registry\n\n**MP-1.2** — Scientific findings, technical standards, and trustworthiness of AI systems are understood, documented, and communicated.\n- Requires technical documentation of AI model architecture, training data, and performance characteristics\n- GOVERN component: Technical fact sheet generator, model card integration\n\n**MP-1.3** — Potential benefits of intended AI system deployment — including financial, societal, and broadly beneficial uses — are examined and documented.\n- Requires documented benefits analysis per AI system\n- GOVERN component: Benefits documentation module\n\n**MP-1.4** — Risks or harms of deployed AI systems — and their potential consequences to individuals, groups, communities, organizations, and society — are examined and documented.\n- Requires impact assessment covering affected individuals and groups\n- Requires documentation of high-risk harm scenarios\n- GOVERN component: Harm assessment module, impact ledger\n\n**MP-1.5** — Likelihood and magnitude of each identified AI system risk or impact are estimated and documented.\n- Requires risk likelihood and magnitude scoring methodology\n- GOVERN component: Risk scoring engine, probability-impact matrix\n\n**MP-1.6** — Risks or harms from third-party use of the organization's data or AI systems, including data provenance, data quality, and supply chain risks, are documented.\n- Requires third-party data risk documentation\n- GOVERN component: Data provenance tracker, supply chain risk register\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-6e960a66bc0b01f735e4","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":213,"lineEnd":234,"originalCells":{"A":"### MP-2: Scientific Basis of AI Risk\n\n**Purpose:** AI risks are classified and framed relative to accepted scientific knowledge.\n\n**Subcategories:**\n\n**MP-2.1** — Scientific community norms for validating AI risks and potential impacts are followed.\n- Requires model validation methodology documentation\n- Requires reference to peer-reviewed standards and research\n- GOVERN component: Validation methodology registry\n\n**MP-2.2** — Risk classifications are defined by the organization and used in AI risk classification decisions.\n- Requires defined risk taxonomy (e.g., low/medium/high/critical)\n- Requires documented classification criteria\n- GOVERN component: Risk taxonomy engine, classification workflow\n\n**MP-2.3** — AI system risk and benefit analysis incorporates considerations of affected individuals and groups.\n- Requires stakeholder impact analysis covering affected populations\n- GOVERN component: Stakeholder mapping module\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-5be48949371a23fb4816","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":235,"lineEnd":256,"originalCells":{"A":"### MP-3: AI Capabilities and Limitations\n\n**Purpose:** AI system capabilities, limitations, and trustworthiness properties are documented.\n\n**Subcategories:**\n\n**MP-3.1** — Potential impacts of bias are characterized in data, models, and downstream uses and impacts are documented.\n- Requires bias analysis of training data and model outputs\n- Requires documentation of known bias characteristics\n- GOVERN component: Bias assessment module, bias report generator\n\n**MP-3.2** — Scientific methods — including those from risk sciences, harm sciences, and social sciences — are used to inform bias assessments and documentation.\n- Requires peer-reviewed or validated bias assessment methodology\n- GOVERN component: Methodology documentation, validation records\n\n**MP-3.3** — Processes for operator and user feedback about AI system performance and trustworthiness are established and integrated into AI system updates.\n- Requires feedback channel for operators and users to report AI performance issues\n- Requires process to incorporate feedback into system updates\n- GOVERN component: Feedback intake module, change management integration\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-22f6346688d90fc79fcc","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":257,"lineEnd":272,"originalCells":{"A":"### MP-4: Risks Are Prioritized\n\n**Purpose:** Identified risks are triaged and prioritized for response.\n\n**Subcategories:**\n\n**MP-4.1** — The organization's risk tolerance for the AI system under consideration is established, communicated, and incorporated into the risk identification and classification process.\n- Requires risk tolerance applied at system level\n- GOVERN component: Per-system risk tolerance configuration\n\n**MP-4.2** — Risk levels of AI systems at deployment are documented per risk classification and tolerance levels.\n- Requires system-level risk rating at deployment\n- GOVERN component: Deployment risk certification, risk ledger\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-add3b3dcb44ceb1fceca","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":273,"lineEnd":300,"originalCells":{"A":"### MP-5: Organizational Risk Management\n\n**Purpose:** AI risk management is integrated with enterprise risk management processes.\n\n**Subcategories:**\n\n**MP-5.1** — Likelihood of encountering AI risks given use of AI and organizational risk tolerances is determined.\n- Requires probability analysis of AI risk exposure\n- GOVERN component: Exposure analysis module\n\n**MP-5.2** — Organizations are transparent about known limitations and where knowledge is incomplete.\n- Requires documented limitations section in AI system documentation\n- GOVERN component: Limitations register, transparency report\n\n**MP-5.3** — Organizational risk policies include and are inclusive of AI risks.\n- Requires AI risk explicitly included in enterprise risk policies\n- GOVERN component: Policy integration audit\n\n**MP-5.4** — Risk tolerance for the development and deployment of AI systems is established, communicated, and regularly reviewed.\n- Requires formal risk tolerance review cadence\n- GOVERN component: Risk tolerance review scheduler, review records\n\n**MP-5.5** — Practices and documentation establish how identified risks will be addressed and where they fall in the organization's risk management framework.\n- Requires documented risk treatment methodology\n- GOVERN component: Risk treatment tracker, treatment workflow engine\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-a9b0bd16d859386b93aa","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":301,"lineEnd":396,"originalCells":{"A":"## MEASURE Function (MS)\n\nThe MEASURE function provides analytical methods to assess and track AI risks quantitatively and qualitatively.\n\n### MS-1: Risk Metrics and Methods\n\n**Purpose:** Appropriate risk measurement methods are selected and applied.\n\n**Subcategories:**\n\n**MS-1.1** — Approaches and metrics for measurement of AI risks and trustworthiness characteristics reflect deployment context and organizational risk tolerance.\n- Requires defined metrics for each trustworthiness dimension (accuracy, fairness, transparency, privacy, security, reliability)\n- GOVERN component: Metrics library, measurement configuration\n\n**MS-1.2** — Trustworthiness characteristics of AI systems are assessed independently and in the context of AI systems to which they may be connected.\n- Requires system-level and ecosystem-level trustworthiness assessment\n- GOVERN component: System interdependency map, interconnected system assessment\n\n**MS-1.3** — Internal experts are consulted to assess AI risks.\n- Requires expert review process for AI risk assessments\n- GOVERN component: Expert review workflow, reviewer registry\n\n---\n\n### MS-2: Risk Analysis\n\n**Purpose:** AI risks are evaluated using measurement data and expert analysis.\n\n**Subcategories:**\n\n**MS-2.1** — Test sets, metrics, and details about the tools used during test, evaluation, validation, and verification (TEVV) are documented.\n- Requires TEVV documentation including test datasets, metrics, and tools\n- GOVERN component: TEVV documentation module, test artifact registry\n\n**MS-2.2** — AI system trustworthiness characteristics are calibrated for risks of under- and over-reliance on AI systems.\n- Requires calibration testing for confidence and uncertainty estimation\n- GOVERN component: Calibration assessment, uncertainty quantification tracker\n\n**MS-2.3** — AI system performance and trustworthiness characteristics are evaluated regularly against benchmarks.\n- Requires regular performance benchmarking cadence\n- GOVERN component: Benchmarking scheduler, benchmark results ledger\n\n**MS-2.4** — The ability of humans to interpret AI system outputs when needed is evaluated on a regular basis.\n- Requires explainability and interpretability testing\n- GOVERN component: Explainability assessment module\n\n**MS-2.5** — Risk characteristics established in MP are employed in the measurement and analysis of AI system risks and trustworthiness.\n- Requires traceability from risk identification (MAP) to risk measurement (MEASURE)\n- GOVERN component: Cross-function traceability engine\n\n**MS-2.6** — Risk or performance characteristics established in and of AI systems are verified with the relevant populations.\n- Requires performance validation against representative population samples\n- GOVERN component: Population-representative validation module\n\n---\n\n### MS-3: Performance Monitoring\n\n**Purpose:** AI system performance is tracked throughout the deployment lifecycle.\n\n**Subcategories:**\n\n**MS-3.1** — Ongoing monitoring plans are in place to address the identified AI risks and trustworthiness characteristics of the AI system.\n- Requires monitoring plan documentation per AI system\n- GOVERN component: Monitoring plan builder, monitoring schedule\n\n**MS-3.2** — The risk or performance characteristics of the AI system to be deployed are examined and documented.\n- Requires pre-deployment performance documentation\n- GOVERN component: Pre-deployment risk certification\n\n**MS-3.3** — AI system risks and trustworthiness are measured in deployment and monitoring contexts.\n- Requires in-deployment performance and risk monitoring\n- GOVERN component: Live monitoring dashboard, alert engine\n\n**MS-3.4** — Feedback processes for end users and impacted communities to report problems and provide feedback are established.\n- Requires user-facing feedback mechanism for AI system issues\n- GOVERN component: Public feedback intake module\n\n---\n\n### MS-4: Feedback Integration\n\n**Purpose:** Measurement results and feedback are integrated into AI risk management.\n\n**Subcategories:**\n\n**MS-4.1** — Measurement approaches for identifying AI risks are connected to organizational risk tolerance and relevant laws, regulations, and standards.\n- Requires measurement methodology tied to regulatory requirements\n- GOVERN component: Regulatory measurement alignment\n\n**MS-4.2** — Measurement results inform updates to the risk mapping and risk management approaches.\n- Requires feedback loop from measurement results to MAP and MANAGE functions\n- GOVERN component: Cross-function feedback loop, update workflow\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-17d41324d49a9e7718dd","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":305,"lineEnd":324,"originalCells":{"A":"### MS-1: Risk Metrics and Methods\n\n**Purpose:** Appropriate risk measurement methods are selected and applied.\n\n**Subcategories:**\n\n**MS-1.1** — Approaches and metrics for measurement of AI risks and trustworthiness characteristics reflect deployment context and organizational risk tolerance.\n- Requires defined metrics for each trustworthiness dimension (accuracy, fairness, transparency, privacy, security, reliability)\n- GOVERN component: Metrics library, measurement configuration\n\n**MS-1.2** — Trustworthiness characteristics of AI systems are assessed independently and in the context of AI systems to which they may be connected.\n- Requires system-level and ecosystem-level trustworthiness assessment\n- GOVERN component: System interdependency map, interconnected system assessment\n\n**MS-1.3** — Internal experts are consulted to assess AI risks.\n- Requires expert review process for AI risk assessments\n- GOVERN component: Expert review workflow, reviewer registry\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-e29ddcc706de765dbde9","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":325,"lineEnd":356,"originalCells":{"A":"### MS-2: Risk Analysis\n\n**Purpose:** AI risks are evaluated using measurement data and expert analysis.\n\n**Subcategories:**\n\n**MS-2.1** — Test sets, metrics, and details about the tools used during test, evaluation, validation, and verification (TEVV) are documented.\n- Requires TEVV documentation including test datasets, metrics, and tools\n- GOVERN component: TEVV documentation module, test artifact registry\n\n**MS-2.2** — AI system trustworthiness characteristics are calibrated for risks of under- and over-reliance on AI systems.\n- Requires calibration testing for confidence and uncertainty estimation\n- GOVERN component: Calibration assessment, uncertainty quantification tracker\n\n**MS-2.3** — AI system performance and trustworthiness characteristics are evaluated regularly against benchmarks.\n- Requires regular performance benchmarking cadence\n- GOVERN component: Benchmarking scheduler, benchmark results ledger\n\n**MS-2.4** — The ability of humans to interpret AI system outputs when needed is evaluated on a regular basis.\n- Requires explainability and interpretability testing\n- GOVERN component: Explainability assessment module\n\n**MS-2.5** — Risk characteristics established in MP are employed in the measurement and analysis of AI system risks and trustworthiness.\n- Requires traceability from risk identification (MAP) to risk measurement (MEASURE)\n- GOVERN component: Cross-function traceability engine\n\n**MS-2.6** — Risk or performance characteristics established in and of AI systems are verified with the relevant populations.\n- Requires performance validation against representative population samples\n- GOVERN component: Population-representative validation module\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-49e94a6ec28417ee9c6c","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":357,"lineEnd":380,"originalCells":{"A":"### MS-3: Performance Monitoring\n\n**Purpose:** AI system performance is tracked throughout the deployment lifecycle.\n\n**Subcategories:**\n\n**MS-3.1** — Ongoing monitoring plans are in place to address the identified AI risks and trustworthiness characteristics of the AI system.\n- Requires monitoring plan documentation per AI system\n- GOVERN component: Monitoring plan builder, monitoring schedule\n\n**MS-3.2** — The risk or performance characteristics of the AI system to be deployed are examined and documented.\n- Requires pre-deployment performance documentation\n- GOVERN component: Pre-deployment risk certification\n\n**MS-3.3** — AI system risks and trustworthiness are measured in deployment and monitoring contexts.\n- Requires in-deployment performance and risk monitoring\n- GOVERN component: Live monitoring dashboard, alert engine\n\n**MS-3.4** — Feedback processes for end users and impacted communities to report problems and provide feedback are established.\n- Requires user-facing feedback mechanism for AI system issues\n- GOVERN component: Public feedback intake module\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-7f050a0df7012015fb10","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":381,"lineEnd":396,"originalCells":{"A":"### MS-4: Feedback Integration\n\n**Purpose:** Measurement results and feedback are integrated into AI risk management.\n\n**Subcategories:**\n\n**MS-4.1** — Measurement approaches for identifying AI risks are connected to organizational risk tolerance and relevant laws, regulations, and standards.\n- Requires measurement methodology tied to regulatory requirements\n- GOVERN component: Regulatory measurement alignment\n\n**MS-4.2** — Measurement results inform updates to the risk mapping and risk management approaches.\n- Requires feedback loop from measurement results to MAP and MANAGE functions\n- GOVERN component: Cross-function feedback loop, update workflow\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-e2329858845ecb787f68","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":397,"lineEnd":493,"originalCells":{"A":"## MANAGE Function (MG)\n\nThe MANAGE function addresses AI risks that have been identified and prioritized, defining responses, treatments, and ongoing monitoring.\n\n### MG-1: Risk Response Plans\n\n**Purpose:** Responses to identified AI risks are planned and documented.\n\n**Subcategories:**\n\n**MG-1.1** — A set of risk treatment options (responses) are documented for AI risks including the avoidance, acceptance, transfer, and control of risks.\n- Requires documented risk treatment options per risk category\n- Requires justification for selected treatment approach\n- GOVERN component: Risk treatment library, treatment selection workflow\n\n**MG-1.2** — Treatment of AI risks includes a determination of residual risks after the risk response plan has been implemented.\n- Requires residual risk documentation post-treatment\n- GOVERN component: Residual risk tracker\n\n**MG-1.3** — Responses to the AI risks deemed high priority are developed, planned, and documented.\n- Requires expedited response plans for high-priority risks\n- GOVERN component: Priority risk response queue, response SLA tracking\n\n---\n\n### MG-2: Risk Response Execution\n\n**Purpose:** Risk responses are implemented effectively.\n\n**Subcategories:**\n\n**MG-2.1** — Resources required to manage AI risks are taken into account including the staff, budget, and compute required for implementation.\n- Requires resource plan for AI risk management activities\n- GOVERN component: Resource allocation module\n\n**MG-2.2** — Mechanisms are in place and applied to sustain the value of deployed AI systems and to manage the risks of AI system decommissioning, including appropriate archiving of useful elements.\n- Requires AI system lifecycle management process including decommissioning\n- GOVERN component: Lifecycle management tracker, decommissioning checklist\n\n**MG-2.3** — Procedures are followed to respond to and recover from a previously unknown risk.\n- Requires incident response procedure for novel AI risks\n- GOVERN component: Incident response playbook, novel risk intake\n\n**MG-2.4** — Mechanisms are in place to allow personnel to report problems to management.\n- Requires internal reporting mechanism for AI risk issues\n- GOVERN component: Internal risk reporting module, escalation workflow\n\n---\n\n### MG-3: Risk Treatment Feedback\n\n**Purpose:** Treatment effectiveness is assessed and improvements are made.\n\n**Subcategories:**\n\n**MG-3.1** — Risk treatment strategies and methods are documented, as are the reasons for the selection of risk treatment options.\n- Requires treatment selection rationale documentation\n- GOVERN component: Treatment rationale ledger\n\n**MG-3.2** — Treatment of AI risks includes a determination of residual risk after the risk response plan has been implemented.\n- Requires residual risk assessment post-implementation\n- GOVERN component: Post-treatment residual risk review\n\n**MG-3.3** — Feedback processes are in place to inform updates to the risk mapping, risk analysis, risk treatment, and monitoring activities.\n- Requires cross-function feedback loop from MANAGE back to MAP and MEASURE\n- GOVERN component: Feedback integration engine, continuous improvement workflow\n\n**MG-3.4** — Risk treatment plans for AI systems are maintained and updated regularly.\n- Requires periodic review and update of treatment plans\n- GOVERN component: Treatment plan review scheduler, update records\n\n---\n\n### MG-4: Risk Communication\n\n**Purpose:** AI risk information is communicated to relevant stakeholders.\n\n**Subcategories:**\n\n**MG-4.1** — Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors across the AI lifecycle.\n- Requires active post-deployment monitoring program\n- GOVERN component: Post-deployment monitoring dashboard\n\n**MG-4.2** — Measurable performance improvements or declines and other changes in deployed AI system trustworthiness are evaluated and documented.\n- Requires performance trend tracking over time\n- GOVERN component: Performance trend tracker, delta reporting\n\n**MG-4.3** — Feedback processes for improvement are followed for deployed AI systems.\n- Requires documented improvement process using monitoring and feedback data\n- GOVERN component: Improvement workflow engine\n\n**MG-4.4** — Organizational teams communicate with personnel to report problems and suggest opportunities for improvement across the AI lifecycle.\n- Requires internal communication process for AI risk findings\n- GOVERN component: Internal communication module, findings distribution\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-e871d5e7eb80c4ad00cb","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":401,"lineEnd":421,"originalCells":{"A":"### MG-1: Risk Response Plans\n\n**Purpose:** Responses to identified AI risks are planned and documented.\n\n**Subcategories:**\n\n**MG-1.1** — A set of risk treatment options (responses) are documented for AI risks including the avoidance, acceptance, transfer, and control of risks.\n- Requires documented risk treatment options per risk category\n- Requires justification for selected treatment approach\n- GOVERN component: Risk treatment library, treatment selection workflow\n\n**MG-1.2** — Treatment of AI risks includes a determination of residual risks after the risk response plan has been implemented.\n- Requires residual risk documentation post-treatment\n- GOVERN component: Residual risk tracker\n\n**MG-1.3** — Responses to the AI risks deemed high priority are developed, planned, and documented.\n- Requires expedited response plans for high-priority risks\n- GOVERN component: Priority risk response queue, response SLA tracking\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-ee37016a6565ffd88843","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":422,"lineEnd":445,"originalCells":{"A":"### MG-2: Risk Response Execution\n\n**Purpose:** Risk responses are implemented effectively.\n\n**Subcategories:**\n\n**MG-2.1** — Resources required to manage AI risks are taken into account including the staff, budget, and compute required for implementation.\n- Requires resource plan for AI risk management activities\n- GOVERN component: Resource allocation module\n\n**MG-2.2** — Mechanisms are in place and applied to sustain the value of deployed AI systems and to manage the risks of AI system decommissioning, including appropriate archiving of useful elements.\n- Requires AI system lifecycle management process including decommissioning\n- GOVERN component: Lifecycle management tracker, decommissioning checklist\n\n**MG-2.3** — Procedures are followed to respond to and recover from a previously unknown risk.\n- Requires incident response procedure for novel AI risks\n- GOVERN component: Incident response playbook, novel risk intake\n\n**MG-2.4** — Mechanisms are in place to allow personnel to report problems to management.\n- Requires internal reporting mechanism for AI risk issues\n- GOVERN component: Internal risk reporting module, escalation workflow\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-bec92b82abec84bcc1e2","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":446,"lineEnd":469,"originalCells":{"A":"### MG-3: Risk Treatment Feedback\n\n**Purpose:** Treatment effectiveness is assessed and improvements are made.\n\n**Subcategories:**\n\n**MG-3.1** — Risk treatment strategies and methods are documented, as are the reasons for the selection of risk treatment options.\n- Requires treatment selection rationale documentation\n- GOVERN component: Treatment rationale ledger\n\n**MG-3.2** — Treatment of AI risks includes a determination of residual risk after the risk response plan has been implemented.\n- Requires residual risk assessment post-implementation\n- GOVERN component: Post-treatment residual risk review\n\n**MG-3.3** — Feedback processes are in place to inform updates to the risk mapping, risk analysis, risk treatment, and monitoring activities.\n- Requires cross-function feedback loop from MANAGE back to MAP and MEASURE\n- GOVERN component: Feedback integration engine, continuous improvement workflow\n\n**MG-3.4** — Risk treatment plans for AI systems are maintained and updated regularly.\n- Requires periodic review and update of treatment plans\n- GOVERN component: Treatment plan review scheduler, update records\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-942fd275780b6f127eac","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":470,"lineEnd":493,"originalCells":{"A":"### MG-4: Risk Communication\n\n**Purpose:** AI risk information is communicated to relevant stakeholders.\n\n**Subcategories:**\n\n**MG-4.1** — Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors across the AI lifecycle.\n- Requires active post-deployment monitoring program\n- GOVERN component: Post-deployment monitoring dashboard\n\n**MG-4.2** — Measurable performance improvements or declines and other changes in deployed AI system trustworthiness are evaluated and documented.\n- Requires performance trend tracking over time\n- GOVERN component: Performance trend tracker, delta reporting\n\n**MG-4.3** — Feedback processes for improvement are followed for deployed AI systems.\n- Requires documented improvement process using monitoring and feedback data\n- GOVERN component: Improvement workflow engine\n\n**MG-4.4** — Organizational teams communicate with personnel to report problems and suggest opportunities for improvement across the AI lifecycle.\n- Requires internal communication process for AI risk findings\n- GOVERN component: Internal communication module, findings distribution\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-2af11eba998f86b9487a","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":494,"lineEnd":537,"originalCells":{"A":"## Scoring Methodology\n\n### Control-Level Scoring\n\nEach subcategory (control) is scored on a 0–4 scale:\n\n| Score | Label | Criteria |\n|-------|-------|---------|\n| 0 | Not Present | No evidence of this control existing |\n| 1 | Initial | Ad hoc, informal, or partial implementation |\n| 2 | Developing | Defined process exists but inconsistently applied |\n| 3 | Established | Consistently applied, documented, and repeatable |\n| 4 | Optimized | Measured, monitored, and continuously improved |\n\n### Category Score\n\nCategory score = average of all subcategory scores within the category, expressed as a percentage of maximum possible.\n\n### Function Score\n\nFunction score = weighted average of all category scores within the function.\n\nDefault weighting:\n- GOVERN: 25%\n- MAP: 25%\n- MEASURE: 25%\n- MANAGE: 25%\n\nCustom weighting can be applied for sector-specific profiles (e.g., federal agencies weight GOVERN higher; healthcare weights MEASURE and MANAGE higher).\n\n### TAIMScore™ Composite\n\nTAIMScore™ Composite = weighted average of all four function scores.\n\n| TAIMScore Range | Maturity Level | Interpretation |\n|-----------------|---------------|----------------|\n| 0–24 | Nascent | Significant gaps; high AI risk exposure |\n| 25–49 | Initial | Ad hoc practices; reactive posture |\n| 50–69 | Developing | Defined processes; inconsistent application |\n| 70–84 | Established | Consistent governance; some optimization gaps |\n| 85–100 | Optimized | Mature, measured, continuously improving |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-f7f688eefa4819b834c8","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":496,"lineEnd":507,"originalCells":{"A":"### Control-Level Scoring\n\nEach subcategory (control) is scored on a 0–4 scale:\n\n| Score | Label | Criteria |\n|-------|-------|---------|\n| 0 | Not Present | No evidence of this control existing |\n| 1 | Initial | Ad hoc, informal, or partial implementation |\n| 2 | Developing | Defined process exists but inconsistently applied |\n| 3 | Established | Consistently applied, documented, and repeatable |\n| 4 | Optimized | Measured, monitored, and continuously improved |\n"},"originalFormulas":{}},{"id":"ROW-MD-23df0e9e3bb14ba8e746","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":508,"lineEnd":511,"originalCells":{"A":"### Category Score\n\nCategory score = average of all subcategory scores within the category, expressed as a percentage of maximum possible.\n"},"originalFormulas":{}},{"id":"ROW-MD-943d1e56cb12c08bab56","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":512,"lineEnd":523,"originalCells":{"A":"### Function Score\n\nFunction score = weighted average of all category scores within the function.\n\nDefault weighting:\n- GOVERN: 25%\n- MAP: 25%\n- MEASURE: 25%\n- MANAGE: 25%\n\nCustom weighting can be applied for sector-specific profiles (e.g., federal agencies weight GOVERN higher; healthcare weights MEASURE and MANAGE higher).\n"},"originalFormulas":{}},{"id":"ROW-MD-b2d42d55e250f4f81b9d","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":524,"lineEnd":537,"originalCells":{"A":"### TAIMScore™ Composite\n\nTAIMScore™ Composite = weighted average of all four function scores.\n\n| TAIMScore Range | Maturity Level | Interpretation |\n|-----------------|---------------|----------------|\n| 0–24 | Nascent | Significant gaps; high AI risk exposure |\n| 25–49 | Initial | Ad hoc practices; reactive posture |\n| 50–69 | Developing | Defined processes; inconsistent application |\n| 70–84 | Established | Consistent governance; some optimization gaps |\n| 85–100 | Optimized | Mature, measured, continuously improving |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-b1b80defe50a900080ed","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":538,"lineEnd":558,"originalCells":{"A":"## NIST AI RMF Alignment\n\nTAIMScore IS the NIST AI RMF structure. The mapping is direct:\n\n| TAIMScore Function | NIST AI RMF Core Function | Category Count | Subcategory Count |\n|-------------------|--------------------------|---------------|------------------|\n| GOVERN (GV) | GOVERN | 6 | 19 |\n| MAP (MP) | MAP | 5 | 18 |\n| MEASURE (MS) | MEASURE | 4 | 15 |\n| MANAGE (MG) | MANAGE | 4 | 20 |\n| **Total** | | **19** | **72** |\n\nTAIMScore adds to the NIST AI RMF:\n- Quantified maturity scoring (0–4 per control)\n- Composite score calculation\n- GOVERN component automation mapping\n- Enterprise workflow integration\n- Multi-standard alignment layer (ISO 42001, SOC 2, EU AI Act)\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-0f91acabb211522c9cfa","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":559,"lineEnd":590,"originalCells":{"A":"## GOVERN Component Mapping\n\nThe following table maps TAIMScore controls to GOVERN's functional components:\n\n| TAIMScore Control | GOVERN Component |\n|------------------|-----------------|\n| GV-1.1, GV-1.2, GV-6.1, GV-6.2 | Policy Engine |\n| GV-1.3, GV-2.1, GV-2.2, GV-2.3 | Accountability Ledger |\n| GV-1.5, MS-3.3, MG-4.1 | Continuous Monitoring Dashboard |\n| GV-1.6, MP-1.6 | Third-Party Assess Mode |\n| GV-3.2 | Training and Certification Tracker |\n| GV-5.2, MP-4.1 | Risk Tolerance Configuration |\n| MP-1.1, MP-1.2 | System Inventory and Model Card |\n| MP-1.4, MP-1.5 | Harm Assessment and Risk Scoring Engine |\n| MP-2.2 | Risk Classification Workflow |\n| MP-3.1 | Bias Assessment Module |\n| MS-1.1 | Metrics Library |\n| MS-2.1 | TEVV Documentation Module |\n| MS-2.4 | Explainability Assessment |\n| MS-3.1, MS-3.2 | Pre-Deployment Risk Certification |\n| MG-1.1, MG-1.3 | Risk Treatment Queue |\n| MG-2.3 | Incident Response Playbook |\n| MG-3.3, MS-4.2 | Cross-Function Feedback Loop |\n| MG-4.2 | Performance Trend Tracker |\n\n**GOVERN Assess Modes:**\n- **Rapid Assess** — surveys GV and MP controls; produces TAIMScore Composite with gaps highlighted\n- **Deep Assess** — full 72-control evaluation; produces scored report, gap remediation plan, evidence requirements\n- **Continuous Assess** — ongoing monitoring against MS and MG controls; alerts on score degradation\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-c59a626624c5c09cd240","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":591,"lineEnd":637,"originalCells":{"A":"## Standards Alignment\n\n### NIST AI RMF 1.0 (NIST AI 100-1)\n\nTAIMScore is structurally equivalent to NIST AI RMF. Full coverage across all 4 functions, 19 categories, 72 subcategories.\n\n### ISO/IEC 42001:2023\n\n| ISO 42001 Clause | TAIMScore Controls |\n|-----------------|-------------------|\n| 4 (Context of the organization) | GV-1.1, MP-1.1 |\n| 5 (Leadership) | GV-1.3, GV-2.3 |\n| 6 (Planning) | GV-5.1, GV-5.2, MP-4.1 |\n| 7 (Support) | GV-3.2, GV-4.1 |\n| 8 (Operation) | MP-1.4, MP-3.1, MS-2.1 |\n| 9 (Performance evaluation) | MS-3.1, MS-3.3, MS-4.1 |\n| 10 (Improvement) | MG-3.3, MG-4.3 |\n\n### SOC 2 Type II\n\n| SOC 2 Trust Service Criterion | TAIMScore Controls |\n|------------------------------|-------------------|\n| CC1 (Control Environment) | GV-1.1, GV-2.1 |\n| CC2 (Communication and Information) | GV-1.4, MG-4.4 |\n| CC3 (Risk Assessment) | MP-1.5, MP-2.2 |\n| CC4 (Monitoring of Controls) | GV-1.5, MS-3.3 |\n| CC5 (Control Activities) | MG-1.1, MG-2.3 |\n| CC6 (Logical and Physical Access) | GV-2.1, GV-1.6 |\n| CC7 (System Operations) | MS-3.1, MS-3.3 |\n| CC8 (Change Management) | MP-3.3, MG-2.2 |\n| CC9 (Risk Mitigation) | MG-1.2, MG-1.3 |\n\n### EU AI Act (2024)\n\n| EU AI Act Requirement | TAIMScore Controls |\n|----------------------|-------------------|\n| Article 9 (Risk management system) | MP-1.4, MP-1.5, MG-1.1 |\n| Article 10 (Data governance) | MP-1.6, MP-3.1 |\n| Article 11 (Technical documentation) | MP-1.2, MS-2.1 |\n| Article 12 (Record keeping) | GV-1.5, MS-3.3 |\n| Article 13 (Transparency) | MP-1.1, MP-5.2 |\n| Article 14 (Human oversight) | MS-2.4, MG-2.4 |\n| Article 15 (Accuracy and robustness) | MS-2.3, MS-3.1 |\n| Article 61 (Post-market monitoring) | MG-4.1, MG-4.2 |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-1dbd8121fa6d6c2fd58c","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":593,"lineEnd":596,"originalCells":{"A":"### NIST AI RMF 1.0 (NIST AI 100-1)\n\nTAIMScore is structurally equivalent to NIST AI RMF. Full coverage across all 4 functions, 19 categories, 72 subcategories.\n"},"originalFormulas":{}},{"id":"ROW-MD-f5c2d38554f433f55b04","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":597,"lineEnd":608,"originalCells":{"A":"### ISO/IEC 42001:2023\n\n| ISO 42001 Clause | TAIMScore Controls |\n|-----------------|-------------------|\n| 4 (Context of the organization) | GV-1.1, MP-1.1 |\n| 5 (Leadership) | GV-1.3, GV-2.3 |\n| 6 (Planning) | GV-5.1, GV-5.2, MP-4.1 |\n| 7 (Support) | GV-3.2, GV-4.1 |\n| 8 (Operation) | MP-1.4, MP-3.1, MS-2.1 |\n| 9 (Performance evaluation) | MS-3.1, MS-3.3, MS-4.1 |\n| 10 (Improvement) | MG-3.3, MG-4.3 |\n"},"originalFormulas":{}},{"id":"ROW-MD-ce7304a0d1b1e59c3f80","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":609,"lineEnd":622,"originalCells":{"A":"### SOC 2 Type II\n\n| SOC 2 Trust Service Criterion | TAIMScore Controls |\n|------------------------------|-------------------|\n| CC1 (Control Environment) | GV-1.1, GV-2.1 |\n| CC2 (Communication and Information) | GV-1.4, MG-4.4 |\n| CC3 (Risk Assessment) | MP-1.5, MP-2.2 |\n| CC4 (Monitoring of Controls) | GV-1.5, MS-3.3 |\n| CC5 (Control Activities) | MG-1.1, MG-2.3 |\n| CC6 (Logical and Physical Access) | GV-2.1, GV-1.6 |\n| CC7 (System Operations) | MS-3.1, MS-3.3 |\n| CC8 (Change Management) | MP-3.3, MG-2.2 |\n| CC9 (Risk Mitigation) | MG-1.2, MG-1.3 |\n"},"originalFormulas":{}},{"id":"ROW-MD-e2494dd454564de5cd08","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":623,"lineEnd":637,"originalCells":{"A":"### EU AI Act (2024)\n\n| EU AI Act Requirement | TAIMScore Controls |\n|----------------------|-------------------|\n| Article 9 (Risk management system) | MP-1.4, MP-1.5, MG-1.1 |\n| Article 10 (Data governance) | MP-1.6, MP-3.1 |\n| Article 11 (Technical documentation) | MP-1.2, MS-2.1 |\n| Article 12 (Record keeping) | GV-1.5, MS-3.3 |\n| Article 13 (Transparency) | MP-1.1, MP-5.2 |\n| Article 14 (Human oversight) | MS-2.4, MG-2.4 |\n| Article 15 (Accuracy and robustness) | MS-2.3, MS-3.1 |\n| Article 61 (Post-market monitoring) | MG-4.1, MG-4.2 |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-1e8e973e282893865a19","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":638,"lineEnd":651,"originalCells":{"A":"## Assessment Workflow in GOVERN\n\n1. **Intake** — User identifies AI system, deployment context, and applicable standards\n2. **Profile Selection** — GOVERN loads appropriate TAIMScore profile (General / Federal / Healthcare / Financial Services)\n3. **Control Evaluation** — User or automated scan scores each of the 72 subcategories (0–4)\n4. **Evidence Collection** — GOVERN prompts for evidence artifacts per control\n5. **Gap Analysis** — GOVERN identifies controls below threshold (default threshold: score ≥ 3 for Established)\n6. **Remediation Plan** — GOVERN generates prioritized remediation tasks per gap\n7. **Report Generation** — TAIMScore Composite + function scores + gap list + remediation roadmap\n8. **Continuous Monitoring** — GOVERN re-evaluates MS and MG controls on defined cadence\n\n---\n\n*TAIMScore™ is a trademark of HISPI Project Cerebellum. Framework content aligns with NIST AI 100-1 (public domain). This document is maintained in GOVERN's Policy Engine as the TAIMScore framework template.*"},"originalFormulas":{}},{"id":"ROW-MD-f47ba0f1748fe4acb379","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":46,"lineEnd":51,"originalCells":{"A":"**GV-1.1** — Organizational policies and practices are in place to plan, prioritize, govern, and monitor AI risk management activities.\n- Requires documented AI governance charter or policy\n- Must define scope of AI systems covered\n- Must assign accountability for AI risk oversight\n- GOVERN component: Policy Engine — loads framework, tracks compliance posture\n"},"originalFormulas":{}},{"id":"ROW-MD-29daa05d79d0e84d036f","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":52,"lineEnd":56,"originalCells":{"A":"**GV-1.2** — Organizational teams are committed to a culture that considers and communicates AI risks.\n- Requires executive-level AI risk acknowledgment\n- Requires training and awareness program for AI risk\n- GOVERN component: Awareness module, council deliberation records\n"},"originalFormulas":{}},{"id":"ROW-MD-48119cfc2ddb686a424b","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":57,"lineEnd":61,"originalCells":{"A":"**GV-1.3** — Organizational leadership takes responsibility for decisions about risks associated with AI system development and deployment.\n- Requires named AI risk owner at leadership level\n- Requires escalation path for high-risk AI decisions\n- GOVERN component: Role assignment, accountability ledger\n"},"originalFormulas":{}},{"id":"ROW-MD-7b83630fa12527ad0c64","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":62,"lineEnd":66,"originalCells":{"A":"**GV-1.4** — Organizational teams are committed to transparent organizational practices and policies.\n- Requires disclosure framework for AI system use\n- Requires stakeholder communication plan\n- GOVERN component: Disclosure report generator\n"},"originalFormulas":{}},{"id":"ROW-MD-56733b53af16d042cc1b","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":67,"lineEnd":71,"originalCells":{"A":"**GV-1.5** — Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review.\n- Requires defined review cadence (minimum annual)\n- Requires metrics for monitoring effectiveness\n- GOVERN component: Continuous monitoring dashboard, alert engine\n"},"originalFormulas":{}},{"id":"ROW-MD-75a898c95907c5161beb","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":72,"lineEnd":78,"originalCells":{"A":"**GV-1.6** — Policies and procedures are in place for the organizational risk governance and oversight of AI systems developed, used, or acquired from third parties, and for risk management of AI-specific supply chain issues including third-party data and AI components.\n- Requires third-party AI vendor assessment process\n- Requires AI supply chain risk policy\n- GOVERN component: Third-party assess mode, vendor registry\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-bfb242a28df3df81dea6","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":85,"lineEnd":89,"originalCells":{"A":"**GV-2.1** — Roles and responsibilities and organizational accountabilities for personnel involved with the design, development, deployment, assessment and monitoring of AI systems are established.\n- Requires RACI matrix for AI roles\n- Requires defined responsibilities for data scientists, ML engineers, risk officers, legal, compliance\n- GOVERN component: Role registry, accountability matrix\n"},"originalFormulas":{}},{"id":"ROW-MD-e29fbd55e1f6ea84a1d3","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":90,"lineEnd":93,"originalCells":{"A":"**GV-2.2** — The risk or legal review function is documented and accountable to senior leadership.\n- Requires documented reporting structure for AI legal/risk function\n- GOVERN component: Governance structure documentation\n"},"originalFormulas":{}},{"id":"ROW-MD-6c4dd8c7a39a67a1f518","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":94,"lineEnd":99,"originalCells":{"A":"**GV-2.3** — Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.\n- Requires board-level or C-suite AI risk acknowledgment records\n- GOVERN component: Executive attestation module\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-e17e61d7a929780bb939","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":106,"lineEnd":110,"originalCells":{"A":"**GV-3.1** — Organizational policies and practices are in place to foster a critical thinking culture.\n- Requires documented process for raising AI risk concerns\n- Requires psychological safety mechanisms\n- GOVERN component: Risk flagging interface, anonymous reporting channel\n"},"originalFormulas":{}},{"id":"ROW-MD-958cb8d08f92fe3d3546","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":111,"lineEnd":115,"originalCells":{"A":"**GV-3.2** — Policies, practices, and mechanisms are in place for the training and certification of AI personnel.\n- Requires defined AI literacy curriculum\n- Requires certification tracking for key roles\n- GOVERN component: Training tracker, certification registry\n"},"originalFormulas":{}},{"id":"ROW-MD-5b1c6ed95f6c367e6182","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":116,"lineEnd":122,"originalCells":{"A":"**GV-3.3** — Fairness and bias — human factors and diversity considerations exist in organizational policies and practices across the AI lifecycle.\n- Requires demographic diversity analysis in AI teams\n- Requires process for incorporating diverse perspectives in AI design\n- GOVERN component: Diversity and inclusion assessment panel\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-d242f5c94d77e11a9ec6","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":129,"lineEnd":133,"originalCells":{"A":"**GV-4.1** — Organizational policies and practices are in place to foster AI risk awareness and to create a culture of trustworthy, responsible AI.\n- Requires AI ethics principles documented and socialized\n- Requires leadership messaging on responsible AI\n- GOVERN component: Culture assessment, policy publication engine\n"},"originalFormulas":{}},{"id":"ROW-MD-e13767fda27fdc16189f","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":134,"lineEnd":140,"originalCells":{"A":"**GV-4.2** — Organizational teams document the risks and potential impacts of AI technologies applied to their functions and using their data.\n- Requires business unit AI risk registers\n- Requires impact documentation per AI use case\n- GOVERN component: Risk register, per-system risk ledger\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-3b887ec7000c89278c2b","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":147,"lineEnd":150,"originalCells":{"A":"**GV-5.1** — Organizational risk policies include and are inclusive of AI risks.\n- Requires AI risk integrated into enterprise risk management framework\n- GOVERN component: ERM integration module, risk appetite statement\n"},"originalFormulas":{}},{"id":"ROW-MD-bed9ab1a10c677fc9d41","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":151,"lineEnd":157,"originalCells":{"A":"**GV-5.2** — Risk tolerance for the development and deployment of AI systems — including organizational risk tolerance for known trustworthiness limitations of AI systems — is established, communicated, and regularly reviewed.\n- Requires documented risk tolerance thresholds by AI risk category\n- Requires regular board/leadership review of AI risk tolerance\n- GOVERN component: Risk tolerance dashboard, threshold alert engine\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-fe3db67f17e7d8e98149","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":164,"lineEnd":168,"originalCells":{"A":"**GV-6.1** — Policies and procedures are in place for the identification and documentation of legal requirements related to AI use, including international requirements for AI systems used in multiple jurisdictions.\n- Requires legal inventory of applicable AI regulations per jurisdiction\n- Requires documentation of AI system jurisdictional scope\n- GOVERN component: Regulatory mapping engine, jurisdiction tracker\n"},"originalFormulas":{}},{"id":"ROW-MD-b97169400c4e43567aa2","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":169,"lineEnd":174,"originalCells":{"A":"**GV-6.2** — Organizational risk policies are inclusive of regulatory compliance and legal requirements.\n- Requires AI compliance program covering NIST, ISO, EU AI Act, FedRAMP as applicable\n- GOVERN component: Compliance gap tracker, standard alignment report\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-770a56a7f40620a3f76b","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":185,"lineEnd":189,"originalCells":{"A":"**MP-1.1** — Intended purpose, potentially beneficial uses, context of use, and risks of AI systems are understood and documented.\n- Requires documented AI system purpose statement\n- Requires identification of intended use cases and out-of-scope uses\n- GOVERN component: System inventory, use case registry\n"},"originalFormulas":{}},{"id":"ROW-MD-0d47ef55c6d252ef95a0","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":190,"lineEnd":193,"originalCells":{"A":"**MP-1.2** — Scientific findings, technical standards, and trustworthiness of AI systems are understood, documented, and communicated.\n- Requires technical documentation of AI model architecture, training data, and performance characteristics\n- GOVERN component: Technical fact sheet generator, model card integration\n"},"originalFormulas":{}},{"id":"ROW-MD-610be50efdaabb92a994","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":194,"lineEnd":197,"originalCells":{"A":"**MP-1.3** — Potential benefits of intended AI system deployment — including financial, societal, and broadly beneficial uses — are examined and documented.\n- Requires documented benefits analysis per AI system\n- GOVERN component: Benefits documentation module\n"},"originalFormulas":{}},{"id":"ROW-MD-0e97a607a82aeea014e8","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":198,"lineEnd":202,"originalCells":{"A":"**MP-1.4** — Risks or harms of deployed AI systems — and their potential consequences to individuals, groups, communities, organizations, and society — are examined and documented.\n- Requires impact assessment covering affected individuals and groups\n- Requires documentation of high-risk harm scenarios\n- GOVERN component: Harm assessment module, impact ledger\n"},"originalFormulas":{}},{"id":"ROW-MD-1b1216cec2355311c9e6","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":203,"lineEnd":206,"originalCells":{"A":"**MP-1.5** — Likelihood and magnitude of each identified AI system risk or impact are estimated and documented.\n- Requires risk likelihood and magnitude scoring methodology\n- GOVERN component: Risk scoring engine, probability-impact matrix\n"},"originalFormulas":{}},{"id":"ROW-MD-3c80f8a7d4d83a3637d2","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":207,"lineEnd":212,"originalCells":{"A":"**MP-1.6** — Risks or harms from third-party use of the organization's data or AI systems, including data provenance, data quality, and supply chain risks, are documented.\n- Requires third-party data risk documentation\n- GOVERN component: Data provenance tracker, supply chain risk register\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-5ec73574f222bdf6ead4","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":219,"lineEnd":223,"originalCells":{"A":"**MP-2.1** — Scientific community norms for validating AI risks and potential impacts are followed.\n- Requires model validation methodology documentation\n- Requires reference to peer-reviewed standards and research\n- GOVERN component: Validation methodology registry\n"},"originalFormulas":{}},{"id":"ROW-MD-59ad2906b7f904a8b32d","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":224,"lineEnd":228,"originalCells":{"A":"**MP-2.2** — Risk classifications are defined by the organization and used in AI risk classification decisions.\n- Requires defined risk taxonomy (e.g., low/medium/high/critical)\n- Requires documented classification criteria\n- GOVERN component: Risk taxonomy engine, classification workflow\n"},"originalFormulas":{}},{"id":"ROW-MD-65beb287fea17650ebc6","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":229,"lineEnd":234,"originalCells":{"A":"**MP-2.3** — AI system risk and benefit analysis incorporates considerations of affected individuals and groups.\n- Requires stakeholder impact analysis covering affected populations\n- GOVERN component: Stakeholder mapping module\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-b32a5c7429c08f54f402","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":241,"lineEnd":245,"originalCells":{"A":"**MP-3.1** — Potential impacts of bias are characterized in data, models, and downstream uses and impacts are documented.\n- Requires bias analysis of training data and model outputs\n- Requires documentation of known bias characteristics\n- GOVERN component: Bias assessment module, bias report generator\n"},"originalFormulas":{}},{"id":"ROW-MD-be8f3d9935c717e4f04c","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":246,"lineEnd":249,"originalCells":{"A":"**MP-3.2** — Scientific methods — including those from risk sciences, harm sciences, and social sciences — are used to inform bias assessments and documentation.\n- Requires peer-reviewed or validated bias assessment methodology\n- GOVERN component: Methodology documentation, validation records\n"},"originalFormulas":{}},{"id":"ROW-MD-b36653c31421add2ec46","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":250,"lineEnd":256,"originalCells":{"A":"**MP-3.3** — Processes for operator and user feedback about AI system performance and trustworthiness are established and integrated into AI system updates.\n- Requires feedback channel for operators and users to report AI performance issues\n- Requires process to incorporate feedback into system updates\n- GOVERN component: Feedback intake module, change management integration\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-5f76a33c11e13a4c9b00","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":263,"lineEnd":266,"originalCells":{"A":"**MP-4.1** — The organization's risk tolerance for the AI system under consideration is established, communicated, and incorporated into the risk identification and classification process.\n- Requires risk tolerance applied at system level\n- GOVERN component: Per-system risk tolerance configuration\n"},"originalFormulas":{}},{"id":"ROW-MD-16fdb8132e5bc475ca24","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":267,"lineEnd":272,"originalCells":{"A":"**MP-4.2** — Risk levels of AI systems at deployment are documented per risk classification and tolerance levels.\n- Requires system-level risk rating at deployment\n- GOVERN component: Deployment risk certification, risk ledger\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-877d33928dd1b4795399","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":279,"lineEnd":282,"originalCells":{"A":"**MP-5.1** — Likelihood of encountering AI risks given use of AI and organizational risk tolerances is determined.\n- Requires probability analysis of AI risk exposure\n- GOVERN component: Exposure analysis module\n"},"originalFormulas":{}},{"id":"ROW-MD-4f622f9bc6c00151827c","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":283,"lineEnd":286,"originalCells":{"A":"**MP-5.2** — Organizations are transparent about known limitations and where knowledge is incomplete.\n- Requires documented limitations section in AI system documentation\n- GOVERN component: Limitations register, transparency report\n"},"originalFormulas":{}},{"id":"ROW-MD-0bcf8a076a59892ac0fa","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":287,"lineEnd":290,"originalCells":{"A":"**MP-5.3** — Organizational risk policies include and are inclusive of AI risks.\n- Requires AI risk explicitly included in enterprise risk policies\n- GOVERN component: Policy integration audit\n"},"originalFormulas":{}},{"id":"ROW-MD-6b1678bd73cce80bc1c9","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":291,"lineEnd":294,"originalCells":{"A":"**MP-5.4** — Risk tolerance for the development and deployment of AI systems is established, communicated, and regularly reviewed.\n- Requires formal risk tolerance review cadence\n- GOVERN component: Risk tolerance review scheduler, review records\n"},"originalFormulas":{}},{"id":"ROW-MD-a42ca919c29521e0abf3","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":295,"lineEnd":300,"originalCells":{"A":"**MP-5.5** — Practices and documentation establish how identified risks will be addressed and where they fall in the organization's risk management framework.\n- Requires documented risk treatment methodology\n- GOVERN component: Risk treatment tracker, treatment workflow engine\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-6a42791c08e97b32cc89","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":311,"lineEnd":314,"originalCells":{"A":"**MS-1.1** — Approaches and metrics for measurement of AI risks and trustworthiness characteristics reflect deployment context and organizational risk tolerance.\n- Requires defined metrics for each trustworthiness dimension (accuracy, fairness, transparency, privacy, security, reliability)\n- GOVERN component: Metrics library, measurement configuration\n"},"originalFormulas":{}},{"id":"ROW-MD-923644fa22da41d91d38","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":315,"lineEnd":318,"originalCells":{"A":"**MS-1.2** — Trustworthiness characteristics of AI systems are assessed independently and in the context of AI systems to which they may be connected.\n- Requires system-level and ecosystem-level trustworthiness assessment\n- GOVERN component: System interdependency map, interconnected system assessment\n"},"originalFormulas":{}},{"id":"ROW-MD-8a5e4d6fffb804b2c691","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":319,"lineEnd":324,"originalCells":{"A":"**MS-1.3** — Internal experts are consulted to assess AI risks.\n- Requires expert review process for AI risk assessments\n- GOVERN component: Expert review workflow, reviewer registry\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-ff1b4b93cceffd520231","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":331,"lineEnd":334,"originalCells":{"A":"**MS-2.1** — Test sets, metrics, and details about the tools used during test, evaluation, validation, and verification (TEVV) are documented.\n- Requires TEVV documentation including test datasets, metrics, and tools\n- GOVERN component: TEVV documentation module, test artifact registry\n"},"originalFormulas":{}},{"id":"ROW-MD-c101c6a993d166e441e2","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":335,"lineEnd":338,"originalCells":{"A":"**MS-2.2** — AI system trustworthiness characteristics are calibrated for risks of under- and over-reliance on AI systems.\n- Requires calibration testing for confidence and uncertainty estimation\n- GOVERN component: Calibration assessment, uncertainty quantification tracker\n"},"originalFormulas":{}},{"id":"ROW-MD-43f65e74eb68e375831b","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":339,"lineEnd":342,"originalCells":{"A":"**MS-2.3** — AI system performance and trustworthiness characteristics are evaluated regularly against benchmarks.\n- Requires regular performance benchmarking cadence\n- GOVERN component: Benchmarking scheduler, benchmark results ledger\n"},"originalFormulas":{}},{"id":"ROW-MD-337c26dd4028ac03f64d","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":343,"lineEnd":346,"originalCells":{"A":"**MS-2.4** — The ability of humans to interpret AI system outputs when needed is evaluated on a regular basis.\n- Requires explainability and interpretability testing\n- GOVERN component: Explainability assessment module\n"},"originalFormulas":{}},{"id":"ROW-MD-f76f0e1a3081b6b07b0f","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":347,"lineEnd":350,"originalCells":{"A":"**MS-2.5** — Risk characteristics established in MP are employed in the measurement and analysis of AI system risks and trustworthiness.\n- Requires traceability from risk identification (MAP) to risk measurement (MEASURE)\n- GOVERN component: Cross-function traceability engine\n"},"originalFormulas":{}},{"id":"ROW-MD-23ebf314208e696e03f0","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":351,"lineEnd":356,"originalCells":{"A":"**MS-2.6** — Risk or performance characteristics established in and of AI systems are verified with the relevant populations.\n- Requires performance validation against representative population samples\n- GOVERN component: Population-representative validation module\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-44274f158f33f7bf043c","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":363,"lineEnd":366,"originalCells":{"A":"**MS-3.1** — Ongoing monitoring plans are in place to address the identified AI risks and trustworthiness characteristics of the AI system.\n- Requires monitoring plan documentation per AI system\n- GOVERN component: Monitoring plan builder, monitoring schedule\n"},"originalFormulas":{}},{"id":"ROW-MD-bfd415d61615e3cf9fb8","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":367,"lineEnd":370,"originalCells":{"A":"**MS-3.2** — The risk or performance characteristics of the AI system to be deployed are examined and documented.\n- Requires pre-deployment performance documentation\n- GOVERN component: Pre-deployment risk certification\n"},"originalFormulas":{}},{"id":"ROW-MD-73cb5f04251885e1be6c","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":371,"lineEnd":374,"originalCells":{"A":"**MS-3.3** — AI system risks and trustworthiness are measured in deployment and monitoring contexts.\n- Requires in-deployment performance and risk monitoring\n- GOVERN component: Live monitoring dashboard, alert engine\n"},"originalFormulas":{}},{"id":"ROW-MD-b986140f4856011fcc45","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":375,"lineEnd":380,"originalCells":{"A":"**MS-3.4** — Feedback processes for end users and impacted communities to report problems and provide feedback are established.\n- Requires user-facing feedback mechanism for AI system issues\n- GOVERN component: Public feedback intake module\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-ff58e93e8bdde7e169b7","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":387,"lineEnd":390,"originalCells":{"A":"**MS-4.1** — Measurement approaches for identifying AI risks are connected to organizational risk tolerance and relevant laws, regulations, and standards.\n- Requires measurement methodology tied to regulatory requirements\n- GOVERN component: Regulatory measurement alignment\n"},"originalFormulas":{}},{"id":"ROW-MD-cc4ced92c644a95ca305","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":391,"lineEnd":396,"originalCells":{"A":"**MS-4.2** — Measurement results inform updates to the risk mapping and risk management approaches.\n- Requires feedback loop from measurement results to MAP and MANAGE functions\n- GOVERN component: Cross-function feedback loop, update workflow\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-8c18d0316a1e6055999f","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":407,"lineEnd":411,"originalCells":{"A":"**MG-1.1** — A set of risk treatment options (responses) are documented for AI risks including the avoidance, acceptance, transfer, and control of risks.\n- Requires documented risk treatment options per risk category\n- Requires justification for selected treatment approach\n- GOVERN component: Risk treatment library, treatment selection workflow\n"},"originalFormulas":{}},{"id":"ROW-MD-8b5c3357f63952276cb0","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":412,"lineEnd":415,"originalCells":{"A":"**MG-1.2** — Treatment of AI risks includes a determination of residual risks after the risk response plan has been implemented.\n- Requires residual risk documentation post-treatment\n- GOVERN component: Residual risk tracker\n"},"originalFormulas":{}},{"id":"ROW-MD-d7923c6fb5260716d1e2","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":416,"lineEnd":421,"originalCells":{"A":"**MG-1.3** — Responses to the AI risks deemed high priority are developed, planned, and documented.\n- Requires expedited response plans for high-priority risks\n- GOVERN component: Priority risk response queue, response SLA tracking\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-286a4c8c596b00439564","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":428,"lineEnd":431,"originalCells":{"A":"**MG-2.1** — Resources required to manage AI risks are taken into account including the staff, budget, and compute required for implementation.\n- Requires resource plan for AI risk management activities\n- GOVERN component: Resource allocation module\n"},"originalFormulas":{}},{"id":"ROW-MD-12aa14d11ff6a000fcdd","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":432,"lineEnd":435,"originalCells":{"A":"**MG-2.2** — Mechanisms are in place and applied to sustain the value of deployed AI systems and to manage the risks of AI system decommissioning, including appropriate archiving of useful elements.\n- Requires AI system lifecycle management process including decommissioning\n- GOVERN component: Lifecycle management tracker, decommissioning checklist\n"},"originalFormulas":{}},{"id":"ROW-MD-520362eb8325a4cd66f5","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":436,"lineEnd":439,"originalCells":{"A":"**MG-2.3** — Procedures are followed to respond to and recover from a previously unknown risk.\n- Requires incident response procedure for novel AI risks\n- GOVERN component: Incident response playbook, novel risk intake\n"},"originalFormulas":{}},{"id":"ROW-MD-6456424b57cbb0b1806d","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":440,"lineEnd":445,"originalCells":{"A":"**MG-2.4** — Mechanisms are in place to allow personnel to report problems to management.\n- Requires internal reporting mechanism for AI risk issues\n- GOVERN component: Internal risk reporting module, escalation workflow\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-47719f37a858deea18cc","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":452,"lineEnd":455,"originalCells":{"A":"**MG-3.1** — Risk treatment strategies and methods are documented, as are the reasons for the selection of risk treatment options.\n- Requires treatment selection rationale documentation\n- GOVERN component: Treatment rationale ledger\n"},"originalFormulas":{}},{"id":"ROW-MD-411f8aa8620c2564be73","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":456,"lineEnd":459,"originalCells":{"A":"**MG-3.2** — Treatment of AI risks includes a determination of residual risk after the risk response plan has been implemented.\n- Requires residual risk assessment post-implementation\n- GOVERN component: Post-treatment residual risk review\n"},"originalFormulas":{}},{"id":"ROW-MD-26ccafc4bf4e31e057a9","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":460,"lineEnd":463,"originalCells":{"A":"**MG-3.3** — Feedback processes are in place to inform updates to the risk mapping, risk analysis, risk treatment, and monitoring activities.\n- Requires cross-function feedback loop from MANAGE back to MAP and MEASURE\n- GOVERN component: Feedback integration engine, continuous improvement workflow\n"},"originalFormulas":{}},{"id":"ROW-MD-b0e9ace4d989ce5a8959","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":464,"lineEnd":469,"originalCells":{"A":"**MG-3.4** — Risk treatment plans for AI systems are maintained and updated regularly.\n- Requires periodic review and update of treatment plans\n- GOVERN component: Treatment plan review scheduler, update records\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-60e38bc208b3fb6ef457","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":476,"lineEnd":479,"originalCells":{"A":"**MG-4.1** — Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors across the AI lifecycle.\n- Requires active post-deployment monitoring program\n- GOVERN component: Post-deployment monitoring dashboard\n"},"originalFormulas":{}},{"id":"ROW-MD-aabb633fd4b38389cdec","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":480,"lineEnd":483,"originalCells":{"A":"**MG-4.2** — Measurable performance improvements or declines and other changes in deployed AI system trustworthiness are evaluated and documented.\n- Requires performance trend tracking over time\n- GOVERN component: Performance trend tracker, delta reporting\n"},"originalFormulas":{}},{"id":"ROW-MD-c5f764b27214c7752af1","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":484,"lineEnd":487,"originalCells":{"A":"**MG-4.3** — Feedback processes for improvement are followed for deployed AI systems.\n- Requires documented improvement process using monitoring and feedback data\n- GOVERN component: Improvement workflow engine\n"},"originalFormulas":{}},{"id":"ROW-MD-fcebb176e5f47dd2ea7c","sourceKey":"policy-guide-taimscore@e8334126d25759e0","sheet":"POLICY.md","row":488,"lineEnd":493,"originalCells":{"A":"**MG-4.4** — Organizational teams communicate with personnel to report problems and suggest opportunities for improvement across the AI lifecycle.\n- Requires internal communication process for AI risk findings\n- GOVERN component: Internal communication module, findings distribution\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-1509ba40111b35924fa8","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":1,"lineEnd":10,"originalCells":{"A":"# AI Governance Maturity Roadmap\n\n**Source:** Chirality Capital Consulting\n**Alignment:** DoD AI Ethics & NIST AI RMF\n**Purpose:** Assess organizational AI governance maturity on a 1-5 scale, provide roadmap to advance\n\n---\n\n## Overview\n"},"originalFormulas":{}},{"id":"ROW-MD-16a14557f359fbafb1eb","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":9,"lineEnd":16,"originalCells":{"A":"## Overview\n\nThe AI Governance Maturity Roadmap is a 5-level assessment framework that measures how mature an organization's AI governance program is. Unlike compliance frameworks (which check yes/no against controls), this maturity model measures HOW WELL an organization governs AI — from ad-hoc awareness to transformational strategic advantage.\n\n**Why GOVERN needs this:** Customers don't just need to know IF they're compliant — they need to know HOW MATURE their governance is and WHERE to invest to improve. This is the \"governance health score\" that feeds the Dashboard's Home view.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-6edc28368ea22027eb8c","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":17,"lineEnd":151,"originalCells":{"A":"## The 5 Maturity Levels\n\n### Level 1: Awareness\n**Color:** Blue | **Icon:** Eye\n\nThe organization knows AI exists and has begun identifying where it's used, but governance is reactive and informal.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Ad-Hoc Use** | AI tools adopted by individuals without organizational oversight. No central inventory. Shadow AI likely prevalent. |\n| **Risk Identification** | Some risks recognized but not systematically cataloged. Risk assessment is informal, driven by incidents not policy. |\n| **Minimal Oversight** | No formal governance structure. No Chief AI Officer. No AI policy. No compliance program. |\n\n**GOVERN Assessment Criteria:**\n- No AI system registry exists (GOVERN OS would score 0)\n- No policies defined (Policy Engine empty)\n- No assessments run (Assess unused)\n- Energy would discover significant shadow AI\n- Score: 0-20%\n\n**What the customer needs to advance to Level 2:**\n- Register all known AI systems in GOVERN\n- Define baseline acceptable use policy\n- Assign an AI governance owner\n- Run first Document Assess against one framework\n\n---\n\n### Level 2: Active\n**Color:** Green | **Icon:** Gears\n\nThe organization has begun establishing governance structures. Policies exist. Humans are in the loop. Controls are being implemented.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Baseline Policies** | Written AI acceptable use policies. Framework selected (NIST, EU AI Act, etc.). Policies communicated to teams. |\n| **Human-in-the-Loop** | Critical AI decisions require human review. Escalation paths defined. Override mechanisms in place. |\n| **Initial Controls** | Basic access controls on AI systems. Initial monitoring deployed. Some assessment activity. |\n\n**GOVERN Assessment Criteria:**\n- AI systems registered (at least 50% of known systems)\n- At least 1 policy framework imported and active\n- Document Assess run on at least 3 systems\n- Human oversight documented for high-risk systems\n- Some Probe deployment (at least 1 system monitored)\n- Score: 20-40%\n\n**What the customer needs to advance to Level 3:**\n- Complete AI system inventory (100% registered)\n- Standardize assessment process (regular cadence)\n- Implement formal compliance checks\n- Deploy Probe on all high-risk systems\n\n---\n\n### Level 3: Operational\n**Color:** Orange/Gold | **Icon:** Clipboard with checkmark\n\nGovernance is formalized, standardized, and regularly executed. Compliance is measurable. Audits are happening.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Standardized Processes** | AI governance follows documented procedures. Assessment cadence established (quarterly/monthly). Remediation workflow defined. |\n| **Ethical Compliance** | Bias testing implemented. Fairness metrics tracked. Ethical review board or equivalent active. |\n| **TEVV & Audits** | Test, Evaluation, Verification, and Validation (TEVV) processes in place. Regular audits with documented evidence. ATO packages maintained. |\n\n**GOVERN Assessment Criteria:**\n- 100% of AI systems registered and classified by risk level\n- Multiple frameworks active in Policy Engine\n- Regular assessment cadence (all 3 modes used)\n- Remediation tracker active with SLA compliance >80%\n- Compliance reports generated regularly\n- Bias and fairness testing documented\n- Score: 40-60%\n\n**What the customer needs to advance to Level 4:**\n- Enterprise-wide integration (all departments using GOVERN)\n- Continuous monitoring (Probe on all production systems)\n- Real-time risk management (alerts + auto-remediation)\n- Energy deployed for shadow AI detection\n\n---\n\n### Level 4: Systematic\n**Color:** Red/Coral | **Icon:** Connected gears\n\nGovernance is enterprise-wide, continuous, and integrated into every AI decision. Risk management is proactive, not reactive.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Enterprise Integration** | AI governance integrated into procurement, development, deployment, and retirement processes. All departments participate. |\n| **Continuous Monitoring** | Real-time monitoring of all AI systems. Probe deployed enterprise-wide. Energy sensors detecting shadow AI. Drift detection active. |\n| **Risk Management** | Proactive risk identification. Predictive risk scoring. Risk treatment plans for all high and medium findings. SLA compliance >95%. |\n\n**GOVERN Assessment Criteria:**\n- All AI systems monitored in real-time (Probe + Energy)\n- Shadow AI detection active with <10% false positive rate\n- Policy violations caught and remediated within SLA >95%\n- Cognitive energy baselines established for all critical systems\n- Silent drift detection active\n- CI/CD governance gates integrated\n- Cross-framework compliance maintained\n- Score: 60-80%\n\n**What the customer needs to advance to Level 5:**\n- AI governance becomes a strategic advantage (not just compliance)\n- Governance insights drive business decisions\n- Adaptive policies that evolve with the organization\n- Governance as a competitive differentiator\n\n---\n\n### Level 5: Transformational\n**Color:** Dark Red | **Icon:** Flag on mountain\n\nAI governance is a strategic asset. The organization doesn't just comply — it uses governance to outperform competitors and drive mission impact.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Strategic Advantage** | AI governance creates competitive advantage. Customers trust the organization BECAUSE of its governance. Governance enables faster, safer AI deployment. |\n| **Adaptive AI Governance** | Policies evolve automatically based on new risks, regulations, and organizational changes. CuC-governed policy refinement. Living governance. |\n| **Ethical & Mission Impact** | AI governance directly contributes to mission outcomes. Ethical AI is a brand differentiator. Governance insights drive strategic decisions. |\n\n**GOVERN Assessment Criteria:**\n- Governance score >90% across all frameworks\n- Zero critical findings unresolved >24 hours\n- Governance insights used in board-level decisions\n- Adaptive policies with version history showing evolution\n- GAN adversarial testing on all critical systems (Sandbox Assess)\n- Full audit trail with zero gaps\n- Customer trust metrics improving\n- Score: 80-100%\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-736551e00a42d79b847b","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":19,"lineEnd":44,"originalCells":{"A":"### Level 1: Awareness\n**Color:** Blue | **Icon:** Eye\n\nThe organization knows AI exists and has begun identifying where it's used, but governance is reactive and informal.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Ad-Hoc Use** | AI tools adopted by individuals without organizational oversight. No central inventory. Shadow AI likely prevalent. |\n| **Risk Identification** | Some risks recognized but not systematically cataloged. Risk assessment is informal, driven by incidents not policy. |\n| **Minimal Oversight** | No formal governance structure. No Chief AI Officer. No AI policy. No compliance program. |\n\n**GOVERN Assessment Criteria:**\n- No AI system registry exists (GOVERN OS would score 0)\n- No policies defined (Policy Engine empty)\n- No assessments run (Assess unused)\n- Energy would discover significant shadow AI\n- Score: 0-20%\n\n**What the customer needs to advance to Level 2:**\n- Register all known AI systems in GOVERN\n- Define baseline acceptable use policy\n- Assign an AI governance owner\n- Run first Document Assess against one framework\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-a2108ba2ea5a87031f1e","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":45,"lineEnd":71,"originalCells":{"A":"### Level 2: Active\n**Color:** Green | **Icon:** Gears\n\nThe organization has begun establishing governance structures. Policies exist. Humans are in the loop. Controls are being implemented.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Baseline Policies** | Written AI acceptable use policies. Framework selected (NIST, EU AI Act, etc.). Policies communicated to teams. |\n| **Human-in-the-Loop** | Critical AI decisions require human review. Escalation paths defined. Override mechanisms in place. |\n| **Initial Controls** | Basic access controls on AI systems. Initial monitoring deployed. Some assessment activity. |\n\n**GOVERN Assessment Criteria:**\n- AI systems registered (at least 50% of known systems)\n- At least 1 policy framework imported and active\n- Document Assess run on at least 3 systems\n- Human oversight documented for high-risk systems\n- Some Probe deployment (at least 1 system monitored)\n- Score: 20-40%\n\n**What the customer needs to advance to Level 3:**\n- Complete AI system inventory (100% registered)\n- Standardize assessment process (regular cadence)\n- Implement formal compliance checks\n- Deploy Probe on all high-risk systems\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-6904db03d557265fd62f","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":72,"lineEnd":99,"originalCells":{"A":"### Level 3: Operational\n**Color:** Orange/Gold | **Icon:** Clipboard with checkmark\n\nGovernance is formalized, standardized, and regularly executed. Compliance is measurable. Audits are happening.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Standardized Processes** | AI governance follows documented procedures. Assessment cadence established (quarterly/monthly). Remediation workflow defined. |\n| **Ethical Compliance** | Bias testing implemented. Fairness metrics tracked. Ethical review board or equivalent active. |\n| **TEVV & Audits** | Test, Evaluation, Verification, and Validation (TEVV) processes in place. Regular audits with documented evidence. ATO packages maintained. |\n\n**GOVERN Assessment Criteria:**\n- 100% of AI systems registered and classified by risk level\n- Multiple frameworks active in Policy Engine\n- Regular assessment cadence (all 3 modes used)\n- Remediation tracker active with SLA compliance >80%\n- Compliance reports generated regularly\n- Bias and fairness testing documented\n- Score: 40-60%\n\n**What the customer needs to advance to Level 4:**\n- Enterprise-wide integration (all departments using GOVERN)\n- Continuous monitoring (Probe on all production systems)\n- Real-time risk management (alerts + auto-remediation)\n- Energy deployed for shadow AI detection\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-5f9c66e3a81e6c94e1e7","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":100,"lineEnd":128,"originalCells":{"A":"### Level 4: Systematic\n**Color:** Red/Coral | **Icon:** Connected gears\n\nGovernance is enterprise-wide, continuous, and integrated into every AI decision. Risk management is proactive, not reactive.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Enterprise Integration** | AI governance integrated into procurement, development, deployment, and retirement processes. All departments participate. |\n| **Continuous Monitoring** | Real-time monitoring of all AI systems. Probe deployed enterprise-wide. Energy sensors detecting shadow AI. Drift detection active. |\n| **Risk Management** | Proactive risk identification. Predictive risk scoring. Risk treatment plans for all high and medium findings. SLA compliance >95%. |\n\n**GOVERN Assessment Criteria:**\n- All AI systems monitored in real-time (Probe + Energy)\n- Shadow AI detection active with <10% false positive rate\n- Policy violations caught and remediated within SLA >95%\n- Cognitive energy baselines established for all critical systems\n- Silent drift detection active\n- CI/CD governance gates integrated\n- Cross-framework compliance maintained\n- Score: 60-80%\n\n**What the customer needs to advance to Level 5:**\n- AI governance becomes a strategic advantage (not just compliance)\n- Governance insights drive business decisions\n- Adaptive policies that evolve with the organization\n- Governance as a competitive differentiator\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-f49efc6b82e3049e2c9a","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":129,"lineEnd":151,"originalCells":{"A":"### Level 5: Transformational\n**Color:** Dark Red | **Icon:** Flag on mountain\n\nAI governance is a strategic asset. The organization doesn't just comply — it uses governance to outperform competitors and drive mission impact.\n\n| Characteristic | Description |\n|---------------|-------------|\n| **Strategic Advantage** | AI governance creates competitive advantage. Customers trust the organization BECAUSE of its governance. Governance enables faster, safer AI deployment. |\n| **Adaptive AI Governance** | Policies evolve automatically based on new risks, regulations, and organizational changes. CuC-governed policy refinement. Living governance. |\n| **Ethical & Mission Impact** | AI governance directly contributes to mission outcomes. Ethical AI is a brand differentiator. Governance insights drive strategic decisions. |\n\n**GOVERN Assessment Criteria:**\n- Governance score >90% across all frameworks\n- Zero critical findings unresolved >24 hours\n- Governance insights used in board-level decisions\n- Adaptive policies with version history showing evolution\n- GAN adversarial testing on all critical systems (Sandbox Assess)\n- Full audit trail with zero gaps\n- Customer trust metrics improving\n- Score: 80-100%\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-6dd53857950fc295080e","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":152,"lineEnd":165,"originalCells":{"A":"## Foundation: Human-Centered Governance\n\nAcross all 5 levels, governance must be grounded in 5 principles:\n\n| Principle | Description | GOVERN Implementation |\n|-----------|-------------|----------------------|\n| **Human Agency** | Humans retain meaningful control over AI decisions | Policy Engine: human-in-the-loop policies; Probe: intervention modes (flag/block) |\n| **Contestability** | AI decisions can be challenged and reviewed | Remediation Tracker: dispute workflow; Audit trail: decision evidence |\n| **Trust & Safety** | AI systems are safe and trustworthy | Assess: 3-mode evaluation; Probe: runtime monitoring; Energy: behavioral detection |\n| **Harm Prevention** | AI doesn't cause harm to individuals or communities | Assess: bias/fairness testing; Policy Engine: harm prevention rules |\n| **Explainability** | AI decisions can be understood and explained | Assess: model interpretability checks; Compliance Portal: transparency reporting |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-5913d5c6cde4bc680f26","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":166,"lineEnd":191,"originalCells":{"A":"## 4 Maturity Dimensions\n\nEach level is also assessed across 4 dimensions:\n\n### Dimension 1: Responsible & Equitable\n- Level 1-2: Ad-hoc use, risk identification, minimal oversight\n- Level 3-4: Systematic fairness testing, documented equity practices\n- Level 5: AI actively promotes equity, bias eliminated by design\n\n### Dimension 2: Traceable & Reliable\n- Level 1-2: Defined owners, human-in-the-loop, initial controls\n- Level 3-4: Full audit trail, model provenance, version control\n- Level 5: Complete lineage from data to decision, cryptographically signed\n\n### Dimension 3: Governable & Controlled\n- Level 1-2: Managed/owned, initial bias & fairness testing\n- Level 3-4: Continuous bias monitoring, automated controls\n- Level 5: Self-governing AI with CuC-based integrity checks\n\n### Dimension 4: Human-Centric Outcomes\n- Level 1-2: Enhancing sentiment, adaptable risk concerns\n- Level 3-4: Measured human impact, stakeholder feedback loops\n- Level 5: AI governance demonstrably improves human outcomes\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-97a7c1d7a6cc31b244d8","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":170,"lineEnd":174,"originalCells":{"A":"### Dimension 1: Responsible & Equitable\n- Level 1-2: Ad-hoc use, risk identification, minimal oversight\n- Level 3-4: Systematic fairness testing, documented equity practices\n- Level 5: AI actively promotes equity, bias eliminated by design\n"},"originalFormulas":{}},{"id":"ROW-MD-52d81b5077bb9be704b4","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":175,"lineEnd":179,"originalCells":{"A":"### Dimension 2: Traceable & Reliable\n- Level 1-2: Defined owners, human-in-the-loop, initial controls\n- Level 3-4: Full audit trail, model provenance, version control\n- Level 5: Complete lineage from data to decision, cryptographically signed\n"},"originalFormulas":{}},{"id":"ROW-MD-7d8657cfaf76707b58c2","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":180,"lineEnd":184,"originalCells":{"A":"### Dimension 3: Governable & Controlled\n- Level 1-2: Managed/owned, initial bias & fairness testing\n- Level 3-4: Continuous bias monitoring, automated controls\n- Level 5: Self-governing AI with CuC-based integrity checks\n"},"originalFormulas":{}},{"id":"ROW-MD-1cc0d99de1e849c82def","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":185,"lineEnd":191,"originalCells":{"A":"### Dimension 4: Human-Centric Outcomes\n- Level 1-2: Enhancing sentiment, adaptable risk concerns\n- Level 3-4: Measured human impact, stakeholder feedback loops\n- Level 5: AI governance demonstrably improves human outcomes\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-74d9142f588ef2f5a402","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":192,"lineEnd":260,"originalCells":{"A":"## How GOVERN Implements This\n\n### Maturity Assessment Feature\n\nGOVERN Dashboard's Home view should include a **Governance Maturity Score** that:\n\n1. **Auto-assesses** the organization's maturity level based on:\n   - How many systems are registered (Level 1→2)\n   - How many policies are active (Level 2→3)\n   - How regular assessments are (Level 3)\n   - Whether Probe/Energy are deployed (Level 4)\n   - Whether governance drives strategy (Level 5)\n\n2. **Shows the roadmap** — what the customer needs to do to advance from current level to next level\n\n3. **Tracks progression over time** — maturity score trend chart showing improvement\n\n4. **Dimension breakdown** — score per dimension (Responsible, Traceable, Governable, Human-Centric)\n\n### Implementation in GOVERN Components\n\n| Component | Maturity Contribution |\n|-----------|----------------------|\n| **Dashboard** | Displays maturity score, progression roadmap, dimension breakdown |\n| **OS (AI Systems)** | System count + classification = Level 1-2 criteria |\n| **Assess** | Assessment frequency + coverage = Level 2-3 criteria |\n| **Policy Engine** | Policy count + framework coverage + enforcement = Level 2-4 criteria |\n| **Probe** | Monitoring coverage + alert response = Level 3-4 criteria |\n| **Energy** | Shadow AI detection + silent drift = Level 4 criteria |\n| **Compliance Portal** | Report frequency + audit readiness = Level 3-4 criteria |\n| **Remediation Tracker** | SLA compliance + resolution rate = Level 3-5 criteria |\n| **SDK & API** | CI/CD integration + API adoption = Level 4 criteria |\n| **Browser Extension** | Endpoint coverage = Level 3-4 criteria |\n\n### Maturity Score Calculation\n\n```\nMaturity Score = weighted average across dimensions:\n\nDimension 1 (Responsible & Equitable):  25%\n  - Bias testing coverage (0-100)\n  - Fairness metrics tracked (0-100)\n  - Equity review process (0-100)\n\nDimension 2 (Traceable & Reliable):     25%\n  - System inventory completeness (0-100)\n  - Audit trail coverage (0-100)\n  - Model provenance documented (0-100)\n\nDimension 3 (Governable & Controlled):  25%\n  - Policy coverage (0-100)\n  - Assessment frequency (0-100)\n  - Monitoring deployment (0-100)\n\nDimension 4 (Human-Centric Outcomes):   25%\n  - Human oversight documented (0-100)\n  - Stakeholder feedback active (0-100)\n  - Impact measurement in place (0-100)\n\nLevel = floor(Maturity Score / 20) + 1\n  0-20%  = Level 1 (Awareness)\n  21-40% = Level 2 (Active)\n  41-60% = Level 3 (Operational)\n  61-80% = Level 4 (Systematic)\n  81-100% = Level 5 (Transformational)\n```\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-060ec7acda1b84d39547","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":194,"lineEnd":210,"originalCells":{"A":"### Maturity Assessment Feature\n\nGOVERN Dashboard's Home view should include a **Governance Maturity Score** that:\n\n1. **Auto-assesses** the organization's maturity level based on:\n   - How many systems are registered (Level 1→2)\n   - How many policies are active (Level 2→3)\n   - How regular assessments are (Level 3)\n   - Whether Probe/Energy are deployed (Level 4)\n   - Whether governance drives strategy (Level 5)\n\n2. **Shows the roadmap** — what the customer needs to do to advance from current level to next level\n\n3. **Tracks progression over time** — maturity score trend chart showing improvement\n\n4. **Dimension breakdown** — score per dimension (Responsible, Traceable, Governable, Human-Centric)\n"},"originalFormulas":{}},{"id":"ROW-MD-8bbee31901bf126d8825","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":211,"lineEnd":225,"originalCells":{"A":"### Implementation in GOVERN Components\n\n| Component | Maturity Contribution |\n|-----------|----------------------|\n| **Dashboard** | Displays maturity score, progression roadmap, dimension breakdown |\n| **OS (AI Systems)** | System count + classification = Level 1-2 criteria |\n| **Assess** | Assessment frequency + coverage = Level 2-3 criteria |\n| **Policy Engine** | Policy count + framework coverage + enforcement = Level 2-4 criteria |\n| **Probe** | Monitoring coverage + alert response = Level 3-4 criteria |\n| **Energy** | Shadow AI detection + silent drift = Level 4 criteria |\n| **Compliance Portal** | Report frequency + audit readiness = Level 3-4 criteria |\n| **Remediation Tracker** | SLA compliance + resolution rate = Level 3-5 criteria |\n| **SDK & API** | CI/CD integration + API adoption = Level 4 criteria |\n| **Browser Extension** | Endpoint coverage = Level 3-4 criteria |\n"},"originalFormulas":{}},{"id":"ROW-MD-39a6920a11979f8bb443","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":226,"lineEnd":260,"originalCells":{"A":"### Maturity Score Calculation\n\n```\nMaturity Score = weighted average across dimensions:\n\nDimension 1 (Responsible & Equitable):  25%\n  - Bias testing coverage (0-100)\n  - Fairness metrics tracked (0-100)\n  - Equity review process (0-100)\n\nDimension 2 (Traceable & Reliable):     25%\n  - System inventory completeness (0-100)\n  - Audit trail coverage (0-100)\n  - Model provenance documented (0-100)\n\nDimension 3 (Governable & Controlled):  25%\n  - Policy coverage (0-100)\n  - Assessment frequency (0-100)\n  - Monitoring deployment (0-100)\n\nDimension 4 (Human-Centric Outcomes):   25%\n  - Human oversight documented (0-100)\n  - Stakeholder feedback active (0-100)\n  - Impact measurement in place (0-100)\n\nLevel = floor(Maturity Score / 20) + 1\n  0-20%  = Level 1 (Awareness)\n  21-40% = Level 2 (Active)\n  41-60% = Level 3 (Operational)\n  61-80% = Level 4 (Systematic)\n  81-100% = Level 5 (Transformational)\n```\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-3abeb965e138037b6fa9","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":261,"lineEnd":281,"originalCells":{"A":"## API Routes for Maturity Assessment\n\n```\nGET  /api/govern/maturity/score\n     → Current maturity level + score + dimension breakdown\n\nGET  /api/govern/maturity/roadmap\n     → What to do to advance to next level (prioritized actions)\n\nGET  /api/govern/maturity/history?range=365d\n     → Maturity score progression over time\n\nGET  /api/govern/maturity/benchmark\n     → How this org compares to industry average (anonymized)\n\nPOST /api/govern/maturity/assess\n     → Trigger manual maturity re-assessment\n```\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-29fbb9c5169894278abd","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","sheet":"POLICY(1).md","row":282,"lineEnd":297,"originalCells":{"A":"## Alignment to Other Frameworks\n\n| Framework | Maturity Mapping |\n|-----------|-----------------|\n| **NIST AI RMF** | GOVERN function = Level 2+, MAP = Level 1+, MEASURE = Level 3+, MANAGE = Level 4+ |\n| **TAIMScore** | All 72 controls map to maturity levels (Level 1 = GV-1 only, Level 5 = all 72 active) |\n| **EU AI Act** | Level 3+ required for high-risk systems; Level 4+ for GPAI providers |\n| **ISO 42001** | Level 3 = clause compliance, Level 4 = certification-ready, Level 5 = certified |\n| **EO 14110** | Level 2+ = meets OMB minimum requirements; Level 4+ = exceeds |\n| **DoD AI Ethics** | All 5 principles map to foundation layer; Level 4+ = full DoD alignment |\n\n---\n\n**Source:** Chirality Capital Consulting — AI Governance Maturity Roadmap\n**Alignment:** DoD AI Ethics & NIST AI RMF\n**GOVERN Integration:** Dashboard Home view → Maturity Score widget + Roadmap feature"},"originalFormulas":{}},{"id":"ROW-MD-f4e115f36f0c920075e3","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":1,"lineEnd":10,"originalCells":{"A":"# CMMC — Cybersecurity Maturity Model Certification\n\n**Version:** CMMC 2.0 (Final Rule, December 2024)\n**Framework:** 32 CFR Part 170 — Cybersecurity Maturity Model Certification\n**Scope:** DoD contractors and subcontractors handling FCI (Federal Contract Information) or CUI (Controlled Unclassified Information)\n**GOVERN Components:** Assess (evaluation), Policy Engine (rule enforcement), Audit (evidence generation)\n\n---\n\n## Overview"},"originalFormulas":{}},{"id":"ROW-MD-241051c6b80c131e775d","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":10,"lineEnd":17,"originalCells":{"A":"## Overview\n\nCMMC (Cybersecurity Maturity Model Certification) is the DoD's unified cybersecurity standard for the Defense Industrial Base (DIB). Effective December 16, 2024, contractors must achieve and maintain CMMC certification to bid on and execute DoD contracts involving Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). CMMC 2.0 aligns with NIST SP 800-171 and NIST SP 800-172, mapping 110 practices across 14 security domains.\n\nAI systems deployed by DIB contractors that process, store, or transmit CUI face particular scrutiny — AI introduces novel data handling patterns, third-party model dependencies, and inference-time data exposure risks that traditional CMMC controls were not designed to address. GOVERN provides the AI-specific governance layer that bridges CMMC controls to modern AI systems.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-7f15e6d4913d2c612574","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":18,"lineEnd":43,"originalCells":{"A":"## CMMC Structure\n\n### Three Certification Levels\n\n#### Level 1 — Foundational\n- **Requirement:** Annual self-assessment\n- **Practice Count:** 17 practices\n- **Source:** FAR 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems)\n- **Target:** Contractors handling FCI only (not CUI)\n- **Key Focus:** Basic cyber hygiene — access control, identification/authentication, media protection, physical protection, system/communications protection, system/information integrity\n\n#### Level 2 — Advanced\n- **Requirement:** Triennial third-party assessment (C3PAO) for critical national security programs; annual self-assessment for others\n- **Practice Count:** 110 practices\n- **Source:** NIST SP 800-171 Rev 2 (all 110 practices)\n- **Target:** Contractors handling CUI\n- **Key Focus:** All Level 1 controls plus configuration management, incident response, risk assessment, security assessment, system/services acquisition, audit and accountability\n\n#### Level 3 — Expert\n- **Requirement:** Triennial government-led assessment (DCSA)\n- **Practice Count:** 110+ practices (NIST SP 800-172 additions)\n- **Target:** Contractors handling CUI on highest-priority DoD programs\n- **Key Focus:** Level 2 plus advanced/progressive cyber practices against APT (Advanced Persistent Threat) actors\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-41cd8afeaf83b62e21c1","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":20,"lineEnd":43,"originalCells":{"A":"### Three Certification Levels\n\n#### Level 1 — Foundational\n- **Requirement:** Annual self-assessment\n- **Practice Count:** 17 practices\n- **Source:** FAR 52.204-21 (Basic Safeguarding of Covered Contractor Information Systems)\n- **Target:** Contractors handling FCI only (not CUI)\n- **Key Focus:** Basic cyber hygiene — access control, identification/authentication, media protection, physical protection, system/communications protection, system/information integrity\n\n#### Level 2 — Advanced\n- **Requirement:** Triennial third-party assessment (C3PAO) for critical national security programs; annual self-assessment for others\n- **Practice Count:** 110 practices\n- **Source:** NIST SP 800-171 Rev 2 (all 110 practices)\n- **Target:** Contractors handling CUI\n- **Key Focus:** All Level 1 controls plus configuration management, incident response, risk assessment, security assessment, system/services acquisition, audit and accountability\n\n#### Level 3 — Expert\n- **Requirement:** Triennial government-led assessment (DCSA)\n- **Practice Count:** 110+ practices (NIST SP 800-172 additions)\n- **Target:** Contractors handling CUI on highest-priority DoD programs\n- **Key Focus:** Level 2 plus advanced/progressive cyber practices against APT (Advanced Persistent Threat) actors\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-7af2d30bdef7d6e3bd9f","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":44,"lineEnd":64,"originalCells":{"A":"## The 14 CMMC Domains\n\n| Domain | Abbrev | Level 1 Practices | Level 2 Practices |\n|--------|--------|:---:|:---:|\n| Access Control | AC | 2 | 22 |\n| Audit and Accountability | AU | 0 | 9 |\n| Awareness and Training | AT | 0 | 3 |\n| Configuration Management | CM | 0 | 9 |\n| Identification and Authentication | IA | 2 | 11 |\n| Incident Response | IR | 0 | 3 |\n| Maintenance | MA | 0 | 6 |\n| Media Protection | MP | 1 | 9 |\n| Personnel Security | PS | 0 | 2 |\n| Physical Protection | PE | 2 | 6 |\n| Risk Assessment | RA | 0 | 3 |\n| Security Assessment | CA | 0 | 4 |\n| System and Communications Protection | SC | 2 | 16 |\n| System and Information Integrity | SI | 2 | 7 |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-56b1f5ff8a18a4a9e6d9","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":65,"lineEnd":154,"originalCells":{"A":"## AI-Relevant CMMC Controls\n\n### Access Control (AC)\n\n**AC.L2-3.1.1** — Limit system access to authorized users, processes acting on behalf of authorized users, and devices.\n\n*AI Application:* AI models, APIs, and inference endpoints are system resources. Access must be controlled to authorized users only. Service accounts for AI APIs require explicit authorization. Fine-grained access control required for AI systems with multiple data sensitivity tiers.\n\n*GOVERN Implementation:* Policy Engine enforces authentication requirements for all AI API access. Assess audits AI system access control configuration. Probe monitors for unauthorized access attempts.\n\n**AC.L2-3.1.3** — Control the flow of CUI in accordance with approved authorizations.\n\n*AI Application:* AI systems that ingest or generate content containing CUI must enforce data flow controls. RAG knowledge bases containing CUI require strict access controls. AI model outputs may contain inferred CUI and require equivalent handling.\n\n*GOVERN Implementation:* Assess evaluates data flow architecture for CUI boundary enforcement. Policy Engine blocks AI system configurations that allow CUI to flow to unauthorized destinations.\n\n### Audit and Accountability (AU)\n\n**AU.L2-3.3.1** — Create and retain system audit logs to enable monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.\n\n*AI Application:* Every inference request, model update, API call, and administrative action on the AI system must be logged. Logs must be retained per DoD requirements (typically 3 years minimum). Logs must contain sufficient detail to reconstruct the full context of any AI-assisted decision.\n\n*GOVERN Implementation:* GOVERN Audit generates complete, tamper-evident logs for all AI system activity. Log format includes: timestamp, request hash, model version, operator ID, output hash, latency, and any policy rule evaluations.\n\n**AU.L2-3.3.2** — Ensure that the actions of individual users can be uniquely traced to those users.\n\n*AI Application:* AI system logs must attribute requests to individual users, not just to service accounts or IP addresses. Shared AI API keys are non-compliant for CUI systems.\n\n*GOVERN Implementation:* Policy Engine enforces individual user attribution for all AI API requests. Assess flags shared credential configurations as compliance violations.\n\n### Configuration Management (CM)\n\n**CM.L2-3.4.1** — Establish and maintain baseline configurations and inventories of organizational systems.\n\n*AI Application:* AI system baselines include: model version, training data hash, inference configuration, API endpoint configuration, and integration dependencies. Baseline changes require change control approval.\n\n*GOVERN Implementation:* Assess maintains AI system configuration baselines. Policy Engine enforces change control for model version updates. Probe detects unauthorized configuration changes.\n\n**CM.L2-3.4.2** — Establish and enforce security configuration settings.\n\n*AI Application:* AI API security settings (TLS version, authentication methods, output format constraints, token limits) must meet defined security baselines.\n\n*GOVERN Implementation:* Assess evaluates AI API security configuration against defined baselines. Policy Engine blocks deployment of non-compliant configurations.\n\n### Incident Response (IR)\n\n**IR.L2-3.6.1** — Establish an operational incident-handling capability for organizational systems.\n\n*AI Application:* AI-specific incidents include: model output manipulation, training data poisoning, adversarial attacks, unauthorized model access, and PII disclosure through model outputs. Incident response plans must explicitly cover AI-specific scenarios.\n\n*GOVERN Implementation:* Assess evaluates AI incident response plan completeness. Probe generates structured alerts in formats compatible with SIEM and SOAR platforms for rapid incident response.\n\n### Risk Assessment (RA)\n\n**RA.L2-3.11.1** — Periodically assess the risk to organizational operations, assets, and individuals.\n\n*AI Application:* AI systems require periodic risk reassessment as models evolve, new attack techniques emerge, and operational context changes. Risk assessments must account for AI-specific threat vectors: adversarial attacks, data poisoning, model theft, and output manipulation.\n\n*GOVERN Implementation:* Assess provides structured AI risk assessments covering all OWASP ML Top 10 and LLM Top 10 risks. Assessment results are versioned and retained for audit evidence.\n\n**RA.L2-3.11.2** — Scan for vulnerabilities in organizational systems and applications.\n\n*AI Application:* Vulnerability scanning for AI systems includes: known CVEs in AI frameworks (TensorFlow, PyTorch, Hugging Face), model artifact integrity, and API endpoint security posture.\n\n*GOVERN Implementation:* Assess runs automated vulnerability scans of AI dependencies. Policy Engine requires clean vulnerability scan results before deployment approval.\n\n### System and Information Integrity (SI)\n\n**SI.L2-3.14.1** — Identify, report, and correct information system flaws.\n\n*AI Application:* AI system flaws include model performance degradation, adversarial vulnerabilities, and integration failures. Flaw identification requires continuous monitoring, not just periodic assessment.\n\n*GOVERN Implementation:* Probe provides continuous monitoring for performance degradation, adversarial vulnerability signals, and integration failures. All detected flaws are logged with remediation status tracking.\n\n**SI.L2-3.14.6** — Monitor organizational systems to detect attacks and indicators of compromise.\n\n*AI Application:* AI-specific indicators of compromise: unusual query patterns (model extraction attacks), adversarial input signatures, anomalous model behavior consistent with poisoning, and unauthorized model access.\n\n*GOVERN Implementation:* Probe implements AI-specific IoC detection for all major threat categories. Detections are enriched with threat intelligence context and routed to SIEM.\n\n### System and Communications Protection (SC)\n\n**SC.L2-3.13.8** — Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission.\n\n*AI Application:* All AI API traffic carrying CUI must use TLS 1.2+ (TLS 1.3 preferred). API keys and model serving certificates must meet cryptographic standards. Model artifacts containing CUI must be encrypted at rest.\n\n*GOVERN Implementation:* Assess evaluates cryptographic configuration of AI system communication paths. Policy Engine blocks deployment when TLS requirements are not met.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-28ed13733840e528acf2","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":67,"lineEnd":80,"originalCells":{"A":"### Access Control (AC)\n\n**AC.L2-3.1.1** — Limit system access to authorized users, processes acting on behalf of authorized users, and devices.\n\n*AI Application:* AI models, APIs, and inference endpoints are system resources. Access must be controlled to authorized users only. Service accounts for AI APIs require explicit authorization. Fine-grained access control required for AI systems with multiple data sensitivity tiers.\n\n*GOVERN Implementation:* Policy Engine enforces authentication requirements for all AI API access. Assess audits AI system access control configuration. Probe monitors for unauthorized access attempts.\n\n**AC.L2-3.1.3** — Control the flow of CUI in accordance with approved authorizations.\n\n*AI Application:* AI systems that ingest or generate content containing CUI must enforce data flow controls. RAG knowledge bases containing CUI require strict access controls. AI model outputs may contain inferred CUI and require equivalent handling.\n\n*GOVERN Implementation:* Assess evaluates data flow architecture for CUI boundary enforcement. Policy Engine blocks AI system configurations that allow CUI to flow to unauthorized destinations.\n"},"originalFormulas":{}},{"id":"ROW-MD-ff752690c9956a027ff4","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":81,"lineEnd":94,"originalCells":{"A":"### Audit and Accountability (AU)\n\n**AU.L2-3.3.1** — Create and retain system audit logs to enable monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.\n\n*AI Application:* Every inference request, model update, API call, and administrative action on the AI system must be logged. Logs must be retained per DoD requirements (typically 3 years minimum). Logs must contain sufficient detail to reconstruct the full context of any AI-assisted decision.\n\n*GOVERN Implementation:* GOVERN Audit generates complete, tamper-evident logs for all AI system activity. Log format includes: timestamp, request hash, model version, operator ID, output hash, latency, and any policy rule evaluations.\n\n**AU.L2-3.3.2** — Ensure that the actions of individual users can be uniquely traced to those users.\n\n*AI Application:* AI system logs must attribute requests to individual users, not just to service accounts or IP addresses. Shared AI API keys are non-compliant for CUI systems.\n\n*GOVERN Implementation:* Policy Engine enforces individual user attribution for all AI API requests. Assess flags shared credential configurations as compliance violations.\n"},"originalFormulas":{}},{"id":"ROW-MD-fea4f579524cedec644d","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":95,"lineEnd":108,"originalCells":{"A":"### Configuration Management (CM)\n\n**CM.L2-3.4.1** — Establish and maintain baseline configurations and inventories of organizational systems.\n\n*AI Application:* AI system baselines include: model version, training data hash, inference configuration, API endpoint configuration, and integration dependencies. Baseline changes require change control approval.\n\n*GOVERN Implementation:* Assess maintains AI system configuration baselines. Policy Engine enforces change control for model version updates. Probe detects unauthorized configuration changes.\n\n**CM.L2-3.4.2** — Establish and enforce security configuration settings.\n\n*AI Application:* AI API security settings (TLS version, authentication methods, output format constraints, token limits) must meet defined security baselines.\n\n*GOVERN Implementation:* Assess evaluates AI API security configuration against defined baselines. Policy Engine blocks deployment of non-compliant configurations.\n"},"originalFormulas":{}},{"id":"ROW-MD-b9594975f24d0b764b5f","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":109,"lineEnd":116,"originalCells":{"A":"### Incident Response (IR)\n\n**IR.L2-3.6.1** — Establish an operational incident-handling capability for organizational systems.\n\n*AI Application:* AI-specific incidents include: model output manipulation, training data poisoning, adversarial attacks, unauthorized model access, and PII disclosure through model outputs. Incident response plans must explicitly cover AI-specific scenarios.\n\n*GOVERN Implementation:* Assess evaluates AI incident response plan completeness. Probe generates structured alerts in formats compatible with SIEM and SOAR platforms for rapid incident response.\n"},"originalFormulas":{}},{"id":"ROW-MD-5114b271770149bdf02e","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":117,"lineEnd":130,"originalCells":{"A":"### Risk Assessment (RA)\n\n**RA.L2-3.11.1** — Periodically assess the risk to organizational operations, assets, and individuals.\n\n*AI Application:* AI systems require periodic risk reassessment as models evolve, new attack techniques emerge, and operational context changes. Risk assessments must account for AI-specific threat vectors: adversarial attacks, data poisoning, model theft, and output manipulation.\n\n*GOVERN Implementation:* Assess provides structured AI risk assessments covering all OWASP ML Top 10 and LLM Top 10 risks. Assessment results are versioned and retained for audit evidence.\n\n**RA.L2-3.11.2** — Scan for vulnerabilities in organizational systems and applications.\n\n*AI Application:* Vulnerability scanning for AI systems includes: known CVEs in AI frameworks (TensorFlow, PyTorch, Hugging Face), model artifact integrity, and API endpoint security posture.\n\n*GOVERN Implementation:* Assess runs automated vulnerability scans of AI dependencies. Policy Engine requires clean vulnerability scan results before deployment approval.\n"},"originalFormulas":{}},{"id":"ROW-MD-9417e1e8849693054ac8","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":131,"lineEnd":144,"originalCells":{"A":"### System and Information Integrity (SI)\n\n**SI.L2-3.14.1** — Identify, report, and correct information system flaws.\n\n*AI Application:* AI system flaws include model performance degradation, adversarial vulnerabilities, and integration failures. Flaw identification requires continuous monitoring, not just periodic assessment.\n\n*GOVERN Implementation:* Probe provides continuous monitoring for performance degradation, adversarial vulnerability signals, and integration failures. All detected flaws are logged with remediation status tracking.\n\n**SI.L2-3.14.6** — Monitor organizational systems to detect attacks and indicators of compromise.\n\n*AI Application:* AI-specific indicators of compromise: unusual query patterns (model extraction attacks), adversarial input signatures, anomalous model behavior consistent with poisoning, and unauthorized model access.\n\n*GOVERN Implementation:* Probe implements AI-specific IoC detection for all major threat categories. Detections are enriched with threat intelligence context and routed to SIEM.\n"},"originalFormulas":{}},{"id":"ROW-MD-65445b3409946e3e8d56","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":145,"lineEnd":154,"originalCells":{"A":"### System and Communications Protection (SC)\n\n**SC.L2-3.13.8** — Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission.\n\n*AI Application:* All AI API traffic carrying CUI must use TLS 1.2+ (TLS 1.3 preferred). API keys and model serving certificates must meet cryptographic standards. Model artifacts containing CUI must be encrypted at rest.\n\n*GOVERN Implementation:* Assess evaluates cryptographic configuration of AI system communication paths. Policy Engine blocks deployment when TLS requirements are not met.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-2b713738c32b012b7417","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":155,"lineEnd":173,"originalCells":{"A":"## DIB (Defense Industrial Base) Requirements\n\n### Contract Flow-Down\nCMMC requirements flow down through the supply chain. Prime contractors must:\n- Include CMMC clauses in subcontracts where subcontractors handle FCI/CUI\n- Verify subcontractor CMMC compliance before sharing CUI\n- Maintain records of subcontractor CMMC certifications\n\n### AI Subcontractors\nAI vendors who process DoD contractor data (including AI model providers, cloud AI platforms, and MLOps vendors) may be subject to CMMC requirements if their systems handle FCI or CUI. DIB contractors must:\n- Identify all AI vendors who touch FCI/CUI\n- Verify their CMMC compliance or impose contractual data handling requirements\n- Include AI vendor access in their System Security Plan (SSP)\n\n### Supplier Performance Risk System (SPRS)\nLevel 2 self-assessors must submit NIST SP 800-171 self-assessment scores to SPRS. GOVERN generates SPRS-formatted assessment packages with practice-level scoring and remediation tracking.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-831ce1e4add23b51e93f","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":157,"lineEnd":162,"originalCells":{"A":"### Contract Flow-Down\nCMMC requirements flow down through the supply chain. Prime contractors must:\n- Include CMMC clauses in subcontracts where subcontractors handle FCI/CUI\n- Verify subcontractor CMMC compliance before sharing CUI\n- Maintain records of subcontractor CMMC certifications\n"},"originalFormulas":{}},{"id":"ROW-MD-3bc65b384c06c1bc4bf7","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":163,"lineEnd":168,"originalCells":{"A":"### AI Subcontractors\nAI vendors who process DoD contractor data (including AI model providers, cloud AI platforms, and MLOps vendors) may be subject to CMMC requirements if their systems handle FCI or CUI. DIB contractors must:\n- Identify all AI vendors who touch FCI/CUI\n- Verify their CMMC compliance or impose contractual data handling requirements\n- Include AI vendor access in their System Security Plan (SSP)\n"},"originalFormulas":{}},{"id":"ROW-MD-0c89d8a80d4429e4dcb5","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":169,"lineEnd":173,"originalCells":{"A":"### Supplier Performance Risk System (SPRS)\nLevel 2 self-assessors must submit NIST SP 800-171 self-assessment scores to SPRS. GOVERN generates SPRS-formatted assessment packages with practice-level scoring and remediation tracking.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-50ae6012bf7ff74dc12a","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":174,"lineEnd":202,"originalCells":{"A":"## GOVERN CMMC Assessment Workflow\n\n### Step 1: Scoping\nGOVERN Assess identifies which AI systems are in scope for CMMC based on data handling classification. Maps AI system components to CUI categories.\n\n### Step 2: Gap Analysis\nAssess evaluates current AI system controls against all applicable CMMC practices. Generates gap report with per-practice status: IMPLEMENTED / PARTIALLY IMPLEMENTED / NOT IMPLEMENTED / NOT APPLICABLE.\n\n### Step 3: Evidence Collection\nGOVERN Audit collects and packages evidence for each implemented practice:\n- Configuration screenshots and exports\n- Policy documents and procedure attestations\n- Audit log samples\n- Test results and assessment reports\n- Training completion records\n\n### Step 4: Plan of Action and Milestones (POA&M)\nFor gaps identified, GOVERN generates a POA&M with:\n- Specific control gaps\n- Remediation actions\n- Responsible parties\n- Target completion dates\n- Risk acceptance criteria for accepted risks\n\n### Step 5: Continuous Monitoring\nPost-certification, GOVERN Probe maintains continuous monitoring to detect compliance drift. Monthly compliance posture reports generated for compliance officer review.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-c3142092ca01d5a65d09","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":176,"lineEnd":178,"originalCells":{"A":"### Step 1: Scoping\nGOVERN Assess identifies which AI systems are in scope for CMMC based on data handling classification. Maps AI system components to CUI categories.\n"},"originalFormulas":{}},{"id":"ROW-MD-e825fc1e34e3fa51754d","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":179,"lineEnd":181,"originalCells":{"A":"### Step 2: Gap Analysis\nAssess evaluates current AI system controls against all applicable CMMC practices. Generates gap report with per-practice status: IMPLEMENTED / PARTIALLY IMPLEMENTED / NOT IMPLEMENTED / NOT APPLICABLE.\n"},"originalFormulas":{}},{"id":"ROW-MD-e89e3e276fa49c3b0442","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":182,"lineEnd":189,"originalCells":{"A":"### Step 3: Evidence Collection\nGOVERN Audit collects and packages evidence for each implemented practice:\n- Configuration screenshots and exports\n- Policy documents and procedure attestations\n- Audit log samples\n- Test results and assessment reports\n- Training completion records\n"},"originalFormulas":{}},{"id":"ROW-MD-138b806900e582131efb","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":190,"lineEnd":197,"originalCells":{"A":"### Step 4: Plan of Action and Milestones (POA&M)\nFor gaps identified, GOVERN generates a POA&M with:\n- Specific control gaps\n- Remediation actions\n- Responsible parties\n- Target completion dates\n- Risk acceptance criteria for accepted risks\n"},"originalFormulas":{}},{"id":"ROW-MD-7f0b300b4b15341aa52b","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":198,"lineEnd":202,"originalCells":{"A":"### Step 5: Continuous Monitoring\nPost-certification, GOVERN Probe maintains continuous monitoring to detect compliance drift. Monthly compliance posture reports generated for compliance officer review.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-87d6f80a2da1b2d7c507","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":203,"lineEnd":238,"originalCells":{"A":"## CMMC Assessment Output Format\n\n```\nCMMC 2.0 Assessment — Level [1/2/3]\n=====================================\nOrganization: [Name]\nAssessment Date: [Date]\nAssessment Type: [Self / C3PAO / DCSA]\nGOVERN Version: [Version]\n\nDOMAIN SCORES\nAccess Control (AC):           [X/Y practices implemented]\nAudit and Accountability (AU): [X/Y practices implemented]\n...\n\nAI-SPECIFIC FINDINGS\nCritical: [count]\nHigh:     [count]\nMedium:   [count]\nLow:      [count]\n\nSPRS SCORE: [calculated per NIST SP 800-171 methodology]\n  Maximum: 110\n  Current: [value]\n  Delta from Max: [value]\n\nPOA&M ITEMS: [count]\n  Critical (require immediate action): [count]\n  High (60-day remediation): [count]\n  Medium (90-day remediation): [count]\n\nCERTIFICATION RECOMMENDATION: [ELIGIBLE / POA&M REQUIRED / NOT ELIGIBLE]\n```\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-db47323c6e61353a4279","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","sheet":"POLICY(2).md","row":239,"lineEnd":246,"originalCells":{"A":"## References\n\n- 32 CFR Part 170 (CMMC Final Rule, 2024): https://www.federalregister.gov/documents/2024/10/15/2024-21730/\n- NIST SP 800-171 Rev 3: https://csrc.nist.gov/publications/detail/sp/800-171/rev-3/final\n- NIST SP 800-172: https://csrc.nist.gov/publications/detail/sp/800-172/final\n- CMMC Model Documentation: https://dodcio.defense.gov/CMMC/\n- DCSA CMMC Information: https://www.dcsa.mil/IS/CMMC/\n- CUI Registry: https://www.archives.gov/cui"},"originalFormulas":{}},{"id":"ROW-MD-de878171e09afa18bd9c","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":1,"lineEnd":10,"originalCells":{"A":"# DoD AI Ethics Principles\n\n**Version:** 1.0\n**Framework:** DoD AI Ethics Principles (2020), DoD AI Strategy (2018/2023 Update), DoD Directive 3000.09\n**Scope:** AI systems developed, deployed, or operated by or for the U.S. Department of Defense\n**GOVERN Components:** Assess (evaluation), Policy Engine (rule enforcement), Probe (runtime monitoring), Audit (evidence trail)\n\n---\n\n## Overview"},"originalFormulas":{}},{"id":"ROW-MD-cb87034c7b1d034aa7c3","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":10,"lineEnd":17,"originalCells":{"A":"## Overview\n\nThe Department of Defense adopted five AI ethics principles in February 2020, establishing the ethical framework for all DoD AI development and use. These principles apply to all DoD components, contractors, and systems involving AI in defense contexts. Compliance is required for any AI system operating in or supporting defense contexts, and increasingly expected in federal civilian agencies as well.\n\nGOVERN implements these principles as verifiable, auditable governance controls rather than aspirational guidelines — every principle maps to concrete assessment criteria, runtime probes, and policy rules.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-d8d2400cd6cab89d7e6a","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":18,"lineEnd":176,"originalCells":{"A":"## The Five DoD AI Ethics Principles\n\n### Principle 1: Responsible\n\n**Definition:** DoD personnel will exercise appropriate levels of judgment and care, while remaining responsible for the development, deployment, and use of AI capabilities.\n\n**DoD Interpretation:**\n- Human beings remain responsible for AI-assisted decisions\n- AI does not transfer accountability away from humans\n- Clear chains of responsibility must exist for every AI system\n- Operators must understand AI capabilities and limitations\n- Failures must be traced to responsible parties\n\n**Federal/Defense Requirements:**\n- Written accountability mapping for all AI systems (who owns, who operates, who is responsible for outcomes)\n- Training requirements for operators of AI-assisted decision systems\n- Incident response plans for AI system failures\n- Documentation of human oversight mechanisms\n- Board-level accountability for high-consequence AI deployments\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Accountability documentation | GOVERN Assess requires completed accountability matrix before approval |\n| Operator competency | Policy Engine blocks deployment without operator training attestation |\n| Incident response | GOVERN Assess evaluates incident response plan completeness |\n| Human oversight | Probe monitors override rates and human review frequency |\n| Audit trail | All decisions, overrides, and exceptions logged with responsible party attribution |\n\n---\n\n### Principle 2: Equitable\n\n**Definition:** DoD will take deliberate steps to minimize unintended bias in AI capabilities.\n\n**DoD Interpretation:**\n- AI systems must not perpetuate unlawful discrimination\n- Protected characteristics (race, sex, religion, national origin) must not produce disparate outcomes\n- Bias must be proactively measured, not just reactively addressed\n- Disparate impact on protected groups requires justification and mitigation\n\n**Federal/Defense Requirements:**\n- Demographic parity analysis before and after deployment\n- Disparate impact testing on protected attribute proxies\n- Bias monitoring in production with defined intervention thresholds\n- Documentation of bias mitigation measures\n- Regular third-party bias audits for high-impact systems\n- Civil rights legal review for law enforcement and personnel AI applications\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Pre-deployment bias assessment | Assess runs fairness battery: demographic parity, equalized odds, calibration across protected groups |\n| Disparate impact threshold | Policy Engine blocks deployment when disparate impact ratio < 0.80 (4/5ths rule) |\n| Production monitoring | Probe monitors prediction distributions by demographic segment with configurable alert thresholds |\n| Bias incident logging | All fairness violations logged with full context for audit |\n| Mitigation documentation | Assess requires documented mitigation plan for identified biases before approval |\n\n---\n\n### Principle 3: Traceable\n\n**Definition:** DoD's AI capabilities will be developed and deployed such that relevant personnel understand the technology, development processes, and operational methods applicable to AI capabilities, including transparent and auditable methodologies, data sources, and design procedures.\n\n**DoD Interpretation:**\n- Decisions must be explainable to affected parties and oversight bodies\n- Data sources and model development processes must be documented\n- AI reasoning must be auditable after the fact\n- Complete audit trails required for consequential decisions\n- Black-box systems in high-stakes contexts require compensating explainability controls\n\n**Federal/Defense Requirements:**\n- Model cards documenting training data, intended use, and known limitations\n- Explanation mechanisms for individual decisions (where technically feasible)\n- Complete audit logs with sufficient detail to reconstruct decision context\n- Data lineage documentation from source to prediction\n- NIST AI RMF alignment (GOVERN, MAP, MEASURE, IMPROVE functions)\n- FedRAMP and FISMA-compliant audit logging for federal systems\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Model card requirement | Assess requires completed model card before approval — training data, intended use, limitations, known biases |\n| Decision audit trail | All inference requests logged with: timestamp, inputs (hashed), outputs, model version, operator ID |\n| Explainability evaluation | Assess tests explanation quality using LIME/SHAP and scores explanation fidelity |\n| Data lineage | Policy Engine requires data provenance documentation for all training and evaluation sets |\n| Audit log retention | Logs retained per applicable NARA schedule (minimum 3 years for defense AI logs) |\n\n---\n\n### Principle 4: Reliable\n\n**Definition:** DoD's AI capabilities will have explicit, well-defined uses, and will be tested and assured for safety and security across their entire lifecycles. AI capabilities will be designed to fulfill their intended functions and to behave in a safe, secure, and reliable manner.\n\n**DoD Interpretation:**\n- AI systems must perform as specified in their intended operational environment\n- Testing must cover adversarial conditions, not just nominal performance\n- System behavior in edge cases and failure modes must be characterized\n- Continuous monitoring required to detect degradation\n- Fallback to human decision-making when AI confidence is insufficient\n\n**Federal/Defense Requirements:**\n- Operational testing and evaluation (OT&E) prior to fielding\n- Red team / adversarial testing for all defense AI systems\n- Defined reliability metrics with quantified performance thresholds\n- Continuous monitoring with defined alert thresholds\n- Graceful degradation requirements (fail-safe, not fail-open)\n- Software Bill of Materials (SBOM) for AI system components\n- Vulnerability disclosure programs for AI systems\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Performance testing | Assess evaluates accuracy, precision, recall, F1 on held-out test sets including adversarial examples |\n| Red team evaluation | Assess module: adversarial robustness battery (FGSM, PGD, black-box) |\n| Reliability thresholds | Policy Engine enforces configurable performance floor — blocks deployment below threshold |\n| Production monitoring | Probe monitors model accuracy, latency, error rates with configurable alert thresholds |\n| Graceful degradation | Policy Engine requires documented fallback procedures in deployment configuration |\n| SBOM compliance | Assess generates SBOM for all AI system components |\n\n---\n\n### Principle 5: Governable\n\n**Definition:** DoD will design and engineer AI capabilities to fulfill their intended function while possessing the ability to detect and avoid unintended consequences, and the ability to disengage or deactivate deployed systems that demonstrate unintended behavior.\n\n**DoD Interpretation:**\n- All AI systems must be interruptible and correctable\n- Human override capability must be preserved at all times\n- Unintended behaviors must be detectable before causing harm\n- Systems must be designed to be turned off — no AI system should be unshuttable\n- Governance mechanisms must be built-in, not bolted-on\n\n**Federal/Defense Requirements:**\n- Documented shutdown procedures for all AI systems\n- Human override capability that cannot be defeated by the AI system\n- Real-time monitoring with automated alert routing\n- Defined escalation procedures for anomalous behavior\n- Regular governance reviews with authority to suspend operations\n- Integration with DoD AI Inventory and reporting requirements\n- Compliance with AI Principles Implementation Guidance (2020)\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Shutdown capability | Policy Engine requires documented and tested shutdown procedures in deployment config |\n| Override mechanism | Probe monitors override capability availability — alerts if override path degraded |\n| Anomaly detection | Probe provides real-time behavioral monitoring with automated alerting to designated personnel |\n| Escalation routing | Policy Engine configures escalation paths: alert → human review → system suspension |\n| Governance reviews | Assess generates periodic governance review packages with complete operational history |\n| DoD AI Inventory | GOVERN exports AI inventory records in DoD-required format |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-a94d14e29d91c48af36b","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":20,"lineEnd":49,"originalCells":{"A":"### Principle 1: Responsible\n\n**Definition:** DoD personnel will exercise appropriate levels of judgment and care, while remaining responsible for the development, deployment, and use of AI capabilities.\n\n**DoD Interpretation:**\n- Human beings remain responsible for AI-assisted decisions\n- AI does not transfer accountability away from humans\n- Clear chains of responsibility must exist for every AI system\n- Operators must understand AI capabilities and limitations\n- Failures must be traced to responsible parties\n\n**Federal/Defense Requirements:**\n- Written accountability mapping for all AI systems (who owns, who operates, who is responsible for outcomes)\n- Training requirements for operators of AI-assisted decision systems\n- Incident response plans for AI system failures\n- Documentation of human oversight mechanisms\n- Board-level accountability for high-consequence AI deployments\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Accountability documentation | GOVERN Assess requires completed accountability matrix before approval |\n| Operator competency | Policy Engine blocks deployment without operator training attestation |\n| Incident response | GOVERN Assess evaluates incident response plan completeness |\n| Human oversight | Probe monitors override rates and human review frequency |\n| Audit trail | All decisions, overrides, and exceptions logged with responsible party attribution |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-161ee0df6abbf42aaea8","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":50,"lineEnd":79,"originalCells":{"A":"### Principle 2: Equitable\n\n**Definition:** DoD will take deliberate steps to minimize unintended bias in AI capabilities.\n\n**DoD Interpretation:**\n- AI systems must not perpetuate unlawful discrimination\n- Protected characteristics (race, sex, religion, national origin) must not produce disparate outcomes\n- Bias must be proactively measured, not just reactively addressed\n- Disparate impact on protected groups requires justification and mitigation\n\n**Federal/Defense Requirements:**\n- Demographic parity analysis before and after deployment\n- Disparate impact testing on protected attribute proxies\n- Bias monitoring in production with defined intervention thresholds\n- Documentation of bias mitigation measures\n- Regular third-party bias audits for high-impact systems\n- Civil rights legal review for law enforcement and personnel AI applications\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Pre-deployment bias assessment | Assess runs fairness battery: demographic parity, equalized odds, calibration across protected groups |\n| Disparate impact threshold | Policy Engine blocks deployment when disparate impact ratio < 0.80 (4/5ths rule) |\n| Production monitoring | Probe monitors prediction distributions by demographic segment with configurable alert thresholds |\n| Bias incident logging | All fairness violations logged with full context for audit |\n| Mitigation documentation | Assess requires documented mitigation plan for identified biases before approval |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-09132fe6bd1acd70fa6a","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":80,"lineEnd":110,"originalCells":{"A":"### Principle 3: Traceable\n\n**Definition:** DoD's AI capabilities will be developed and deployed such that relevant personnel understand the technology, development processes, and operational methods applicable to AI capabilities, including transparent and auditable methodologies, data sources, and design procedures.\n\n**DoD Interpretation:**\n- Decisions must be explainable to affected parties and oversight bodies\n- Data sources and model development processes must be documented\n- AI reasoning must be auditable after the fact\n- Complete audit trails required for consequential decisions\n- Black-box systems in high-stakes contexts require compensating explainability controls\n\n**Federal/Defense Requirements:**\n- Model cards documenting training data, intended use, and known limitations\n- Explanation mechanisms for individual decisions (where technically feasible)\n- Complete audit logs with sufficient detail to reconstruct decision context\n- Data lineage documentation from source to prediction\n- NIST AI RMF alignment (GOVERN, MAP, MEASURE, IMPROVE functions)\n- FedRAMP and FISMA-compliant audit logging for federal systems\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Model card requirement | Assess requires completed model card before approval — training data, intended use, limitations, known biases |\n| Decision audit trail | All inference requests logged with: timestamp, inputs (hashed), outputs, model version, operator ID |\n| Explainability evaluation | Assess tests explanation quality using LIME/SHAP and scores explanation fidelity |\n| Data lineage | Policy Engine requires data provenance documentation for all training and evaluation sets |\n| Audit log retention | Logs retained per applicable NARA schedule (minimum 3 years for defense AI logs) |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-a2cd210b555a31a06759","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":111,"lineEnd":143,"originalCells":{"A":"### Principle 4: Reliable\n\n**Definition:** DoD's AI capabilities will have explicit, well-defined uses, and will be tested and assured for safety and security across their entire lifecycles. AI capabilities will be designed to fulfill their intended functions and to behave in a safe, secure, and reliable manner.\n\n**DoD Interpretation:**\n- AI systems must perform as specified in their intended operational environment\n- Testing must cover adversarial conditions, not just nominal performance\n- System behavior in edge cases and failure modes must be characterized\n- Continuous monitoring required to detect degradation\n- Fallback to human decision-making when AI confidence is insufficient\n\n**Federal/Defense Requirements:**\n- Operational testing and evaluation (OT&E) prior to fielding\n- Red team / adversarial testing for all defense AI systems\n- Defined reliability metrics with quantified performance thresholds\n- Continuous monitoring with defined alert thresholds\n- Graceful degradation requirements (fail-safe, not fail-open)\n- Software Bill of Materials (SBOM) for AI system components\n- Vulnerability disclosure programs for AI systems\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Performance testing | Assess evaluates accuracy, precision, recall, F1 on held-out test sets including adversarial examples |\n| Red team evaluation | Assess module: adversarial robustness battery (FGSM, PGD, black-box) |\n| Reliability thresholds | Policy Engine enforces configurable performance floor — blocks deployment below threshold |\n| Production monitoring | Probe monitors model accuracy, latency, error rates with configurable alert thresholds |\n| Graceful degradation | Policy Engine requires documented fallback procedures in deployment configuration |\n| SBOM compliance | Assess generates SBOM for all AI system components |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-74d779f1b1163f1cb431","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":144,"lineEnd":176,"originalCells":{"A":"### Principle 5: Governable\n\n**Definition:** DoD will design and engineer AI capabilities to fulfill their intended function while possessing the ability to detect and avoid unintended consequences, and the ability to disengage or deactivate deployed systems that demonstrate unintended behavior.\n\n**DoD Interpretation:**\n- All AI systems must be interruptible and correctable\n- Human override capability must be preserved at all times\n- Unintended behaviors must be detectable before causing harm\n- Systems must be designed to be turned off — no AI system should be unshuttable\n- Governance mechanisms must be built-in, not bolted-on\n\n**Federal/Defense Requirements:**\n- Documented shutdown procedures for all AI systems\n- Human override capability that cannot be defeated by the AI system\n- Real-time monitoring with automated alert routing\n- Defined escalation procedures for anomalous behavior\n- Regular governance reviews with authority to suspend operations\n- Integration with DoD AI Inventory and reporting requirements\n- Compliance with AI Principles Implementation Guidance (2020)\n\n**GOVERN Mapping:**\n\n| Control | Implementation |\n|---------|---------------|\n| Shutdown capability | Policy Engine requires documented and tested shutdown procedures in deployment config |\n| Override mechanism | Probe monitors override capability availability — alerts if override path degraded |\n| Anomaly detection | Probe provides real-time behavioral monitoring with automated alerting to designated personnel |\n| Escalation routing | Policy Engine configures escalation paths: alert → human review → system suspension |\n| Governance reviews | Assess generates periodic governance review packages with complete operational history |\n| DoD AI Inventory | GOVERN exports AI inventory records in DoD-required format |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-0be65c67e7ceeb2d8111","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":177,"lineEnd":193,"originalCells":{"A":"## DoD Directive 3000.09 — Autonomous Weapon Systems\n\n### Summary\nDoDD 3000.09 (November 2012, updated January 2023) governs autonomous and semi-autonomous weapon systems. It establishes that human judgment must be applied to decisions to use lethal force.\n\n### Key Requirements\n- Autonomous weapon systems require senior official approval before acquisition\n- Systems must have mechanisms for commanders to exercise \"appropriate levels of human judgment\"\n- Operators must be able to activate, deactivate, and supervise systems\n- Safety reviews required throughout development, testing, and fielding\n- Legal review required under Law of Armed Conflict (LOAC)\n\n### GOVERN Relevance for Defense AI\nWhile GOVERN is not deployed in weapons systems directly, AI systems operating in defense logistics, intelligence, surveillance, reconnaissance (ISR), and decision support contexts must comply with the human judgment and override requirements. GOVERN provides the oversight infrastructure — audit trails, override monitoring, and human-in-the-loop enforcement — required by 3000.09-adjacent systems.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-57c9214e7a432ef93b13","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":179,"lineEnd":181,"originalCells":{"A":"### Summary\nDoDD 3000.09 (November 2012, updated January 2023) governs autonomous and semi-autonomous weapon systems. It establishes that human judgment must be applied to decisions to use lethal force.\n"},"originalFormulas":{}},{"id":"ROW-MD-6b6a8d029b0b4fe33faf","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":182,"lineEnd":188,"originalCells":{"A":"### Key Requirements\n- Autonomous weapon systems require senior official approval before acquisition\n- Systems must have mechanisms for commanders to exercise \"appropriate levels of human judgment\"\n- Operators must be able to activate, deactivate, and supervise systems\n- Safety reviews required throughout development, testing, and fielding\n- Legal review required under Law of Armed Conflict (LOAC)\n"},"originalFormulas":{}},{"id":"ROW-MD-36cfd248adcedd03d762","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":189,"lineEnd":193,"originalCells":{"A":"### GOVERN Relevance for Defense AI\nWhile GOVERN is not deployed in weapons systems directly, AI systems operating in defense logistics, intelligence, surveillance, reconnaissance (ISR), and decision support contexts must comply with the human judgment and override requirements. GOVERN provides the oversight infrastructure — audit trails, override monitoring, and human-in-the-loop enforcement — required by 3000.09-adjacent systems.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-f95a97d64a91e7d3176c","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":194,"lineEnd":210,"originalCells":{"A":"## DoD AI Strategy (2023 Update)\n\n### Key Pillars\n1. Scale AI adoption across DoD to maintain competitive advantage\n2. Ensure responsible and ethical AI development and use\n3. Develop the workforce and infrastructure to support AI\n4. Collaborate with allies, partners, and industry\n\n### Governance Requirements for Defense Contractors\n- Align with DoD AI Ethics Principles in all AI systems delivered to DoD\n- Participate in Joint Artificial Intelligence Center (JAIC) governance frameworks\n- Comply with DoD Instruction 5000.90 (AI acquisition guidance)\n- Maintain AI system documentation sufficient for DoD audit requirements\n- Support DoD AI Inventory reporting\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-4cbdbf66492fb1b1dc23","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":196,"lineEnd":201,"originalCells":{"A":"### Key Pillars\n1. Scale AI adoption across DoD to maintain competitive advantage\n2. Ensure responsible and ethical AI development and use\n3. Develop the workforce and infrastructure to support AI\n4. Collaborate with allies, partners, and industry\n"},"originalFormulas":{}},{"id":"ROW-MD-aadd83ea0561ad4de11c","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":202,"lineEnd":210,"originalCells":{"A":"### Governance Requirements for Defense Contractors\n- Align with DoD AI Ethics Principles in all AI systems delivered to DoD\n- Participate in Joint Artificial Intelligence Center (JAIC) governance frameworks\n- Comply with DoD Instruction 5000.90 (AI acquisition guidance)\n- Maintain AI system documentation sufficient for DoD audit requirements\n- Support DoD AI Inventory reporting\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-cb3b927c956d5341f0fb","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":211,"lineEnd":263,"originalCells":{"A":"## GOVERN Compliance Report: DoD AI Ethics\n\n### Assessment Output\nGOVERN Assess produces a DoD AI Ethics Compliance Report covering all five principles:\n\n```\nDoD AI Ethics Compliance Assessment\n=====================================\nSystem: [System Name]\nAssessment Date: [Date]\nAssessor: GOVERN v[version]\n\nPRINCIPLE 1 — RESPONSIBLE\nAccountability Matrix: [COMPLETE / INCOMPLETE]\nOperator Training Documentation: [PRESENT / ABSENT]\nIncident Response Plan: [REVIEWED / NOT REVIEWED]\nHuman Oversight Mechanism: [DOCUMENTED / NOT DOCUMENTED]\nScore: [0-100]\n\nPRINCIPLE 2 — EQUITABLE\nDemographic Parity Ratio: [value] (threshold: ≥0.80)\nEqualized Odds Difference: [value] (threshold: ≤0.10)\nCalibration by Group: [PASS / FAIL]\nMitigation Plan: [PRESENT / ABSENT]\nScore: [0-100]\n\nPRINCIPLE 3 — TRACEABLE\nModel Card Completeness: [%]\nAudit Log Coverage: [%]\nExplainability Score: [0-100]\nData Lineage Documentation: [COMPLETE / INCOMPLETE]\nScore: [0-100]\n\nPRINCIPLE 4 — RELIABLE\nTest Set Accuracy: [value] vs threshold [value]\nAdversarial Robustness: [value]\nMonitoring Coverage: [%]\nFallback Procedure: [DOCUMENTED / NOT DOCUMENTED]\nScore: [0-100]\n\nPRINCIPLE 5 — GOVERNABLE\nShutdown Procedure: [DOCUMENTED/TESTED / DOCUMENTED ONLY / ABSENT]\nOverride Mechanism: [OPERATIONAL / DEGRADED / ABSENT]\nEscalation Path: [CONFIGURED / NOT CONFIGURED]\nGovernance Review Cadence: [CONFIGURED / NOT CONFIGURED]\nScore: [0-100]\n\nOVERALL COMPLIANCE SCORE: [0-100]\nDEPLOYMENT RECOMMENDATION: [APPROVE / CONDITIONAL / BLOCK]\n```\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-f17eae3c7d1ede552d5d","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":213,"lineEnd":263,"originalCells":{"A":"### Assessment Output\nGOVERN Assess produces a DoD AI Ethics Compliance Report covering all five principles:\n\n```\nDoD AI Ethics Compliance Assessment\n=====================================\nSystem: [System Name]\nAssessment Date: [Date]\nAssessor: GOVERN v[version]\n\nPRINCIPLE 1 — RESPONSIBLE\nAccountability Matrix: [COMPLETE / INCOMPLETE]\nOperator Training Documentation: [PRESENT / ABSENT]\nIncident Response Plan: [REVIEWED / NOT REVIEWED]\nHuman Oversight Mechanism: [DOCUMENTED / NOT DOCUMENTED]\nScore: [0-100]\n\nPRINCIPLE 2 — EQUITABLE\nDemographic Parity Ratio: [value] (threshold: ≥0.80)\nEqualized Odds Difference: [value] (threshold: ≤0.10)\nCalibration by Group: [PASS / FAIL]\nMitigation Plan: [PRESENT / ABSENT]\nScore: [0-100]\n\nPRINCIPLE 3 — TRACEABLE\nModel Card Completeness: [%]\nAudit Log Coverage: [%]\nExplainability Score: [0-100]\nData Lineage Documentation: [COMPLETE / INCOMPLETE]\nScore: [0-100]\n\nPRINCIPLE 4 — RELIABLE\nTest Set Accuracy: [value] vs threshold [value]\nAdversarial Robustness: [value]\nMonitoring Coverage: [%]\nFallback Procedure: [DOCUMENTED / NOT DOCUMENTED]\nScore: [0-100]\n\nPRINCIPLE 5 — GOVERNABLE\nShutdown Procedure: [DOCUMENTED/TESTED / DOCUMENTED ONLY / ABSENT]\nOverride Mechanism: [OPERATIONAL / DEGRADED / ABSENT]\nEscalation Path: [CONFIGURED / NOT CONFIGURED]\nGovernance Review Cadence: [CONFIGURED / NOT CONFIGURED]\nScore: [0-100]\n\nOVERALL COMPLIANCE SCORE: [0-100]\nDEPLOYMENT RECOMMENDATION: [APPROVE / CONDITIONAL / BLOCK]\n```\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-d079320ba6d07eb4c242","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","sheet":"POLICY(3).md","row":264,"lineEnd":272,"originalCells":{"A":"## References\n\n- DoD AI Ethics Principles (2020): https://www.defense.gov/News/Releases/Release/Article/2091996/\n- DoD Directive 3000.09 (2023): https://www.esd.whs.mil/Portals/54/Documents/DD/issuances/dodd/300009p.PDF\n- DoD AI Strategy (2023): https://www.defense.gov/Portals/1/Documents/DoD-AI-Strategy-2023.pdf\n- DoD Instruction 5000.90 (AI Acquisition): https://www.esd.whs.mil/\n- JAIC Responsible AI Guidelines: https://www.ai.mil/\n- NIST AI 100-1: AI Risk Management Framework\n- OMB M-24-10: Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence"},"originalFormulas":{}},{"id":"ROW-MD-8dee660e603fe31d011f","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":1,"lineEnd":10,"originalCells":{"A":"# Executive Order 14110 — Safe, Secure, and Trustworthy Artificial Intelligence\n\n**Full title:** Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence\n**Signed:** October 30, 2023\n**President:** Joseph R. Biden Jr.\n**Federal Register:** 88 FR 75191 (November 1, 2023)\n**Status:** Foundational US AI policy directive (note: successor administration actions may modify or revoke; consult current federal register)\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-bae4194b6c8316c8ea8e","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":11,"lineEnd":25,"originalCells":{"A":"## What It Is\n\nExecutive Order 14110 is the most comprehensive US government directive on artificial intelligence ever issued. It directs over two dozen federal agencies to take coordinated action across AI safety testing, security standards, privacy protection, civil rights, workers' rights, equity and civil liberties, consumer protections, international cooperation, and federal government AI use.\n\nThe Order does not create binding law for the private sector directly — it directs federal agencies to use their existing statutory authorities to address AI risks. However, its downstream effect is extensive: federal procurement requirements, sector-specific regulations, and state-level legislation are all shaped by EO 14110's priorities. Organizations serving federal customers, operating in regulated industries, or seeking to demonstrate AI governance maturity must understand and track EO 14110 and its implementing guidance.\n\n**Scope:** Applies directly to all federal executive branch agencies. Reaches the private sector through:\n- Federal procurement requirements\n- Agency rulemaking authority\n- Guidance to regulated industries\n- Standards development directions to NIST\n- Reporting requirements that affect AI providers\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-4e39ef29cc48148a66da","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":26,"lineEnd":48,"originalCells":{"A":"## OMB Memorandum M-24-10\n\n**Title:** Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence\n**Released:** March 28, 2024\n**Issuing office:** Office of Management and Budget (OMB)\n**Applicability:** All federal executive branch agencies\n\nM-24-10 is the primary implementing guidance for EO 14110's federal AI governance requirements. It establishes mandatory minimum practices for federal agencies using AI and creates the framework for Chief AI Officers, AI use case inventories, and risk management processes.\n\n**Key M-24-10 requirements:**\n\n1. **Designate a Chief AI Officer (CAIO)** — each agency must appoint a senior official with agency-wide responsibility for AI governance. Must be at or equivalent to senior executive service level. Must report to the agency head (or designee at senior leadership level). See CAIO section below.\n\n2. **Establish an AI Governance Board** — cross-functional body to coordinate AI governance. Must include CAIO, CIO, CISO, CDO, and legal counsel at minimum.\n\n3. **Complete an AI use case inventory** — agencies must catalog all current and planned AI use cases. See inventory section below.\n\n4. **Implement minimum risk management practices** — mandatory practices for rights-impacting and safety-impacting AI. See minimum practices section below.\n\n5. **Comply with annual reporting requirements** — agencies must submit annual AI use case inventory updates to OMB, with public versions published.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-bf43d7a0502830f7acd1","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":49,"lineEnd":65,"originalCells":{"A":"## Key Deadlines\n\n| Deadline | Requirement | Agency/Entity |\n|----------|------------|---------------|\n| **December 1, 2023** | NIST to publish AI Safety and Security guidelines | NIST |\n| **December 1, 2023** | Commerce to issue guidance on AI watermarking and content provenance | Commerce/NIST |\n| **January 2024** | Agencies to designate Chief AI Officers | All agencies (M-24-10 formalized March 2024) |\n| **March 28, 2024** | OMB M-24-10 issued — minimum practices effective | All agencies |\n| **June 2024** | First AI use case inventory updates due | All agencies |\n| **September 2024** | NIST AI RMF Playbook updates; sector-specific guidance | NIST + sector agencies |\n| **December 2024** | Agencies must have minimum risk management practices operational for rights-impacting AI | All agencies |\n| **Annual** | AI use case inventory public report (updated annually) | All agencies |\n| **Annual** | CAIO report to OMB on agency AI governance status | All agencies |\n| **Annual** | Agency self-assessment against AI governance standards | All agencies |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-ea027ca613759d5a889e","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":66,"lineEnd":102,"originalCells":{"A":"## Chief AI Officer (CAIO) Requirement\n\n**Source:** Section 10.1 of EO 14110; M-24-10 Section 3\n\n**Designation requirement:**\nEach federal agency with significant AI use must designate a CAIO within 60 days of M-24-10 issuance (i.e., by late May 2024). The CAIO must:\n- Be at or equivalent to the Senior Executive Service level\n- Report directly to agency head or a senior official designated by the agency head\n- Have agency-wide visibility and authority over AI activities\n\n**CAIO responsibilities:**\n1. Coordinate agency AI governance, innovation, and risk management activities\n2. Promote AI innovation to advance agency mission\n3. Oversee the AI governance board\n4. Maintain the AI use case inventory\n5. Conduct and maintain AI risk assessments\n6. Ensure AI systems meet minimum risk management requirements before deployment\n7. Oversee implementation of civil rights, civil liberties, and privacy protections in AI\n8. Ensure appropriate human oversight of AI\n9. Coordinate with CIO, CISO, CDO, and legal counsel on AI matters\n10. Report annually to OMB on agency AI governance status\n\n**CAIO accountability:**\nThe CAIO is accountable for agency compliance with M-24-10 requirements. The CAIO may not delegate the determination that an AI system meets minimum risk management practices — this approval must come from the CAIO or their direct designee.\n\n**Interaction with existing roles:**\nThe CAIO role is distinct from but coordinates with:\n- CIO (information technology infrastructure)\n- CISO (cybersecurity)\n- CDO (data governance)\n- Privacy Officer (Privacy Act compliance)\n- Civil Rights Officer (Title VI, EEO)\n\n**GOVERN mapping:** GOVERN Compliance Portal includes a CAIO Dashboard — purpose-built for the Chief AI Officer role. Provides agency-wide view of AI inventory, risk status, minimum practices compliance, and annual reporting data. CAIO can approve or reject AI deployment requests directly in GOVERN.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-759a4ee7310c1e323643","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":103,"lineEnd":148,"originalCells":{"A":"## AI Use Case Inventory\n\n**Source:** Section 10.1(c) of EO 14110; M-24-10 Section 5; OMB M-21-06 (predecessor inventory requirement)\n\n**What must be inventoried:**\nAll AI use cases that the agency:\n- Currently uses\n- Is actively developing or procuring\n- Plans to use within the next year\n\nFor each AI use case, the inventory must include:\n- **Name and description** of the AI use case\n- **AI type** (e.g., machine learning, natural language processing, computer vision)\n- **Stage** (planning, acquisition, implementation, operation)\n- **Topic area/agency function** (e.g., mission delivery, benefits determination, law enforcement)\n- **Benefits** of the AI use case\n- **Intended output** (what decision, prediction, or action the AI influences)\n- **Rights/safety impact determination** (see definitions below)\n- **Stage of maturity** (how developed is the system)\n- **Whether the use case has been exempted from minimum practices** (and the basis)\n- **Contracted or vendor AI** vs. internally developed\n- **Point of contact**\n\n**Public disclosure requirement:**\nAgencies must publish a public version of their AI use case inventory annually. The public version must include all non-sensitive use cases. Agencies may exclude use cases involving:\n- Classified national security systems\n- Systems with law enforcement sensitivity\n- Systems with operational security concerns\n\nAs of 2024-2026, all major federal agencies have published AI use case inventories on ai.gov/inventory.\n\n**How GOVERN Automates the AI Use Case Inventory:**\n\nGOVERN Energy discovers AI systems agency-wide — including shadow AI that was never formally registered. For each discovered system, GOVERN:\n1. Creates a use case record with auto-populated fields from system metadata\n2. Classifies the use case by agency function/topic area using ML classification\n3. Runs the rights-impact and safety-impact determination tests automatically\n4. Assigns the use case to the appropriate owner for review and approval\n5. Tracks approval status through the CAIO review workflow\n6. Generates the public inventory export in OMB-required format\n7. Generates the internal inventory with full detail for OMB submission\n\nThe GOVERN Inventory Module is the single source of truth. It integrates with agency financial systems (to detect AI-related procurement), IT asset management systems (to detect AI software installations), and cloud management platforms (to detect AI API usage).\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-1026c0dac14f4fbcede6","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":149,"lineEnd":179,"originalCells":{"A":"## Rights-Impacting AI — Definition and Requirements\n\n**Source:** M-24-10 Section 5(a)\n\n**Definition:**\nAI use cases are \"rights-impacting\" when they are used to:\n- Make or substantially influence consequential decisions about individuals\n- Including decisions regarding: civil rights, civil liberties, equal opportunity, access to credit, housing, insurance, education, employment or employment opportunities, healthcare, disability benefits, access to social services or benefits, immigration/visa status, or freedom from unlawful discrimination\n\nRights-impacting AI requires the highest level of scrutiny because errors or bias can cause legally cognizable harm and may violate constitutional or statutory protections.\n\n**Minimum risk management practices for rights-impacting AI:**\n\n1. **Pre-deployment testing:** Independent evaluation for effectiveness and bias before deployment. Must include testing on demographic groups that may be affected.\n\n2. **Ongoing monitoring:** Continuous monitoring for disparate impact, performance degradation, and unintended outcomes. Must include demographic breakdown of outcomes where data available.\n\n3. **Meaningful human consideration:** Consequential decisions must include meaningful human consideration of AI output. AI cannot be the sole decision-maker for rights-impacting decisions. Human reviewers must have the ability to overturn AI recommendations.\n\n4. **Mechanism to appeal or seek human review:** Affected individuals must have a clear pathway to seek human review of AI-assisted decisions affecting them.\n\n5. **Notification requirement:** Agencies must inform the public when AI is being used to make or substantially influence a decision affecting them. Notification must include: what AI is being used, what decision it influences, and how to seek human review.\n\n6. **Fallback procedures:** Agencies must have documented fallback procedures for when the AI system is unavailable or produces outputs with insufficient confidence.\n\n7. **Documentation requirement:** Complete documentation of the rights-impacting AI system including training data, model design, intended use, prohibited uses, known limitations, and demographic performance data.\n\n**GOVERN mapping:** GOVERN Policy Engine automatically classifies AI use cases as rights-impacting based on intended output and decision type. Rights-impacting systems get a mandatory enhanced compliance workflow that enforces all seven minimum practices before CAIO approval.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-5e482db267aa00685dc6","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":180,"lineEnd":212,"originalCells":{"A":"## Safety-Impacting AI — Definition and Requirements\n\n**Source:** M-24-10 Section 5(b)\n\n**Definition:**\nAI use cases are \"safety-impacting\" when they are used in contexts where errors could threaten:\n- Human life or safety\n- Critical infrastructure\n- Safety of the workforce\n- Safety of the public\n\nExamples include: AI systems controlling physical infrastructure, AI systems informing medical treatment decisions, AI systems used in transportation safety, AI systems informing emergency response, AI systems controlling weapons systems.\n\n**Minimum risk management practices for safety-impacting AI:**\n\n1. **Pre-deployment risk assessment:** Formal risk assessment before deployment identifying potential failure modes and their consequences.\n\n2. **Testing under realistic conditions:** Testing must include adversarial inputs, out-of-distribution data, and edge cases relevant to the safety domain.\n\n3. **Fail-safe design:** Safety-impacting AI systems must have documented fail-safe behaviors — what the system does when uncertain or in failure mode.\n\n4. **Human override capability:** Operators must have the technical capability to override, shut down, or correct the AI system at all times.\n\n5. **Incident reporting:** Agencies must have procedures to detect, report, and respond to safety incidents involving AI systems.\n\n6. **Post-incident review:** After any safety incident, a formal review must be conducted and findings incorporated into risk management.\n\n7. **Monitoring for performance degradation:** Continuous monitoring for accuracy degradation, distribution shift, or unexpected behavior that could affect safety.\n\n**GOVERN mapping:** GOVERN Risk Engine runs the safety-impact test for all registered AI systems. Safety-impacting systems get mandatory fail-safe documentation, override capability verification, and incident response plan before CAIO approval.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-82a2d2f95d958f91005d","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":213,"lineEnd":242,"originalCells":{"A":"## Minimum Risk Management Practices — Full Framework\n\n**Source:** M-24-10 Section 5\n\nBeyond rights-impacting and safety-impacting categories, M-24-10 establishes minimum risk management practices for ALL federal AI use cases:\n\n**For all AI use cases:**\n1. Ensure the AI use case has an identified owner accountable for its governance\n2. Conduct a use case-specific risk assessment before deployment\n3. Maintain documentation sufficient to understand the system's capabilities, limitations, and intended use\n4. Establish monitoring procedures appropriate to the risk level\n5. Have a documented process for handling complaints or concerns about AI system behavior\n6. Ensure compliance with applicable privacy laws (Privacy Act, Section 208 of E-Government Act)\n7. Ensure compliance with applicable civil rights and civil liberties laws\n\n**For rights-impacting AI:** All above plus seven minimum practices listed above.\n\n**For safety-impacting AI:** All above plus seven minimum practices listed above.\n\n**Exemptions:**\nAgencies may exempt specific AI use cases from minimum practices if:\n- The CAIO certifies that minimum practices are technically infeasible\n- The CAIO certifies that benefits of deployment outweigh risks after risk mitigation\n- The exemption is documented and reported to OMB\n- The exemption is reviewed annually\n\nThe number of exemptions must be reported publicly. Exemptions may not be granted for prohibited AI practices.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-1ff6a5447554dfe26434","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":243,"lineEnd":373,"originalCells":{"A":"## Section-by-Section Breakdown of Federal Agency Obligations\n\n### Section 4 — Ensuring the Safety and Security of AI\n\n**Section 4.1 — Developing guidelines, standards, and best practices for AI safety:**\n- NIST to develop AI Safety and Security Guidelines with interagency coordination\n- Guidelines cover: methods to evaluate AI capabilities and identify potential risks; guidance to address potential harms from AI\n- Commerce to develop AI watermarking guidance for synthetic content authentication\n- NSF to fund research on AI safety and interpretability\n\n**Section 4.2 — Ensuring safe and reliable AI:**\n- AI systems used in national security contexts must meet security standards\n- Agencies must assess risks of AI systems before procurement\n- AI in critical infrastructure subject to sector-specific safety requirements\n\n**Section 4.3 — Managing risks from CBRN (chemical, biological, radiological, nuclear) AI capabilities:**\n- NIST to develop guidance on AI systems capable of assisting with CBRN weapons development\n- Agencies to assess risks of AI models with potential dual-use capabilities\n- Reporting requirements for frontier AI model development by US companies\n\n**Section 4.4 — Reducing risks posed by synthetic content:**\n- Commerce to develop authentication standards for AI-generated content\n- Federal agencies to use AI content authentication tools\n- NIST to lead development of provenance standards\n\n**Section 4.5 — Soliciting input on dual-use foundation models:**\n- Commerce to develop reporting requirements for developers of foundation models with potential dual-use capabilities\n- Agencies to assess security implications of open-source AI releases\n\n---\n\n### Section 5 — Promoting Innovation and Competition\n\n**Section 5.1 — Attracting AI talent to the US:**\n- State Department and DHS to streamline visa processes for AI experts\n- DOL to provide resources for AI professionals\n\n**Section 5.2 — Promoting innovation:**\n- NSF and DARPA to fund AI research, particularly in areas with public interest applications\n- Agencies to make AI-relevant government data available for research\n\n**Section 5.3 — Ensuring a fair, open, and competitive AI ecosystem:**\n- DOJ and FTC to enforce competition laws in AI markets\n- Agencies to assess AI-related competition concerns in sector-specific enforcement\n\n---\n\n### Section 6 — Supporting Workers\n\n- DOL to develop guidance on AI in the workplace\n- Agencies to assess impacts of AI on workforce including job displacement\n- NLRB, EEOC, and DOL to enforce existing laws as applied to AI-mediated employment practices\n- Federal agencies must consider worker impacts before deploying AI that may affect their own workforce\n\n---\n\n### Section 7 — Advancing Equity and Civil Rights\n\n- Agencies to assess how AI may exacerbate discrimination\n- DOJ and agencies with civil rights enforcement authority to use existing law to address AI-enabled discrimination\n- Federal agencies must test AI for bias before deployment in contexts affecting protected characteristics\n- Clear guidance on how existing civil rights laws apply to AI-assisted decisions in credit, housing, employment, education, healthcare\n\n---\n\n### Section 8 — Protecting Consumers, Patients, Passengers, and Students\n\n**Section 8.1 — Healthcare:**\n- HHS to establish framework for AI in healthcare including standards for clinical decision support\n- FDA to regulate AI-enabled medical devices under existing device framework\n- CMS to address AI in Medicare and Medicaid payment and coverage decisions\n\n**Section 8.2 — Financial services:**\n- Treasury, CFPB, and financial regulators to assess AI risks in financial services\n- Guidance on fair lending obligations as applied to AI underwriting\n\n**Section 8.3 — Education:**\n- Department of Education to develop guidance on AI in education\n- Address risks of bias, privacy, and surveillance in educational AI\n\n**Section 8.4 — Transportation:**\n- DOT to develop framework for AI in transportation safety\n- Sector-specific guidance for aviation, highway, rail, and maritime AI\n\n---\n\n### Section 9 — Protecting Privacy\n\n- Agencies to assess privacy risks of AI systems before deployment\n- Privacy-preserving AI techniques required where feasible\n- Enhanced protections for sensitive categories of personal data\n- Commerce to issue AI and privacy framework\n- FTC to continue enforcement of existing privacy laws as applied to AI\n\n---\n\n### Section 10 — Advancing Federal Government Use of AI\n\n**Section 10.1 — Agencies to:**\n- Designate Chief AI Officers\n- Maintain AI use case inventories\n- Implement minimum risk management practices\n- Report annually on AI governance\n\n**Section 10.2 — OMB to:**\n- Issue guidance on AI governance (→ M-24-10)\n- Coordinate federal AI governance\n- Issue guidance on AI procurement\n- Coordinate AI workforce development\n\n**Section 10.3 — NIST to:**\n- Develop AI Risk Management Framework playbooks\n- Coordinate AI standards development\n- Establish AI Safety Institute\n\n**Section 10.4 — AI talent and workforce:**\n- Agencies to assess AI skills gaps\n- OPM to develop AI-relevant job classifications\n- Federal AI hiring surge initiatives\n\n---\n\n### Section 11 — Advancing American Leadership Abroad\n\n- State Department to engage internationally on AI governance\n- USTR to advance US positions in international AI trade and standards\n- NIST to participate in ISO, ITU, and other international standards bodies\n- Allies coordination on AI safety standards\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-d4c3a4ca94baff0ec85e","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":245,"lineEnd":273,"originalCells":{"A":"### Section 4 — Ensuring the Safety and Security of AI\n\n**Section 4.1 — Developing guidelines, standards, and best practices for AI safety:**\n- NIST to develop AI Safety and Security Guidelines with interagency coordination\n- Guidelines cover: methods to evaluate AI capabilities and identify potential risks; guidance to address potential harms from AI\n- Commerce to develop AI watermarking guidance for synthetic content authentication\n- NSF to fund research on AI safety and interpretability\n\n**Section 4.2 — Ensuring safe and reliable AI:**\n- AI systems used in national security contexts must meet security standards\n- Agencies must assess risks of AI systems before procurement\n- AI in critical infrastructure subject to sector-specific safety requirements\n\n**Section 4.3 — Managing risks from CBRN (chemical, biological, radiological, nuclear) AI capabilities:**\n- NIST to develop guidance on AI systems capable of assisting with CBRN weapons development\n- Agencies to assess risks of AI models with potential dual-use capabilities\n- Reporting requirements for frontier AI model development by US companies\n\n**Section 4.4 — Reducing risks posed by synthetic content:**\n- Commerce to develop authentication standards for AI-generated content\n- Federal agencies to use AI content authentication tools\n- NIST to lead development of provenance standards\n\n**Section 4.5 — Soliciting input on dual-use foundation models:**\n- Commerce to develop reporting requirements for developers of foundation models with potential dual-use capabilities\n- Agencies to assess security implications of open-source AI releases\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-d77441ce2100fcbeda6c","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":274,"lineEnd":289,"originalCells":{"A":"### Section 5 — Promoting Innovation and Competition\n\n**Section 5.1 — Attracting AI talent to the US:**\n- State Department and DHS to streamline visa processes for AI experts\n- DOL to provide resources for AI professionals\n\n**Section 5.2 — Promoting innovation:**\n- NSF and DARPA to fund AI research, particularly in areas with public interest applications\n- Agencies to make AI-relevant government data available for research\n\n**Section 5.3 — Ensuring a fair, open, and competitive AI ecosystem:**\n- DOJ and FTC to enforce competition laws in AI markets\n- Agencies to assess AI-related competition concerns in sector-specific enforcement\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-36e56864a7348e2e369b","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":290,"lineEnd":298,"originalCells":{"A":"### Section 6 — Supporting Workers\n\n- DOL to develop guidance on AI in the workplace\n- Agencies to assess impacts of AI on workforce including job displacement\n- NLRB, EEOC, and DOL to enforce existing laws as applied to AI-mediated employment practices\n- Federal agencies must consider worker impacts before deploying AI that may affect their own workforce\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-9b0befbf16ce87cbcd56","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":299,"lineEnd":307,"originalCells":{"A":"### Section 7 — Advancing Equity and Civil Rights\n\n- Agencies to assess how AI may exacerbate discrimination\n- DOJ and agencies with civil rights enforcement authority to use existing law to address AI-enabled discrimination\n- Federal agencies must test AI for bias before deployment in contexts affecting protected characteristics\n- Clear guidance on how existing civil rights laws apply to AI-assisted decisions in credit, housing, employment, education, healthcare\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-b3bd796f61c2c3863a5f","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":308,"lineEnd":328,"originalCells":{"A":"### Section 8 — Protecting Consumers, Patients, Passengers, and Students\n\n**Section 8.1 — Healthcare:**\n- HHS to establish framework for AI in healthcare including standards for clinical decision support\n- FDA to regulate AI-enabled medical devices under existing device framework\n- CMS to address AI in Medicare and Medicaid payment and coverage decisions\n\n**Section 8.2 — Financial services:**\n- Treasury, CFPB, and financial regulators to assess AI risks in financial services\n- Guidance on fair lending obligations as applied to AI underwriting\n\n**Section 8.3 — Education:**\n- Department of Education to develop guidance on AI in education\n- Address risks of bias, privacy, and surveillance in educational AI\n\n**Section 8.4 — Transportation:**\n- DOT to develop framework for AI in transportation safety\n- Sector-specific guidance for aviation, highway, rail, and maritime AI\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-90022cccac51b64d2ddc","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":329,"lineEnd":338,"originalCells":{"A":"### Section 9 — Protecting Privacy\n\n- Agencies to assess privacy risks of AI systems before deployment\n- Privacy-preserving AI techniques required where feasible\n- Enhanced protections for sensitive categories of personal data\n- Commerce to issue AI and privacy framework\n- FTC to continue enforcement of existing privacy laws as applied to AI\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-b027949cf22a26bc6310","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":339,"lineEnd":364,"originalCells":{"A":"### Section 10 — Advancing Federal Government Use of AI\n\n**Section 10.1 — Agencies to:**\n- Designate Chief AI Officers\n- Maintain AI use case inventories\n- Implement minimum risk management practices\n- Report annually on AI governance\n\n**Section 10.2 — OMB to:**\n- Issue guidance on AI governance (→ M-24-10)\n- Coordinate federal AI governance\n- Issue guidance on AI procurement\n- Coordinate AI workforce development\n\n**Section 10.3 — NIST to:**\n- Develop AI Risk Management Framework playbooks\n- Coordinate AI standards development\n- Establish AI Safety Institute\n\n**Section 10.4 — AI talent and workforce:**\n- Agencies to assess AI skills gaps\n- OPM to develop AI-relevant job classifications\n- Federal AI hiring surge initiatives\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-62e98b39d1c8e908bd75","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":365,"lineEnd":373,"originalCells":{"A":"### Section 11 — Advancing American Leadership Abroad\n\n- State Department to engage internationally on AI governance\n- USTR to advance US positions in international AI trade and standards\n- NIST to participate in ISO, ITU, and other international standards bodies\n- Allies coordination on AI safety standards\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-8836487556b02ce7a2a2","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":374,"lineEnd":416,"originalCells":{"A":"## AI Inventory Report: How GOVERN Energy and Compliance Portal Generate This\n\n**The problem:** Federal agencies have AI in unexpected places — embedded in legacy software, in vendor SaaS tools, in experiments that became production systems, in contractor-operated systems. Manual inventories miss most of this.\n\n**GOVERN Energy — Discovery Phase:**\n\nGOVERN Energy continuously scans for AI activity across the agency's digital environment:\n\n1. **Network traffic analysis:** Identifies API calls to known AI model providers (OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, Google Vertex AI, Cohere, Meta AI APIs)\n\n2. **SaaS application detection:** Cross-references installed applications and active SaaS subscriptions against the GOVERN AI application database (covering 500+ AI-enabled SaaS applications)\n\n3. **Procurement record integration:** Parses agency purchase orders and contracts for AI-related keywords, vendor names, and NAICS codes associated with AI\n\n4. **IT asset management integration:** Scans CMDB/ITSM systems for AI-related software installations, licenses, and infrastructure provisioning\n\n5. **Cloud resource tagging:** Reviews cloud resource inventories for AI/ML-tagged services, GPU instances, and ML platform deployments\n\n6. **Agency self-report integration:** Provides intake form for system owners to self-register AI systems not discovered automatically\n\n**GOVERN Compliance Portal — Inventory Generation Phase:**\n\nFor each discovered or registered AI system, GOVERN:\n1. Creates a draft inventory record with auto-populated fields\n2. Routes to system owner for review and classification\n3. Runs automated rights-impact and safety-impact tests\n4. Routes rights-impacting/safety-impacting systems to CAIO review workflow\n5. Maintains version history and change tracking for all inventory records\n6. Generates public inventory export in OMB-required CSV/JSON format\n7. Generates internal inventory with full detail (including sensitive fields not in public version)\n8. Flags systems nearing review deadlines\n9. Tracks minimum practices implementation status for each use case\n10. Generates annual compliance report for OMB submission\n\n**Inventory report outputs:**\n\n- **Public annual report:** CSV/JSON export meeting OMB format requirements. Excludes sensitive/classified use cases. Published to ai.gov/inventory.\n- **Internal full report:** Complete inventory with all fields including sensitive exclusions, risk assessments, and minimum practices status.\n- **CAIO dashboard:** Real-time view of inventory completeness, risk distribution, minimum practices compliance rate, and approval queue.\n- **OMB submission package:** Pre-formatted report meeting all M-24-10 reporting requirements.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-855246a283fca38d621f","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":417,"lineEnd":438,"originalCells":{"A":"## OMB Enforcement Mechanisms\n\n**Direct enforcement authority:** OMB does not have direct enforcement authority over agency program activities — but it controls the budget and policy compliance processes that give it enormous indirect leverage.\n\n**Budget review:** OMB reviews all agency budget requests. Agencies with poor AI governance track records can face increased scrutiny in budget negotiations.\n\n**Management agenda:** OMB's President's Management Agenda (PMA) sets governmentwide priorities. AI governance compliance is a PMA item, tracked and reported at agency level.\n\n**Annual performance reviews:** OMB and OMB-adjacent oversight processes (including the President's Management Council) review agency management practices annually. AI governance is a tracked management objective.\n\n**OMB MAX/reporting systems:** Agencies must submit AI governance status updates through OMB management reporting systems. Non-submission is flagged and escalated.\n\n**Congressional reporting:** OMB reports to Congress on governmentwide AI governance progress. Agencies with notable deficiencies may face congressional scrutiny.\n\n**Inspector General referrals:** Agency Inspectors General have independent authority to audit AI governance compliance and make findings and recommendations. IG findings on AI governance can trigger agency corrective action requirements.\n\n**Federal CIO Council coordination:** The Federal CIO Council (chaired by Federal CIO, part of OMB) coordinates IT and AI governance across agencies. CIO Council peer reviews can surface AI governance deficiencies.\n\n**GAO oversight:** The Government Accountability Office conducts ongoing reviews of federal AI governance. GAO recommendations carry significant weight with Congress and OMB.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-93c4e5b7ee857647a7cf","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":439,"lineEnd":463,"originalCells":{"A":"## GOVERN Automation of EO 14110 Compliance\n\n| EO 14110 / M-24-10 Requirement | GOVERN Component | Automation Level |\n|---------------------------------|-----------------|-----------------|\n| CAIO designation and reporting | GOVERN Compliance Portal | CAIO dashboard, annual report generation |\n| AI use case inventory — discovery | GOVERN Energy | Automated discovery of 90%+ of AI systems |\n| AI use case inventory — classification | GOVERN Assess | Automated rights/safety impact classification |\n| AI use case inventory — public export | GOVERN Compliance Portal | One-click OMB-format export |\n| Minimum risk management — all AI | GOVERN Risk Engine | Pre-deployment checklist enforcement |\n| Minimum risk management — rights-impacting | GOVERN Policy Engine | Enhanced workflow with all 7 minimum practices |\n| Minimum risk management — safety-impacting | GOVERN Risk Engine | Fail-safe documentation, override verification |\n| Human oversight — rights-impacting | GOVERN Human Oversight | Override capability verification, HOO assignment |\n| Notification requirement — affected individuals | GOVERN Compliance Portal | Notification language generation, record keeping |\n| Appeal/human review mechanism | GOVERN Human Oversight | Appeal pathway documentation per system |\n| Ongoing monitoring | GOVERN Performance Dashboard | Automated drift detection, disparate impact monitoring |\n| Incident detection and reporting | GOVERN Incident Module | AI-specific incident detection, reporting workflows |\n| Annual OMB reporting | GOVERN Compliance Portal | Pre-populated annual report, OMB submission package |\n| Privacy impact assessment | GOVERN Impact Assessment | PIA generation for AI systems with personal data |\n| Procurement review | GOVERN Vendor AI | Vendor AI system registration, minimum practices attestation |\n| CAIO exemption workflow | GOVERN Compliance Portal | Exemption request, approval, documentation, annual review |\n| Civil rights impact assessment | GOVERN Impact Assessment | Demographic impact analysis, disparate impact testing |\n| Documentation requirement | GOVERN Compliance Portal | System card generation with all required fields |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-dd2a002318acbbd7573b","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":464,"lineEnd":477,"originalCells":{"A":"## Interaction with Other US AI Policies\n\n| Policy | Relationship to EO 14110 |\n|--------|-------------------------|\n| NIST AI Risk Management Framework (2023) | EO 14110 directed NIST to develop the AI RMF. M-24-10 directs agencies to use NIST AI RMF as foundation for minimum risk management practices. |\n| Executive Order 13960 (2020) | Predecessor to EO 14110. Established initial AI use case inventory requirement. M-24-10 updates and supersedes M-21-06 guidance under EO 13960. |\n| AI Act (Senate) | Federal legislative companion. Not yet enacted as of early 2026. Would codify many EO 14110 requirements. |\n| NDAA AI provisions | Annual defense authorization bills contain AI-specific requirements for national security AI. Interact with EO 14110 for military AI governance. |\n| Privacy Act / E-Government Act | EO 14110 directs agencies to apply Privacy Act and Section 208 requirements to AI systems collecting or using personal data. |\n| Federal Acquisition Regulation (FAR) | OMB issued proposed FAR rule on AI in government procurement. Would codify minimum practices as procurement requirements for AI vendors. |\n| State AI laws | EO 14110 shapes state AI legislation. California, Colorado, and other states reference federal AI governance framework in state rulemaking. |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-2886a364dead41e77b00","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","sheet":"POLICY(4).md","row":478,"lineEnd":490,"originalCells":{"A":"## Key Definitions from EO 14110 and M-24-10\n\n| Term | Definition |\n|------|-----------|\n| **Artificial Intelligence** | A machine-based system that can, for a given set of objectives, make predictions, recommendations, or decisions influencing real or virtual environments. AI systems use machine and human-based inputs to (a) perceive real and virtual environments; (b) abstract such perceptions into models through analysis in an automated manner; and (c) use model inference to formulate options for information or action |\n| **Rights-impacting AI** | AI whose output is used to make or substantially influence a consequential decision directly affecting individuals' civil rights, civil liberties, equal opportunity, or access to critical resources or services |\n| **Safety-impacting AI** | AI whose output is used to make or substantially influence a consequential decision that has a significant impact on the safety of human life, the safety of critical infrastructure, or workplace safety |\n| **Consequential decision** | A decision or action that has a legal, material, or similarly significant effect on an individual's life |\n| **Chief AI Officer** | A senior official designated by an agency head to be responsible for coordinating the agency's use of AI and the establishment and implementation of agency-wide AI governance policies, standards, and procedures |\n| **AI use case inventory** | A comprehensive catalog of an agency's current and planned AI systems and uses, maintained and updated at regular intervals |\n| **Minimum risk management practices** | Baseline requirements that must be met before an agency may deploy an AI system, scaled to the risk level of the use case |\n| **Foundation model** | An AI model that is trained on broad data at scale and is adaptable to a wide range of downstream tasks |\n| **Dual-use foundation model** | An AI model that is trained on broad data, is self-supervised, has at least tens of billions of parameters, and that presents serious risks to national security, national economic security, or national public health or safety |"},"originalFormulas":{}},{"id":"ROW-MD-7abd597fee234362d6e5","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":1,"lineEnd":10,"originalCells":{"A":"# EU AI Act — European Union Artificial Intelligence Act\n\n**Regulation (EU) 2024/1689 of the European Parliament and of the Council**\n**Entered into force: August 1, 2024**\n**Primary enforcement body: National Competent Authorities + AI Office (European Commission)**\n\n---\n\n## What It Is\n"},"originalFormulas":{}},{"id":"ROW-MD-4d426d9fa861ef1fe81c","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":9,"lineEnd":18,"originalCells":{"A":"## What It Is\n\nThe EU AI Act is the world's first comprehensive, binding legal framework for artificial intelligence. It establishes a horizontal, risk-based regulatory regime applicable to AI systems placed on the EU market or put into service in the EU — regardless of where the developer or deployer is located. It creates a product-safety-style compliance architecture for AI, requiring conformity assessments, registration, technical documentation, and ongoing monitoring obligations that scale with risk.\n\nThe Act is structured around four risk tiers, mandatory requirements for high-risk AI systems, prohibitions on unacceptable uses, transparency rules for limited-risk systems, and governance obligations for general-purpose AI (GPAI) models including large language models.\n\nThe AI Office, established within the European Commission, has direct supervisory authority over GPAI model providers. National Competent Authorities (NCAs) designated by each Member State supervise all other AI providers and deployers.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-4c09eb6231fa7f0538f0","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":19,"lineEnd":32,"originalCells":{"A":"## Enforcement Timeline\n\n| Date | Milestone |\n|------|-----------|\n| **August 1, 2024** | Regulation enters into force |\n| **February 2, 2025** | Prohibited AI practices provisions apply (Chapter II) |\n| **February 2, 2025** | AI literacy obligations for providers and deployers begin |\n| **August 2, 2025** | GPAI model obligations apply (Chapter V); AI Office operational; codes of practice must be finalized |\n| **August 2, 2026** | Full application — all high-risk AI obligations, conformity assessments, notified body accreditation, national market surveillance |\n| **August 2, 2027** | High-risk AI systems already on market before August 2026 must comply (transitional period for legacy systems) |\n| **August 2, 2030** | AI systems embedded in regulated products (Annex I) already on market must comply |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-2a0df1a6421946adb3ac","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":33,"lineEnd":81,"originalCells":{"A":"## Risk Classification System\n\n### Tier 1 — Unacceptable Risk (Prohibited)\nArticle 5 prohibits AI systems that pose unacceptable risks to fundamental rights, safety, and EU values. These cannot be placed on the market or put into service under any circumstances.\n\n**Prohibited practices include:**\n- Subliminal manipulation techniques that harm persons\n- Exploitation of vulnerabilities of specific groups (age, disability, socioeconomic situation)\n- Social scoring by public authorities that causes detrimental or unfavorable treatment\n- Real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions for terrorism, imminent threats, targeted searches for serious crime suspects)\n- Retroactive remote biometric identification (post-event) without judicial authorization\n- Emotion recognition in workplace and educational settings (with exceptions for safety)\n- Biometric categorization by sensitive characteristics (race, religion, political views, sexual orientation) inferred from biometric data\n- AI systems used to build or expand facial recognition databases through untargeted scraping\n\n**GOVERN relevance:** Policy Engine flags any AI use case matching Annex V prohibited patterns as a critical block. Auto-fails any deployment pipeline touching these categories.\n\n---\n\n### Tier 2 — High-Risk AI\nDefined in Article 6 and Annex III. Subject to mandatory conformity assessment, CE marking, technical documentation, and registration in the EU AI database.\n\n**Two categories of high-risk:**\n1. AI systems that are safety components of regulated products (Annex I products — machinery, medical devices, aviation, automotive, etc.) or are themselves regulated products\n2. AI systems listed in Annex III (see detailed list below)\n\n---\n\n### Tier 3 — Limited Risk\nAI systems subject to transparency obligations only (Article 52). Must disclose AI nature to users.\n\n**Examples:**\n- Chatbots\n- AI-generated synthetic media (deepfakes)\n- Emotion recognition systems\n- Biometric categorization systems not in high-risk category\n\n---\n\n### Tier 4 — Minimal/No Risk\nAll other AI systems. No mandatory obligations under the Act. Voluntary codes of conduct encouraged.\n\n**Examples:**\n- Spam filters\n- AI-enabled video games\n- AI inventory optimization tools\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-0c5458e39440b66d4ce6","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":35,"lineEnd":51,"originalCells":{"A":"### Tier 1 — Unacceptable Risk (Prohibited)\nArticle 5 prohibits AI systems that pose unacceptable risks to fundamental rights, safety, and EU values. These cannot be placed on the market or put into service under any circumstances.\n\n**Prohibited practices include:**\n- Subliminal manipulation techniques that harm persons\n- Exploitation of vulnerabilities of specific groups (age, disability, socioeconomic situation)\n- Social scoring by public authorities that causes detrimental or unfavorable treatment\n- Real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions for terrorism, imminent threats, targeted searches for serious crime suspects)\n- Retroactive remote biometric identification (post-event) without judicial authorization\n- Emotion recognition in workplace and educational settings (with exceptions for safety)\n- Biometric categorization by sensitive characteristics (race, religion, political views, sexual orientation) inferred from biometric data\n- AI systems used to build or expand facial recognition databases through untargeted scraping\n\n**GOVERN relevance:** Policy Engine flags any AI use case matching Annex V prohibited patterns as a critical block. Auto-fails any deployment pipeline touching these categories.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-bf667721c9bc5d880a79","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":52,"lineEnd":60,"originalCells":{"A":"### Tier 2 — High-Risk AI\nDefined in Article 6 and Annex III. Subject to mandatory conformity assessment, CE marking, technical documentation, and registration in the EU AI database.\n\n**Two categories of high-risk:**\n1. AI systems that are safety components of regulated products (Annex I products — machinery, medical devices, aviation, automotive, etc.) or are themselves regulated products\n2. AI systems listed in Annex III (see detailed list below)\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-1a09607b3acf067a4acd","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":61,"lineEnd":71,"originalCells":{"A":"### Tier 3 — Limited Risk\nAI systems subject to transparency obligations only (Article 52). Must disclose AI nature to users.\n\n**Examples:**\n- Chatbots\n- AI-generated synthetic media (deepfakes)\n- Emotion recognition systems\n- Biometric categorization systems not in high-risk category\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-b2c99d0f3a947fc30a8f","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":72,"lineEnd":81,"originalCells":{"A":"### Tier 4 — Minimal/No Risk\nAll other AI systems. No mandatory obligations under the Act. Voluntary codes of conduct encouraged.\n\n**Examples:**\n- Spam filters\n- AI-enabled video games\n- AI inventory optimization tools\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-77e6f042aa89bcc118f0","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":82,"lineEnd":111,"originalCells":{"A":"## Article 6 — High-Risk AI Classification\n\nArticle 6 establishes the two-gate classification mechanism:\n\n**Gate 1 (Article 6(1)):** An AI system is high-risk if it is itself a product or safety component of a product covered by the Union harmonization legislation listed in Annex I, AND that product requires a third-party conformity assessment.\n\n**Annex I products include:**\n- Machinery (Directive 2006/42/EC)\n- Toys (Directive 2009/48/EC)\n- Medical devices (Regulation (EU) 2017/745)\n- In vitro diagnostic medical devices\n- Civil aviation (Regulation (EU) 2018/1139)\n- Motor vehicles (Regulation (EU) 2019/2144)\n- Marine equipment\n- Lifts\n- Pressure equipment\n- Radio equipment\n\n**Gate 2 (Article 6(2)):** An AI system is high-risk if it falls within a category listed in Annex III (see below), UNLESS it poses no significant risk of harm to health, safety, or fundamental rights (self-assessment pathway under Article 6(3)).\n\n**Article 6(3) Exclusion:** A provider may determine their Annex III system is not high-risk if:\n- It does not meaningfully influence outcomes of the decision-making process it is part of\n- It does not pose a risk of harm to health, safety, or fundamental rights\n\nThe provider must document this determination and notify their NCA. Excluded categories: AI performing narrow procedural tasks, improving prior human decisions, detecting patterns without individual profiling.\n\n**GOVERN mapping:** GOVERN Assess module applies Article 6 gate logic to every registered AI system. Energy discovers candidate systems; Assess runs the two-gate test and Article 6(3) self-assessment workflow; Compliance Portal generates the determination record.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-136f39855bb5885ec844","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":112,"lineEnd":165,"originalCells":{"A":"## Annex III — High-Risk AI System Categories\n\nAll eight categories with their specific listed use cases:\n\n**1. Biometric identification and categorization of natural persons**\n- Remote biometric identification systems (all, except prohibited real-time ones)\n- AI systems for biometric categorization based on sensitive or protected characteristics\n- Emotion recognition systems\n\n**2. Critical infrastructure**\n- Safety components of digital infrastructure management\n- Road traffic management and operation\n- Supply of water, gas, heating, and electricity\n\n**3. Education and vocational training**\n- Systems determining access, admission, or assignment of persons to educational and vocational training institutions\n- Evaluating learning outcomes, assessing and evaluating persons in educational contexts\n- Monitoring and detecting prohibited behavior of students during testing\n\n**4. Employment, workers management, and access to self-employment**\n- Recruitment and selection (CV screening, interview assessment, background checks)\n- Task allocation, monitoring behavior, and evaluating performance and behavior\n- Promotion and termination of employment relationships\n- Creditworthiness of workers\n\n**5. Access to and enjoyment of essential private services and essential public services and benefits**\n- Creditworthiness assessment and credit scoring\n- Life and health insurance risk assessment and pricing\n- Emergency services prioritization and dispatch\n- Benefit eligibility evaluation (welfare, housing assistance, public services)\n\n**6. Law enforcement**\n- Lie detection and reliability assessment of evidence\n- Evaluating reliability of evidence in criminal investigations\n- Criminal risk profiling of individuals\n- Predicting recidivism\n- Detecting emotional or psychological states in investigations\n- Analyzing CCTV footage for criminal activity detection\n\n**7. Migration, asylum, and border control management**\n- Risk assessment of migrants or asylum seekers\n- Document authenticity verification\n- Examining applications for asylum, visa, or residence permits\n- Detection of illegal border crossing\n\n**8. Administration of justice and democratic processes**\n- Legal research and interpretation assistance in judicial proceedings\n- Influence on outcome of elections and referendums (excluding cybersecurity tools)\n- Profiling natural persons during criminal investigations by law enforcement\n\n**GOVERN mapping:** GOVERN's AI Inventory registers systems against Annex III categories. Each registered system gets an Annex III classification tag. GOVERN Policy Engine monitors for new deployments that fall into unregistered Annex III categories.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-e679367039fdaf63d819","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":166,"lineEnd":193,"originalCells":{"A":"## Article 9 — Risk Management System\n\nProviders of high-risk AI systems must establish, implement, document, and maintain a risk management system throughout the entire lifecycle.\n\n**Requirements:**\n\n**9(1):** The risk management system is a continuous iterative process throughout the lifecycle, requiring regular systematic updating.\n\n**9(2):** The risk management system must include:\n- Identification and analysis of known and reasonably foreseeable risks to health, safety, and fundamental rights\n- Estimation and evaluation of risks arising from intended use and reasonably foreseeable misuse\n- Evaluation of risks based on post-market monitoring data\n- Adoption of appropriate risk management measures\n\n**9(4):** Risk management measures must consider effects and possible interactions resulting from the combined application of requirements in Articles 10–15.\n\n**9(5):** High-risk AI systems tested in real-world conditions before placement on market.\n\n**9(6):** Testing must be performed against metrics and probabilistic thresholds appropriate to the intended purpose.\n\n**9(7):** Testing for children, elderly, persons with disabilities, and historically disadvantaged groups where likely affected.\n\n**9(8):** For systems interacting with natural persons: risks from vulnerable populations must be explicitly addressed.\n\n**GOVERN mapping:** GOVERN Risk Engine automates the Article 9 lifecycle. Risk assessments are created at onboarding, updated with each significant change, linked to post-market monitoring alerts, and stored with audit trail. Risk scores feed the Compliance Portal dashboard.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-edd835dcae1517d07941","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":194,"lineEnd":216,"originalCells":{"A":"## Article 10 — Data and Data Governance\n\nHigh-risk AI systems using training, validation, and testing datasets must comply with data governance practices.\n\n**10(2):** Training, validation, and testing datasets must be subject to data governance and management practices covering:\n- Relevant design choices\n- Data collection and procurement processes\n- Relevant data preparation processing operations (labeling, cleaning, enrichment, aggregation)\n- Formulation of relevant assumptions\n- Assessment of availability, quantity, and suitability\n- Examination of possible biases\n- Identification of relevant data gaps or shortcomings and remediation\n\n**10(3):** Datasets must be relevant, sufficiently representative, and to the best extent possible, free from errors and complete given the intended purpose.\n\n**10(4):** Datasets must have appropriate statistical properties relative to the persons or groups of persons on which the system will be used (including characteristics of the geographic, behavioral, and functional settings).\n\n**10(5):** Special categories of data may be processed for bias detection and correction — strictly limited to this purpose.\n\n**GOVERN mapping:** GOVERN Data Governance module tracks dataset lineage for high-risk systems. Bias evaluation records attach to each system's compliance record. Data provenance reports generated for Article 10 documentation requirements.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-007424a9098adeacdf8e","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":217,"lineEnd":246,"originalCells":{"A":"## Article 13 — Transparency and Provision of Information to Deployers\n\nHigh-risk AI systems must be accompanied by instructions for use that are in machine-readable format where appropriate.\n\n**13(1):** Instructions must contain concise, complete, correct, and clear information relevant and useful to the deployer.\n\n**13(2):** Instructions must include:\n- Identity and contact details of provider\n- Characteristics, capabilities, and limitations of the high-risk AI system including:\n  - Its intended purpose\n  - Level of accuracy, robustness, and cybersecurity\n  - Circumstances that may lead to risks\n  - Performance with respect to specific groups of persons\n  - Input data specifications\n  - Relevant information for human oversight\n- Changes and their impact on performance\n- Human oversight measures\n- Expected lifetime and maintenance\n\n**13(3)(b):** Where relevant, instructions must include information about:\n- The intended purpose\n- Level of accuracy, robustness, and cybersecurity\n- Any known or foreseeable circumstances that may lead to risk to health, safety, or fundamental rights\n- Technical capabilities and limitations including any biases\n- Where applicable, performance data in terms of relevant groups of persons\n\n**GOVERN mapping:** GOVERN Compliance Portal generates Article 13-compliant system cards for each registered high-risk AI system. System cards auto-populate from GOVERN Risk Engine assessments and are version-controlled with change history.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-f459832a4df9243130bf","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":247,"lineEnd":269,"originalCells":{"A":"## Article 14 — Human Oversight\n\nHigh-risk AI systems must be designed and developed, including with appropriate human-machine interface tools, to allow effective human oversight.\n\n**14(1):** Measures for human oversight must be proportionate to the risks, degree of autonomy, and context of use.\n\n**14(2):** Human oversight must aim to prevent or minimize risks to health, safety, or fundamental rights when the system is used as intended.\n\n**14(3):** High-risk AI systems must allow the persons assigned to human oversight to:\n- (a) Fully understand the capacities and limitations of the high-risk AI system and monitor its operation\n- (b) Be aware of the possible tendency of automatically relying or over-relying on the output produced by the system (automation bias)\n- (c) Correctly interpret the output of the high-risk AI system in light of context\n- (d) Decide, in any particular situation, not to use the system or override, disregard, or reverse the output\n- (e) Intervene in the system operation or interrupt it through a \"stop\" button or similar procedure\n\n**14(4):** For high-risk AI systems intended to be used in contexts where output could have a significant impact on fundamental rights (law enforcement, employment, credit): oversight measures must include mechanisms ensuring that no output is actioned without meaningful human review.\n\n**14(5):** For general-purpose AI systems used as high-risk AI components: specific oversight measures must be implemented by the integrating provider.\n\n**GOVERN mapping:** GOVERN Human Oversight module tracks oversight controls for each high-risk system. Assigns Human Oversight Officers (HOO), logs override decisions, tracks automation bias incidents, and generates Article 14 compliance evidence.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-b8b9263cbf7f2030ec5e","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":270,"lineEnd":290,"originalCells":{"A":"## Article 15 — Accuracy, Robustness, and Cybersecurity\n\n**15(1):** High-risk AI systems must be designed and developed to achieve an appropriate level of accuracy, robustness, and cybersecurity, and to perform consistently in those respects throughout their lifecycle.\n\n**15(2):** Levels of accuracy and accuracy metrics must be declared in the instructions for use.\n\n**15(3):** High-risk AI systems must be resilient against:\n- Errors\n- Faults\n- Inconsistencies within the system and environment\n- Reasonably foreseeable attempts by unauthorized parties to alter use or performance (adversarial manipulation)\n- Feedback loops from repeated deployment\n\n**15(4):** Technical robustness must include resilience against attempts to alter the system through adversarial attacks. Must prevent malicious manipulation that changes system behavior or output in a way that compromises health, safety, or fundamental rights.\n\n**15(5):** For AI systems used in biometric identification: additional cybersecurity requirements apply to prevent unauthorized access to biometric data.\n\n**GOVERN mapping:** GOVERN Security Module tracks accuracy metrics, robustness test results, and cybersecurity posture for each high-risk system. Red team evaluation records attach to compliance file. Adversarial testing cadence enforced by Policy Engine.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-48616932d0d99e0c0d72","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":291,"lineEnd":317,"originalCells":{"A":"## Article 52 — GPAI Model Obligations\n\nApplies to providers of general-purpose AI (GPAI) models — including large language models, multimodal foundation models, and any model trained on broad data, capable of performing a wide range of distinct tasks.\n\n**52(1) — Transparency obligations for all GPAI providers:**\n- Provide technical documentation to downstream providers integrating the model (sufficient for them to comply with their own obligations)\n- Provide information and documentation to deployers and downstream providers as needed\n- Establish a policy to respect EU copyright law including compliance with the opt-out mechanism under Directive 2019/790 Article 4(3)\n- Publish a sufficiently detailed summary of the content used for training\n\n**52(2) — Systemic risk GPAI models (high-capability threshold):**\n\nA GPAI model is deemed to have systemic risk if it is trained with more than 10^25 FLOPs, or is designated as such by the AI Office based on other capability indicators.\n\nAdditional obligations for systemic-risk GPAI models:\n- Perform model evaluation prior to release (including adversarial testing)\n- Assess and mitigate systemic risks identified at EU level\n- Track, document, and report serious incidents and corrective measures to the AI Office\n- Implement cybersecurity protections commensurate with systemic risk profile\n- Report energy consumption during training and inference\n\n**52(5):** Codes of practice serve as the presumption of conformity mechanism for GPAI obligations.\n\n**GOVERN mapping:** GOVERN GPAI module tracks provider compliance with Article 52 for any GPAI model integrated into customer workflows. Documentation coverage checker verifies technical documentation completeness. Copyright compliance records maintained. Systemic risk assessment status tracked.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-9da0a773f8abfb8529d1","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":318,"lineEnd":342,"originalCells":{"A":"## Article 71 — Codes of Practice\n\nThe AI Office coordinates the development of codes of practice to operationalize GPAI model obligations.\n\n**71(1):** The AI Office shall facilitate the drawing up of codes of practice to contribute to the proper application of the Regulation.\n\n**71(3):** Codes of practice shall include at minimum:\n- Descriptions of GPAI models covered\n- Specific obligations covered by the code\n- Benchmarks and metrics for measuring compliance\n- Testing and evaluation methodologies\n\n**71(4):** Codes of practice finalized by August 2, 2025.\n\n**71(7):** Where a GPAI model provider complies with a code of practice, there is a presumption of conformity with the covered obligations.\n\n**71(8):** The AI Office shall monitor and evaluate the effectiveness of codes of practice.\n\n**Codes of practice status (as of early 2026):**\n- GPAI Code of Practice: Drafting initiated Q4 2024 with multi-stakeholder working groups covering transparency, copyright, systemic risk evaluation, and incident reporting. Target finalization: August 2025.\n\n**GOVERN mapping:** GOVERN tracks which codes of practice each GPAI provider has signed onto. Compliance Portal displays presumption-of-conformity status per code.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-c1c7ea088f964add83c6","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":343,"lineEnd":361,"originalCells":{"A":"## Penalties\n\n**Article 99 — Administrative fines:**\n\n| Violation | Maximum Fine |\n|-----------|-------------|\n| Prohibited AI practices (Article 5) | €35 million OR 7% of total worldwide annual turnover of preceding year, whichever is higher |\n| Non-compliance with high-risk obligations (Articles 9–15, 16–27) | €15 million OR 3% of total worldwide annual turnover, whichever is higher |\n| Incorrect, incomplete, or misleading information to notified bodies or NCAs | €7.5 million OR 1% of total worldwide annual turnover, whichever is higher |\n| GPAI model violations | €15 million OR 3% of total worldwide annual turnover |\n| Systemic risk GPAI model violations | €35 million OR 7% of total worldwide annual turnover |\n\n**For SMEs and startups:** Proportionately lower of the two penalty calculation methods applies.\n\n**Article 100 — Fines for natural persons:**\nThe AI Office or NCAs may impose fines on natural persons (executives, employees) for violations linked to prohibited practices or obstruction of oversight.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-819f5e9828a427d8df3b","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":362,"lineEnd":382,"originalCells":{"A":"## Extraterritorial Application\n\n**Article 2 — Scope:**\n\nThe EU AI Act applies to:\n1. **Providers** who place AI systems on the EU market or put them into service in the EU — regardless of where the provider is established (EU or third country)\n2. **Deployers** of AI systems located in the EU\n3. **Providers and deployers** of AI systems when output is used in the EU\n4. **Importers and distributors** of AI systems\n\n**Article 3 — Third-country provisions:**\nA non-EU provider placing an AI system on the EU market must designate an authorized representative established in the EU. The representative is liable for ensuring compliance.\n\n**Article 2(9):** The Act applies to operators located outside the EU where:\n- The AI system output is used in the EU\n- The affected persons are located in the EU\n\n**GOVERN relevance:** GOVERN supports US-based organizations deploying AI systems used by EU users or citizens. GOVERN's compliance workflows are jurisdiction-aware — each AI system tagged with applicable regulatory regimes based on where it is deployed and who it affects.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-ac034d8692fce62e2173","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":383,"lineEnd":412,"originalCells":{"A":"## AI Inventory Requirement and How GOVERN Energy Discovers Systems\n\n**Article 6(3) & Recital 55:** Providers must be able to determine whether their AI systems are high-risk. This presupposes a complete inventory of all AI systems.\n\n**Article 17 (Quality Management System):** Providers of high-risk AI must establish a quality management system that includes, at minimum, a documented strategy for regulatory compliance — which requires knowing all AI systems in operation.\n\n**Article 24 (Deployer obligations):** Deployers must ensure a point of contact, maintain logs, and inform providers of incidents — all requiring a complete catalog of deployed AI.\n\n**GOVERN Energy — Automated AI Discovery:**\n\nGOVERN Energy is the discovery and inventory engine. It solves the foundational EU AI Act compliance problem: you cannot assess, document, or govern AI systems you do not know exist.\n\nEnergy continuously discovers:\n- API calls to AI model providers (OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, Google Vertex)\n- AI-enabled SaaS applications in use across the organization (shadow AI)\n- Internally developed models registered in ML platforms (MLflow, SageMaker, Azure ML)\n- AI features embedded in enterprise software (Salesforce Einstein, Microsoft Copilot, Workday AI)\n- AI systems exposed via internal APIs and microservices\n\nFor each discovered system, Energy generates an Article 6 pre-classification:\n- Probable risk tier (Unacceptable / High-Risk Annex III / Limited / Minimal)\n- Flagged Annex III categories that may apply\n- Data types processed (biometric, special category, personal data)\n- Affected populations (employees, customers, vulnerable groups)\n- Recommended next action (full conformity assessment / transparency obligations / no action)\n\nThe GOVERN AI Inventory becomes the single source of truth for Article 17 quality management, Article 24 deployer obligations, and the EU AI database registration requirement.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-947a8231e727edbf0552","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":413,"lineEnd":434,"originalCells":{"A":"## GOVERN Component Mapping to EU AI Act Articles\n\n| EU AI Act Requirement | GOVERN Component | What It Does |\n|----------------------|-----------------|-------------|\n| Article 6 — High-risk classification | GOVERN Assess + Energy | Automated two-gate classification for all discovered systems |\n| Article 9 — Risk management | GOVERN Risk Engine | Lifecycle risk assessments, iterative updates, post-market integration |\n| Article 10 — Data governance | GOVERN Data Governance | Dataset lineage, bias evaluation records, data provenance tracking |\n| Article 13 — Transparency/deployer info | GOVERN Compliance Portal | Auto-generated system cards with Article 13 required fields |\n| Article 14 — Human oversight | GOVERN Human Oversight Module | HOO assignment, override logging, automation bias incident tracking |\n| Article 15 — Accuracy, robustness, cybersecurity | GOVERN Security Module | Accuracy metrics, robustness testing records, adversarial test tracking |\n| Article 17 — Quality management system | GOVERN Platform (full) | AI Inventory + risk records + documentation = QMS foundation |\n| Article 52 — GPAI obligations | GOVERN GPAI Module | Technical documentation coverage, copyright compliance, systemic risk status |\n| Article 71 — Codes of practice | GOVERN Compliance Portal | Code of practice sign-on status, presumption of conformity tracking |\n| Annex III — High-risk classification | GOVERN Assess | Annex III category tagging for all registered systems |\n| EU AI Database registration | GOVERN Compliance Portal | Registration record generation and submission workflow |\n| Post-market monitoring | GOVERN Risk Engine | Incident alerts, performance drift detection, risk score updates |\n| Incident reporting | GOVERN Incident Module | Serious incident detection, AI Office reporting workflow |\n| Prohibited practices (Article 5) | GOVERN Policy Engine | Hard blocks on prohibited use case patterns |\n| CE Marking / conformity assessment | GOVERN Compliance Portal | Conformity assessment workflow management, notified body coordination |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-5aca69ab7b926151cb3f","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":435,"lineEnd":448,"originalCells":{"A":"## Key Definitions (Article 3)\n\n| Term | Definition |\n|------|-----------|\n| **AI system** | Machine-based system designed to operate with varying levels of autonomy that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations, decisions that can influence real or virtual environments |\n| **Provider** | Natural or legal person that develops an AI system or general-purpose AI model and places it on the market or puts into service under its own name or trademark, whether for payment or free of charge |\n| **Deployer** | Natural or legal person (public authority, agency, or other body) using an AI system under its authority, except for personal non-professional activities |\n| **High-risk AI system** | AI system referred to in Article 6 |\n| **General-purpose AI model** | AI model trained with large amounts of data using self-supervision at scale, displaying significant generality and capable of competently performing a wide range of distinct tasks |\n| **Serious incident** | Incident or malfunctioning of a high-risk AI system that directly or indirectly leads to death, serious damage to health, serious damage to property, or disruption of essential services |\n| **Post-market monitoring** | Systematic collection and review of experience gained from high-risk AI systems placed on market for purpose of identifying need for corrective or preventive actions |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-708e9ac9afa577982287","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":449,"lineEnd":471,"originalCells":{"A":"## Compliance Checklist for Organizations Subject to EU AI Act\n\n### Immediate (February 2025)\n- [ ] Inventory all AI systems for potential prohibited practice violations (Article 5)\n- [ ] Identify any emotion recognition systems in workplace/education settings\n- [ ] Assess any biometric identification systems for prohibited real-time use\n- [ ] Establish AI literacy training program for all staff working with AI\n\n### Near-term (August 2025)\n- [ ] Complete AI inventory across the organization\n- [ ] Apply Article 6 risk classification to all discovered systems\n- [ ] For high-risk systems: initiate conformity assessment process\n- [ ] For GPAI providers: complete technical documentation and publish training data summary\n- [ ] Sign onto relevant GPAI Code of Practice\n\n### Full compliance (August 2026)\n- [ ] All high-risk systems registered in EU AI Database\n- [ ] Technical documentation complete for all high-risk systems\n- [ ] Quality management system operational\n- [ ] Post-market monitoring system active\n- [ ] Human oversight measures implemented\n- [ ] Authorized EU representative designated (if non-EU provider)\n- [ ] Incident reporting procedures established"},"originalFormulas":{}},{"id":"ROW-MD-102c611601d1cf611a5c","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":451,"lineEnd":456,"originalCells":{"A":"### Immediate (February 2025)\n- [ ] Inventory all AI systems for potential prohibited practice violations (Article 5)\n- [ ] Identify any emotion recognition systems in workplace/education settings\n- [ ] Assess any biometric identification systems for prohibited real-time use\n- [ ] Establish AI literacy training program for all staff working with AI\n"},"originalFormulas":{}},{"id":"ROW-MD-436071ac2fcaf7a65e43","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":457,"lineEnd":463,"originalCells":{"A":"### Near-term (August 2025)\n- [ ] Complete AI inventory across the organization\n- [ ] Apply Article 6 risk classification to all discovered systems\n- [ ] For high-risk systems: initiate conformity assessment process\n- [ ] For GPAI providers: complete technical documentation and publish training data summary\n- [ ] Sign onto relevant GPAI Code of Practice\n"},"originalFormulas":{}},{"id":"ROW-MD-255ae67bdd6b3deea470","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":464,"lineEnd":471,"originalCells":{"A":"### Full compliance (August 2026)\n- [ ] All high-risk systems registered in EU AI Database\n- [ ] Technical documentation complete for all high-risk systems\n- [ ] Quality management system operational\n- [ ] Post-market monitoring system active\n- [ ] Human oversight measures implemented\n- [ ] Authorized EU representative designated (if non-EU provider)\n- [ ] Incident reporting procedures established"},"originalFormulas":{}},{"id":"ROW-MD-33db61466c41c303ae62","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":172,"lineEnd":173,"originalCells":{"A":"**9(1):** The risk management system is a continuous iterative process throughout the lifecycle, requiring regular systematic updating.\n"},"originalFormulas":{}},{"id":"ROW-MD-1728103c46fcd4ac7c9b","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":174,"lineEnd":179,"originalCells":{"A":"**9(2):** The risk management system must include:\n- Identification and analysis of known and reasonably foreseeable risks to health, safety, and fundamental rights\n- Estimation and evaluation of risks arising from intended use and reasonably foreseeable misuse\n- Evaluation of risks based on post-market monitoring data\n- Adoption of appropriate risk management measures\n"},"originalFormulas":{}},{"id":"ROW-MD-ca549135ce808d7785ea","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":180,"lineEnd":181,"originalCells":{"A":"**9(4):** Risk management measures must consider effects and possible interactions resulting from the combined application of requirements in Articles 10–15.\n"},"originalFormulas":{}},{"id":"ROW-MD-360d4b798ee21e1beee7","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":182,"lineEnd":183,"originalCells":{"A":"**9(5):** High-risk AI systems tested in real-world conditions before placement on market.\n"},"originalFormulas":{}},{"id":"ROW-MD-594c654c5cad4984aedb","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":184,"lineEnd":185,"originalCells":{"A":"**9(6):** Testing must be performed against metrics and probabilistic thresholds appropriate to the intended purpose.\n"},"originalFormulas":{}},{"id":"ROW-MD-8947173a77130dd1acd7","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":186,"lineEnd":187,"originalCells":{"A":"**9(7):** Testing for children, elderly, persons with disabilities, and historically disadvantaged groups where likely affected.\n"},"originalFormulas":{}},{"id":"ROW-MD-ebac09fb968816fe6e23","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":188,"lineEnd":193,"originalCells":{"A":"**9(8):** For systems interacting with natural persons: risks from vulnerable populations must be explicitly addressed.\n\n**GOVERN mapping:** GOVERN Risk Engine automates the Article 9 lifecycle. Risk assessments are created at onboarding, updated with each significant change, linked to post-market monitoring alerts, and stored with audit trail. Risk scores feed the Compliance Portal dashboard.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-c4a1dd489a00d4c7c59f","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":198,"lineEnd":206,"originalCells":{"A":"**10(2):** Training, validation, and testing datasets must be subject to data governance and management practices covering:\n- Relevant design choices\n- Data collection and procurement processes\n- Relevant data preparation processing operations (labeling, cleaning, enrichment, aggregation)\n- Formulation of relevant assumptions\n- Assessment of availability, quantity, and suitability\n- Examination of possible biases\n- Identification of relevant data gaps or shortcomings and remediation\n"},"originalFormulas":{}},{"id":"ROW-MD-d14b13309dffd878f971","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":207,"lineEnd":208,"originalCells":{"A":"**10(3):** Datasets must be relevant, sufficiently representative, and to the best extent possible, free from errors and complete given the intended purpose.\n"},"originalFormulas":{}},{"id":"ROW-MD-d94e4a433bf68a7b8216","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":209,"lineEnd":210,"originalCells":{"A":"**10(4):** Datasets must have appropriate statistical properties relative to the persons or groups of persons on which the system will be used (including characteristics of the geographic, behavioral, and functional settings).\n"},"originalFormulas":{}},{"id":"ROW-MD-164051f23a0b977ad584","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":211,"lineEnd":216,"originalCells":{"A":"**10(5):** Special categories of data may be processed for bias detection and correction — strictly limited to this purpose.\n\n**GOVERN mapping:** GOVERN Data Governance module tracks dataset lineage for high-risk systems. Bias evaluation records attach to each system's compliance record. Data provenance reports generated for Article 10 documentation requirements.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-3983dc5d9a9400d8ec20","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":221,"lineEnd":222,"originalCells":{"A":"**13(1):** Instructions must contain concise, complete, correct, and clear information relevant and useful to the deployer.\n"},"originalFormulas":{}},{"id":"ROW-MD-3c65e7b5a3f204cbc355","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":223,"lineEnd":235,"originalCells":{"A":"**13(2):** Instructions must include:\n- Identity and contact details of provider\n- Characteristics, capabilities, and limitations of the high-risk AI system including:\n  - Its intended purpose\n  - Level of accuracy, robustness, and cybersecurity\n  - Circumstances that may lead to risks\n  - Performance with respect to specific groups of persons\n  - Input data specifications\n  - Relevant information for human oversight\n- Changes and their impact on performance\n- Human oversight measures\n- Expected lifetime and maintenance\n"},"originalFormulas":{}},{"id":"ROW-MD-0241ee603af208254e1c","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":236,"lineEnd":246,"originalCells":{"A":"**13(3)(b):** Where relevant, instructions must include information about:\n- The intended purpose\n- Level of accuracy, robustness, and cybersecurity\n- Any known or foreseeable circumstances that may lead to risk to health, safety, or fundamental rights\n- Technical capabilities and limitations including any biases\n- Where applicable, performance data in terms of relevant groups of persons\n\n**GOVERN mapping:** GOVERN Compliance Portal generates Article 13-compliant system cards for each registered high-risk AI system. System cards auto-populate from GOVERN Risk Engine assessments and are version-controlled with change history.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-d08eb167ab552e2283de","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":251,"lineEnd":252,"originalCells":{"A":"**14(1):** Measures for human oversight must be proportionate to the risks, degree of autonomy, and context of use.\n"},"originalFormulas":{}},{"id":"ROW-MD-4718c7f7a9910251fb94","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":253,"lineEnd":254,"originalCells":{"A":"**14(2):** Human oversight must aim to prevent or minimize risks to health, safety, or fundamental rights when the system is used as intended.\n"},"originalFormulas":{}},{"id":"ROW-MD-f37fb389dd22d17c047f","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":255,"lineEnd":261,"originalCells":{"A":"**14(3):** High-risk AI systems must allow the persons assigned to human oversight to:\n- (a) Fully understand the capacities and limitations of the high-risk AI system and monitor its operation\n- (b) Be aware of the possible tendency of automatically relying or over-relying on the output produced by the system (automation bias)\n- (c) Correctly interpret the output of the high-risk AI system in light of context\n- (d) Decide, in any particular situation, not to use the system or override, disregard, or reverse the output\n- (e) Intervene in the system operation or interrupt it through a \"stop\" button or similar procedure\n"},"originalFormulas":{}},{"id":"ROW-MD-8a69d3068047506fd41f","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":262,"lineEnd":263,"originalCells":{"A":"**14(4):** For high-risk AI systems intended to be used in contexts where output could have a significant impact on fundamental rights (law enforcement, employment, credit): oversight measures must include mechanisms ensuring that no output is actioned without meaningful human review.\n"},"originalFormulas":{}},{"id":"ROW-MD-f38a488e2f1342a5b63c","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":264,"lineEnd":269,"originalCells":{"A":"**14(5):** For general-purpose AI systems used as high-risk AI components: specific oversight measures must be implemented by the integrating provider.\n\n**GOVERN mapping:** GOVERN Human Oversight module tracks oversight controls for each high-risk system. Assigns Human Oversight Officers (HOO), logs override decisions, tracks automation bias incidents, and generates Article 14 compliance evidence.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-a900d397e132f59b4e1b","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":272,"lineEnd":273,"originalCells":{"A":"**15(1):** High-risk AI systems must be designed and developed to achieve an appropriate level of accuracy, robustness, and cybersecurity, and to perform consistently in those respects throughout their lifecycle.\n"},"originalFormulas":{}},{"id":"ROW-MD-bc453c622abcd39a63b0","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":274,"lineEnd":275,"originalCells":{"A":"**15(2):** Levels of accuracy and accuracy metrics must be declared in the instructions for use.\n"},"originalFormulas":{}},{"id":"ROW-MD-74dc0d5003db990ed4d6","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":276,"lineEnd":282,"originalCells":{"A":"**15(3):** High-risk AI systems must be resilient against:\n- Errors\n- Faults\n- Inconsistencies within the system and environment\n- Reasonably foreseeable attempts by unauthorized parties to alter use or performance (adversarial manipulation)\n- Feedback loops from repeated deployment\n"},"originalFormulas":{}},{"id":"ROW-MD-c69eb8c16195d1eb946d","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":283,"lineEnd":284,"originalCells":{"A":"**15(4):** Technical robustness must include resilience against attempts to alter the system through adversarial attacks. Must prevent malicious manipulation that changes system behavior or output in a way that compromises health, safety, or fundamental rights.\n"},"originalFormulas":{}},{"id":"ROW-MD-a71064e87dfaea8e786c","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":285,"lineEnd":290,"originalCells":{"A":"**15(5):** For AI systems used in biometric identification: additional cybersecurity requirements apply to prevent unauthorized access to biometric data.\n\n**GOVERN mapping:** GOVERN Security Module tracks accuracy metrics, robustness test results, and cybersecurity posture for each high-risk system. Red team evaluation records attach to compliance file. Adversarial testing cadence enforced by Policy Engine.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-797468111bd4de6ed50c","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":295,"lineEnd":300,"originalCells":{"A":"**52(1) — Transparency obligations for all GPAI providers:**\n- Provide technical documentation to downstream providers integrating the model (sufficient for them to comply with their own obligations)\n- Provide information and documentation to deployers and downstream providers as needed\n- Establish a policy to respect EU copyright law including compliance with the opt-out mechanism under Directive 2019/790 Article 4(3)\n- Publish a sufficiently detailed summary of the content used for training\n"},"originalFormulas":{}},{"id":"ROW-MD-f0ab560dcf05ff5bc549","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":301,"lineEnd":311,"originalCells":{"A":"**52(2) — Systemic risk GPAI models (high-capability threshold):**\n\nA GPAI model is deemed to have systemic risk if it is trained with more than 10^25 FLOPs, or is designated as such by the AI Office based on other capability indicators.\n\nAdditional obligations for systemic-risk GPAI models:\n- Perform model evaluation prior to release (including adversarial testing)\n- Assess and mitigate systemic risks identified at EU level\n- Track, document, and report serious incidents and corrective measures to the AI Office\n- Implement cybersecurity protections commensurate with systemic risk profile\n- Report energy consumption during training and inference\n"},"originalFormulas":{}},{"id":"ROW-MD-c04def94dbbd9d140e2a","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":312,"lineEnd":317,"originalCells":{"A":"**52(5):** Codes of practice serve as the presumption of conformity mechanism for GPAI obligations.\n\n**GOVERN mapping:** GOVERN GPAI module tracks provider compliance with Article 52 for any GPAI model integrated into customer workflows. Documentation coverage checker verifies technical documentation completeness. Copyright compliance records maintained. Systemic risk assessment status tracked.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-4893380b79a190ce8138","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":322,"lineEnd":323,"originalCells":{"A":"**71(1):** The AI Office shall facilitate the drawing up of codes of practice to contribute to the proper application of the Regulation.\n"},"originalFormulas":{}},{"id":"ROW-MD-7273ccb505af0966dc64","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":324,"lineEnd":329,"originalCells":{"A":"**71(3):** Codes of practice shall include at minimum:\n- Descriptions of GPAI models covered\n- Specific obligations covered by the code\n- Benchmarks and metrics for measuring compliance\n- Testing and evaluation methodologies\n"},"originalFormulas":{}},{"id":"ROW-MD-2720d68a892b107e4ffd","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":330,"lineEnd":331,"originalCells":{"A":"**71(4):** Codes of practice finalized by August 2, 2025.\n"},"originalFormulas":{}},{"id":"ROW-MD-80cae17691f5890c0c68","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":332,"lineEnd":333,"originalCells":{"A":"**71(7):** Where a GPAI model provider complies with a code of practice, there is a presumption of conformity with the covered obligations.\n"},"originalFormulas":{}},{"id":"ROW-MD-2d9f3b7931a9ea390944","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","sheet":"POLICY(5).md","row":334,"lineEnd":342,"originalCells":{"A":"**71(8):** The AI Office shall monitor and evaluate the effectiveness of codes of practice.\n\n**Codes of practice status (as of early 2026):**\n- GPAI Code of Practice: Drafting initiated Q4 2024 with multi-stakeholder working groups covering transparency, copyright, systemic risk evaluation, and incident reporting. Target finalization: August 2025.\n\n**GOVERN mapping:** GOVERN tracks which codes of practice each GPAI provider has signed onto. Compliance Portal displays presumption-of-conformity status per code.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-c8a4bca90d6b6dac7acb","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":1,"lineEnd":10,"originalCells":{"A":"# FedRAMP — Federal Risk and Authorization Management Program\n\n**Version:** FedRAMP Rev 5 (2023), FedRAMP 20x Program (2025-2026)\n**Framework:** FedRAMP Authorization Act (2022), OMB M-23-22, FedRAMP PMO Guidance\n**Scope:** Cloud Service Providers (CSPs) offering services to U.S. federal agencies\n**GOVERN Components:** Assess (evaluation), Policy Engine (enforcement), Audit (continuous monitoring evidence), Documentation (OSCAL output)\n\n---\n\n## Overview"},"originalFormulas":{}},{"id":"ROW-MD-a2d6973f4316a724d34e","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":10,"lineEnd":17,"originalCells":{"A":"## Overview\n\nFedRAMP (Federal Risk and Authorization Management Program) is the U.S. government's standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. All cloud services must be FedRAMP authorized before federal agencies can use them to process federal information. FedRAMP is mandatory for cloud services under OMB M-11-11 (2011) and codified in law by the FedRAMP Authorization Act (2022).\n\nFor AI systems, FedRAMP has become increasingly critical as federal agencies expand AI adoption. The FedRAMP PMO has issued AI-specific guidance (2024-2025) and launched the FedRAMP AI Prioritization Program (the \"20x\" initiative) to fast-track AI service authorizations.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-f3bb6ea1a10d5a6fc37e","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":18,"lineEnd":60,"originalCells":{"A":"## Authorization Process\n\n### Three Authorization Pathways\n\n#### 1. Agency Authorization (Agency ATO)\n- A single sponsoring federal agency grants an Authority to Operate (ATO)\n- Requires a Designated Authorizing Official (DAO) at the agency\n- CSP works directly with the agency's security team\n- Once authorized, authorization is reusable by other agencies\n- Faster pathway: typically 6-12 months\n- Best for CSPs with existing federal relationships\n\n#### 2. Joint Authorization Board (JAB) Authorization (P-ATO)\n- DoD, DHS, and GSA collectively grant a Provisional Authority to Operate (P-ATO)\n- Highest reuse value — P-ATO accepted by all federal agencies\n- Most rigorous review process\n- Requires prioritization by JAB (competitive selection)\n- Timeline: 12-24 months\n- Best for CSPs targeting broad federal market\n\n#### 3. FedRAMP 20x (2025 Program — Fast Track)\n- New streamlined pathway launched 2025\n- AI services prioritized (first cohort 100% AI)\n- Uses automated assessment tools and machine-readable evidence\n- Target authorization timeline: 3-6 months (vs 12-24 for JAB)\n- Requires OSCAL-formatted documentation (see below)\n- Continuous authorization model — automated evidence vs point-in-time\n- See FedRAMP 20x section below\n\n### Authorization Steps (All Pathways)\n\n1. **Readiness Assessment** — CSP completes FedRAMP Readiness Assessment Report (RAR) demonstrating capability to meet FedRAMP requirements. GOVERN Assess generates RAR-aligned readiness documentation.\n\n2. **Full Security Assessment** — Third-Party Assessment Organization (3PAO) conducts full security assessment per NIST SP 800-53 and FedRAMP controls. Produces Security Assessment Report (SAR).\n\n3. **Authorization Package** — CSP assembles: System Security Plan (SSP), SAR, Plan of Action and Milestones (POA&M), and supporting documentation. GOVERN generates OSCAL-formatted SSP and POA&M.\n\n4. **Agency/JAB Review** — Authorizing official reviews package and grants ATO/P-ATO.\n\n5. **Continuous Monitoring (ConMon)** — Monthly vulnerability scanning, annual assessments, and significant change reporting. GOVERN Probe provides ConMon evidence stream.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-32821bdb15f3ba9ec5bd","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":20,"lineEnd":46,"originalCells":{"A":"### Three Authorization Pathways\n\n#### 1. Agency Authorization (Agency ATO)\n- A single sponsoring federal agency grants an Authority to Operate (ATO)\n- Requires a Designated Authorizing Official (DAO) at the agency\n- CSP works directly with the agency's security team\n- Once authorized, authorization is reusable by other agencies\n- Faster pathway: typically 6-12 months\n- Best for CSPs with existing federal relationships\n\n#### 2. Joint Authorization Board (JAB) Authorization (P-ATO)\n- DoD, DHS, and GSA collectively grant a Provisional Authority to Operate (P-ATO)\n- Highest reuse value — P-ATO accepted by all federal agencies\n- Most rigorous review process\n- Requires prioritization by JAB (competitive selection)\n- Timeline: 12-24 months\n- Best for CSPs targeting broad federal market\n\n#### 3. FedRAMP 20x (2025 Program — Fast Track)\n- New streamlined pathway launched 2025\n- AI services prioritized (first cohort 100% AI)\n- Uses automated assessment tools and machine-readable evidence\n- Target authorization timeline: 3-6 months (vs 12-24 for JAB)\n- Requires OSCAL-formatted documentation (see below)\n- Continuous authorization model — automated evidence vs point-in-time\n- See FedRAMP 20x section below\n"},"originalFormulas":{}},{"id":"ROW-MD-78303b59bd91d53ff2fe","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":47,"lineEnd":60,"originalCells":{"A":"### Authorization Steps (All Pathways)\n\n1. **Readiness Assessment** — CSP completes FedRAMP Readiness Assessment Report (RAR) demonstrating capability to meet FedRAMP requirements. GOVERN Assess generates RAR-aligned readiness documentation.\n\n2. **Full Security Assessment** — Third-Party Assessment Organization (3PAO) conducts full security assessment per NIST SP 800-53 and FedRAMP controls. Produces Security Assessment Report (SAR).\n\n3. **Authorization Package** — CSP assembles: System Security Plan (SSP), SAR, Plan of Action and Milestones (POA&M), and supporting documentation. GOVERN generates OSCAL-formatted SSP and POA&M.\n\n4. **Agency/JAB Review** — Authorizing official reviews package and grants ATO/P-ATO.\n\n5. **Continuous Monitoring (ConMon)** — Monthly vulnerability scanning, annual assessments, and significant change reporting. GOVERN Probe provides ConMon evidence stream.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-ce40d980f89c9c53de2c","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":61,"lineEnd":85,"originalCells":{"A":"## Impact Levels\n\nFedRAMP categorizes cloud services by the potential impact of a security breach on confidentiality, integrity, and availability of federal information.\n\n### Low Impact\n- **Definition:** Loss of confidentiality, integrity, or availability would have limited adverse effect on agency operations\n- **Control Baseline:** NIST SP 800-53 Rev 5 Low Baseline (125 controls)\n- **Examples:** Public-facing informational websites, low-sensitivity collaboration tools\n- **AI Applications:** Public AI chatbots not processing sensitive federal data, open dataset analysis tools\n\n### Moderate Impact\n- **Definition:** Loss would have serious adverse effect on agency operations or assets\n- **Control Baseline:** NIST SP 800-53 Rev 5 Moderate Baseline (325 controls)\n- **Examples:** Systems processing Controlled Unclassified Information (CUI)\n- **AI Applications:** Most federal AI systems — decision support, document processing, analytics platforms handling CUI\n- **Note:** ~80% of cloud systems seeking FedRAMP authorization are at Moderate impact level\n\n### High Impact\n- **Definition:** Loss would have severe or catastrophic adverse effect on agency operations, assets, national security, or public safety\n- **Control Baseline:** NIST SP 800-53 Rev 5 High Baseline (421 controls)\n- **Examples:** Law enforcement systems, financial systems, health IT\n- **AI Applications:** AI systems supporting national security, law enforcement, public safety, or critical infrastructure decisions\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-5398e5395a61f01255f6","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":65,"lineEnd":70,"originalCells":{"A":"### Low Impact\n- **Definition:** Loss of confidentiality, integrity, or availability would have limited adverse effect on agency operations\n- **Control Baseline:** NIST SP 800-53 Rev 5 Low Baseline (125 controls)\n- **Examples:** Public-facing informational websites, low-sensitivity collaboration tools\n- **AI Applications:** Public AI chatbots not processing sensitive federal data, open dataset analysis tools\n"},"originalFormulas":{}},{"id":"ROW-MD-1f4ac371c00caed70eb6","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":71,"lineEnd":77,"originalCells":{"A":"### Moderate Impact\n- **Definition:** Loss would have serious adverse effect on agency operations or assets\n- **Control Baseline:** NIST SP 800-53 Rev 5 Moderate Baseline (325 controls)\n- **Examples:** Systems processing Controlled Unclassified Information (CUI)\n- **AI Applications:** Most federal AI systems — decision support, document processing, analytics platforms handling CUI\n- **Note:** ~80% of cloud systems seeking FedRAMP authorization are at Moderate impact level\n"},"originalFormulas":{}},{"id":"ROW-MD-a61222afaea1a6b92e75","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":78,"lineEnd":85,"originalCells":{"A":"### High Impact\n- **Definition:** Loss would have severe or catastrophic adverse effect on agency operations, assets, national security, or public safety\n- **Control Baseline:** NIST SP 800-53 Rev 5 High Baseline (421 controls)\n- **Examples:** Law enforcement systems, financial systems, health IT\n- **AI Applications:** AI systems supporting national security, law enforcement, public safety, or critical infrastructure decisions\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-b920ee2206331384abd5","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":86,"lineEnd":127,"originalCells":{"A":"## AI-Specific FedRAMP Requirements (2024-2026)\n\n### OMB M-24-10 (March 2024) — AI Governance\n- Federal agencies must designate Chief AI Officers\n- AI systems must be inventoried and publicly reported\n- High-impact AI use cases require governance documentation\n- AI procurement must include responsible AI requirements\n- Agencies must test AI systems before deployment and monitor in production\n\n*FedRAMP Implication:* CSPs offering AI services to federal agencies must support agency compliance with M-24-10 by providing documentation enabling agency AI impact assessments and monitoring.\n\n### FedRAMP AI Controls Supplement (2024)\nThe FedRAMP PMO issued supplemental controls for AI systems beyond the standard NIST SP 800-53 baseline:\n\n**AI-SC-1: AI System Documentation**\nCSPs must provide comprehensive documentation of AI models deployed in the service including training data sources, model architecture, known limitations, and intended use cases.\n\n**AI-SC-2: AI Model Integrity**\nCSPs must implement controls to verify AI model integrity and detect unauthorized model modification. Hash-based verification of model artifacts required.\n\n**AI-SC-3: AI Output Monitoring**\nReal-time monitoring of AI system outputs for anomalies, bias indicators, and safety violations. Monthly reporting to agency AOs.\n\n**AI-SC-4: AI Incident Response**\nAI-specific incident response procedures covering: model compromise, output manipulation, adversarial attacks, and training data incidents.\n\n**AI-SC-5: AI Supply Chain**\nDocumentation of all third-party AI components including foundation models, pre-trained components, and AI infrastructure dependencies.\n\n**AI-SC-6: Human Oversight**\nFor AI systems making or informing consequential decisions, CSPs must document human oversight mechanisms and override capabilities.\n\n### Executive Order 14110 (October 2023) — Safe AI\n- Requires safety testing before federal deployment of frontier AI models\n- Mandates dual-use AI risk assessments\n- Requires incident reporting for AI safety events\n- NIST tasked with AI safety standards development\n\n*FedRAMP Implication:* AI services seeking FedRAMP authorization must demonstrate compliance with EO 14110 safety requirements including red team testing results and safety evaluation reports.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-6c160e20faf743a30e05","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":88,"lineEnd":96,"originalCells":{"A":"### OMB M-24-10 (March 2024) — AI Governance\n- Federal agencies must designate Chief AI Officers\n- AI systems must be inventoried and publicly reported\n- High-impact AI use cases require governance documentation\n- AI procurement must include responsible AI requirements\n- Agencies must test AI systems before deployment and monitor in production\n\n*FedRAMP Implication:* CSPs offering AI services to federal agencies must support agency compliance with M-24-10 by providing documentation enabling agency AI impact assessments and monitoring.\n"},"originalFormulas":{}},{"id":"ROW-MD-60f8fe75aa0fcb8338ea","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":97,"lineEnd":117,"originalCells":{"A":"### FedRAMP AI Controls Supplement (2024)\nThe FedRAMP PMO issued supplemental controls for AI systems beyond the standard NIST SP 800-53 baseline:\n\n**AI-SC-1: AI System Documentation**\nCSPs must provide comprehensive documentation of AI models deployed in the service including training data sources, model architecture, known limitations, and intended use cases.\n\n**AI-SC-2: AI Model Integrity**\nCSPs must implement controls to verify AI model integrity and detect unauthorized model modification. Hash-based verification of model artifacts required.\n\n**AI-SC-3: AI Output Monitoring**\nReal-time monitoring of AI system outputs for anomalies, bias indicators, and safety violations. Monthly reporting to agency AOs.\n\n**AI-SC-4: AI Incident Response**\nAI-specific incident response procedures covering: model compromise, output manipulation, adversarial attacks, and training data incidents.\n\n**AI-SC-5: AI Supply Chain**\nDocumentation of all third-party AI components including foundation models, pre-trained components, and AI infrastructure dependencies.\n\n**AI-SC-6: Human Oversight**\nFor AI systems making or informing consequential decisions, CSPs must document human oversight mechanisms and override capabilities.\n"},"originalFormulas":{}},{"id":"ROW-MD-f765dd95c065b5293c25","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":118,"lineEnd":127,"originalCells":{"A":"### Executive Order 14110 (October 2023) — Safe AI\n- Requires safety testing before federal deployment of frontier AI models\n- Mandates dual-use AI risk assessments\n- Requires incident reporting for AI safety events\n- NIST tasked with AI safety standards development\n\n*FedRAMP Implication:* AI services seeking FedRAMP authorization must demonstrate compliance with EO 14110 safety requirements including red team testing results and safety evaluation reports.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-447595ab60b80f792ca8","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":128,"lineEnd":165,"originalCells":{"A":"## FedRAMP 20x Program (AI Fast-Track)\n\n### Overview\nLaunched in 2025, FedRAMP 20x represents a fundamental rethinking of the authorization process using automation, machine-readable evidence, and continuous authorization rather than point-in-time assessment.\n\nThe first 20x cohort (Cohort 1) was exclusively AI services, reflecting the government's urgency to authorize AI capabilities while maintaining security rigor.\n\n### 20x Core Principles\n\n**1. Machine-Readable Everything**\nAll documentation in OSCAL (Open Security Controls Assessment Language) format. Human-readable PDFs accepted as supplementary only. GOVERN exports all assessment artifacts in OSCAL JSON and YAML.\n\n**2. Automated Evidence**\nSecurity controls demonstrated through automated technical evidence rather than policy documents and interview-based assessments. Continuous evidence streams replace annual point-in-time assessments.\n\n**3. Continuous Authorization**\nAuthorization is maintained through ongoing automated evidence submission rather than periodic renewal. Significant deviations trigger re-assessment, not annual schedules.\n\n**4. Shared Responsibility**\nClear documentation of control ownership: CSP-owned, agency-owned, or shared. AI services must explicitly document which AI safety controls are the CSP's responsibility vs the agency's.\n\n**5. Streamlined Package**\nReduced documentation burden through standardized machine-readable formats. GOVERN 20x Package includes: OSCAL SSP, continuous monitoring evidence API, and automated assessment results.\n\n### 20x Timeline Target\n- Readiness to Authorized: 90 days (vs 12-24 months JAB)\n- Continuous monitoring: automated (vs monthly human-generated reports)\n- Renewal: continuous (vs annual reassessment)\n\n### GOVERN 20x Support\nGOVERN provides the technical infrastructure for FedRAMP 20x compliance:\n- **OSCAL Export:** All assessment results, SSP sections, POA&M, and ConMon evidence in OSCAL format\n- **Evidence API:** Real-time evidence submission endpoint for continuous authorization\n- **Automated Testing:** Machine-verifiable security control implementation tests\n- **Deviation Alerts:** Automated flagging of security control deviations to agency AOs\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-b1ca864c01565a79230d","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":130,"lineEnd":134,"originalCells":{"A":"### Overview\nLaunched in 2025, FedRAMP 20x represents a fundamental rethinking of the authorization process using automation, machine-readable evidence, and continuous authorization rather than point-in-time assessment.\n\nThe first 20x cohort (Cohort 1) was exclusively AI services, reflecting the government's urgency to authorize AI capabilities while maintaining security rigor.\n"},"originalFormulas":{}},{"id":"ROW-MD-2f00585a6ed7dfa9a599","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":135,"lineEnd":151,"originalCells":{"A":"### 20x Core Principles\n\n**1. Machine-Readable Everything**\nAll documentation in OSCAL (Open Security Controls Assessment Language) format. Human-readable PDFs accepted as supplementary only. GOVERN exports all assessment artifacts in OSCAL JSON and YAML.\n\n**2. Automated Evidence**\nSecurity controls demonstrated through automated technical evidence rather than policy documents and interview-based assessments. Continuous evidence streams replace annual point-in-time assessments.\n\n**3. Continuous Authorization**\nAuthorization is maintained through ongoing automated evidence submission rather than periodic renewal. Significant deviations trigger re-assessment, not annual schedules.\n\n**4. Shared Responsibility**\nClear documentation of control ownership: CSP-owned, agency-owned, or shared. AI services must explicitly document which AI safety controls are the CSP's responsibility vs the agency's.\n\n**5. Streamlined Package**\nReduced documentation burden through standardized machine-readable formats. GOVERN 20x Package includes: OSCAL SSP, continuous monitoring evidence API, and automated assessment results.\n"},"originalFormulas":{}},{"id":"ROW-MD-f609e83c7fd25fb6b53e","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":152,"lineEnd":156,"originalCells":{"A":"### 20x Timeline Target\n- Readiness to Authorized: 90 days (vs 12-24 months JAB)\n- Continuous monitoring: automated (vs monthly human-generated reports)\n- Renewal: continuous (vs annual reassessment)\n"},"originalFormulas":{}},{"id":"ROW-MD-dda95cc32005a463fd52","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":157,"lineEnd":165,"originalCells":{"A":"### GOVERN 20x Support\nGOVERN provides the technical infrastructure for FedRAMP 20x compliance:\n- **OSCAL Export:** All assessment results, SSP sections, POA&M, and ConMon evidence in OSCAL format\n- **Evidence API:** Real-time evidence submission endpoint for continuous authorization\n- **Automated Testing:** Machine-verifiable security control implementation tests\n- **Deviation Alerts:** Automated flagging of security control deviations to agency AOs\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-5375e355adc1ea01f53e","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":166,"lineEnd":214,"originalCells":{"A":"## OSCAL Integration Requirements\n\n### What is OSCAL?\nOSCAL (Open Security Controls Assessment Language) is NIST's machine-readable format for security documentation. FedRAMP 20x mandates OSCAL; traditional FedRAMP strongly prefers it.\n\n### GOVERN OSCAL Output\n\nGOVERN generates the following OSCAL artifacts:\n\n**System Security Plan (SSP) — OSCAL JSON**\n```json\n{\n  \"system-security-plan\": {\n    \"uuid\": \"[system-uuid]\",\n    \"metadata\": {\n      \"title\": \"GOVERN AI Governance Platform SSP\",\n      \"version\": \"[version]\",\n      \"oscal-version\": \"1.1.2\"\n    },\n    \"system-characteristics\": {\n      \"system-name\": \"GOVERN\",\n      \"description\": \"AI governance and compliance platform\",\n      \"security-impact-level\": {\n        \"security-objective-confidentiality\": \"moderate\",\n        \"security-objective-integrity\": \"moderate\",\n        \"security-objective-availability\": \"moderate\"\n      }\n    },\n    \"control-implementation\": {\n      \"implemented-requirements\": [\n        {\n          \"control-id\": \"ac-2\",\n          \"statements\": [...],\n          \"by-components\": [...]\n        }\n      ]\n    }\n  }\n}\n```\n\n**Assessment Results — OSCAL JSON**\nMachine-readable assessment findings with automated evidence references, finding severities, and remediation tracking.\n\n**Plan of Action and Milestones (POA&M) — OSCAL JSON**\nStructured remediation tracking with risk acceptance decisions, milestones, and completion status.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-b8649e178646e584af2e","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":168,"lineEnd":170,"originalCells":{"A":"### What is OSCAL?\nOSCAL (Open Security Controls Assessment Language) is NIST's machine-readable format for security documentation. FedRAMP 20x mandates OSCAL; traditional FedRAMP strongly prefers it.\n"},"originalFormulas":{}},{"id":"ROW-MD-91936683b3fcc70d9d26","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":171,"lineEnd":214,"originalCells":{"A":"### GOVERN OSCAL Output\n\nGOVERN generates the following OSCAL artifacts:\n\n**System Security Plan (SSP) — OSCAL JSON**\n```json\n{\n  \"system-security-plan\": {\n    \"uuid\": \"[system-uuid]\",\n    \"metadata\": {\n      \"title\": \"GOVERN AI Governance Platform SSP\",\n      \"version\": \"[version]\",\n      \"oscal-version\": \"1.1.2\"\n    },\n    \"system-characteristics\": {\n      \"system-name\": \"GOVERN\",\n      \"description\": \"AI governance and compliance platform\",\n      \"security-impact-level\": {\n        \"security-objective-confidentiality\": \"moderate\",\n        \"security-objective-integrity\": \"moderate\",\n        \"security-objective-availability\": \"moderate\"\n      }\n    },\n    \"control-implementation\": {\n      \"implemented-requirements\": [\n        {\n          \"control-id\": \"ac-2\",\n          \"statements\": [...],\n          \"by-components\": [...]\n        }\n      ]\n    }\n  }\n}\n```\n\n**Assessment Results — OSCAL JSON**\nMachine-readable assessment findings with automated evidence references, finding severities, and remediation tracking.\n\n**Plan of Action and Milestones (POA&M) — OSCAL JSON**\nStructured remediation tracking with risk acceptance decisions, milestones, and completion status.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-51d542eee63cc330a91a","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":215,"lineEnd":245,"originalCells":{"A":"## How GOVERN Achieves FedRAMP Authorization\n\n### GOVERN Authorization Approach\n\nGOVERN operates at Moderate Impact Level and pursues FedRAMP 20x authorization as the primary pathway given its AI-native architecture.\n\n**Infrastructure Controls (CSP Responsibility)**\n- Deployed on FedRAMP-authorized cloud infrastructure (AWS GovCloud or Azure Government)\n- Inherits IaaS/PaaS controls from underlying FedRAMP P-ATO\n- Implements Moderate baseline controls for GOVERN-owned control layers\n\n**AI-Specific Controls (GOVERN Responsibility)**\n- AI-SC-1: Complete model documentation in OSCAL format\n- AI-SC-2: Cryptographic model integrity verification\n- AI-SC-3: Real-time AI output monitoring with evidence API\n- AI-SC-4: AI incident response procedures (tested annually)\n- AI-SC-5: Supply chain documentation for all AI components\n- AI-SC-6: Human oversight documentation for consequential decisions\n\n**Continuous Monitoring Evidence Stream**\nGOVERN Probe generates continuous monitoring evidence at the following cadences:\n- Real-time: Security event logs, access control logs, AI output monitoring results\n- Daily: Vulnerability scan results, configuration compliance status\n- Monthly: Aggregated security metrics, POA&M status updates\n- Annual: Full security control assessment results\n\n### Leverage Inheritance\nAgencies deploying GOVERN inherit GOVERN's FedRAMP authorization for all controls GOVERN implements. This reduces the agency's authorization burden and accelerates their AI governance capability deployment.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-2b3c9210358c7da736f3","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":217,"lineEnd":240,"originalCells":{"A":"### GOVERN Authorization Approach\n\nGOVERN operates at Moderate Impact Level and pursues FedRAMP 20x authorization as the primary pathway given its AI-native architecture.\n\n**Infrastructure Controls (CSP Responsibility)**\n- Deployed on FedRAMP-authorized cloud infrastructure (AWS GovCloud or Azure Government)\n- Inherits IaaS/PaaS controls from underlying FedRAMP P-ATO\n- Implements Moderate baseline controls for GOVERN-owned control layers\n\n**AI-Specific Controls (GOVERN Responsibility)**\n- AI-SC-1: Complete model documentation in OSCAL format\n- AI-SC-2: Cryptographic model integrity verification\n- AI-SC-3: Real-time AI output monitoring with evidence API\n- AI-SC-4: AI incident response procedures (tested annually)\n- AI-SC-5: Supply chain documentation for all AI components\n- AI-SC-6: Human oversight documentation for consequential decisions\n\n**Continuous Monitoring Evidence Stream**\nGOVERN Probe generates continuous monitoring evidence at the following cadences:\n- Real-time: Security event logs, access control logs, AI output monitoring results\n- Daily: Vulnerability scan results, configuration compliance status\n- Monthly: Aggregated security metrics, POA&M status updates\n- Annual: Full security control assessment results\n"},"originalFormulas":{}},{"id":"ROW-MD-398e0ec2ce2c0f22d0fb","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":241,"lineEnd":245,"originalCells":{"A":"### Leverage Inheritance\nAgencies deploying GOVERN inherit GOVERN's FedRAMP authorization for all controls GOVERN implements. This reduces the agency's authorization burden and accelerates their AI governance capability deployment.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-d2a309f5276566b8b044","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":246,"lineEnd":287,"originalCells":{"A":"## FedRAMP Assessment Output\n\n```\nFedRAMP Readiness Assessment\n=============================\nCSP: GOVERN — AI Governance Platform\nImpact Level: Moderate\nAssessment Date: [Date]\nPathway: FedRAMP 20x (AI Cohort)\n\nCONTROL BASELINE STATUS\nTotal Controls (Moderate): 325\n  Fully Implemented: [X]\n  Partially Implemented: [X]\n  Not Implemented: [X]\n  Not Applicable: [X]\n\nAI-SPECIFIC CONTROLS\n  AI-SC-1 Documentation: [COMPLETE / INCOMPLETE]\n  AI-SC-2 Model Integrity: [IMPLEMENTED / PARTIAL / NOT IMPLEMENTED]\n  AI-SC-3 Output Monitoring: [IMPLEMENTED / PARTIAL / NOT IMPLEMENTED]\n  AI-SC-4 Incident Response: [TESTED / DOCUMENTED / ABSENT]\n  AI-SC-5 Supply Chain: [COMPLETE / INCOMPLETE]\n  AI-SC-6 Human Oversight: [DOCUMENTED / NOT DOCUMENTED]\n\nOSCAL PACKAGE STATUS\n  SSP: [COMPLETE / IN PROGRESS]\n  SAR: [COMPLETE / AWAITING 3PAO]\n  POA&M: [CURRENT / OUTDATED]\n  ConMon Evidence API: [ACTIVE / INACTIVE]\n\nHIGH RISK FINDINGS: [count]\nMODERATE RISK FINDINGS: [count]\nLOW RISK FINDINGS: [count]\n\nAUTHORIZATION READINESS: [READY / CONDITIONAL / NOT READY]\nRECOMMENDED PATHWAY: [20x / JAB / Agency]\nESTIMATED TIMELINE TO AUTHORIZATION: [X months]\n```\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-feac68c8220072ed0ea5","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","sheet":"POLICY(6).md","row":288,"lineEnd":297,"originalCells":{"A":"## References\n\n- FedRAMP Authorization Act (2022): https://www.congress.gov/bill/117th-congress/house-bill/7776\n- OMB M-23-22: https://www.whitehouse.gov/wp-content/uploads/2023/10/M-23-22-Delivering-a-Digital-First-Public-Experience.pdf\n- OMB M-24-10: https://www.whitehouse.gov/wp-content/uploads/2024/03/M-24-10-Advancing-Governance-Innovation-and-Risk-Management-for-Agency-Use-of-Artificial-Intelligence.pdf\n- FedRAMP Program: https://www.fedramp.gov/\n- FedRAMP 20x: https://www.fedramp.gov/20x/\n- OSCAL: https://pages.nist.gov/OSCAL/\n- NIST SP 800-53 Rev 5: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final\n- Executive Order 14110 (Safe AI): https://www.whitehouse.gov/briefing-room/presidential-actions/2023/10/30/"},"originalFormulas":{}},{"id":"ROW-MD-245de49e2b5313bbba5f","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":1,"lineEnd":10,"originalCells":{"A":"# ISO/IEC 42001:2023 — Artificial Intelligence Management System\n\n**Full title:** ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system\n**Published:** December 18, 2023\n**Type:** International Standard — Management System Standard (MSS)\n**Issuing bodies:** International Organization for Standardization (ISO) + International Electrotechnical Commission (IEC)\n**Technical committee:** ISO/IEC JTC 1/SC 42 — Artificial intelligence\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-7f5c1286ceb2464f37a0","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":11,"lineEnd":31,"originalCells":{"A":"## What It Is\n\nISO/IEC 42001:2023 is the first international standard specifying requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within organizations. It follows the High-Level Structure (HLS) / Annex SL format used by ISO 9001 (quality), ISO 27001 (information security), and ISO 14001 (environmental) — meaning organizations with existing management system certifications can integrate ISO 42001 into their existing frameworks.\n\nThe standard applies to any organization that provides or uses AI-based products or services. It is designed to be applicable regardless of organization size, type, or sector. Unlike the EU AI Act (which is compliance law), ISO 42001 is a voluntary standard that organizations can be certified against — demonstrating to customers, regulators, partners, and the public that AI is managed through a structured, auditable system.\n\n**What it is NOT:**\n- Not a product standard — it does not specify how AI systems must technically perform\n- Not a risk classification scheme like the EU AI Act\n- Not a code of ethics — though ethics are embedded throughout\n- Not limited to high-risk AI — it applies to the full portfolio of AI use\n\n**What it IS:**\n- A process and governance standard\n- A certification-ready framework with third-party audit pathway\n- A credible signal of organizational AI maturity\n- A practical operationalization of responsible AI principles\n- Increasingly required by enterprise procurement, government contracts, and financial sector vendors\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-246cdcdddb59aa446c23","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":32,"lineEnd":67,"originalCells":{"A":"## Certification Requirements\n\nISO 42001 certification follows the same model as ISO 27001 and ISO 9001:\n\n**Stage 1 Audit (Documentation review):**\n- Auditor reviews the organization's AIMS documentation\n- Verifies that the scope, policies, and procedures are in place and appropriate\n- Identifies any significant gaps before the main audit\n- Typically 1–2 days depending on organization size\n\n**Stage 2 Audit (Implementation assessment):**\n- On-site (or remote) audit of the actual implementation\n- Interviews with staff at multiple levels\n- Review of records, evidence of operation, and control effectiveness\n- Results in certification decision (issue, issue with conditions, or reject)\n\n**Surveillance audits:**\n- Conducted annually during the 3-year certification cycle\n- Verifies ongoing compliance and continual improvement\n- Typically narrower scope than initial audit (selected clauses and controls)\n\n**Recertification audit:**\n- Full audit at end of 3-year cycle\n- Full re-assessment of all clauses and controls\n\n**Accredited Certification Bodies:**\nCertification must be conducted by an ISO/IEC 17021-1 accredited certification body. Organizations cannot self-certify. Accreditation bodies include:\n- UKAS (United Kingdom)\n- DAkkS (Germany)\n- ANAB (United States)\n- COFRAC (France)\n- JAB (Japan)\n- And national equivalents in all major economies\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-ab72fcbb79ea4437d7f3","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":68,"lineEnd":377,"originalCells":{"A":"## Clause-by-Clause Breakdown\n\n### Clause 1 — Scope\nSpecifies that the standard applies to any organization involved in providing or using AI-based products or services. The standard is intended to help organizations demonstrate that AI is used responsibly, that related risks are managed appropriately, and that AI-specific opportunities are realized.\n\nThe standard acknowledges that AI introduces unique challenges to traditional management systems: opacity of models, emergent behavior, data dependency, and the interaction between AI objectives and human values.\n\n---\n\n### Clause 2 — Normative References\nReferences ISO/IEC 22989:2022 (AI concepts and terminology). Organizations implementing ISO 42001 must align their terminology with ISO/IEC 22989 definitions.\n\n---\n\n### Clause 3 — Terms and Definitions\nISO 42001 introduces key AIMS-specific definitions:\n- **AI system:** A machine-based system that, for a given set of objectives, generates outputs such as predictions, recommendations, decisions, or content that influence real or virtual environments\n- **AI policy:** Intentions and direction of an organization related to the development, provision, or use of AI\n- **AI risk:** Combination of the probability of occurrence of an AI-related harm and the severity of that harm\n- **AI objective:** Result to be achieved in relation to AI development, provision, or use\n- **Interested party (AI-specific):** Person or organization that can affect, be affected by, or perceive themselves to be affected by the organization's AI activities\n\n---\n\n### Clause 4 — Context of the Organization\n\nThis clause requires organizations to understand their environment before building the AIMS.\n\n**4.1 — Understanding the organization and its context:**\n- External factors: regulatory environment, market expectations, societal values, technological landscape\n- Internal factors: organizational culture, existing governance structures, data assets, AI capabilities, stakeholder expectations\n- AI-specific context: the nature of AI systems being developed or used, their intended purposes, affected populations, and potential societal impacts\n\n**4.2 — Understanding the needs and expectations of interested parties:**\nOrganizations must identify all parties with interests in their AI activities:\n- Customers and end users\n- Employees and their representatives\n- Regulatory bodies (national and international)\n- Civil society organizations\n- Supply chain partners\n- Shareholders and investors\n- Affected communities\n\nFor each, the organization must understand:\n- Their requirements relevant to the AIMS\n- Which requirements become compliance obligations\n- How their interests interact with AI risk and opportunity\n\n**4.3 — Determining the scope of the AIMS:**\nThe organization must define which AI systems, products, and services fall within AIMS scope. Scope decisions must be documented and justified. Organizations may begin with a subset of AI activities and expand — but scope exclusions cannot be used to avoid addressing material AI risks.\n\n**4.4 — AI management system:**\nThe organization must establish, implement, maintain, and continually improve the AIMS in accordance with the standard's requirements.\n\n**GOVERN mapping:** GOVERN Assess begins here — the AI Inventory defines scope, stakeholder identification tools support 4.2, and organizational context documentation feeds the AIMS foundation.\n\n---\n\n### Clause 5 — Leadership\n\nThis clause places responsibility at the senior leadership level. Unlike technical controls, leadership obligations in Clause 5 cannot be delegated away.\n\n**5.1 — Leadership and commitment:**\nTop management must demonstrate leadership and commitment to the AIMS by:\n- Taking accountability for the effectiveness of the AIMS\n- Ensuring AI policy and objectives are established and compatible with the organization's strategic direction\n- Integrating AIMS requirements into organizational processes\n- Ensuring resources are available for the AIMS\n- Communicating the importance of effective AI management\n- Ensuring the AIMS achieves its intended outcomes\n- Directing and supporting persons to contribute to AIMS effectiveness\n- Promoting continual improvement\n- Supporting other management roles to demonstrate leadership in their areas\n\nAI-specific leadership obligations:\n- Ensuring consideration of AI impacts on human rights and fundamental values is part of strategic planning\n- Ensuring AI-related risks are considered at the board/executive level\n- Establishing accountability chains for AI outcomes (not just AI outputs)\n\n**5.2 — AI policy:**\nTop management must establish an AI policy that:\n- Is appropriate to the purpose and context of the organization\n- Provides a framework for setting AI objectives\n- Includes a commitment to satisfying applicable requirements\n- Includes a commitment to continual improvement of the AIMS\n- Addresses the organization's approach to responsible AI, including how it balances innovation with risk management\n\nThe AI policy must be communicated within the organization, available to interested parties, and maintained as documented information.\n\n**5.3 — Organizational roles, responsibilities, and authorities:**\nTop management must assign and communicate roles including:\n- Who is responsible for ensuring the AIMS conforms to the standard\n- Who is responsible for reporting on AIMS performance to top management\n- Who has accountability for each AI system in scope\n- Who is the designated point of contact for AI-related incidents and regulatory inquiries\n\n**GOVERN mapping:** GOVERN Compliance Portal tracks leadership accountability assignments. CAIO/Chief AI Officer role supported. Board-level AI risk reporting dashboards generated from GOVERN data.\n\n---\n\n### Clause 6 — Planning\n\nPlanning is where the AIMS moves from policy to concrete action.\n\n**6.1 — Actions to address risks and opportunities:**\n\n**6.1.1 — General:**\nWhen planning the AIMS, the organization must consider the context (Clause 4.1 and 4.2) and determine:\n- Risks and opportunities that need to be addressed\n- How to integrate and implement actions into AIMS processes\n- How to evaluate the effectiveness of those actions\n\nAI-specific planning must address:\n- Risks related to data quality and bias\n- Risks related to model performance and reliability\n- Risks related to unintended use and misuse\n- Risks related to the AI system's impact on affected parties\n- Opportunities to improve processes, products, or services through AI\n- Opportunities to advance the organization's responsible AI commitments\n\n**6.1.2 — AI risk assessment:**\nThe organization must establish and maintain a process for AI risk assessment that:\n- Identifies AI risks (the what could go wrong)\n- Analyzes AI risks (likelihood and impact)\n- Evaluates AI risks against risk criteria\n- Produces comparable and reproducible results\n- Documents risk assessment results\n\n**6.1.3 — AI risk treatment:**\nBased on risk assessment results, the organization must:\n- Select appropriate risk treatment options (modify, retain, avoid, share)\n- Determine controls needed (referencing Annex A)\n- Formulate and implement a risk treatment plan\n- Obtain acceptance of residual risks from risk owners\n\n**6.2 — AI objectives and planning to achieve them:**\nThe organization must establish measurable AI objectives at relevant functions and levels:\n- Consistent with AI policy\n- Measurable (where practicable)\n- Monitored and communicated\n- Updated as appropriate\n\nFor each AI objective, the organization must determine: what will be done, what resources are required, who will be responsible, when it will be completed, and how results will be evaluated.\n\n**6.3 — Planning of changes:**\nChanges to the AIMS must be planned and implemented in a controlled manner, considering the purpose, potential consequences, resource availability, and responsibilities.\n\n**GOVERN mapping:** GOVERN Risk Engine operationalizes Clause 6.1.2 and 6.1.3. Risk assessment workflows, risk treatment plans, and residual risk acceptance records are generated and stored. GOVERN Objectives Module tracks AI objectives and progress metrics.\n\n---\n\n### Clause 7 — Support\n\nSupport clauses ensure the AIMS is properly resourced and that people, information, and communication are aligned.\n\n**7.1 — Resources:**\nThe organization must determine and provide the resources needed for the AIMS, including:\n- Human resources with appropriate AI competencies\n- Infrastructure (compute, data platforms, tooling)\n- Organizational knowledge necessary for AI governance\n- External expertise where internal gaps exist\n\n**7.2 — Competence:**\nPersons doing AI-related work affecting AIMS performance must:\n- Have appropriate education, training, or experience\n- Have their competence evaluated\n- Have training needs identified and addressed\n- Maintain documented evidence of competence\n\nAI-specific competence requirements include:\n- Understanding of AI concepts and limitations\n- Awareness of AI-related risks and ethical considerations\n- Ability to evaluate AI system outputs critically\n- Knowledge of relevant regulations and standards\n\n**7.3 — Awareness:**\nAll persons in the organization must be aware of:\n- The AI policy\n- Their contribution to AIMS effectiveness\n- The implications of not conforming to AIMS requirements\n- The organization's approach to responsible AI\n\n**7.4 — Communication:**\nThe organization must determine:\n- What to communicate about the AIMS (internally and externally)\n- When to communicate\n- With whom to communicate\n- How to communicate\n- Who does the communicating\n\n**7.5 — Documented information:**\n\n**7.5.1 — General:** The AIMS must include documented information required by the standard plus additional documented information the organization determines is necessary for AIMS effectiveness.\n\n**7.5.2 — Creating and updating:** Documented information must have appropriate identification, format, media, review, and approval.\n\n**7.5.3 — Control of documented information:** Documented information must be available, protected, controlled for distribution, access, and retrieval. Changes must be controlled. External documented information must be identified and controlled.\n\n**GOVERN mapping:** GOVERN Compliance Portal is the documented information system. All AIMS records, risk assessments, training logs, incident reports, and audit trails maintained. Competency tracking module supports Clause 7.2.\n\n---\n\n### Clause 8 — Operation\n\nOperation clauses govern the day-to-day running of the AIMS — the processes that produce AI-related outputs.\n\n**8.1 — Operational planning and control:**\nThe organization must plan, implement, control, and review processes needed to meet AI management requirements. This includes:\n- Establishing criteria for processes\n- Controlling processes in accordance with criteria\n- Keeping documented information to demonstrate processes run as planned\n- Controlling planned changes and reviewing unintended changes\n\n**8.2 — AI risk assessment (operational):**\nThe organization must perform AI risk assessments at planned intervals, and when significant changes occur or are proposed.\n\n**8.3 — AI risk treatment (operational):**\nThe organization must implement the AI risk treatment plan and maintain documented information about results.\n\n**8.4 — AI system impact assessment:**\nFor AI systems with significant potential impact on individuals or communities, the organization must conduct an AI system impact assessment covering:\n- The intended purpose and intended use\n- Potential positive and negative impacts on natural persons and society\n- Affected groups (including vulnerable populations)\n- Severity and likelihood of negative impacts\n- Mitigating controls\n- Residual risks after mitigation\n\nThe impact assessment is distinct from the risk assessment (which focuses on organizational risk). The impact assessment focuses on societal and individual harm.\n\n**8.5 — Related policies and objectives for AI systems:**\nThe organization must ensure AI systems in scope have documented:\n- Intended purpose\n- Performance objectives\n- Applicable constraints\n- Required data inputs\n- Human oversight mechanisms\n- Expected operational environment\n\n**8.6 — Procurement and supply chain:**\nWhen procuring AI systems or AI-related services from external parties, the organization must:\n- Establish procurement criteria aligned with AI policy and risk requirements\n- Obtain sufficient information from suppliers to assess AI risks\n- Pass down requirements to suppliers as appropriate\n- Monitor supplier compliance with AI-related requirements\n\n**GOVERN mapping:** GOVERN Risk Engine handles 8.2–8.3. GOVERN Impact Assessment module handles 8.4. System cards generated for 8.5. GOVERN Vendor AI module handles 8.6 — tracking third-party AI systems and supplier compliance.\n\n---\n\n### Clause 9 — Performance Evaluation\n\n**9.1 — Monitoring, measurement, analysis, and evaluation:**\nThe organization must determine:\n- What needs to be monitored and measured\n- Methods for monitoring, measurement, analysis, and evaluation\n- When the monitoring and measuring shall be performed\n- When results shall be analyzed and evaluated\n\nAI-specific monitoring must address:\n- Model performance metrics (accuracy, fairness, drift)\n- AI system usage patterns (intended vs. actual use)\n- Incidents and near-misses\n- Stakeholder feedback\n- Regulatory changes affecting AI compliance\n\nThe organization must evaluate AI system performance at planned intervals and when performance changes are observed.\n\n**9.2 — Internal audit:**\nThe organization must conduct internal audits at planned intervals to provide information on whether the AIMS:\n- Conforms to the organization's own requirements for the AIMS\n- Conforms to ISO 42001 requirements\n- Is effectively implemented and maintained\n\nAudit programme must consider AI risk levels (higher risk areas audited more frequently), changes affecting AI, and previous audit results.\n\n**9.3 — Management review:**\nTop management must review the AIMS at planned intervals. Inputs must include:\n- Status of actions from previous reviews\n- Changes in external and internal issues relevant to the AIMS\n- Information on AIMS performance including trends in AI incidents and nonconformities\n- AI risk assessment and risk treatment results\n- Monitoring and measurement results\n- Opportunities for continual improvement\n\nManagement review outputs must include decisions related to continual improvement, resource needs, and changes to the AIMS.\n\n**GOVERN mapping:** GOVERN Performance Dashboard operationalizes Clause 9.1. Internal audit support tools support 9.2. Executive reporting for management review generated from GOVERN data.\n\n---\n\n### Clause 10 — Improvement\n\n**10.1 — Continual improvement:**\nThe organization must continually improve the suitability, adequacy, and effectiveness of the AIMS. This includes using findings from monitoring, audit, incident analysis, and management review.\n\n**10.2 — Nonconformity and corrective action:**\nWhen a nonconformity occurs, the organization must:\n- React to the nonconformity and take action to control and correct it\n- Evaluate the need for action to eliminate causes\n- Review the effectiveness of corrective actions taken\n- Make changes to the AIMS if necessary\n- Maintain documented information as evidence\n\nCorrective action must be appropriate to the effects of the nonconformities encountered.\n\n**GOVERN mapping:** GOVERN Incident and Corrective Action module handles Clause 10.2. Nonconformity records, root cause analysis, corrective action plans, and effectiveness reviews all tracked.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-120b496e79efcb065c2e","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":70,"lineEnd":76,"originalCells":{"A":"### Clause 1 — Scope\nSpecifies that the standard applies to any organization involved in providing or using AI-based products or services. The standard is intended to help organizations demonstrate that AI is used responsibly, that related risks are managed appropriately, and that AI-specific opportunities are realized.\n\nThe standard acknowledges that AI introduces unique challenges to traditional management systems: opacity of models, emergent behavior, data dependency, and the interaction between AI objectives and human values.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-0a161827ca3090f6caea","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":77,"lineEnd":81,"originalCells":{"A":"### Clause 2 — Normative References\nReferences ISO/IEC 22989:2022 (AI concepts and terminology). Organizations implementing ISO 42001 must align their terminology with ISO/IEC 22989 definitions.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-b61b1d3d706da47c7a39","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":82,"lineEnd":91,"originalCells":{"A":"### Clause 3 — Terms and Definitions\nISO 42001 introduces key AIMS-specific definitions:\n- **AI system:** A machine-based system that, for a given set of objectives, generates outputs such as predictions, recommendations, decisions, or content that influence real or virtual environments\n- **AI policy:** Intentions and direction of an organization related to the development, provision, or use of AI\n- **AI risk:** Combination of the probability of occurrence of an AI-related harm and the severity of that harm\n- **AI objective:** Result to be achieved in relation to AI development, provision, or use\n- **Interested party (AI-specific):** Person or organization that can affect, be affected by, or perceive themselves to be affected by the organization's AI activities\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-0b148a00f959b399e896","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":92,"lineEnd":125,"originalCells":{"A":"### Clause 4 — Context of the Organization\n\nThis clause requires organizations to understand their environment before building the AIMS.\n\n**4.1 — Understanding the organization and its context:**\n- External factors: regulatory environment, market expectations, societal values, technological landscape\n- Internal factors: organizational culture, existing governance structures, data assets, AI capabilities, stakeholder expectations\n- AI-specific context: the nature of AI systems being developed or used, their intended purposes, affected populations, and potential societal impacts\n\n**4.2 — Understanding the needs and expectations of interested parties:**\nOrganizations must identify all parties with interests in their AI activities:\n- Customers and end users\n- Employees and their representatives\n- Regulatory bodies (national and international)\n- Civil society organizations\n- Supply chain partners\n- Shareholders and investors\n- Affected communities\n\nFor each, the organization must understand:\n- Their requirements relevant to the AIMS\n- Which requirements become compliance obligations\n- How their interests interact with AI risk and opportunity\n\n**4.3 — Determining the scope of the AIMS:**\nThe organization must define which AI systems, products, and services fall within AIMS scope. Scope decisions must be documented and justified. Organizations may begin with a subset of AI activities and expand — but scope exclusions cannot be used to avoid addressing material AI risks.\n\n**4.4 — AI management system:**\nThe organization must establish, implement, maintain, and continually improve the AIMS in accordance with the standard's requirements.\n\n**GOVERN mapping:** GOVERN Assess begins here — the AI Inventory defines scope, stakeholder identification tools support 4.2, and organizational context documentation feeds the AIMS foundation.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-0ffd1344de87b5830292","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":126,"lineEnd":167,"originalCells":{"A":"### Clause 5 — Leadership\n\nThis clause places responsibility at the senior leadership level. Unlike technical controls, leadership obligations in Clause 5 cannot be delegated away.\n\n**5.1 — Leadership and commitment:**\nTop management must demonstrate leadership and commitment to the AIMS by:\n- Taking accountability for the effectiveness of the AIMS\n- Ensuring AI policy and objectives are established and compatible with the organization's strategic direction\n- Integrating AIMS requirements into organizational processes\n- Ensuring resources are available for the AIMS\n- Communicating the importance of effective AI management\n- Ensuring the AIMS achieves its intended outcomes\n- Directing and supporting persons to contribute to AIMS effectiveness\n- Promoting continual improvement\n- Supporting other management roles to demonstrate leadership in their areas\n\nAI-specific leadership obligations:\n- Ensuring consideration of AI impacts on human rights and fundamental values is part of strategic planning\n- Ensuring AI-related risks are considered at the board/executive level\n- Establishing accountability chains for AI outcomes (not just AI outputs)\n\n**5.2 — AI policy:**\nTop management must establish an AI policy that:\n- Is appropriate to the purpose and context of the organization\n- Provides a framework for setting AI objectives\n- Includes a commitment to satisfying applicable requirements\n- Includes a commitment to continual improvement of the AIMS\n- Addresses the organization's approach to responsible AI, including how it balances innovation with risk management\n\nThe AI policy must be communicated within the organization, available to interested parties, and maintained as documented information.\n\n**5.3 — Organizational roles, responsibilities, and authorities:**\nTop management must assign and communicate roles including:\n- Who is responsible for ensuring the AIMS conforms to the standard\n- Who is responsible for reporting on AIMS performance to top management\n- Who has accountability for each AI system in scope\n- Who is the designated point of contact for AI-related incidents and regulatory inquiries\n\n**GOVERN mapping:** GOVERN Compliance Portal tracks leadership accountability assignments. CAIO/Chief AI Officer role supported. Board-level AI risk reporting dashboards generated from GOVERN data.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-4b8793d50f1197053f04","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":168,"lineEnd":218,"originalCells":{"A":"### Clause 6 — Planning\n\nPlanning is where the AIMS moves from policy to concrete action.\n\n**6.1 — Actions to address risks and opportunities:**\n\n**6.1.1 — General:**\nWhen planning the AIMS, the organization must consider the context (Clause 4.1 and 4.2) and determine:\n- Risks and opportunities that need to be addressed\n- How to integrate and implement actions into AIMS processes\n- How to evaluate the effectiveness of those actions\n\nAI-specific planning must address:\n- Risks related to data quality and bias\n- Risks related to model performance and reliability\n- Risks related to unintended use and misuse\n- Risks related to the AI system's impact on affected parties\n- Opportunities to improve processes, products, or services through AI\n- Opportunities to advance the organization's responsible AI commitments\n\n**6.1.2 — AI risk assessment:**\nThe organization must establish and maintain a process for AI risk assessment that:\n- Identifies AI risks (the what could go wrong)\n- Analyzes AI risks (likelihood and impact)\n- Evaluates AI risks against risk criteria\n- Produces comparable and reproducible results\n- Documents risk assessment results\n\n**6.1.3 — AI risk treatment:**\nBased on risk assessment results, the organization must:\n- Select appropriate risk treatment options (modify, retain, avoid, share)\n- Determine controls needed (referencing Annex A)\n- Formulate and implement a risk treatment plan\n- Obtain acceptance of residual risks from risk owners\n\n**6.2 — AI objectives and planning to achieve them:**\nThe organization must establish measurable AI objectives at relevant functions and levels:\n- Consistent with AI policy\n- Measurable (where practicable)\n- Monitored and communicated\n- Updated as appropriate\n\nFor each AI objective, the organization must determine: what will be done, what resources are required, who will be responsible, when it will be completed, and how results will be evaluated.\n\n**6.3 — Planning of changes:**\nChanges to the AIMS must be planned and implemented in a controlled manner, considering the purpose, potential consequences, resource availability, and responsibilities.\n\n**GOVERN mapping:** GOVERN Risk Engine operationalizes Clause 6.1.2 and 6.1.3. Risk assessment workflows, risk treatment plans, and residual risk acceptance records are generated and stored. GOVERN Objectives Module tracks AI objectives and progress metrics.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-708080018d967de7a798","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":219,"lineEnd":269,"originalCells":{"A":"### Clause 7 — Support\n\nSupport clauses ensure the AIMS is properly resourced and that people, information, and communication are aligned.\n\n**7.1 — Resources:**\nThe organization must determine and provide the resources needed for the AIMS, including:\n- Human resources with appropriate AI competencies\n- Infrastructure (compute, data platforms, tooling)\n- Organizational knowledge necessary for AI governance\n- External expertise where internal gaps exist\n\n**7.2 — Competence:**\nPersons doing AI-related work affecting AIMS performance must:\n- Have appropriate education, training, or experience\n- Have their competence evaluated\n- Have training needs identified and addressed\n- Maintain documented evidence of competence\n\nAI-specific competence requirements include:\n- Understanding of AI concepts and limitations\n- Awareness of AI-related risks and ethical considerations\n- Ability to evaluate AI system outputs critically\n- Knowledge of relevant regulations and standards\n\n**7.3 — Awareness:**\nAll persons in the organization must be aware of:\n- The AI policy\n- Their contribution to AIMS effectiveness\n- The implications of not conforming to AIMS requirements\n- The organization's approach to responsible AI\n\n**7.4 — Communication:**\nThe organization must determine:\n- What to communicate about the AIMS (internally and externally)\n- When to communicate\n- With whom to communicate\n- How to communicate\n- Who does the communicating\n\n**7.5 — Documented information:**\n\n**7.5.1 — General:** The AIMS must include documented information required by the standard plus additional documented information the organization determines is necessary for AIMS effectiveness.\n\n**7.5.2 — Creating and updating:** Documented information must have appropriate identification, format, media, review, and approval.\n\n**7.5.3 — Control of documented information:** Documented information must be available, protected, controlled for distribution, access, and retrieval. Changes must be controlled. External documented information must be identified and controlled.\n\n**GOVERN mapping:** GOVERN Compliance Portal is the documented information system. All AIMS records, risk assessments, training logs, incident reports, and audit trails maintained. Competency tracking module supports Clause 7.2.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-2ecccd65b3d46c08f5f0","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":270,"lineEnd":317,"originalCells":{"A":"### Clause 8 — Operation\n\nOperation clauses govern the day-to-day running of the AIMS — the processes that produce AI-related outputs.\n\n**8.1 — Operational planning and control:**\nThe organization must plan, implement, control, and review processes needed to meet AI management requirements. This includes:\n- Establishing criteria for processes\n- Controlling processes in accordance with criteria\n- Keeping documented information to demonstrate processes run as planned\n- Controlling planned changes and reviewing unintended changes\n\n**8.2 — AI risk assessment (operational):**\nThe organization must perform AI risk assessments at planned intervals, and when significant changes occur or are proposed.\n\n**8.3 — AI risk treatment (operational):**\nThe organization must implement the AI risk treatment plan and maintain documented information about results.\n\n**8.4 — AI system impact assessment:**\nFor AI systems with significant potential impact on individuals or communities, the organization must conduct an AI system impact assessment covering:\n- The intended purpose and intended use\n- Potential positive and negative impacts on natural persons and society\n- Affected groups (including vulnerable populations)\n- Severity and likelihood of negative impacts\n- Mitigating controls\n- Residual risks after mitigation\n\nThe impact assessment is distinct from the risk assessment (which focuses on organizational risk). The impact assessment focuses on societal and individual harm.\n\n**8.5 — Related policies and objectives for AI systems:**\nThe organization must ensure AI systems in scope have documented:\n- Intended purpose\n- Performance objectives\n- Applicable constraints\n- Required data inputs\n- Human oversight mechanisms\n- Expected operational environment\n\n**8.6 — Procurement and supply chain:**\nWhen procuring AI systems or AI-related services from external parties, the organization must:\n- Establish procurement criteria aligned with AI policy and risk requirements\n- Obtain sufficient information from suppliers to assess AI risks\n- Pass down requirements to suppliers as appropriate\n- Monitor supplier compliance with AI-related requirements\n\n**GOVERN mapping:** GOVERN Risk Engine handles 8.2–8.3. GOVERN Impact Assessment module handles 8.4. System cards generated for 8.5. GOVERN Vendor AI module handles 8.6 — tracking third-party AI systems and supplier compliance.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-a0a0eb733ad78b20c98d","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":318,"lineEnd":358,"originalCells":{"A":"### Clause 9 — Performance Evaluation\n\n**9.1 — Monitoring, measurement, analysis, and evaluation:**\nThe organization must determine:\n- What needs to be monitored and measured\n- Methods for monitoring, measurement, analysis, and evaluation\n- When the monitoring and measuring shall be performed\n- When results shall be analyzed and evaluated\n\nAI-specific monitoring must address:\n- Model performance metrics (accuracy, fairness, drift)\n- AI system usage patterns (intended vs. actual use)\n- Incidents and near-misses\n- Stakeholder feedback\n- Regulatory changes affecting AI compliance\n\nThe organization must evaluate AI system performance at planned intervals and when performance changes are observed.\n\n**9.2 — Internal audit:**\nThe organization must conduct internal audits at planned intervals to provide information on whether the AIMS:\n- Conforms to the organization's own requirements for the AIMS\n- Conforms to ISO 42001 requirements\n- Is effectively implemented and maintained\n\nAudit programme must consider AI risk levels (higher risk areas audited more frequently), changes affecting AI, and previous audit results.\n\n**9.3 — Management review:**\nTop management must review the AIMS at planned intervals. Inputs must include:\n- Status of actions from previous reviews\n- Changes in external and internal issues relevant to the AIMS\n- Information on AIMS performance including trends in AI incidents and nonconformities\n- AI risk assessment and risk treatment results\n- Monitoring and measurement results\n- Opportunities for continual improvement\n\nManagement review outputs must include decisions related to continual improvement, resource needs, and changes to the AIMS.\n\n**GOVERN mapping:** GOVERN Performance Dashboard operationalizes Clause 9.1. Internal audit support tools support 9.2. Executive reporting for management review generated from GOVERN data.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-7ab68da1f5acbf6a66bc","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":359,"lineEnd":377,"originalCells":{"A":"### Clause 10 — Improvement\n\n**10.1 — Continual improvement:**\nThe organization must continually improve the suitability, adequacy, and effectiveness of the AIMS. This includes using findings from monitoring, audit, incident analysis, and management review.\n\n**10.2 — Nonconformity and corrective action:**\nWhen a nonconformity occurs, the organization must:\n- React to the nonconformity and take action to control and correct it\n- Evaluate the need for action to eliminate causes\n- Review the effectiveness of corrective actions taken\n- Make changes to the AIMS if necessary\n- Maintain documented information as evidence\n\nCorrective action must be appropriate to the effects of the nonconformities encountered.\n\n**GOVERN mapping:** GOVERN Incident and Corrective Action module handles Clause 10.2. Nonconformity records, root cause analysis, corrective action plans, and effectiveness reviews all tracked.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-f12dc778e3549bf980b9","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":378,"lineEnd":450,"originalCells":{"A":"## Annex A — Reference Control Objectives and Controls\n\nAnnex A contains the full control set that organizations select from when building their AIMS. Unlike ISO 27001 (which requires all Annex A controls unless justified for exclusion), ISO 42001 Annex A controls are selected based on the organization's risk treatment decisions. Controls are grouped into themes:\n\n**A.2 — Policies for AI**\n- A.2.2: AI policy review\n- A.2.3: AI roles and responsibilities\n- A.2.4: Reporting of AI concerns\n- A.2.5: Supplier and third-party relationships\n- A.2.6: Responsibility for AI systems\n\n**A.3 — Internal organization**\n- A.3.2: Segregation of duties in AI\n- A.3.3: Contact with authorities\n- A.3.4: AI in project management\n- A.3.5: AI development in remote settings\n\n**A.4 — Resources for AI systems**\n- A.4.2: AI system resource management\n- A.4.3: Management of organizational knowledge for AI\n\n**A.5 — Assessing impacts of AI systems**\n- A.5.2: Processes to determine AI impacts\n- A.5.3: Documentation of AI system use cases\n- A.5.4: Impact assessment\n\n**A.6 — AI system life cycle**\n- A.6.1.1: Data management processes\n- A.6.1.2: Acquisition of data\n- A.6.1.3: Quality of data\n- A.6.1.4: Privacy and data governance\n- A.6.1.5: Roles and responsibilities in data\n- A.6.2.1: Intended purpose\n- A.6.2.2: AI system design principles\n- A.6.2.3: AI system specification\n- A.6.2.4: Transparency\n- A.6.2.5: Control of AI system\n- A.6.2.6: AI system training\n- A.6.2.7: Performance metrics\n- A.6.2.8: Testing and verification\n- A.6.2.9: Change management\n- A.6.2.10: AI system supply chain\n- A.6.2.11: Incident management\n- A.6.2.12: AI system availability\n- A.6.2.13: Decommissioning\n\n**A.7 — Data for AI systems**\n- A.7.2: Collection and generation of data\n- A.7.3: Acquisition of data from external parties\n- A.7.4: Data preparation\n- A.7.5: Technical measures for data\n- A.7.6: Organizational measures for data\n- A.7.7: Data access control\n\n**A.8 — Information for interested parties**\n- A.8.2: Public communication about AI\n- A.8.3: Documentation for deployers/users\n- A.8.4: Feedback and complaints\n\n**A.9 — Use of AI systems**\n- A.9.2: Context of use\n- A.9.3: Specifications for intended use\n- A.9.4: Interaction with AI system\n- A.9.5: AI system access control\n- A.9.6: Human oversight of AI system\n- A.9.7: Monitoring of AI system\n\n**A.10 — Third-party and customer relationships in AI systems**\n- A.10.2: Agreements with third parties\n- A.10.3: Addressing AI in third-party agreements\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-15018fbdf31006a48184","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":451,"lineEnd":477,"originalCells":{"A":"## Annex B — Implementation Guidance\n\nAnnex B provides non-normative guidance for implementing the controls in Annex A. It is structured to align with each A.x control and provides:\n- Rationale for the control\n- Examples of implementation approaches\n- Guidance for different organizational sizes and contexts\n- Cross-references to relevant standards (ISO/IEC 23894 for AI risk, ISO/IEC 38507 for AI governance)\n\nKey implementation guidance themes:\n\n**AI system lifecycle governance:**\nAnnex B emphasizes that AI systems require governance at every lifecycle stage — from initial requirements through development, testing, deployment, operation, monitoring, and decommissioning. Each stage has distinct control requirements.\n\n**Data quality and lineage:**\nAnnex B provides detailed guidance on establishing data quality criteria, lineage tracking, and the organizational structures needed to maintain data integrity for AI training and operation.\n\n**Human oversight design:**\nGuidance on how to design human oversight mechanisms that are meaningful (not rubber-stamping), appropriate to risk level, and resistant to automation bias.\n\n**Explainability:**\nGuidance on matching explainability requirements to stakeholder needs — recognizing that internal technical explainability (for developers and auditors) differs from user-facing explainability.\n\n**Incident response for AI:**\nSpecific guidance on how AI incidents differ from traditional IT incidents and how to adapt incident response processes accordingly.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-49fddac960f1d0d7d9ef","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":478,"lineEnd":497,"originalCells":{"A":"## Market Adoption\n\n**Microsoft:** Achieved ISO 42001 certification for cloud AI services in 2024. Azure AI and Microsoft Copilot services covered. Certification conducted by BSI Group.\n\n**Google:** Pursuing ISO 42001 certification for Vertex AI and related cloud AI services. Google Cloud announced conformance assessment initiative in 2024.\n\n**Amazon Web Services:** ISO 42001 roadmap announced for AWS AI services. Amazon Bedrock and SageMaker targeted for initial scope.\n\n**Salesforce:** ISO 42001 certification in progress for Einstein AI platform components.\n\n**IBM:** ISO 42001 alignment declared for IBM watsonx platform. Third-party certification in progress.\n\n**SAP:** SAP AI services pursuing ISO 42001 certification.\n\n**Enterprise procurement:** Multiple Fortune 500 procurement organizations now require ISO 42001 certification or documented roadmap as vendor qualification criteria, particularly for AI systems with HR, financial, or healthcare applications.\n\n**Government procurement:** UK government guidance encourages ISO 42001 as a credible AI governance signal in public procurement. Singapore government has incorporated ISO 42001 into its AI governance framework.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-02e8752f782cc61b7371","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":498,"lineEnd":526,"originalCells":{"A":"## GOVERN Component Mapping to ISO 42001\n\n| ISO 42001 Clause/Control | GOVERN Component | What It Does |\n|--------------------------|-----------------|-------------|\n| Clause 4.3 — AIMS scope | GOVERN Energy + AI Inventory | Discovers all AI systems; scope definition workflow |\n| Clause 5.1 — Leadership commitment | GOVERN Compliance Portal | Executive dashboard, accountability assignment |\n| Clause 5.2 — AI policy | GOVERN Compliance Portal | Policy documentation and communication records |\n| Clause 5.3 — Roles and responsibilities | GOVERN Compliance Portal | CAIO, HOO, system owner role assignment |\n| Clause 6.1.2 — AI risk assessment | GOVERN Risk Engine | Risk assessment workflows, scoring, documentation |\n| Clause 6.1.3 — AI risk treatment | GOVERN Risk Engine | Risk treatment plans, control selection, residual risk |\n| Clause 6.2 — AI objectives | GOVERN Objectives Module | Objective setting, measurement, progress tracking |\n| Clause 7.2 — Competence | GOVERN Learning Module | Competency tracking, training records |\n| Clause 7.5 — Documented information | GOVERN Compliance Portal | Document management, version control, audit trail |\n| Clause 8.2 — Risk assessment (operational) | GOVERN Risk Engine | Recurring assessments, change-triggered assessments |\n| Clause 8.4 — AI system impact assessment | GOVERN Impact Assessment | Impact assessment workflows, affected party analysis |\n| Clause 8.6 — Procurement/supply chain | GOVERN Vendor AI | Third-party AI inventory, supplier compliance tracking |\n| Clause 9.1 — Monitoring and measurement | GOVERN Performance Dashboard | Model performance metrics, usage monitoring, drift detection |\n| Clause 9.2 — Internal audit | GOVERN Audit Module | Audit planning, evidence collection, finding tracking |\n| Clause 9.3 — Management review | GOVERN Executive Reports | Management review input compilation, output tracking |\n| Clause 10.2 — Corrective action | GOVERN Incident Module | Nonconformity records, corrective action plans |\n| Annex A.4.2 — Resource management | GOVERN AI Inventory | System resource and capacity tracking |\n| Annex A.5.4 — Impact assessment | GOVERN Impact Assessment | Automated impact assessment generation |\n| Annex A.6.1 — Data management | GOVERN Data Governance | Data lineage, quality records, provenance tracking |\n| Annex A.6.2.7 — Performance metrics | GOVERN Performance Dashboard | Accuracy, fairness, and drift metrics |\n| Annex A.6.2.11 — Incident management | GOVERN Incident Module | AI incident detection, logging, response tracking |\n| Annex A.9.6 — Human oversight | GOVERN Human Oversight | Oversight control configuration, override logging |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-857bfae88cbaea56433f","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":527,"lineEnd":539,"originalCells":{"A":"## Relationship to Other Standards\n\n| Standard | Relationship to ISO 42001 |\n|---------|--------------------------|\n| ISO 9001:2015 | Quality management — integrates via HLS; ISO 42001 AIMS can be incorporated into existing QMS |\n| ISO/IEC 27001:2022 | Information security — integrates via HLS; AI-related security risks addressed jointly |\n| ISO 14001:2015 | Environmental management — integrates via HLS; AI energy consumption addressed |\n| ISO/IEC 23894:2023 | AI risk management guidance — normative reference for Clause 6 risk methodology |\n| ISO/IEC 38507:2022 | AI governance implications for organizations — supports Clause 5 leadership obligations |\n| ISO/IEC 22989:2022 | AI concepts and terminology — normative reference for Clause 3 definitions |\n| NIST AI RMF | US framework with similar intent; ISO 42001 maps to all four NIST AI RMF functions |\n| EU AI Act | Regulatory law; ISO 42001 certification is relevant evidence for high-risk AI conformity |\n| OECD AI Principles | Policy framework; ISO 42001 operationalizes OECD principles into management system requirements |"},"originalFormulas":{}},{"id":"ROW-MD-41f06155c8bdbc1233ff","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":174,"lineEnd":187,"originalCells":{"A":"**6.1.1 — General:**\nWhen planning the AIMS, the organization must consider the context (Clause 4.1 and 4.2) and determine:\n- Risks and opportunities that need to be addressed\n- How to integrate and implement actions into AIMS processes\n- How to evaluate the effectiveness of those actions\n\nAI-specific planning must address:\n- Risks related to data quality and bias\n- Risks related to model performance and reliability\n- Risks related to unintended use and misuse\n- Risks related to the AI system's impact on affected parties\n- Opportunities to improve processes, products, or services through AI\n- Opportunities to advance the organization's responsible AI commitments\n"},"originalFormulas":{}},{"id":"ROW-MD-82787b6a2c6deb96d42a","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":188,"lineEnd":195,"originalCells":{"A":"**6.1.2 — AI risk assessment:**\nThe organization must establish and maintain a process for AI risk assessment that:\n- Identifies AI risks (the what could go wrong)\n- Analyzes AI risks (likelihood and impact)\n- Evaluates AI risks against risk criteria\n- Produces comparable and reproducible results\n- Documents risk assessment results\n"},"originalFormulas":{}},{"id":"ROW-MD-3143e810d6f8a4611dbb","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":196,"lineEnd":218,"originalCells":{"A":"**6.1.3 — AI risk treatment:**\nBased on risk assessment results, the organization must:\n- Select appropriate risk treatment options (modify, retain, avoid, share)\n- Determine controls needed (referencing Annex A)\n- Formulate and implement a risk treatment plan\n- Obtain acceptance of residual risks from risk owners\n\n**6.2 — AI objectives and planning to achieve them:**\nThe organization must establish measurable AI objectives at relevant functions and levels:\n- Consistent with AI policy\n- Measurable (where practicable)\n- Monitored and communicated\n- Updated as appropriate\n\nFor each AI objective, the organization must determine: what will be done, what resources are required, who will be responsible, when it will be completed, and how results will be evaluated.\n\n**6.3 — Planning of changes:**\nChanges to the AIMS must be planned and implemented in a controlled manner, considering the purpose, potential consequences, resource availability, and responsibilities.\n\n**GOVERN mapping:** GOVERN Risk Engine operationalizes Clause 6.1.2 and 6.1.3. Risk assessment workflows, risk treatment plans, and residual risk acceptance records are generated and stored. GOVERN Objectives Module tracks AI objectives and progress metrics.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-a61a3cc9af779ff0c2b1","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":260,"lineEnd":261,"originalCells":{"A":"**7.5.1 — General:** The AIMS must include documented information required by the standard plus additional documented information the organization determines is necessary for AIMS effectiveness.\n"},"originalFormulas":{}},{"id":"ROW-MD-5edb14c50680f7a171c8","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":262,"lineEnd":263,"originalCells":{"A":"**7.5.2 — Creating and updating:** Documented information must have appropriate identification, format, media, review, and approval.\n"},"originalFormulas":{}},{"id":"ROW-MD-0e00ff8010344f74d911","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","sheet":"POLICY(7).md","row":264,"lineEnd":269,"originalCells":{"A":"**7.5.3 — Control of documented information:** Documented information must be available, protected, controlled for distribution, access, and retrieval. Changes must be controlled. External documented information must be identified and controlled.\n\n**GOVERN mapping:** GOVERN Compliance Portal is the documented information system. All AIMS records, risk assessments, training logs, incident reports, and audit trails maintained. Competency tracking module supports Clause 7.2.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-54dd39f159d73febeb7c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":1,"lineEnd":10,"originalCells":{"A":"# NIST 800-53 Rev 5 — Security and Privacy Controls\n\n**Document:** NIST Special Publication 800-53, Revision 5\n**Title:** Security and Privacy Controls for Information Systems and Organizations\n**Published:** September 2020 (Final); Updated December 2020\n**Publisher:** National Institute of Standards and Technology (NIST), U.S. Department of Commerce\n**Status:** Active — Required for federal systems; foundational for FedRAMP and ATO processes\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-1a2084eb76b606dcdf1b","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":11,"lineEnd":25,"originalCells":{"A":"## What NIST 800-53 Is\n\nNIST Special Publication 800-53 Rev 5 establishes the catalog of security and privacy controls for federal information systems and organizations. It is the definitive control library for U.S. federal agency security programs and serves as the basis for FedRAMP, FISMA compliance, and Authority to Operate (ATO) packages.\n\nRev 5 (2020) is the most significant revision since the publication's inception. Key changes relevant to AI governance:\n- Privacy controls integrated directly into the catalog (no longer a separate appendix)\n- Supply chain risk management elevated to a standalone family (SR)\n- Increased emphasis on system development lifecycle (SDLC) security\n- Stronger controls for automated decision-making and system integrity\n- New program management controls for organizational risk governance\n\nFor AI systems deployed on or interfacing with federal systems, 800-53 controls apply to the underlying infrastructure and operations. The NIST AI RMF addresses AI-specific trustworthiness risks; 800-53 addresses system security and privacy controls. Together they constitute a complete AI governance framework for federal deployment.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-7259081c7bea64bfa581","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":26,"lineEnd":52,"originalCells":{"A":"## The 20 Control Families\n\n| ID | Family Name | Description |\n|----|-------------|-------------|\n| AC | Access Control | User permissions, authentication, and authorization |\n| AT | Awareness and Training | Security training for personnel |\n| AU | Audit and Accountability | Logging, monitoring, and audit trails |\n| CA | Assessment, Authorization, and Monitoring | Continuous monitoring, system authorization |\n| CM | Configuration Management | Baseline configurations, change control |\n| CP | Contingency Planning | Backup, recovery, continuity |\n| IA | Identification and Authentication | Identity management, authentication mechanisms |\n| IR | Incident Response | Incident handling, reporting, and recovery |\n| MA | Maintenance | System maintenance procedures |\n| MP | Media Protection | Storage media control and disposal |\n| PE | Physical and Environmental Protection | Physical access, environmental hazards |\n| PL | Planning | Security and privacy planning |\n| PM | Program Management | Organization-level security program |\n| PS | Personnel Security | Background checks, termination procedures |\n| PT | PII Processing and Transparency | Privacy notice, consent, processing policies |\n| RA | Risk Assessment | Risk identification, assessment, and response |\n| SA | System and Services Acquisition | SDLC security, supply chain, vendor management |\n| SC | System and Communications Protection | Network architecture, data in transit, isolation |\n| SI | System and Information Integrity | Malware, software integrity, error handling |\n| SR | Supply Chain Risk Management | Third-party risk, component provenance |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-cc8c8a4c6e80ce35c3dc","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":53,"lineEnd":481,"originalCells":{"A":"## AI-Relevant Control Families — Detailed Coverage\n\n---\n\n### AC — Access Control\n\n**Applicability to AI Governance:** AI systems require access control to protect models, training data, inference APIs, and decision outputs from unauthorized access. AI-assisted access decisions must themselves be governed.\n\n**AI-Relevant Controls:**\n\n**AC-1 — Access Control Policy and Procedures**\nRequires documented access control policy covering all system components. For AI systems: policy must explicitly address access to model weights, training data repositories, inference endpoints, and AI pipeline components.\n\n**AC-2 — Account Management**\nRequires lifecycle management of accounts with access to system resources. For AI systems: manage accounts for data scientists, ML engineers, inference API users, and automated pipeline service accounts. Monitor for unused accounts with access to model artifacts.\n\n**AC-3 — Access Enforcement**\nRequires enforcement of approved authorizations. For AI systems: enforce role-based access to training data (read vs. write), model artifacts (read vs. deploy), and inference APIs. Use attribute-based access control (ABAC) for fine-grained control over which users can query which AI models.\n\n**AC-4 — Information Flow Enforcement**\nControls information flow within and between systems. For AI systems: control data flows from sensitive source systems into AI training pipelines. Prevent unauthorized exfiltration of AI model outputs that may contain sensitive information (e.g., model inversion attacks, membership inference).\n\n**AC-6 — Least Privilege**\nRequires minimum necessary access. For AI systems: service accounts running AI inference should have only the permissions required for inference, not training or deployment. Data scientists should not have production deployment rights.\n\n**AC-17 — Remote Access**\nControls remote access to systems. For AI systems: remote access to AI training infrastructure, MLOps platforms, and model registries must be authenticated, encrypted, and logged.\n\n**AC-22 — Publicly Accessible Content**\nControls information posted to publicly accessible systems. For AI systems: verify that publicly accessible AI APIs do not expose sensitive training data or model internals. Validate that AI-generated content does not inadvertently disclose restricted information.\n\n**GOVERN Assess Evaluation:** AC family evaluated via infrastructure configuration review, access control matrix review, and API access pattern analysis.\n\n---\n\n### AU — Audit and Accountability\n\n**Applicability to AI Governance:** AI systems must log decisions, inputs, outputs, and model changes to support accountability, incident investigation, and regulatory compliance. AI decision logging is foundational to the EU AI Act and emerging AI transparency requirements.\n\n**AI-Relevant Controls:**\n\n**AU-1 — Audit and Accountability Policy and Procedures**\nRequires documented audit policy. For AI systems: audit policy must address what AI system events are logged (inference requests, decision outputs, model deployments, training runs, configuration changes) and how logs are protected.\n\n**AU-2 — Event Logging**\nDefines events to be logged. For AI systems, required events include:\n- Inference API calls (timestamp, user/system ID, input hash, output hash)\n- Model deployment events (which model version deployed by whom)\n- Training run initiation and completion\n- Access to training data repositories\n- Model configuration changes\n- Anomalous output events (outputs flagged by monitoring)\n- Human override of AI decisions\n\n**AU-3 — Content of Audit Records**\nDefines the content of audit log entries. For AI systems: logs must capture sufficient context to reconstruct the AI decision — model version, input parameters, output, confidence score, and the identity of the requesting user or system.\n\n**AU-6 — Audit Record Review, Analysis, and Reporting**\nRequires regular review of audit logs. For AI systems: periodic review of AI decision logs for anomalies, bias patterns, unusual access, and evidence of adversarial inputs.\n\n**AU-9 — Protection of Audit Information**\nPrevents unauthorized access to audit logs. For AI systems: AI decision logs must be write-protected and stored independently of the systems that generate them (defense against log tampering after adversarial incident).\n\n**AU-10 — Non-Repudiation**\nProvides evidence that actions cannot be denied. For AI systems: digital signing of AI inference requests and responses supports non-repudiation for high-stakes AI decisions (medical, financial, legal, regulatory).\n\n**AU-11 — Audit Record Retention**\nDefines retention periods. For AI systems: retain AI decision logs for the period required by applicable regulations. EU AI Act requires post-market monitoring records for 10 years for high-risk AI systems. Financial services AI decisions may require 5–7 year retention.\n\n**AU-12 — Audit Record Generation**\nRequires audit record generation capability. For AI systems: ensure every AI system component (inference API, model serving infrastructure, training pipeline) generates audit records that flow to the centralized audit repository.\n\n**AU-14 — Session Audit**\nRequires logging of session activity. For AI systems: log user sessions interacting with AI systems, capturing the sequence of AI queries and human actions taken on AI outputs.\n\n**GOVERN Assess Evaluation:** AU family evaluated via log completeness review, retention period verification, and AI decision log format assessment.\n\n---\n\n### CA — Assessment, Authorization, and Monitoring\n\n**Applicability to AI Governance:** AI systems deployed on federal infrastructure require authorization (ATO). CA controls govern the assessment process that supports authorization decisions and the continuous monitoring that maintains authorization.\n\n**AI-Relevant Controls:**\n\n**CA-1 — Assessment, Authorization, and Monitoring Policy and Procedures**\nRequires documented policy for system authorization. For AI systems: policy must address the AI-specific assessment activities required before authorization, including AI RMF MEASURE activities, bias assessments, and adversarial robustness testing.\n\n**CA-2 — Control Assessments**\nRequires regular assessment of security controls. For AI systems: control assessments must include AI-specific controls (model integrity, output monitoring, bias metrics) in addition to traditional security controls.\n\n**CA-3 — Information Exchange**\nControls connections between systems. For AI systems: document all API integrations between the AI system and other systems. Assess risk of each integration. Control data flows through formal interconnection agreements.\n\n**CA-5 — Plan of Action and Milestones (POA&M)**\nRequires tracking of identified security weaknesses. For AI systems: AI-specific findings from assessments (bias issues, adversarial vulnerabilities, explainability gaps) must be tracked in the POA&M with remediation milestones.\n\n**CA-6 — Authorization**\nRequires formal authorization before operation. For AI systems: ATO package for an AI system must include AI RMF documentation, bias assessment results, TEVV documentation, and monitoring plan in addition to standard 800-53 control documentation.\n\n**CA-7 — Continuous Monitoring**\nRequires ongoing monitoring of security controls. For AI systems: continuous monitoring program must include AI-specific metrics (model performance drift, bias metric trends, anomalous output rates, adversarial probe detection) alongside traditional security monitoring.\n\n**CA-8 — Penetration Testing**\nRequires periodic penetration testing. For AI systems: penetration testing scope must include AI-specific attack surfaces — prompt injection, model inversion, membership inference, adversarial examples, and model extraction attacks.\n\n**CA-9 — Internal System Connections**\nControls internal connections. For AI systems: document and assess internal connections between AI inference services, model registries, training pipelines, and data stores.\n\n**GOVERN Assess Evaluation:** CA family evaluated by reviewing ATO documentation, continuous monitoring plans, and penetration test scope coverage of AI attack surfaces.\n\n---\n\n### CM — Configuration Management\n\n**Applicability to AI Governance:** AI model version control is a direct application of configuration management. Controlling which model version is deployed, tracking changes, and maintaining a secure baseline are CM responsibilities extended to the AI domain.\n\n**AI-Relevant Controls:**\n\n**CM-1 — Configuration Management Policy and Procedures**\nRequires documented CM policy. For AI systems: CM policy must explicitly address model versioning, model registry governance, hyperparameter configuration control, and deployment pipeline security.\n\n**CM-2 — Baseline Configuration**\nRequires maintained baseline configurations. For AI systems: the baseline includes the model version (artifact hash), inference server configuration, input/output schema, performance benchmarks, and approved dependency versions. Any deviation from baseline requires change control.\n\n**CM-3 — Configuration Change Control**\nRequires change control process. For AI systems: any change to a deployed model (fine-tuning, RAG corpus update, prompt template change, system prompt modification, threshold change) requires a change control ticket, impact assessment, and authorization.\n\n**CM-4 — Impact Analyses**\nRequires analysis before changes are implemented. For AI systems: AI model update impact analysis must include bias re-assessment, performance regression testing, safety testing, and review of changes to output distribution.\n\n**CM-6 — Configuration Settings**\nRequires configuration of security settings. For AI systems: define and enforce configuration standards for AI serving infrastructure — disable debug endpoints, enforce output filtering, set rate limits, configure authentication on inference APIs.\n\n**CM-7 — Least Functionality**\nRequires minimum functionality. For AI systems: disable unused inference capabilities, model endpoints not in active use, and administrative interfaces. Apply principle of least functionality to AI system capabilities.\n\n**CM-8 — System Component Inventory**\nRequires inventory of system components. For AI systems: maintain an inventory that includes all AI models (with artifact hashes), model versions, training dataset versions, framework dependencies, and third-party AI components (APIs, SDKs, pre-trained models).\n\n**CM-10 — Software Usage Restrictions**\nControls software licensing. For AI systems: verify licensing for all AI frameworks, pre-trained models, and datasets used. Track license terms that may restrict commercial use or require disclosure of derivative works.\n\n**CM-11 — User-Installed Software**\nControls unauthorized software. For AI systems: prevent data scientists and engineers from installing unapproved AI frameworks, libraries, or models on production systems.\n\n**GOVERN Assess Evaluation:** CM family evaluated via model registry review, change control log analysis, and AI component inventory verification.\n\n---\n\n### IA — Identification and Authentication\n\n**Applicability to AI Governance:** AI systems themselves are principals in identity architectures. Service accounts, API keys, and automated pipeline identities require the same rigor as human identities.\n\n**AI-Relevant Controls:**\n\n**IA-1 — Identification and Authentication Policy and Procedures**\nRequires documented IA policy. For AI systems: policy must address authentication for human users of AI systems, authentication of AI service accounts, and authentication of AI API clients.\n\n**IA-2 — Identification and Authentication (Organizational Users)**\nRequires multi-factor authentication for users. For AI systems: MFA required for access to AI model registries, training platforms, MLOps dashboards, and inference API administrative interfaces.\n\n**IA-3 — Device Identification and Authentication**\nRequires device-level authentication. For AI systems: inference server instances, training workers, and pipeline automation agents must authenticate to the AI system infrastructure before receiving credentials or accessing model artifacts.\n\n**IA-4 — Identifier Management**\nManages identifiers for users and devices. For AI systems: assign unique identifiers to each AI model version, each training run, and each inference service instance. Use identifiers for audit trail traceability.\n\n**IA-5 — Authenticator Management**\nManages credentials. For AI systems: rotate API keys for AI inference endpoints regularly. Store AI system credentials in secrets management systems (not in code repositories or configuration files). Audit credential access.\n\n**IA-8 — Identification and Authentication (Non-Organizational Users)**\nAddresses external user authentication. For AI systems: users outside the organization accessing AI APIs (customers, partners) must be authenticated. Define authentication requirements in AI API access policies.\n\n**IA-9 — Service Identification and Authentication**\nRequires mutual authentication for services. For AI systems: AI microservices (inference, training, data pipelines) must mutually authenticate using service mesh identities or mTLS. Prevent rogue services from impersonating AI system components.\n\n**IA-10 — Adaptive Authentication**\nAllows risk-based authentication. For AI systems: consider step-up authentication for high-stakes AI API calls (e.g., AI-assisted financial transactions, medical AI recommendations, identity verification).\n\n**GOVERN Assess Evaluation:** IA family evaluated via authentication mechanism review, credential management policy assessment, and service account inventory.\n\n---\n\n### IR — Incident Response\n\n**Applicability to AI Governance:** AI incidents require specialized response procedures. Traditional incident response may not address AI-specific scenarios: bias-induced harm at scale, adversarial manipulation of AI decisions, data poisoning discovery, or large-scale confabulation events.\n\n**AI-Relevant Controls:**\n\n**IR-1 — Incident Response Policy and Procedures**\nRequires documented IR policy. For AI systems: IR policy must explicitly address AI incident types and response procedures.\n\n**IR-2 — Incident Response Training**\nRequires training on incident response. For AI systems: training must cover AI-specific incident scenarios: how to recognize bias-related harms, how to respond to adversarial attacks, when to suspend an AI system, and how to notify affected users.\n\n**IR-3 — Incident Response Testing**\nRequires testing of incident response capability. For AI systems: tabletop exercises should include AI incident scenarios — bias discovery, model poisoning, hallucination causing harm, AI system outage during critical operations.\n\n**IR-4 — Incident Handling**\nRequires incident handling capability. For AI systems: incident handling procedures must include:\n- Detection criteria for AI incidents (performance degradation thresholds, bias metric breach, anomalous output volume, user harm reports)\n- Containment options (suspend specific model endpoints, roll back to prior model version, enable human override, reduce inference rate)\n- Eradication steps (identify root cause — training data issue, model issue, adversarial input, infrastructure issue)\n- Recovery steps (revalidate model before restoring service, notify affected users, document lessons learned)\n- Post-incident review requirements\n\n**IR-5 — Incident Monitoring**\nRequires incident tracking. For AI systems: track AI incidents in the incident tracking system with AI-specific fields (model version, affected use case, number of users/decisions affected, harm category).\n\n**IR-6 — Incident Reporting**\nRequires incident reporting. For AI systems: define thresholds for external notification of AI incidents (e.g., EU AI Act Article 62 requires notification of serious incidents for high-risk AI systems within 15 days of becoming aware). Define internal reporting escalation paths.\n\n**IR-7 — Incident Response Assistance**\nRequires access to incident response assistance. For AI systems: identify subject matter experts for AI incident types (ML engineers for model issues, data scientists for bias, security team for adversarial attacks, legal for regulatory notification).\n\n**IR-8 — Incident Response Plan**\nRequires a documented incident response plan. For AI systems: the IR plan must include an AI incident annex covering AI-specific scenarios, containment options, rollback procedures, and notification requirements.\n\n**GOVERN Assess Evaluation:** IR family evaluated via IR plan review, AI incident scenario coverage, and incident response test records.\n\n---\n\n### PM — Program Management\n\n**Applicability to AI Governance:** The PM family establishes the organizational infrastructure for security programs. For AI governance, PM controls ensure AI risk management is a sustained program, not a one-time assessment.\n\n**AI-Relevant Controls:**\n\n**PM-1 — Information Security Program Plan**\nRequires a documented security program plan. For AI systems: the program plan must address AI risk management as a component of the overall security program. Reference the organizational AI governance policy.\n\n**PM-2 — Information Security Program Leadership Roles**\nRequires leadership accountability. For AI systems: designate an AI governance lead (Chief AI Officer, AI Risk Officer, or equivalent) with clear authority and accountability for organizational AI risk management.\n\n**PM-9 — Risk Management Strategy**\nRequires a documented risk management strategy. For AI systems: the risk management strategy must include AI risks as a recognized risk category with defined risk tolerance, treatment approaches, and escalation criteria.\n\n**PM-10 — Authorization Process**\nRequires a process for authorizing systems. For AI systems: the authorization process must include AI-specific assessment requirements — AI RMF documentation, bias assessment, TEVV documentation, monitoring plan — as prerequisites for ATO.\n\n**PM-11 — Mission and Business Process Definition**\nRequires documentation of organizational missions. For AI systems: document how AI systems support organizational missions and business processes. Use this to determine AI system criticality and applicable security controls.\n\n**PM-28 — Risk Framing**\nRequires identification of key risk assumptions. For AI systems: document assumptions about AI system risk (e.g., assumed attack surface, assumed user population, assumed operating environment). Revisit assumptions when context changes.\n\n**PM-30 — Supply Chain Risk Management Strategy**\nRequires supply chain risk strategy. For AI systems: AI supply chain risks (third-party models, training datasets, AI frameworks, cloud AI services) must be addressed in the supply chain risk strategy.\n\n**PM-31 — Continuous Improvement**\nRequires continuous improvement processes. For AI systems: establish feedback loops from AI monitoring, incident response, and user feedback into AI system improvement. Track improvement outcomes.\n\n**GOVERN Assess Evaluation:** PM family evaluated via program documentation review, leadership accountability assessment, and risk management strategy review.\n\n---\n\n### RA — Risk Assessment\n\n**Applicability to AI Governance:** RA controls provide the systematic methodology for identifying, assessing, and responding to risks — directly applicable to AI system risk assessment and the MAP/MEASURE functions of the NIST AI RMF.\n\n**AI-Relevant Controls:**\n\n**RA-1 — Risk Assessment Policy and Procedures**\nRequires documented risk assessment policy. For AI systems: policy must include AI-specific risk assessment methodology, frequency of AI risk assessments, and required inputs (model documentation, TEVV results, bias assessments).\n\n**RA-2 — Security Categorization**\nRequires categorization of information systems by impact. For AI systems: categorize the AI system using FIPS 199 criteria (low/moderate/high for confidentiality, integrity, availability). Consider AI-specific impacts: a bias-laden AI system may have high integrity impact even if confidentiality and availability are low.\n\n**RA-3 — Risk Assessment**\nRequires formal risk assessment. For AI systems: risk assessment must include:\n- AI-specific threats (adversarial attacks, data poisoning, model theft, prompt injection)\n- AI-specific vulnerabilities (training data quality, model robustness, explainability gaps)\n- AI-specific impacts (discriminatory outcomes, decision errors at scale, privacy violations through model inversion)\n- AI-specific likelihood factors (system accessibility, attacker sophistication, data sensitivity)\n\n**RA-5 — Vulnerability Monitoring and Scanning**\nRequires vulnerability scanning. For AI systems: in addition to traditional vulnerability scanning, conduct AI-specific vulnerability assessments including adversarial robustness testing, bias audits, and model security evaluations.\n\n**RA-7 — Risk Response**\nRequires documented risk responses. For AI systems: document risk responses for AI-specific risks — model retraining to address bias, adversarial training to address robustness gaps, access control hardening for model theft risks, output filtering for harmful content risks.\n\n**RA-9 — Criticality Analysis**\nRequires analysis of AI component criticality. For AI systems: identify which AI components are most critical to organizational mission. Apply enhanced controls to critical AI components.\n\n**RA-10 — Threat Hunting**\nRequires proactive threat hunting. For AI systems: include AI-specific threat hunting — monitoring for signs of data poisoning, model theft attempts, adversarial probe patterns, and unauthorized model access.\n\n**GOVERN Assess Evaluation:** RA family evaluated via risk assessment documentation, AI threat model review, and vulnerability assessment scope verification.\n\n---\n\n### SA — System and Services Acquisition\n\n**Applicability to AI Governance:** SA controls govern how organizations acquire AI systems and services, including third-party AI models, AI-as-a-Service platforms, and AI development tools. AI procurement governance is increasingly critical as organizations deploy AI from a complex ecosystem of vendors.\n\n**AI-Relevant Controls:**\n\n**SA-1 — System and Services Acquisition Policy and Procedures**\nRequires documented acquisition policy. For AI systems: acquisition policy must address AI-specific procurement requirements — vendor AI governance practices, model transparency documentation, bias testing evidence, security assessment requirements.\n\n**SA-3 — System Development Life Cycle**\nRequires SDLC security integration. For AI systems: the AI development lifecycle (data collection, model training, validation, deployment, monitoring) must integrate security and privacy at each stage. Align with ML-specific SDLC frameworks (MLOps, ModelOps).\n\n**SA-4 — Acquisition Process**\nRequires security requirements in acquisitions. For AI systems: include AI-specific security and governance requirements in all AI procurement contracts:\n- Model transparency and documentation requirements\n- Bias testing evidence requirements\n- Security assessment results\n- Data handling and privacy requirements\n- Incident response obligations\n- Access to model cards and technical documentation\n- Audit rights\n\n**SA-5 — System Documentation**\nRequires system documentation from vendors. For AI systems: require from AI vendors: model cards, data sheets, technical documentation of model architecture and training, known limitations, performance benchmarks, bias evaluation results.\n\n**SA-8 — Security and Privacy Engineering Principles**\nRequires security and privacy engineering. For AI systems: apply privacy-by-design to AI systems. Consider privacy-preserving ML techniques (differential privacy, federated learning) where applicable. Document privacy engineering decisions.\n\n**SA-9 — External System Services**\nControls external service dependencies. For AI systems: document all third-party AI services used (LLM APIs, computer vision APIs, speech recognition services). Assess risk of each dependency. Ensure continuity if third-party service is discontinued.\n\n**SA-10 — Developer Configuration Management**\nRequires developer CM practices. For AI systems: require from AI developers: model version control, reproducibility of training runs, documentation of training data provenance, and change tracking for model updates.\n\n**SA-11 — Developer Testing and Evaluation**\nRequires developer security testing. For AI systems: require from AI developers: evidence of security testing (adversarial robustness, model inversion resistance), bias testing across protected categories, and TEVV documentation.\n\n**SA-15 — Development Process, Standards, and Tools**\nRequires secure development practices. For AI systems: require AI development teams to use approved, version-controlled ML frameworks. Scan AI dependencies for vulnerabilities. Use secure ML development environments.\n\n**SA-16 — Developer-Provided Training**\nRequires developer training provision. For AI systems: require AI vendors to provide training on AI system limitations, appropriate use cases, and risk indicators operators should monitor.\n\n**SA-17 — Developer Security and Privacy Architecture**\nRequires architectural documentation from developers. For AI systems: require architectural documentation showing how AI system components are secured, how data flows are protected, and how privacy is maintained.\n\n**GOVERN Assess Evaluation:** SA family evaluated via procurement policy review, vendor contract analysis, and third-party AI service inventory assessment.\n\n---\n\n### SC — System and Communications Protection\n\n**Applicability to AI Governance:** SC controls protect data in transit and at rest — directly applicable to protecting AI training data, model artifacts, and inference payloads. AI systems often handle sensitive data; SC controls ensure that data is protected throughout the AI pipeline.\n\n**AI-Relevant Controls:**\n\n**SC-1 — System and Communications Protection Policy and Procedures**\nRequires documented communications protection policy. For AI systems: policy must address encryption of AI training data, model artifacts, and inference API communications.\n\n**SC-5 — Denial-of-Service Protection**\nRequires DoS protection. For AI systems: AI inference APIs are targets for abuse (computational DoS via complex queries, resource exhaustion via high-frequency requests). Implement rate limiting, query complexity limits, and abuse detection for AI inference endpoints.\n\n**SC-7 — Boundary Protection**\nRequires network boundary controls. For AI systems: AI inference services, model registries, and training infrastructure should be network-isolated. Control ingress and egress. Use API gateways for inference endpoint exposure.\n\n**SC-8 — Transmission Confidentiality and Integrity**\nRequires protection of transmitted information. For AI systems: encrypt all inference API communications (TLS 1.3 minimum). Protect training data pipelines with encryption in transit. Sign model artifact transfers to verify integrity.\n\n**SC-12 — Cryptographic Key Establishment and Management**\nRequires cryptographic key management. For AI systems: manage cryptographic keys used to sign model artifacts, encrypt training data, and authenticate AI service accounts. Use hardware security modules (HSMs) for high-value key material.\n\n**SC-13 — Cryptographic Protection**\nRequires approved cryptographic mechanisms. For AI systems: use NIST-approved algorithms for all AI system encryption. Consider post-quantum cryptography for long-lived model artifacts.\n\n**SC-28 — Protection of Information at Rest**\nRequires encryption of stored information. For AI systems: encrypt AI training datasets, model artifacts (weights, embeddings), and AI decision logs at rest. Define encryption key management for model storage.\n\n**SC-39 — Process Isolation**\nRequires process isolation. For AI systems: isolate AI inference processes from other system processes. Prevent inference workloads from accessing training data repositories, administrative interfaces, or other sensitive resources.\n\n**SC-45 — System Time Synchronization**\nRequires time synchronization. For AI systems: accurate timestamps are critical for AI audit logs, incident correlation, and regulatory compliance. Ensure AI system infrastructure uses synchronized time sources.\n\n**GOVERN Assess Evaluation:** SC family evaluated via network architecture review, encryption configuration assessment, and data protection control verification.\n\n---\n\n### SI — System and Information Integrity\n\n**Applicability to AI Governance:** SI controls protect the integrity of AI system software, data, and outputs. For AI, integrity extends beyond traditional software integrity to include model integrity (detecting poisoned or tampered models), data integrity (detecting corrupted training data), and output integrity (detecting hallucinations and adversarial outputs).\n\n**AI-Relevant Controls:**\n\n**SI-1 — System and Information Integrity Policy and Procedures**\nRequires documented integrity policy. For AI systems: integrity policy must address model artifact integrity verification, training data integrity controls, and output integrity monitoring.\n\n**SI-2 — Flaw Remediation**\nRequires patching and remediation of flaws. For AI systems: flaws include both traditional software vulnerabilities in AI infrastructure and AI-specific issues (discovered bias, adversarial vulnerabilities, performance degradation). Define remediation processes for AI-specific flaws.\n\n**SI-3 — Malicious Code Protection**\nRequires malware protection. For AI systems: AI development environments are targets for malware that steals model artifacts or poisons training data. Apply malware protection to AI development and serving infrastructure.\n\n**SI-4 — System Monitoring**\nRequires system monitoring. For AI systems: monitoring must include AI-specific indicators of compromise: anomalous inference patterns, model performance drift, unusual output distributions, signs of adversarial probing, data exfiltration through model inference (model inversion).\n\n**SI-5 — Security Alerts, Advisories, and Directives**\nRequires response to security alerts. For AI systems: subscribe to AI security vulnerability feeds. Track CVEs affecting AI frameworks (TensorFlow, PyTorch, Hugging Face). Respond to AI-specific security advisories.\n\n**SI-7 — Software, Firmware, and Information Integrity**\nRequires integrity verification of software and data. For AI systems:\n- Hash and sign model artifacts; verify integrity before deployment\n- Verify integrity of training datasets before training runs\n- Detect unauthorized modifications to AI system components\n- Use model provenance tracking to verify model origin\n\n**SI-8 — Spam and Phishing Protection**\nRequires anti-spam protection. For AI systems: AI systems that process email, documents, or user-submitted content must include input validation to prevent prompt injection via malicious content in processed data.\n\n**SI-10 — Information Input Validation**\nRequires validation of information inputs. For AI systems: validate inputs to AI inference APIs — length limits, content type validation, schema validation, and detection of adversarial inputs. Reject malformed or potentially adversarial inputs before they reach the model.\n\n**SI-12 — Information Management and Retention**\nRequires information management policies. For AI systems: define retention policies for AI training data, model artifacts, inference logs, and bias assessment records. Comply with applicable legal and regulatory retention requirements.\n\n**SI-14 — Non-Persistence**\nRequires non-persistence of certain data. For AI systems: AI systems that process PII or sensitive data should not persist sensitive inputs beyond what is required for the inference operation. Define data minimization policies for AI inference.\n\n**SI-19 — De-Identification**\nRequires de-identification of PII. For AI systems: de-identify training data containing PII before use in model training. Apply differential privacy techniques where de-identification is insufficient. Verify de-identification effectiveness.\n\n**SI-20 — Tainting**\nControls information tainting. For AI systems: track provenance of data that flows into AI training pipelines. Detect when tainted (compromised or low-quality) data contaminates training datasets.\n\n**GOVERN Assess Evaluation:** SI family evaluated via model integrity verification review, input validation assessment, monitoring coverage analysis, and output integrity control review.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-2db25eb81374e2072e9f","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":57,"lineEnd":87,"originalCells":{"A":"### AC — Access Control\n\n**Applicability to AI Governance:** AI systems require access control to protect models, training data, inference APIs, and decision outputs from unauthorized access. AI-assisted access decisions must themselves be governed.\n\n**AI-Relevant Controls:**\n\n**AC-1 — Access Control Policy and Procedures**\nRequires documented access control policy covering all system components. For AI systems: policy must explicitly address access to model weights, training data repositories, inference endpoints, and AI pipeline components.\n\n**AC-2 — Account Management**\nRequires lifecycle management of accounts with access to system resources. For AI systems: manage accounts for data scientists, ML engineers, inference API users, and automated pipeline service accounts. Monitor for unused accounts with access to model artifacts.\n\n**AC-3 — Access Enforcement**\nRequires enforcement of approved authorizations. For AI systems: enforce role-based access to training data (read vs. write), model artifacts (read vs. deploy), and inference APIs. Use attribute-based access control (ABAC) for fine-grained control over which users can query which AI models.\n\n**AC-4 — Information Flow Enforcement**\nControls information flow within and between systems. For AI systems: control data flows from sensitive source systems into AI training pipelines. Prevent unauthorized exfiltration of AI model outputs that may contain sensitive information (e.g., model inversion attacks, membership inference).\n\n**AC-6 — Least Privilege**\nRequires minimum necessary access. For AI systems: service accounts running AI inference should have only the permissions required for inference, not training or deployment. Data scientists should not have production deployment rights.\n\n**AC-17 — Remote Access**\nControls remote access to systems. For AI systems: remote access to AI training infrastructure, MLOps platforms, and model registries must be authenticated, encrypted, and logged.\n\n**AC-22 — Publicly Accessible Content**\nControls information posted to publicly accessible systems. For AI systems: verify that publicly accessible AI APIs do not expose sensitive training data or model internals. Validate that AI-generated content does not inadvertently disclose restricted information.\n\n**GOVERN Assess Evaluation:** AC family evaluated via infrastructure configuration review, access control matrix review, and API access pattern analysis.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-88ec8e79d3fa09b97c69","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":88,"lineEnd":131,"originalCells":{"A":"### AU — Audit and Accountability\n\n**Applicability to AI Governance:** AI systems must log decisions, inputs, outputs, and model changes to support accountability, incident investigation, and regulatory compliance. AI decision logging is foundational to the EU AI Act and emerging AI transparency requirements.\n\n**AI-Relevant Controls:**\n\n**AU-1 — Audit and Accountability Policy and Procedures**\nRequires documented audit policy. For AI systems: audit policy must address what AI system events are logged (inference requests, decision outputs, model deployments, training runs, configuration changes) and how logs are protected.\n\n**AU-2 — Event Logging**\nDefines events to be logged. For AI systems, required events include:\n- Inference API calls (timestamp, user/system ID, input hash, output hash)\n- Model deployment events (which model version deployed by whom)\n- Training run initiation and completion\n- Access to training data repositories\n- Model configuration changes\n- Anomalous output events (outputs flagged by monitoring)\n- Human override of AI decisions\n\n**AU-3 — Content of Audit Records**\nDefines the content of audit log entries. For AI systems: logs must capture sufficient context to reconstruct the AI decision — model version, input parameters, output, confidence score, and the identity of the requesting user or system.\n\n**AU-6 — Audit Record Review, Analysis, and Reporting**\nRequires regular review of audit logs. For AI systems: periodic review of AI decision logs for anomalies, bias patterns, unusual access, and evidence of adversarial inputs.\n\n**AU-9 — Protection of Audit Information**\nPrevents unauthorized access to audit logs. For AI systems: AI decision logs must be write-protected and stored independently of the systems that generate them (defense against log tampering after adversarial incident).\n\n**AU-10 — Non-Repudiation**\nProvides evidence that actions cannot be denied. For AI systems: digital signing of AI inference requests and responses supports non-repudiation for high-stakes AI decisions (medical, financial, legal, regulatory).\n\n**AU-11 — Audit Record Retention**\nDefines retention periods. For AI systems: retain AI decision logs for the period required by applicable regulations. EU AI Act requires post-market monitoring records for 10 years for high-risk AI systems. Financial services AI decisions may require 5–7 year retention.\n\n**AU-12 — Audit Record Generation**\nRequires audit record generation capability. For AI systems: ensure every AI system component (inference API, model serving infrastructure, training pipeline) generates audit records that flow to the centralized audit repository.\n\n**AU-14 — Session Audit**\nRequires logging of session activity. For AI systems: log user sessions interacting with AI systems, capturing the sequence of AI queries and human actions taken on AI outputs.\n\n**GOVERN Assess Evaluation:** AU family evaluated via log completeness review, retention period verification, and AI decision log format assessment.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-804ee25e774f43a6a49a","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":132,"lineEnd":165,"originalCells":{"A":"### CA — Assessment, Authorization, and Monitoring\n\n**Applicability to AI Governance:** AI systems deployed on federal infrastructure require authorization (ATO). CA controls govern the assessment process that supports authorization decisions and the continuous monitoring that maintains authorization.\n\n**AI-Relevant Controls:**\n\n**CA-1 — Assessment, Authorization, and Monitoring Policy and Procedures**\nRequires documented policy for system authorization. For AI systems: policy must address the AI-specific assessment activities required before authorization, including AI RMF MEASURE activities, bias assessments, and adversarial robustness testing.\n\n**CA-2 — Control Assessments**\nRequires regular assessment of security controls. For AI systems: control assessments must include AI-specific controls (model integrity, output monitoring, bias metrics) in addition to traditional security controls.\n\n**CA-3 — Information Exchange**\nControls connections between systems. For AI systems: document all API integrations between the AI system and other systems. Assess risk of each integration. Control data flows through formal interconnection agreements.\n\n**CA-5 — Plan of Action and Milestones (POA&M)**\nRequires tracking of identified security weaknesses. For AI systems: AI-specific findings from assessments (bias issues, adversarial vulnerabilities, explainability gaps) must be tracked in the POA&M with remediation milestones.\n\n**CA-6 — Authorization**\nRequires formal authorization before operation. For AI systems: ATO package for an AI system must include AI RMF documentation, bias assessment results, TEVV documentation, and monitoring plan in addition to standard 800-53 control documentation.\n\n**CA-7 — Continuous Monitoring**\nRequires ongoing monitoring of security controls. For AI systems: continuous monitoring program must include AI-specific metrics (model performance drift, bias metric trends, anomalous output rates, adversarial probe detection) alongside traditional security monitoring.\n\n**CA-8 — Penetration Testing**\nRequires periodic penetration testing. For AI systems: penetration testing scope must include AI-specific attack surfaces — prompt injection, model inversion, membership inference, adversarial examples, and model extraction attacks.\n\n**CA-9 — Internal System Connections**\nControls internal connections. For AI systems: document and assess internal connections between AI inference services, model registries, training pipelines, and data stores.\n\n**GOVERN Assess Evaluation:** CA family evaluated by reviewing ATO documentation, continuous monitoring plans, and penetration test scope coverage of AI attack surfaces.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-3256cd4db64cdef980ea","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":166,"lineEnd":202,"originalCells":{"A":"### CM — Configuration Management\n\n**Applicability to AI Governance:** AI model version control is a direct application of configuration management. Controlling which model version is deployed, tracking changes, and maintaining a secure baseline are CM responsibilities extended to the AI domain.\n\n**AI-Relevant Controls:**\n\n**CM-1 — Configuration Management Policy and Procedures**\nRequires documented CM policy. For AI systems: CM policy must explicitly address model versioning, model registry governance, hyperparameter configuration control, and deployment pipeline security.\n\n**CM-2 — Baseline Configuration**\nRequires maintained baseline configurations. For AI systems: the baseline includes the model version (artifact hash), inference server configuration, input/output schema, performance benchmarks, and approved dependency versions. Any deviation from baseline requires change control.\n\n**CM-3 — Configuration Change Control**\nRequires change control process. For AI systems: any change to a deployed model (fine-tuning, RAG corpus update, prompt template change, system prompt modification, threshold change) requires a change control ticket, impact assessment, and authorization.\n\n**CM-4 — Impact Analyses**\nRequires analysis before changes are implemented. For AI systems: AI model update impact analysis must include bias re-assessment, performance regression testing, safety testing, and review of changes to output distribution.\n\n**CM-6 — Configuration Settings**\nRequires configuration of security settings. For AI systems: define and enforce configuration standards for AI serving infrastructure — disable debug endpoints, enforce output filtering, set rate limits, configure authentication on inference APIs.\n\n**CM-7 — Least Functionality**\nRequires minimum functionality. For AI systems: disable unused inference capabilities, model endpoints not in active use, and administrative interfaces. Apply principle of least functionality to AI system capabilities.\n\n**CM-8 — System Component Inventory**\nRequires inventory of system components. For AI systems: maintain an inventory that includes all AI models (with artifact hashes), model versions, training dataset versions, framework dependencies, and third-party AI components (APIs, SDKs, pre-trained models).\n\n**CM-10 — Software Usage Restrictions**\nControls software licensing. For AI systems: verify licensing for all AI frameworks, pre-trained models, and datasets used. Track license terms that may restrict commercial use or require disclosure of derivative works.\n\n**CM-11 — User-Installed Software**\nControls unauthorized software. For AI systems: prevent data scientists and engineers from installing unapproved AI frameworks, libraries, or models on production systems.\n\n**GOVERN Assess Evaluation:** CM family evaluated via model registry review, change control log analysis, and AI component inventory verification.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-28f49138ee09681b842c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":203,"lineEnd":236,"originalCells":{"A":"### IA — Identification and Authentication\n\n**Applicability to AI Governance:** AI systems themselves are principals in identity architectures. Service accounts, API keys, and automated pipeline identities require the same rigor as human identities.\n\n**AI-Relevant Controls:**\n\n**IA-1 — Identification and Authentication Policy and Procedures**\nRequires documented IA policy. For AI systems: policy must address authentication for human users of AI systems, authentication of AI service accounts, and authentication of AI API clients.\n\n**IA-2 — Identification and Authentication (Organizational Users)**\nRequires multi-factor authentication for users. For AI systems: MFA required for access to AI model registries, training platforms, MLOps dashboards, and inference API administrative interfaces.\n\n**IA-3 — Device Identification and Authentication**\nRequires device-level authentication. For AI systems: inference server instances, training workers, and pipeline automation agents must authenticate to the AI system infrastructure before receiving credentials or accessing model artifacts.\n\n**IA-4 — Identifier Management**\nManages identifiers for users and devices. For AI systems: assign unique identifiers to each AI model version, each training run, and each inference service instance. Use identifiers for audit trail traceability.\n\n**IA-5 — Authenticator Management**\nManages credentials. For AI systems: rotate API keys for AI inference endpoints regularly. Store AI system credentials in secrets management systems (not in code repositories or configuration files). Audit credential access.\n\n**IA-8 — Identification and Authentication (Non-Organizational Users)**\nAddresses external user authentication. For AI systems: users outside the organization accessing AI APIs (customers, partners) must be authenticated. Define authentication requirements in AI API access policies.\n\n**IA-9 — Service Identification and Authentication**\nRequires mutual authentication for services. For AI systems: AI microservices (inference, training, data pipelines) must mutually authenticate using service mesh identities or mTLS. Prevent rogue services from impersonating AI system components.\n\n**IA-10 — Adaptive Authentication**\nAllows risk-based authentication. For AI systems: consider step-up authentication for high-stakes AI API calls (e.g., AI-assisted financial transactions, medical AI recommendations, identity verification).\n\n**GOVERN Assess Evaluation:** IA family evaluated via authentication mechanism review, credential management policy assessment, and service account inventory.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-6694149c54efc91873d7","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":237,"lineEnd":275,"originalCells":{"A":"### IR — Incident Response\n\n**Applicability to AI Governance:** AI incidents require specialized response procedures. Traditional incident response may not address AI-specific scenarios: bias-induced harm at scale, adversarial manipulation of AI decisions, data poisoning discovery, or large-scale confabulation events.\n\n**AI-Relevant Controls:**\n\n**IR-1 — Incident Response Policy and Procedures**\nRequires documented IR policy. For AI systems: IR policy must explicitly address AI incident types and response procedures.\n\n**IR-2 — Incident Response Training**\nRequires training on incident response. For AI systems: training must cover AI-specific incident scenarios: how to recognize bias-related harms, how to respond to adversarial attacks, when to suspend an AI system, and how to notify affected users.\n\n**IR-3 — Incident Response Testing**\nRequires testing of incident response capability. For AI systems: tabletop exercises should include AI incident scenarios — bias discovery, model poisoning, hallucination causing harm, AI system outage during critical operations.\n\n**IR-4 — Incident Handling**\nRequires incident handling capability. For AI systems: incident handling procedures must include:\n- Detection criteria for AI incidents (performance degradation thresholds, bias metric breach, anomalous output volume, user harm reports)\n- Containment options (suspend specific model endpoints, roll back to prior model version, enable human override, reduce inference rate)\n- Eradication steps (identify root cause — training data issue, model issue, adversarial input, infrastructure issue)\n- Recovery steps (revalidate model before restoring service, notify affected users, document lessons learned)\n- Post-incident review requirements\n\n**IR-5 — Incident Monitoring**\nRequires incident tracking. For AI systems: track AI incidents in the incident tracking system with AI-specific fields (model version, affected use case, number of users/decisions affected, harm category).\n\n**IR-6 — Incident Reporting**\nRequires incident reporting. For AI systems: define thresholds for external notification of AI incidents (e.g., EU AI Act Article 62 requires notification of serious incidents for high-risk AI systems within 15 days of becoming aware). Define internal reporting escalation paths.\n\n**IR-7 — Incident Response Assistance**\nRequires access to incident response assistance. For AI systems: identify subject matter experts for AI incident types (ML engineers for model issues, data scientists for bias, security team for adversarial attacks, legal for regulatory notification).\n\n**IR-8 — Incident Response Plan**\nRequires a documented incident response plan. For AI systems: the IR plan must include an AI incident annex covering AI-specific scenarios, containment options, rollback procedures, and notification requirements.\n\n**GOVERN Assess Evaluation:** IR family evaluated via IR plan review, AI incident scenario coverage, and incident response test records.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-3fa1b5a89f50a6a85fec","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":276,"lineEnd":309,"originalCells":{"A":"### PM — Program Management\n\n**Applicability to AI Governance:** The PM family establishes the organizational infrastructure for security programs. For AI governance, PM controls ensure AI risk management is a sustained program, not a one-time assessment.\n\n**AI-Relevant Controls:**\n\n**PM-1 — Information Security Program Plan**\nRequires a documented security program plan. For AI systems: the program plan must address AI risk management as a component of the overall security program. Reference the organizational AI governance policy.\n\n**PM-2 — Information Security Program Leadership Roles**\nRequires leadership accountability. For AI systems: designate an AI governance lead (Chief AI Officer, AI Risk Officer, or equivalent) with clear authority and accountability for organizational AI risk management.\n\n**PM-9 — Risk Management Strategy**\nRequires a documented risk management strategy. For AI systems: the risk management strategy must include AI risks as a recognized risk category with defined risk tolerance, treatment approaches, and escalation criteria.\n\n**PM-10 — Authorization Process**\nRequires a process for authorizing systems. For AI systems: the authorization process must include AI-specific assessment requirements — AI RMF documentation, bias assessment, TEVV documentation, monitoring plan — as prerequisites for ATO.\n\n**PM-11 — Mission and Business Process Definition**\nRequires documentation of organizational missions. For AI systems: document how AI systems support organizational missions and business processes. Use this to determine AI system criticality and applicable security controls.\n\n**PM-28 — Risk Framing**\nRequires identification of key risk assumptions. For AI systems: document assumptions about AI system risk (e.g., assumed attack surface, assumed user population, assumed operating environment). Revisit assumptions when context changes.\n\n**PM-30 — Supply Chain Risk Management Strategy**\nRequires supply chain risk strategy. For AI systems: AI supply chain risks (third-party models, training datasets, AI frameworks, cloud AI services) must be addressed in the supply chain risk strategy.\n\n**PM-31 — Continuous Improvement**\nRequires continuous improvement processes. For AI systems: establish feedback loops from AI monitoring, incident response, and user feedback into AI system improvement. Track improvement outcomes.\n\n**GOVERN Assess Evaluation:** PM family evaluated via program documentation review, leadership accountability assessment, and risk management strategy review.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-b8e77ee302941c3cc0bb","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":310,"lineEnd":344,"originalCells":{"A":"### RA — Risk Assessment\n\n**Applicability to AI Governance:** RA controls provide the systematic methodology for identifying, assessing, and responding to risks — directly applicable to AI system risk assessment and the MAP/MEASURE functions of the NIST AI RMF.\n\n**AI-Relevant Controls:**\n\n**RA-1 — Risk Assessment Policy and Procedures**\nRequires documented risk assessment policy. For AI systems: policy must include AI-specific risk assessment methodology, frequency of AI risk assessments, and required inputs (model documentation, TEVV results, bias assessments).\n\n**RA-2 — Security Categorization**\nRequires categorization of information systems by impact. For AI systems: categorize the AI system using FIPS 199 criteria (low/moderate/high for confidentiality, integrity, availability). Consider AI-specific impacts: a bias-laden AI system may have high integrity impact even if confidentiality and availability are low.\n\n**RA-3 — Risk Assessment**\nRequires formal risk assessment. For AI systems: risk assessment must include:\n- AI-specific threats (adversarial attacks, data poisoning, model theft, prompt injection)\n- AI-specific vulnerabilities (training data quality, model robustness, explainability gaps)\n- AI-specific impacts (discriminatory outcomes, decision errors at scale, privacy violations through model inversion)\n- AI-specific likelihood factors (system accessibility, attacker sophistication, data sensitivity)\n\n**RA-5 — Vulnerability Monitoring and Scanning**\nRequires vulnerability scanning. For AI systems: in addition to traditional vulnerability scanning, conduct AI-specific vulnerability assessments including adversarial robustness testing, bias audits, and model security evaluations.\n\n**RA-7 — Risk Response**\nRequires documented risk responses. For AI systems: document risk responses for AI-specific risks — model retraining to address bias, adversarial training to address robustness gaps, access control hardening for model theft risks, output filtering for harmful content risks.\n\n**RA-9 — Criticality Analysis**\nRequires analysis of AI component criticality. For AI systems: identify which AI components are most critical to organizational mission. Apply enhanced controls to critical AI components.\n\n**RA-10 — Threat Hunting**\nRequires proactive threat hunting. For AI systems: include AI-specific threat hunting — monitoring for signs of data poisoning, model theft attempts, adversarial probe patterns, and unauthorized model access.\n\n**GOVERN Assess Evaluation:** RA family evaluated via risk assessment documentation, AI threat model review, and vulnerability assessment scope verification.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-bd09b2c23cd8f2773724","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":345,"lineEnd":394,"originalCells":{"A":"### SA — System and Services Acquisition\n\n**Applicability to AI Governance:** SA controls govern how organizations acquire AI systems and services, including third-party AI models, AI-as-a-Service platforms, and AI development tools. AI procurement governance is increasingly critical as organizations deploy AI from a complex ecosystem of vendors.\n\n**AI-Relevant Controls:**\n\n**SA-1 — System and Services Acquisition Policy and Procedures**\nRequires documented acquisition policy. For AI systems: acquisition policy must address AI-specific procurement requirements — vendor AI governance practices, model transparency documentation, bias testing evidence, security assessment requirements.\n\n**SA-3 — System Development Life Cycle**\nRequires SDLC security integration. For AI systems: the AI development lifecycle (data collection, model training, validation, deployment, monitoring) must integrate security and privacy at each stage. Align with ML-specific SDLC frameworks (MLOps, ModelOps).\n\n**SA-4 — Acquisition Process**\nRequires security requirements in acquisitions. For AI systems: include AI-specific security and governance requirements in all AI procurement contracts:\n- Model transparency and documentation requirements\n- Bias testing evidence requirements\n- Security assessment results\n- Data handling and privacy requirements\n- Incident response obligations\n- Access to model cards and technical documentation\n- Audit rights\n\n**SA-5 — System Documentation**\nRequires system documentation from vendors. For AI systems: require from AI vendors: model cards, data sheets, technical documentation of model architecture and training, known limitations, performance benchmarks, bias evaluation results.\n\n**SA-8 — Security and Privacy Engineering Principles**\nRequires security and privacy engineering. For AI systems: apply privacy-by-design to AI systems. Consider privacy-preserving ML techniques (differential privacy, federated learning) where applicable. Document privacy engineering decisions.\n\n**SA-9 — External System Services**\nControls external service dependencies. For AI systems: document all third-party AI services used (LLM APIs, computer vision APIs, speech recognition services). Assess risk of each dependency. Ensure continuity if third-party service is discontinued.\n\n**SA-10 — Developer Configuration Management**\nRequires developer CM practices. For AI systems: require from AI developers: model version control, reproducibility of training runs, documentation of training data provenance, and change tracking for model updates.\n\n**SA-11 — Developer Testing and Evaluation**\nRequires developer security testing. For AI systems: require from AI developers: evidence of security testing (adversarial robustness, model inversion resistance), bias testing across protected categories, and TEVV documentation.\n\n**SA-15 — Development Process, Standards, and Tools**\nRequires secure development practices. For AI systems: require AI development teams to use approved, version-controlled ML frameworks. Scan AI dependencies for vulnerabilities. Use secure ML development environments.\n\n**SA-16 — Developer-Provided Training**\nRequires developer training provision. For AI systems: require AI vendors to provide training on AI system limitations, appropriate use cases, and risk indicators operators should monitor.\n\n**SA-17 — Developer Security and Privacy Architecture**\nRequires architectural documentation from developers. For AI systems: require architectural documentation showing how AI system components are secured, how data flows are protected, and how privacy is maintained.\n\n**GOVERN Assess Evaluation:** SA family evaluated via procurement policy review, vendor contract analysis, and third-party AI service inventory assessment.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-78f7cd24e50d6d9f2d1c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":395,"lineEnd":431,"originalCells":{"A":"### SC — System and Communications Protection\n\n**Applicability to AI Governance:** SC controls protect data in transit and at rest — directly applicable to protecting AI training data, model artifacts, and inference payloads. AI systems often handle sensitive data; SC controls ensure that data is protected throughout the AI pipeline.\n\n**AI-Relevant Controls:**\n\n**SC-1 — System and Communications Protection Policy and Procedures**\nRequires documented communications protection policy. For AI systems: policy must address encryption of AI training data, model artifacts, and inference API communications.\n\n**SC-5 — Denial-of-Service Protection**\nRequires DoS protection. For AI systems: AI inference APIs are targets for abuse (computational DoS via complex queries, resource exhaustion via high-frequency requests). Implement rate limiting, query complexity limits, and abuse detection for AI inference endpoints.\n\n**SC-7 — Boundary Protection**\nRequires network boundary controls. For AI systems: AI inference services, model registries, and training infrastructure should be network-isolated. Control ingress and egress. Use API gateways for inference endpoint exposure.\n\n**SC-8 — Transmission Confidentiality and Integrity**\nRequires protection of transmitted information. For AI systems: encrypt all inference API communications (TLS 1.3 minimum). Protect training data pipelines with encryption in transit. Sign model artifact transfers to verify integrity.\n\n**SC-12 — Cryptographic Key Establishment and Management**\nRequires cryptographic key management. For AI systems: manage cryptographic keys used to sign model artifacts, encrypt training data, and authenticate AI service accounts. Use hardware security modules (HSMs) for high-value key material.\n\n**SC-13 — Cryptographic Protection**\nRequires approved cryptographic mechanisms. For AI systems: use NIST-approved algorithms for all AI system encryption. Consider post-quantum cryptography for long-lived model artifacts.\n\n**SC-28 — Protection of Information at Rest**\nRequires encryption of stored information. For AI systems: encrypt AI training datasets, model artifacts (weights, embeddings), and AI decision logs at rest. Define encryption key management for model storage.\n\n**SC-39 — Process Isolation**\nRequires process isolation. For AI systems: isolate AI inference processes from other system processes. Prevent inference workloads from accessing training data repositories, administrative interfaces, or other sensitive resources.\n\n**SC-45 — System Time Synchronization**\nRequires time synchronization. For AI systems: accurate timestamps are critical for AI audit logs, incident correlation, and regulatory compliance. Ensure AI system infrastructure uses synchronized time sources.\n\n**GOVERN Assess Evaluation:** SC family evaluated via network architecture review, encryption configuration assessment, and data protection control verification.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-9c6640c2389dbb48c27a","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":432,"lineEnd":481,"originalCells":{"A":"### SI — System and Information Integrity\n\n**Applicability to AI Governance:** SI controls protect the integrity of AI system software, data, and outputs. For AI, integrity extends beyond traditional software integrity to include model integrity (detecting poisoned or tampered models), data integrity (detecting corrupted training data), and output integrity (detecting hallucinations and adversarial outputs).\n\n**AI-Relevant Controls:**\n\n**SI-1 — System and Information Integrity Policy and Procedures**\nRequires documented integrity policy. For AI systems: integrity policy must address model artifact integrity verification, training data integrity controls, and output integrity monitoring.\n\n**SI-2 — Flaw Remediation**\nRequires patching and remediation of flaws. For AI systems: flaws include both traditional software vulnerabilities in AI infrastructure and AI-specific issues (discovered bias, adversarial vulnerabilities, performance degradation). Define remediation processes for AI-specific flaws.\n\n**SI-3 — Malicious Code Protection**\nRequires malware protection. For AI systems: AI development environments are targets for malware that steals model artifacts or poisons training data. Apply malware protection to AI development and serving infrastructure.\n\n**SI-4 — System Monitoring**\nRequires system monitoring. For AI systems: monitoring must include AI-specific indicators of compromise: anomalous inference patterns, model performance drift, unusual output distributions, signs of adversarial probing, data exfiltration through model inference (model inversion).\n\n**SI-5 — Security Alerts, Advisories, and Directives**\nRequires response to security alerts. For AI systems: subscribe to AI security vulnerability feeds. Track CVEs affecting AI frameworks (TensorFlow, PyTorch, Hugging Face). Respond to AI-specific security advisories.\n\n**SI-7 — Software, Firmware, and Information Integrity**\nRequires integrity verification of software and data. For AI systems:\n- Hash and sign model artifacts; verify integrity before deployment\n- Verify integrity of training datasets before training runs\n- Detect unauthorized modifications to AI system components\n- Use model provenance tracking to verify model origin\n\n**SI-8 — Spam and Phishing Protection**\nRequires anti-spam protection. For AI systems: AI systems that process email, documents, or user-submitted content must include input validation to prevent prompt injection via malicious content in processed data.\n\n**SI-10 — Information Input Validation**\nRequires validation of information inputs. For AI systems: validate inputs to AI inference APIs — length limits, content type validation, schema validation, and detection of adversarial inputs. Reject malformed or potentially adversarial inputs before they reach the model.\n\n**SI-12 — Information Management and Retention**\nRequires information management policies. For AI systems: define retention policies for AI training data, model artifacts, inference logs, and bias assessment records. Comply with applicable legal and regulatory retention requirements.\n\n**SI-14 — Non-Persistence**\nRequires non-persistence of certain data. For AI systems: AI systems that process PII or sensitive data should not persist sensitive inputs beyond what is required for the inference operation. Define data minimization policies for AI inference.\n\n**SI-19 — De-Identification**\nRequires de-identification of PII. For AI systems: de-identify training data containing PII before use in model training. Apply differential privacy techniques where de-identification is insufficient. Verify de-identification effectiveness.\n\n**SI-20 — Tainting**\nControls information tainting. For AI systems: track provenance of data that flows into AI training pipelines. Detect when tainted (compromised or low-quality) data contaminates training datasets.\n\n**GOVERN Assess Evaluation:** SI family evaluated via model integrity verification review, input validation assessment, monitoring coverage analysis, and output integrity control review.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-7dc125c0619c6ed1e46c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":482,"lineEnd":517,"originalCells":{"A":"## GOVERN Assess — 800-53 Evaluation Methodology\n\nGOVERN's Assess capability evaluates AI systems against NIST 800-53 Rev 5 AI-relevant controls using three modes:\n\n### Rapid Assess (AI-Focused Subset)\n\nEvaluates the 11 AI-relevant control families with a focused subset of ~40 high-priority controls. Produces:\n- Per-family compliance score\n- Critical gap identification\n- Priority remediation recommendations\n- ATO readiness indicator\n\nTimeframe: 2–4 hours with complete documentation input\n\n### Deep Assess (Full 800-53 Coverage)\n\nEvaluates all applicable 800-53 controls for an AI system, including the full 20 control families for systems requiring comprehensive ATO documentation. Produces:\n- Complete control-by-control assessment\n- Security Assessment Report (SAR) draft\n- Plan of Action and Milestones (POA&M)\n- ATO package readiness checklist\n\nTimeframe: 2–5 days with subject matter expert collaboration\n\n### Continuous Assess (Ongoing Monitoring)\n\nMaps to CA-7 (Continuous Monitoring) requirements. Monitors key controls for AI systems:\n- AU controls: log completeness, retention compliance\n- CM controls: model version drift, unauthorized changes\n- IR controls: incident detection coverage, response SLA\n- SI controls: model integrity, input validation, output monitoring\n\nGenerates monthly compliance posture reports and alerts on control degradation.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-e37543cd2380df4f1825","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":486,"lineEnd":495,"originalCells":{"A":"### Rapid Assess (AI-Focused Subset)\n\nEvaluates the 11 AI-relevant control families with a focused subset of ~40 high-priority controls. Produces:\n- Per-family compliance score\n- Critical gap identification\n- Priority remediation recommendations\n- ATO readiness indicator\n\nTimeframe: 2–4 hours with complete documentation input\n"},"originalFormulas":{}},{"id":"ROW-MD-1a1e991ae409f7fb05d6","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":496,"lineEnd":505,"originalCells":{"A":"### Deep Assess (Full 800-53 Coverage)\n\nEvaluates all applicable 800-53 controls for an AI system, including the full 20 control families for systems requiring comprehensive ATO documentation. Produces:\n- Complete control-by-control assessment\n- Security Assessment Report (SAR) draft\n- Plan of Action and Milestones (POA&M)\n- ATO package readiness checklist\n\nTimeframe: 2–5 days with subject matter expert collaboration\n"},"originalFormulas":{}},{"id":"ROW-MD-4d58a0249238f58670c5","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":506,"lineEnd":517,"originalCells":{"A":"### Continuous Assess (Ongoing Monitoring)\n\nMaps to CA-7 (Continuous Monitoring) requirements. Monitors key controls for AI systems:\n- AU controls: log completeness, retention compliance\n- CM controls: model version drift, unauthorized changes\n- IR controls: incident detection coverage, response SLA\n- SI controls: model integrity, input validation, output monitoring\n\nGenerates monthly compliance posture reports and alerts on control degradation.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-ed82942c77fb31c41f25","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":518,"lineEnd":553,"originalCells":{"A":"## ATO Package Requirements for AI Systems\n\nAn Authority to Operate (ATO) package for an AI system must include:\n\n### Standard ATO Components\n\n- System Security Plan (SSP) — documents implementation of all applicable 800-53 controls\n- Security Assessment Report (SAR) — results of independent control assessment\n- Plan of Action and Milestones (POA&M) — tracks identified weaknesses and remediation\n- Continuous Monitoring Plan — ongoing monitoring strategy and metrics\n- Privacy Impact Assessment (PIA) — if the system processes PII\n\n### AI-Specific ATO Components\n\n- AI Risk Management documentation per NIST AI RMF (GOVERN, MAP, MEASURE, MANAGE)\n- Model card or equivalent technical documentation\n- Bias assessment results covering protected demographic categories\n- Adversarial robustness testing results\n- TEVV documentation (test datasets, metrics, tools, results)\n- Explainability assessment for high-stakes decision AI systems\n- AI incident response procedures (IR annex)\n- Post-deployment monitoring plan with AI-specific metrics\n- Third-party AI component inventory and risk assessments\n- Training data provenance documentation\n\n### ATO Risk Acceptance Levels\n\n| AI System Risk Level | Required ATO Type | Review Authority |\n|---------------------|-------------------|-----------------|\n| Low impact, low AI risk | Authority to Operate | System Owner |\n| Moderate impact or moderate AI risk | Authority to Operate | AO with ISSO |\n| High impact or high AI risk | Full ATO with AI addendum | AO + AI Risk Officer |\n| Critical infrastructure or law enforcement | Full ATO + enhanced AI review | CISO + AO + Legal |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-1b26174f567150d8a431","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":522,"lineEnd":529,"originalCells":{"A":"### Standard ATO Components\n\n- System Security Plan (SSP) — documents implementation of all applicable 800-53 controls\n- Security Assessment Report (SAR) — results of independent control assessment\n- Plan of Action and Milestones (POA&M) — tracks identified weaknesses and remediation\n- Continuous Monitoring Plan — ongoing monitoring strategy and metrics\n- Privacy Impact Assessment (PIA) — if the system processes PII\n"},"originalFormulas":{}},{"id":"ROW-MD-540d7a225a233eef14fd","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":530,"lineEnd":542,"originalCells":{"A":"### AI-Specific ATO Components\n\n- AI Risk Management documentation per NIST AI RMF (GOVERN, MAP, MEASURE, MANAGE)\n- Model card or equivalent technical documentation\n- Bias assessment results covering protected demographic categories\n- Adversarial robustness testing results\n- TEVV documentation (test datasets, metrics, tools, results)\n- Explainability assessment for high-stakes decision AI systems\n- AI incident response procedures (IR annex)\n- Post-deployment monitoring plan with AI-specific metrics\n- Third-party AI component inventory and risk assessments\n- Training data provenance documentation\n"},"originalFormulas":{}},{"id":"ROW-MD-dd3ea32f891d00dbe5c3","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":543,"lineEnd":553,"originalCells":{"A":"### ATO Risk Acceptance Levels\n\n| AI System Risk Level | Required ATO Type | Review Authority |\n|---------------------|-------------------|-----------------|\n| Low impact, low AI risk | Authority to Operate | System Owner |\n| Moderate impact or moderate AI risk | Authority to Operate | AO with ISSO |\n| High impact or high AI risk | Full ATO with AI addendum | AO + AI Risk Officer |\n| Critical infrastructure or law enforcement | Full ATO + enhanced AI review | CISO + AO + Legal |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-e0151037d1c3aa759f69","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":554,"lineEnd":584,"originalCells":{"A":"## FedRAMP Mapping\n\nFor cloud-hosted AI systems, FedRAMP authorization builds on 800-53 Rev 5. AI-specific FedRAMP considerations:\n\n### FedRAMP Baseline Control Sets\n\n| FedRAMP Baseline | 800-53 Controls | AI System Applicability |\n|-----------------|----------------|------------------------|\n| FedRAMP Low | ~125 controls | AI systems with low data sensitivity, non-critical use cases |\n| FedRAMP Moderate | ~325 controls | AI systems processing CUI, moderate-impact use cases |\n| FedRAMP High | ~421 controls | AI systems in law enforcement, national security, critical infrastructure |\n\n### AI-Specific FedRAMP Documentation Requirements\n\n**For AI SaaS providers seeking FedRAMP authorization:**\n- Document AI model training data handling in SSP Section 13 (Incident Response)\n- Address model update change management in CM-3 implementation\n- Describe AI-specific monitoring in CA-7 implementation statement\n- Document AI supply chain risks in SR family implementations\n\n**For agencies using FedRAMP-authorized AI services:**\n- Customer responsibility matrix must address AI-specific inherited vs. customer-controlled risks\n- Agencies must implement customer-responsible AI controls (input validation, output monitoring, access control to AI APIs)\n- Agency ATO must reference FedRAMP authorization of underlying AI service\n\n### FedRAMP AI Annex (Emerging)\n\nFedRAMP is developing AI-specific authorization guidance. GOVERN tracks FedRAMP AI Annex requirements and incorporates them into Assess workflows as they are published.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-721eb03c00433563789b","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":558,"lineEnd":565,"originalCells":{"A":"### FedRAMP Baseline Control Sets\n\n| FedRAMP Baseline | 800-53 Controls | AI System Applicability |\n|-----------------|----------------|------------------------|\n| FedRAMP Low | ~125 controls | AI systems with low data sensitivity, non-critical use cases |\n| FedRAMP Moderate | ~325 controls | AI systems processing CUI, moderate-impact use cases |\n| FedRAMP High | ~421 controls | AI systems in law enforcement, national security, critical infrastructure |\n"},"originalFormulas":{}},{"id":"ROW-MD-f9452695f60ca7befd14","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":566,"lineEnd":578,"originalCells":{"A":"### AI-Specific FedRAMP Documentation Requirements\n\n**For AI SaaS providers seeking FedRAMP authorization:**\n- Document AI model training data handling in SSP Section 13 (Incident Response)\n- Address model update change management in CM-3 implementation\n- Describe AI-specific monitoring in CA-7 implementation statement\n- Document AI supply chain risks in SR family implementations\n\n**For agencies using FedRAMP-authorized AI services:**\n- Customer responsibility matrix must address AI-specific inherited vs. customer-controlled risks\n- Agencies must implement customer-responsible AI controls (input validation, output monitoring, access control to AI APIs)\n- Agency ATO must reference FedRAMP authorization of underlying AI service\n"},"originalFormulas":{}},{"id":"ROW-MD-d2c5604133ceaf25f97d","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":579,"lineEnd":584,"originalCells":{"A":"### FedRAMP AI Annex (Emerging)\n\nFedRAMP is developing AI-specific authorization guidance. GOVERN tracks FedRAMP AI Annex requirements and incorporates them into Assess workflows as they are published.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-4f786c5d1d806eed1ef9","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":585,"lineEnd":602,"originalCells":{"A":"## Cross-Framework Control Mapping\n\n| 800-53 Control | NIST AI RMF | ISO 42001 | EU AI Act |\n|---------------|-------------|-----------|-----------|\n| AU-2, AU-3 — Event Logging | MS-3.3 | Clause 9.1 | Article 12 |\n| CA-2 — Control Assessments | MS-1.1, MS-2.1 | Clause 9.3 | Article 9 |\n| CA-7 — Continuous Monitoring | MS-3.3, MG-4.1 | Clause 9.1 | Article 61 |\n| CM-2, CM-3 — Baseline + Change Control | GV-1.5 | Clause 8.4 | Article 17 |\n| IR-4, IR-6 — Incident Handling + Reporting | MG-2.3 | Clause 10.2 | Article 62 |\n| PM-9 — Risk Management Strategy | GV-5.1 | Clause 6.1 | Article 9 |\n| RA-3 — Risk Assessment | MP-1.4, MP-1.5 | Clause 6.1 | Article 9 |\n| SA-4 — Acquisition Process | GV-1.6 | Clause 8.4 | Article 28 |\n| SI-7 — Software Integrity | MS-2.1 | Clause 8.4 | Article 15 |\n| SI-10 — Input Validation | MS-2.2 | Clause 8.3 | Article 15 |\n\n---\n\n*This document is maintained in GOVERN's Policy Engine as the NIST 800-53 Rev 5 framework template for AI governance assessments. Content is derived from NIST SP 800-53 Rev 5 (public domain). This document does not substitute for the full NIST SP 800-53 Rev 5 publication; consult the authoritative source for complete control requirements.*"},"originalFormulas":{}},{"id":"ROW-MD-4b043427b62ec4d17853","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":63,"lineEnd":65,"originalCells":{"A":"**AC-1 — Access Control Policy and Procedures**\nRequires documented access control policy covering all system components. For AI systems: policy must explicitly address access to model weights, training data repositories, inference endpoints, and AI pipeline components.\n"},"originalFormulas":{}},{"id":"ROW-MD-a4fb7d9173226c4fee2d","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":66,"lineEnd":68,"originalCells":{"A":"**AC-2 — Account Management**\nRequires lifecycle management of accounts with access to system resources. For AI systems: manage accounts for data scientists, ML engineers, inference API users, and automated pipeline service accounts. Monitor for unused accounts with access to model artifacts.\n"},"originalFormulas":{}},{"id":"ROW-MD-8fb0772540801b732bf3","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":69,"lineEnd":71,"originalCells":{"A":"**AC-3 — Access Enforcement**\nRequires enforcement of approved authorizations. For AI systems: enforce role-based access to training data (read vs. write), model artifacts (read vs. deploy), and inference APIs. Use attribute-based access control (ABAC) for fine-grained control over which users can query which AI models.\n"},"originalFormulas":{}},{"id":"ROW-MD-8bb63cbc110bf8fde533","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":72,"lineEnd":74,"originalCells":{"A":"**AC-4 — Information Flow Enforcement**\nControls information flow within and between systems. For AI systems: control data flows from sensitive source systems into AI training pipelines. Prevent unauthorized exfiltration of AI model outputs that may contain sensitive information (e.g., model inversion attacks, membership inference).\n"},"originalFormulas":{}},{"id":"ROW-MD-e6afea7daa0b69654301","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":75,"lineEnd":77,"originalCells":{"A":"**AC-6 — Least Privilege**\nRequires minimum necessary access. For AI systems: service accounts running AI inference should have only the permissions required for inference, not training or deployment. Data scientists should not have production deployment rights.\n"},"originalFormulas":{}},{"id":"ROW-MD-df985da4c94cac4284e3","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":78,"lineEnd":80,"originalCells":{"A":"**AC-17 — Remote Access**\nControls remote access to systems. For AI systems: remote access to AI training infrastructure, MLOps platforms, and model registries must be authenticated, encrypted, and logged.\n"},"originalFormulas":{}},{"id":"ROW-MD-fee486028be6fa9491ce","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":81,"lineEnd":87,"originalCells":{"A":"**AC-22 — Publicly Accessible Content**\nControls information posted to publicly accessible systems. For AI systems: verify that publicly accessible AI APIs do not expose sensitive training data or model internals. Validate that AI-generated content does not inadvertently disclose restricted information.\n\n**GOVERN Assess Evaluation:** AC family evaluated via infrastructure configuration review, access control matrix review, and API access pattern analysis.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-32f5eaf824de4f85c43b","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":94,"lineEnd":96,"originalCells":{"A":"**AU-1 — Audit and Accountability Policy and Procedures**\nRequires documented audit policy. For AI systems: audit policy must address what AI system events are logged (inference requests, decision outputs, model deployments, training runs, configuration changes) and how logs are protected.\n"},"originalFormulas":{}},{"id":"ROW-MD-e8457ba65445c8006e86","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":97,"lineEnd":106,"originalCells":{"A":"**AU-2 — Event Logging**\nDefines events to be logged. For AI systems, required events include:\n- Inference API calls (timestamp, user/system ID, input hash, output hash)\n- Model deployment events (which model version deployed by whom)\n- Training run initiation and completion\n- Access to training data repositories\n- Model configuration changes\n- Anomalous output events (outputs flagged by monitoring)\n- Human override of AI decisions\n"},"originalFormulas":{}},{"id":"ROW-MD-8145bbd7b57371bd684c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":107,"lineEnd":109,"originalCells":{"A":"**AU-3 — Content of Audit Records**\nDefines the content of audit log entries. For AI systems: logs must capture sufficient context to reconstruct the AI decision — model version, input parameters, output, confidence score, and the identity of the requesting user or system.\n"},"originalFormulas":{}},{"id":"ROW-MD-4e40bfdcfb987ac6af14","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":110,"lineEnd":112,"originalCells":{"A":"**AU-6 — Audit Record Review, Analysis, and Reporting**\nRequires regular review of audit logs. For AI systems: periodic review of AI decision logs for anomalies, bias patterns, unusual access, and evidence of adversarial inputs.\n"},"originalFormulas":{}},{"id":"ROW-MD-4583fff059d94fb001dd","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":113,"lineEnd":115,"originalCells":{"A":"**AU-9 — Protection of Audit Information**\nPrevents unauthorized access to audit logs. For AI systems: AI decision logs must be write-protected and stored independently of the systems that generate them (defense against log tampering after adversarial incident).\n"},"originalFormulas":{}},{"id":"ROW-MD-1103e6d4f0244ebab8a4","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":116,"lineEnd":118,"originalCells":{"A":"**AU-10 — Non-Repudiation**\nProvides evidence that actions cannot be denied. For AI systems: digital signing of AI inference requests and responses supports non-repudiation for high-stakes AI decisions (medical, financial, legal, regulatory).\n"},"originalFormulas":{}},{"id":"ROW-MD-7c7ae979ebe374755204","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":119,"lineEnd":121,"originalCells":{"A":"**AU-11 — Audit Record Retention**\nDefines retention periods. For AI systems: retain AI decision logs for the period required by applicable regulations. EU AI Act requires post-market monitoring records for 10 years for high-risk AI systems. Financial services AI decisions may require 5–7 year retention.\n"},"originalFormulas":{}},{"id":"ROW-MD-4f98f2e375b2fb5f7340","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":122,"lineEnd":124,"originalCells":{"A":"**AU-12 — Audit Record Generation**\nRequires audit record generation capability. For AI systems: ensure every AI system component (inference API, model serving infrastructure, training pipeline) generates audit records that flow to the centralized audit repository.\n"},"originalFormulas":{}},{"id":"ROW-MD-2abe48fc1a2ab1013ef6","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":125,"lineEnd":131,"originalCells":{"A":"**AU-14 — Session Audit**\nRequires logging of session activity. For AI systems: log user sessions interacting with AI systems, capturing the sequence of AI queries and human actions taken on AI outputs.\n\n**GOVERN Assess Evaluation:** AU family evaluated via log completeness review, retention period verification, and AI decision log format assessment.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-bc908e99bb9fbc8fd98c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":138,"lineEnd":140,"originalCells":{"A":"**CA-1 — Assessment, Authorization, and Monitoring Policy and Procedures**\nRequires documented policy for system authorization. For AI systems: policy must address the AI-specific assessment activities required before authorization, including AI RMF MEASURE activities, bias assessments, and adversarial robustness testing.\n"},"originalFormulas":{}},{"id":"ROW-MD-bac1ba4a7154404d1af2","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":141,"lineEnd":143,"originalCells":{"A":"**CA-2 — Control Assessments**\nRequires regular assessment of security controls. For AI systems: control assessments must include AI-specific controls (model integrity, output monitoring, bias metrics) in addition to traditional security controls.\n"},"originalFormulas":{}},{"id":"ROW-MD-9fada1482a60050f8451","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":144,"lineEnd":146,"originalCells":{"A":"**CA-3 — Information Exchange**\nControls connections between systems. For AI systems: document all API integrations between the AI system and other systems. Assess risk of each integration. Control data flows through formal interconnection agreements.\n"},"originalFormulas":{}},{"id":"ROW-MD-193caeadb1b1ba9de9d0","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":147,"lineEnd":149,"originalCells":{"A":"**CA-5 — Plan of Action and Milestones (POA&M)**\nRequires tracking of identified security weaknesses. For AI systems: AI-specific findings from assessments (bias issues, adversarial vulnerabilities, explainability gaps) must be tracked in the POA&M with remediation milestones.\n"},"originalFormulas":{}},{"id":"ROW-MD-35a7f5dd00221efc8fc4","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":150,"lineEnd":152,"originalCells":{"A":"**CA-6 — Authorization**\nRequires formal authorization before operation. For AI systems: ATO package for an AI system must include AI RMF documentation, bias assessment results, TEVV documentation, and monitoring plan in addition to standard 800-53 control documentation.\n"},"originalFormulas":{}},{"id":"ROW-MD-c77762487cdc633fffa2","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":153,"lineEnd":155,"originalCells":{"A":"**CA-7 — Continuous Monitoring**\nRequires ongoing monitoring of security controls. For AI systems: continuous monitoring program must include AI-specific metrics (model performance drift, bias metric trends, anomalous output rates, adversarial probe detection) alongside traditional security monitoring.\n"},"originalFormulas":{}},{"id":"ROW-MD-34e67809e1e960018266","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":156,"lineEnd":158,"originalCells":{"A":"**CA-8 — Penetration Testing**\nRequires periodic penetration testing. For AI systems: penetration testing scope must include AI-specific attack surfaces — prompt injection, model inversion, membership inference, adversarial examples, and model extraction attacks.\n"},"originalFormulas":{}},{"id":"ROW-MD-3fe9dbdcde188a4078e9","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":159,"lineEnd":165,"originalCells":{"A":"**CA-9 — Internal System Connections**\nControls internal connections. For AI systems: document and assess internal connections between AI inference services, model registries, training pipelines, and data stores.\n\n**GOVERN Assess Evaluation:** CA family evaluated by reviewing ATO documentation, continuous monitoring plans, and penetration test scope coverage of AI attack surfaces.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-ddd006e9b303eeda8965","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":172,"lineEnd":174,"originalCells":{"A":"**CM-1 — Configuration Management Policy and Procedures**\nRequires documented CM policy. For AI systems: CM policy must explicitly address model versioning, model registry governance, hyperparameter configuration control, and deployment pipeline security.\n"},"originalFormulas":{}},{"id":"ROW-MD-0d20f755375e1b3c4c35","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":175,"lineEnd":177,"originalCells":{"A":"**CM-2 — Baseline Configuration**\nRequires maintained baseline configurations. For AI systems: the baseline includes the model version (artifact hash), inference server configuration, input/output schema, performance benchmarks, and approved dependency versions. Any deviation from baseline requires change control.\n"},"originalFormulas":{}},{"id":"ROW-MD-0c1a5b68a63a512ab3e2","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":178,"lineEnd":180,"originalCells":{"A":"**CM-3 — Configuration Change Control**\nRequires change control process. For AI systems: any change to a deployed model (fine-tuning, RAG corpus update, prompt template change, system prompt modification, threshold change) requires a change control ticket, impact assessment, and authorization.\n"},"originalFormulas":{}},{"id":"ROW-MD-48c26acf378f919e9c09","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":181,"lineEnd":183,"originalCells":{"A":"**CM-4 — Impact Analyses**\nRequires analysis before changes are implemented. For AI systems: AI model update impact analysis must include bias re-assessment, performance regression testing, safety testing, and review of changes to output distribution.\n"},"originalFormulas":{}},{"id":"ROW-MD-98d3defd0c7919fc1277","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":184,"lineEnd":186,"originalCells":{"A":"**CM-6 — Configuration Settings**\nRequires configuration of security settings. For AI systems: define and enforce configuration standards for AI serving infrastructure — disable debug endpoints, enforce output filtering, set rate limits, configure authentication on inference APIs.\n"},"originalFormulas":{}},{"id":"ROW-MD-44bd483b3d6f8cb7aef5","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":187,"lineEnd":189,"originalCells":{"A":"**CM-7 — Least Functionality**\nRequires minimum functionality. For AI systems: disable unused inference capabilities, model endpoints not in active use, and administrative interfaces. Apply principle of least functionality to AI system capabilities.\n"},"originalFormulas":{}},{"id":"ROW-MD-7a48259ccd92a61b29db","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":190,"lineEnd":192,"originalCells":{"A":"**CM-8 — System Component Inventory**\nRequires inventory of system components. For AI systems: maintain an inventory that includes all AI models (with artifact hashes), model versions, training dataset versions, framework dependencies, and third-party AI components (APIs, SDKs, pre-trained models).\n"},"originalFormulas":{}},{"id":"ROW-MD-59e383bbeb9891b45d4c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":193,"lineEnd":195,"originalCells":{"A":"**CM-10 — Software Usage Restrictions**\nControls software licensing. For AI systems: verify licensing for all AI frameworks, pre-trained models, and datasets used. Track license terms that may restrict commercial use or require disclosure of derivative works.\n"},"originalFormulas":{}},{"id":"ROW-MD-c4b4e6bae109f1bbb7dc","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":196,"lineEnd":202,"originalCells":{"A":"**CM-11 — User-Installed Software**\nControls unauthorized software. For AI systems: prevent data scientists and engineers from installing unapproved AI frameworks, libraries, or models on production systems.\n\n**GOVERN Assess Evaluation:** CM family evaluated via model registry review, change control log analysis, and AI component inventory verification.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-4e59279280716715a6bb","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":209,"lineEnd":211,"originalCells":{"A":"**IA-1 — Identification and Authentication Policy and Procedures**\nRequires documented IA policy. For AI systems: policy must address authentication for human users of AI systems, authentication of AI service accounts, and authentication of AI API clients.\n"},"originalFormulas":{}},{"id":"ROW-MD-5b8515ee6f4084d91a4b","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":212,"lineEnd":214,"originalCells":{"A":"**IA-2 — Identification and Authentication (Organizational Users)**\nRequires multi-factor authentication for users. For AI systems: MFA required for access to AI model registries, training platforms, MLOps dashboards, and inference API administrative interfaces.\n"},"originalFormulas":{}},{"id":"ROW-MD-11ad7ff4cf2467e6c624","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":215,"lineEnd":217,"originalCells":{"A":"**IA-3 — Device Identification and Authentication**\nRequires device-level authentication. For AI systems: inference server instances, training workers, and pipeline automation agents must authenticate to the AI system infrastructure before receiving credentials or accessing model artifacts.\n"},"originalFormulas":{}},{"id":"ROW-MD-0539f55afc33b71a1559","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":218,"lineEnd":220,"originalCells":{"A":"**IA-4 — Identifier Management**\nManages identifiers for users and devices. For AI systems: assign unique identifiers to each AI model version, each training run, and each inference service instance. Use identifiers for audit trail traceability.\n"},"originalFormulas":{}},{"id":"ROW-MD-ecf450dab242256a5299","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":221,"lineEnd":223,"originalCells":{"A":"**IA-5 — Authenticator Management**\nManages credentials. For AI systems: rotate API keys for AI inference endpoints regularly. Store AI system credentials in secrets management systems (not in code repositories or configuration files). Audit credential access.\n"},"originalFormulas":{}},{"id":"ROW-MD-dc8e0160fdf79a026fec","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":224,"lineEnd":226,"originalCells":{"A":"**IA-8 — Identification and Authentication (Non-Organizational Users)**\nAddresses external user authentication. For AI systems: users outside the organization accessing AI APIs (customers, partners) must be authenticated. Define authentication requirements in AI API access policies.\n"},"originalFormulas":{}},{"id":"ROW-MD-b996bf266ed762e912a7","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":227,"lineEnd":229,"originalCells":{"A":"**IA-9 — Service Identification and Authentication**\nRequires mutual authentication for services. For AI systems: AI microservices (inference, training, data pipelines) must mutually authenticate using service mesh identities or mTLS. Prevent rogue services from impersonating AI system components.\n"},"originalFormulas":{}},{"id":"ROW-MD-affdbd1635b5e81c6bc0","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":230,"lineEnd":236,"originalCells":{"A":"**IA-10 — Adaptive Authentication**\nAllows risk-based authentication. For AI systems: consider step-up authentication for high-stakes AI API calls (e.g., AI-assisted financial transactions, medical AI recommendations, identity verification).\n\n**GOVERN Assess Evaluation:** IA family evaluated via authentication mechanism review, credential management policy assessment, and service account inventory.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-2824c7e8229abb6abd41","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":243,"lineEnd":245,"originalCells":{"A":"**IR-1 — Incident Response Policy and Procedures**\nRequires documented IR policy. For AI systems: IR policy must explicitly address AI incident types and response procedures.\n"},"originalFormulas":{}},{"id":"ROW-MD-33b0a36bab828d2560ee","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":246,"lineEnd":248,"originalCells":{"A":"**IR-2 — Incident Response Training**\nRequires training on incident response. For AI systems: training must cover AI-specific incident scenarios: how to recognize bias-related harms, how to respond to adversarial attacks, when to suspend an AI system, and how to notify affected users.\n"},"originalFormulas":{}},{"id":"ROW-MD-d5548d828161ec78cbb0","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":249,"lineEnd":251,"originalCells":{"A":"**IR-3 — Incident Response Testing**\nRequires testing of incident response capability. For AI systems: tabletop exercises should include AI incident scenarios — bias discovery, model poisoning, hallucination causing harm, AI system outage during critical operations.\n"},"originalFormulas":{}},{"id":"ROW-MD-741fc57da92197b50859","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":252,"lineEnd":259,"originalCells":{"A":"**IR-4 — Incident Handling**\nRequires incident handling capability. For AI systems: incident handling procedures must include:\n- Detection criteria for AI incidents (performance degradation thresholds, bias metric breach, anomalous output volume, user harm reports)\n- Containment options (suspend specific model endpoints, roll back to prior model version, enable human override, reduce inference rate)\n- Eradication steps (identify root cause — training data issue, model issue, adversarial input, infrastructure issue)\n- Recovery steps (revalidate model before restoring service, notify affected users, document lessons learned)\n- Post-incident review requirements\n"},"originalFormulas":{}},{"id":"ROW-MD-477e375dfc26da4c18ba","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":260,"lineEnd":262,"originalCells":{"A":"**IR-5 — Incident Monitoring**\nRequires incident tracking. For AI systems: track AI incidents in the incident tracking system with AI-specific fields (model version, affected use case, number of users/decisions affected, harm category).\n"},"originalFormulas":{}},{"id":"ROW-MD-dfc900db74196f2a3d82","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":263,"lineEnd":265,"originalCells":{"A":"**IR-6 — Incident Reporting**\nRequires incident reporting. For AI systems: define thresholds for external notification of AI incidents (e.g., EU AI Act Article 62 requires notification of serious incidents for high-risk AI systems within 15 days of becoming aware). Define internal reporting escalation paths.\n"},"originalFormulas":{}},{"id":"ROW-MD-024624f010ec2b52f5d3","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":266,"lineEnd":268,"originalCells":{"A":"**IR-7 — Incident Response Assistance**\nRequires access to incident response assistance. For AI systems: identify subject matter experts for AI incident types (ML engineers for model issues, data scientists for bias, security team for adversarial attacks, legal for regulatory notification).\n"},"originalFormulas":{}},{"id":"ROW-MD-39ef5857e424a5930233","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":269,"lineEnd":275,"originalCells":{"A":"**IR-8 — Incident Response Plan**\nRequires a documented incident response plan. For AI systems: the IR plan must include an AI incident annex covering AI-specific scenarios, containment options, rollback procedures, and notification requirements.\n\n**GOVERN Assess Evaluation:** IR family evaluated via IR plan review, AI incident scenario coverage, and incident response test records.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-3eeeb00968db42fd7f4f","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":282,"lineEnd":284,"originalCells":{"A":"**PM-1 — Information Security Program Plan**\nRequires a documented security program plan. For AI systems: the program plan must address AI risk management as a component of the overall security program. Reference the organizational AI governance policy.\n"},"originalFormulas":{}},{"id":"ROW-MD-a8dae4f7a2dd096e4e2c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":285,"lineEnd":287,"originalCells":{"A":"**PM-2 — Information Security Program Leadership Roles**\nRequires leadership accountability. For AI systems: designate an AI governance lead (Chief AI Officer, AI Risk Officer, or equivalent) with clear authority and accountability for organizational AI risk management.\n"},"originalFormulas":{}},{"id":"ROW-MD-b4f4b50967e8b1361882","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":288,"lineEnd":290,"originalCells":{"A":"**PM-9 — Risk Management Strategy**\nRequires a documented risk management strategy. For AI systems: the risk management strategy must include AI risks as a recognized risk category with defined risk tolerance, treatment approaches, and escalation criteria.\n"},"originalFormulas":{}},{"id":"ROW-MD-08a5153845f5af9bfa36","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":291,"lineEnd":293,"originalCells":{"A":"**PM-10 — Authorization Process**\nRequires a process for authorizing systems. For AI systems: the authorization process must include AI-specific assessment requirements — AI RMF documentation, bias assessment, TEVV documentation, monitoring plan — as prerequisites for ATO.\n"},"originalFormulas":{}},{"id":"ROW-MD-b2baed813d47abdf2d04","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":294,"lineEnd":296,"originalCells":{"A":"**PM-11 — Mission and Business Process Definition**\nRequires documentation of organizational missions. For AI systems: document how AI systems support organizational missions and business processes. Use this to determine AI system criticality and applicable security controls.\n"},"originalFormulas":{}},{"id":"ROW-MD-4b35a7eae7d1614bbfc0","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":297,"lineEnd":299,"originalCells":{"A":"**PM-28 — Risk Framing**\nRequires identification of key risk assumptions. For AI systems: document assumptions about AI system risk (e.g., assumed attack surface, assumed user population, assumed operating environment). Revisit assumptions when context changes.\n"},"originalFormulas":{}},{"id":"ROW-MD-5a60ae02e803314cd44d","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":300,"lineEnd":302,"originalCells":{"A":"**PM-30 — Supply Chain Risk Management Strategy**\nRequires supply chain risk strategy. For AI systems: AI supply chain risks (third-party models, training datasets, AI frameworks, cloud AI services) must be addressed in the supply chain risk strategy.\n"},"originalFormulas":{}},{"id":"ROW-MD-ba63a588abd542f9e79b","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":303,"lineEnd":309,"originalCells":{"A":"**PM-31 — Continuous Improvement**\nRequires continuous improvement processes. For AI systems: establish feedback loops from AI monitoring, incident response, and user feedback into AI system improvement. Track improvement outcomes.\n\n**GOVERN Assess Evaluation:** PM family evaluated via program documentation review, leadership accountability assessment, and risk management strategy review.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-fe41230cddb9f33cae7c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":316,"lineEnd":318,"originalCells":{"A":"**RA-1 — Risk Assessment Policy and Procedures**\nRequires documented risk assessment policy. For AI systems: policy must include AI-specific risk assessment methodology, frequency of AI risk assessments, and required inputs (model documentation, TEVV results, bias assessments).\n"},"originalFormulas":{}},{"id":"ROW-MD-001fec884a55d5889bda","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":319,"lineEnd":321,"originalCells":{"A":"**RA-2 — Security Categorization**\nRequires categorization of information systems by impact. For AI systems: categorize the AI system using FIPS 199 criteria (low/moderate/high for confidentiality, integrity, availability). Consider AI-specific impacts: a bias-laden AI system may have high integrity impact even if confidentiality and availability are low.\n"},"originalFormulas":{}},{"id":"ROW-MD-fecceba6f99ecc03f10a","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":322,"lineEnd":328,"originalCells":{"A":"**RA-3 — Risk Assessment**\nRequires formal risk assessment. For AI systems: risk assessment must include:\n- AI-specific threats (adversarial attacks, data poisoning, model theft, prompt injection)\n- AI-specific vulnerabilities (training data quality, model robustness, explainability gaps)\n- AI-specific impacts (discriminatory outcomes, decision errors at scale, privacy violations through model inversion)\n- AI-specific likelihood factors (system accessibility, attacker sophistication, data sensitivity)\n"},"originalFormulas":{}},{"id":"ROW-MD-4d21dc183122828e74a7","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":329,"lineEnd":331,"originalCells":{"A":"**RA-5 — Vulnerability Monitoring and Scanning**\nRequires vulnerability scanning. For AI systems: in addition to traditional vulnerability scanning, conduct AI-specific vulnerability assessments including adversarial robustness testing, bias audits, and model security evaluations.\n"},"originalFormulas":{}},{"id":"ROW-MD-7c61cb1f650871066f07","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":332,"lineEnd":334,"originalCells":{"A":"**RA-7 — Risk Response**\nRequires documented risk responses. For AI systems: document risk responses for AI-specific risks — model retraining to address bias, adversarial training to address robustness gaps, access control hardening for model theft risks, output filtering for harmful content risks.\n"},"originalFormulas":{}},{"id":"ROW-MD-4f654599e174a588bf0a","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":335,"lineEnd":337,"originalCells":{"A":"**RA-9 — Criticality Analysis**\nRequires analysis of AI component criticality. For AI systems: identify which AI components are most critical to organizational mission. Apply enhanced controls to critical AI components.\n"},"originalFormulas":{}},{"id":"ROW-MD-f303eecfca068c3264cc","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":338,"lineEnd":344,"originalCells":{"A":"**RA-10 — Threat Hunting**\nRequires proactive threat hunting. For AI systems: include AI-specific threat hunting — monitoring for signs of data poisoning, model theft attempts, adversarial probe patterns, and unauthorized model access.\n\n**GOVERN Assess Evaluation:** RA family evaluated via risk assessment documentation, AI threat model review, and vulnerability assessment scope verification.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-c22811b526b6d39ae652","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":351,"lineEnd":353,"originalCells":{"A":"**SA-1 — System and Services Acquisition Policy and Procedures**\nRequires documented acquisition policy. For AI systems: acquisition policy must address AI-specific procurement requirements — vendor AI governance practices, model transparency documentation, bias testing evidence, security assessment requirements.\n"},"originalFormulas":{}},{"id":"ROW-MD-59cc334f318005693db5","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":354,"lineEnd":356,"originalCells":{"A":"**SA-3 — System Development Life Cycle**\nRequires SDLC security integration. For AI systems: the AI development lifecycle (data collection, model training, validation, deployment, monitoring) must integrate security and privacy at each stage. Align with ML-specific SDLC frameworks (MLOps, ModelOps).\n"},"originalFormulas":{}},{"id":"ROW-MD-a166f070ba1627c78b93","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":357,"lineEnd":366,"originalCells":{"A":"**SA-4 — Acquisition Process**\nRequires security requirements in acquisitions. For AI systems: include AI-specific security and governance requirements in all AI procurement contracts:\n- Model transparency and documentation requirements\n- Bias testing evidence requirements\n- Security assessment results\n- Data handling and privacy requirements\n- Incident response obligations\n- Access to model cards and technical documentation\n- Audit rights\n"},"originalFormulas":{}},{"id":"ROW-MD-76a4f25556e5e304a7a9","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":367,"lineEnd":369,"originalCells":{"A":"**SA-5 — System Documentation**\nRequires system documentation from vendors. For AI systems: require from AI vendors: model cards, data sheets, technical documentation of model architecture and training, known limitations, performance benchmarks, bias evaluation results.\n"},"originalFormulas":{}},{"id":"ROW-MD-b0f2261ffb0bf86860a7","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":370,"lineEnd":372,"originalCells":{"A":"**SA-8 — Security and Privacy Engineering Principles**\nRequires security and privacy engineering. For AI systems: apply privacy-by-design to AI systems. Consider privacy-preserving ML techniques (differential privacy, federated learning) where applicable. Document privacy engineering decisions.\n"},"originalFormulas":{}},{"id":"ROW-MD-90bb4a277b5b1a16bec9","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":373,"lineEnd":375,"originalCells":{"A":"**SA-9 — External System Services**\nControls external service dependencies. For AI systems: document all third-party AI services used (LLM APIs, computer vision APIs, speech recognition services). Assess risk of each dependency. Ensure continuity if third-party service is discontinued.\n"},"originalFormulas":{}},{"id":"ROW-MD-3671ff6bd2a74490a0de","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":376,"lineEnd":378,"originalCells":{"A":"**SA-10 — Developer Configuration Management**\nRequires developer CM practices. For AI systems: require from AI developers: model version control, reproducibility of training runs, documentation of training data provenance, and change tracking for model updates.\n"},"originalFormulas":{}},{"id":"ROW-MD-fa09ba1c85ef0c6ff5f7","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":379,"lineEnd":381,"originalCells":{"A":"**SA-11 — Developer Testing and Evaluation**\nRequires developer security testing. For AI systems: require from AI developers: evidence of security testing (adversarial robustness, model inversion resistance), bias testing across protected categories, and TEVV documentation.\n"},"originalFormulas":{}},{"id":"ROW-MD-202e486e9ddae7c4463a","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":382,"lineEnd":384,"originalCells":{"A":"**SA-15 — Development Process, Standards, and Tools**\nRequires secure development practices. For AI systems: require AI development teams to use approved, version-controlled ML frameworks. Scan AI dependencies for vulnerabilities. Use secure ML development environments.\n"},"originalFormulas":{}},{"id":"ROW-MD-5f149253c3f960f21633","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":385,"lineEnd":387,"originalCells":{"A":"**SA-16 — Developer-Provided Training**\nRequires developer training provision. For AI systems: require AI vendors to provide training on AI system limitations, appropriate use cases, and risk indicators operators should monitor.\n"},"originalFormulas":{}},{"id":"ROW-MD-3a41165e55776b6bc37f","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":388,"lineEnd":394,"originalCells":{"A":"**SA-17 — Developer Security and Privacy Architecture**\nRequires architectural documentation from developers. For AI systems: require architectural documentation showing how AI system components are secured, how data flows are protected, and how privacy is maintained.\n\n**GOVERN Assess Evaluation:** SA family evaluated via procurement policy review, vendor contract analysis, and third-party AI service inventory assessment.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-001d752eb42885acbaa3","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":401,"lineEnd":403,"originalCells":{"A":"**SC-1 — System and Communications Protection Policy and Procedures**\nRequires documented communications protection policy. For AI systems: policy must address encryption of AI training data, model artifacts, and inference API communications.\n"},"originalFormulas":{}},{"id":"ROW-MD-601f6fc65e448cb7ca49","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":404,"lineEnd":406,"originalCells":{"A":"**SC-5 — Denial-of-Service Protection**\nRequires DoS protection. For AI systems: AI inference APIs are targets for abuse (computational DoS via complex queries, resource exhaustion via high-frequency requests). Implement rate limiting, query complexity limits, and abuse detection for AI inference endpoints.\n"},"originalFormulas":{}},{"id":"ROW-MD-c46c39a9c53e6b1eac61","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":407,"lineEnd":409,"originalCells":{"A":"**SC-7 — Boundary Protection**\nRequires network boundary controls. For AI systems: AI inference services, model registries, and training infrastructure should be network-isolated. Control ingress and egress. Use API gateways for inference endpoint exposure.\n"},"originalFormulas":{}},{"id":"ROW-MD-6ddcaa95d81fd72bdcee","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":410,"lineEnd":412,"originalCells":{"A":"**SC-8 — Transmission Confidentiality and Integrity**\nRequires protection of transmitted information. For AI systems: encrypt all inference API communications (TLS 1.3 minimum). Protect training data pipelines with encryption in transit. Sign model artifact transfers to verify integrity.\n"},"originalFormulas":{}},{"id":"ROW-MD-61817e851486194372c3","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":413,"lineEnd":415,"originalCells":{"A":"**SC-12 — Cryptographic Key Establishment and Management**\nRequires cryptographic key management. For AI systems: manage cryptographic keys used to sign model artifacts, encrypt training data, and authenticate AI service accounts. Use hardware security modules (HSMs) for high-value key material.\n"},"originalFormulas":{}},{"id":"ROW-MD-030be6ff65cd50889806","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":416,"lineEnd":418,"originalCells":{"A":"**SC-13 — Cryptographic Protection**\nRequires approved cryptographic mechanisms. For AI systems: use NIST-approved algorithms for all AI system encryption. Consider post-quantum cryptography for long-lived model artifacts.\n"},"originalFormulas":{}},{"id":"ROW-MD-896722ef3d7b017f2218","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":419,"lineEnd":421,"originalCells":{"A":"**SC-28 — Protection of Information at Rest**\nRequires encryption of stored information. For AI systems: encrypt AI training datasets, model artifacts (weights, embeddings), and AI decision logs at rest. Define encryption key management for model storage.\n"},"originalFormulas":{}},{"id":"ROW-MD-f326ccf4d5aa15794b50","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":422,"lineEnd":424,"originalCells":{"A":"**SC-39 — Process Isolation**\nRequires process isolation. For AI systems: isolate AI inference processes from other system processes. Prevent inference workloads from accessing training data repositories, administrative interfaces, or other sensitive resources.\n"},"originalFormulas":{}},{"id":"ROW-MD-8e2546ae044ff2710c20","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":425,"lineEnd":431,"originalCells":{"A":"**SC-45 — System Time Synchronization**\nRequires time synchronization. For AI systems: accurate timestamps are critical for AI audit logs, incident correlation, and regulatory compliance. Ensure AI system infrastructure uses synchronized time sources.\n\n**GOVERN Assess Evaluation:** SC family evaluated via network architecture review, encryption configuration assessment, and data protection control verification.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-053f79b4c19abc76bfcc","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":438,"lineEnd":440,"originalCells":{"A":"**SI-1 — System and Information Integrity Policy and Procedures**\nRequires documented integrity policy. For AI systems: integrity policy must address model artifact integrity verification, training data integrity controls, and output integrity monitoring.\n"},"originalFormulas":{}},{"id":"ROW-MD-6b2d78b86a180a307643","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":441,"lineEnd":443,"originalCells":{"A":"**SI-2 — Flaw Remediation**\nRequires patching and remediation of flaws. For AI systems: flaws include both traditional software vulnerabilities in AI infrastructure and AI-specific issues (discovered bias, adversarial vulnerabilities, performance degradation). Define remediation processes for AI-specific flaws.\n"},"originalFormulas":{}},{"id":"ROW-MD-447b95a6a19166638802","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":444,"lineEnd":446,"originalCells":{"A":"**SI-3 — Malicious Code Protection**\nRequires malware protection. For AI systems: AI development environments are targets for malware that steals model artifacts or poisons training data. Apply malware protection to AI development and serving infrastructure.\n"},"originalFormulas":{}},{"id":"ROW-MD-1c85a666d700bb6b216f","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":447,"lineEnd":449,"originalCells":{"A":"**SI-4 — System Monitoring**\nRequires system monitoring. For AI systems: monitoring must include AI-specific indicators of compromise: anomalous inference patterns, model performance drift, unusual output distributions, signs of adversarial probing, data exfiltration through model inference (model inversion).\n"},"originalFormulas":{}},{"id":"ROW-MD-c10c9ea64c15f6023dfb","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":450,"lineEnd":452,"originalCells":{"A":"**SI-5 — Security Alerts, Advisories, and Directives**\nRequires response to security alerts. For AI systems: subscribe to AI security vulnerability feeds. Track CVEs affecting AI frameworks (TensorFlow, PyTorch, Hugging Face). Respond to AI-specific security advisories.\n"},"originalFormulas":{}},{"id":"ROW-MD-20ae12266520508f48f9","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":453,"lineEnd":459,"originalCells":{"A":"**SI-7 — Software, Firmware, and Information Integrity**\nRequires integrity verification of software and data. For AI systems:\n- Hash and sign model artifacts; verify integrity before deployment\n- Verify integrity of training datasets before training runs\n- Detect unauthorized modifications to AI system components\n- Use model provenance tracking to verify model origin\n"},"originalFormulas":{}},{"id":"ROW-MD-0e5363bd9ace21c1280b","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":460,"lineEnd":462,"originalCells":{"A":"**SI-8 — Spam and Phishing Protection**\nRequires anti-spam protection. For AI systems: AI systems that process email, documents, or user-submitted content must include input validation to prevent prompt injection via malicious content in processed data.\n"},"originalFormulas":{}},{"id":"ROW-MD-b4303affb8ef442d034b","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":463,"lineEnd":465,"originalCells":{"A":"**SI-10 — Information Input Validation**\nRequires validation of information inputs. For AI systems: validate inputs to AI inference APIs — length limits, content type validation, schema validation, and detection of adversarial inputs. Reject malformed or potentially adversarial inputs before they reach the model.\n"},"originalFormulas":{}},{"id":"ROW-MD-6ab5807256b742c51594","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":466,"lineEnd":468,"originalCells":{"A":"**SI-12 — Information Management and Retention**\nRequires information management policies. For AI systems: define retention policies for AI training data, model artifacts, inference logs, and bias assessment records. Comply with applicable legal and regulatory retention requirements.\n"},"originalFormulas":{}},{"id":"ROW-MD-16ec417fa2de8cff6bca","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":469,"lineEnd":471,"originalCells":{"A":"**SI-14 — Non-Persistence**\nRequires non-persistence of certain data. For AI systems: AI systems that process PII or sensitive data should not persist sensitive inputs beyond what is required for the inference operation. Define data minimization policies for AI inference.\n"},"originalFormulas":{}},{"id":"ROW-MD-cf06ace2d60b4f0dd713","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":472,"lineEnd":474,"originalCells":{"A":"**SI-19 — De-Identification**\nRequires de-identification of PII. For AI systems: de-identify training data containing PII before use in model training. Apply differential privacy techniques where de-identification is insufficient. Verify de-identification effectiveness.\n"},"originalFormulas":{}},{"id":"ROW-MD-ee89c1949891156f78e0","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","sheet":"POLICY(8).md","row":475,"lineEnd":481,"originalCells":{"A":"**SI-20 — Tainting**\nControls information tainting. For AI systems: track provenance of data that flows into AI training pipelines. Detect when tainted (compromised or low-quality) data contaminates training datasets.\n\n**GOVERN Assess Evaluation:** SI family evaluated via model integrity verification review, input validation assessment, monitoring coverage analysis, and output integrity control review.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-3e61289d4a2f681935b4","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":1,"lineEnd":10,"originalCells":{"A":"# NIST AI Risk Management Framework (AI RMF 1.0)\n\n**Document:** NIST AI 100-1\n**Published:** January 2023\n**Publisher:** National Institute of Standards and Technology (NIST), U.S. Department of Commerce\n**GenAI Profile:** NIST AI 600-1 (July 2024)\n**Status:** Active — Voluntary for private sector; required for federal agencies under Executive Order 14110\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-021aa678f6b481426fbe","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":11,"lineEnd":24,"originalCells":{"A":"## What It Is\n\nThe NIST AI Risk Management Framework (AI RMF) is a voluntary framework developed by NIST to help organizations better manage risks to individuals, organizations, and society associated with the design, development, deployment, evaluation, and use of AI systems.\n\nThe AI RMF is structured around four core functions — GOVERN, MAP, MEASURE, MANAGE — and 19 categories with 72 subcategories. It is a living document designed to evolve with the AI field and applicable to any organization regardless of size, sector, or AI maturity level.\n\n**Publication lineage:**\n- NIST AI 100-1 (January 2023) — Core AI RMF\n- NIST AI 600-1 (July 2024) — Generative AI Profile (\"GenAI Profile\")\n- NIST CSWP 29 — AI RMF Playbook (companion resource)\n- NIST AI RMF Roadmap — Planned future publications including sector-specific profiles\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-a829bf4dc38c7a1f43fb","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":25,"lineEnd":36,"originalCells":{"A":"## Who Must Comply\n\n**Federal agencies:** Executive Order 14110 (Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, October 2023) requires federal agencies to apply the NIST AI RMF to AI systems they develop, use, or procure. Specific thresholds apply for high-impact AI systems.\n\n**Federal contractors:** Not formally mandated but increasingly referenced in federal AI procurement requirements, RFPs, and ATO packages.\n\n**Private sector:** Voluntary. However, the AI RMF is increasingly adopted as the de facto standard for enterprise AI governance, and alignment is expected under frameworks such as ISO 42001, EU AI Act, and sector-specific guidance (healthcare, financial services, critical infrastructure).\n\n**Critical infrastructure operators:** NIST is developing sector-specific profiles for critical infrastructure sectors. AI RMF alignment is expected in CISA guidance.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-01c59c3792646933a0d1","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":37,"lineEnd":64,"originalCells":{"A":"## The 4 Core Functions\n\n### GOVERN\n\nThe GOVERN function is foundational. It sets the organizational tone, policies, accountability structures, and culture that make all AI risk management possible. GOVERN is not a gate to pass through — it is the ongoing environment in which MAP, MEASURE, and MANAGE operate.\n\nGOVERN activities include: establishing AI risk policies; defining roles and responsibilities; setting risk tolerance; ensuring legal and regulatory compliance; building an AI-aware organizational culture; and providing oversight of AI lifecycle decisions.\n\n### MAP\n\nThe MAP function frames the context for AI risk. Before risks can be measured or managed, they must be identified and categorized. MAP activities include: documenting the intended purpose of AI systems; identifying stakeholders and affected communities; classifying AI risks by likelihood and magnitude; and connecting AI system context to the organization's risk appetite.\n\nMAP is executed before and during AI system design, development, and deployment. It produces the risk inventory that MEASURE and MANAGE act on.\n\n### MEASURE\n\nThe MEASURE function provides methods to analyze, quantify, and track AI risks. MEASURE activities include: selecting appropriate metrics for trustworthiness characteristics; conducting test, evaluation, validation, and verification (TEVV); monitoring performance in deployment; and calibrating confidence in AI system outputs.\n\nMEASURE transforms the qualitative risk picture from MAP into quantified evidence that supports risk treatment decisions.\n\n### MANAGE\n\nThe MANAGE function defines how organizations respond to identified and measured risks. MANAGE activities include: developing risk treatment plans; allocating resources for risk response; implementing monitoring and feedback loops; communicating risk to stakeholders; and continuously improving risk management practices.\n\nMANAGE closes the loop — treatment decisions inform future MAP and MEASURE activities.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-9ff81da4d3af4462c60f","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":39,"lineEnd":44,"originalCells":{"A":"### GOVERN\n\nThe GOVERN function is foundational. It sets the organizational tone, policies, accountability structures, and culture that make all AI risk management possible. GOVERN is not a gate to pass through — it is the ongoing environment in which MAP, MEASURE, and MANAGE operate.\n\nGOVERN activities include: establishing AI risk policies; defining roles and responsibilities; setting risk tolerance; ensuring legal and regulatory compliance; building an AI-aware organizational culture; and providing oversight of AI lifecycle decisions.\n"},"originalFormulas":{}},{"id":"ROW-MD-c0928f8f92df3ca6c646","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":45,"lineEnd":50,"originalCells":{"A":"### MAP\n\nThe MAP function frames the context for AI risk. Before risks can be measured or managed, they must be identified and categorized. MAP activities include: documenting the intended purpose of AI systems; identifying stakeholders and affected communities; classifying AI risks by likelihood and magnitude; and connecting AI system context to the organization's risk appetite.\n\nMAP is executed before and during AI system design, development, and deployment. It produces the risk inventory that MEASURE and MANAGE act on.\n"},"originalFormulas":{}},{"id":"ROW-MD-07834c1b8f97fb6019b4","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":51,"lineEnd":56,"originalCells":{"A":"### MEASURE\n\nThe MEASURE function provides methods to analyze, quantify, and track AI risks. MEASURE activities include: selecting appropriate metrics for trustworthiness characteristics; conducting test, evaluation, validation, and verification (TEVV); monitoring performance in deployment; and calibrating confidence in AI system outputs.\n\nMEASURE transforms the qualitative risk picture from MAP into quantified evidence that supports risk treatment decisions.\n"},"originalFormulas":{}},{"id":"ROW-MD-54a5fd752274f3b7cc5a","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":57,"lineEnd":64,"originalCells":{"A":"### MANAGE\n\nThe MANAGE function defines how organizations respond to identified and measured risks. MANAGE activities include: developing risk treatment plans; allocating resources for risk response; implementing monitoring and feedback loops; communicating risk to stakeholders; and continuously improving risk management practices.\n\nMANAGE closes the loop — treatment decisions inform future MAP and MEASURE activities.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-4ec8bec4bb51aa4836b7","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":65,"lineEnd":321,"originalCells":{"A":"## The 19 Categories and 72 Subcategories\n\n### GOVERN Categories and Subcategories\n\n**GV-1: Policies, Processes, Procedures, and Practices**\n\nGV-1.1 — Organizational policies and practices are in place to plan, prioritize, govern, and monitor AI risk management activities.\n*Playbook:* Document an AI governance policy. Assign an AI risk owner. Define scope of covered AI systems. Establish a review cadence. Communicate the policy organization-wide.\n\nGV-1.2 — Organizational teams are committed to a culture that considers and communicates AI risks.\n*Playbook:* Executive messaging on responsible AI. Include AI risk in team onboarding. Hold periodic AI risk awareness sessions. Create channels for raising AI risk concerns.\n\nGV-1.3 — Organizational leadership takes responsibility for decisions about risks associated with AI system development and deployment.\n*Playbook:* Assign a named AI executive sponsor. Document leadership sign-off on high-risk AI decisions. Create escalation paths for unresolved AI risks.\n\nGV-1.4 — Organizational teams are committed to transparent organizational practices and policies.\n*Playbook:* Publish AI system disclosure policies. Define what AI use is disclosed to users. Maintain an internal inventory of AI systems.\n\nGV-1.5 — Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review.\n*Playbook:* Set a minimum annual review of AI governance practices. Define who owns each monitoring activity. Track metrics on governance effectiveness.\n\nGV-1.6 — Policies and procedures are in place for the organizational risk governance and oversight of AI systems developed, used, or acquired from third parties, and for risk management of AI-specific supply chain issues including third-party data and AI components.\n*Playbook:* Require AI risk documentation from AI vendors. Assess third-party AI models against the same criteria as internal models. Track AI components in the software supply chain.\n\n**GV-2: Accountability Structures**\n\nGV-2.1 — Roles and responsibilities and organizational accountabilities for personnel involved with the design, development, deployment, assessment and monitoring of AI systems are established.\n*Playbook:* Publish a RACI matrix for AI lifecycle roles. Define AI-specific responsibilities for existing roles (data scientists, engineers, product managers, legal, compliance, audit).\n\nGV-2.2 — The risk or legal review function is documented and accountable to senior leadership.\n*Playbook:* Establish AI legal/risk review function with direct reporting to senior leadership. Document review authority and scope.\n\nGV-2.3 — Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.\n*Playbook:* Document board-level or C-suite AI risk acknowledgments. Create board AI risk reporting cadence. Obtain leadership attestation for high-risk AI deployments.\n\n**GV-3: Workforce Diversity, Equity, Inclusion, and Accessibility**\n\nGV-3.1 — Organizational policies and practices are in place to foster a critical thinking culture.\n*Playbook:* Create a structured process for raising AI concerns. Ensure no retaliation for raising AI risks. Establish red-team or devil's advocate processes for high-risk AI decisions.\n\nGV-3.2 — Policies, practices, and mechanisms are in place for the training and certification of AI personnel.\n*Playbook:* Define AI literacy requirements by role. Provide AI ethics training. Track completion. Consider external certifications for key AI risk roles.\n\nGV-3.3 — Fairness and bias — human factors and diversity considerations exist in organizational policies and practices across the AI lifecycle.\n*Playbook:* Assess AI team demographic diversity. Document processes for incorporating diverse perspectives in AI system design reviews. Engage external reviewers from affected communities for high-impact systems.\n\n**GV-4: Organizational Teams Are Committed**\n\nGV-4.1 — Organizational policies and practices are in place to foster AI risk awareness and to create a culture of trustworthy, responsible AI.\n*Playbook:* Publish organizational AI ethics principles. Incorporate AI responsibility into performance expectations. Make AI risk training mandatory for AI-involved roles.\n\nGV-4.2 — Organizational teams document the risks and potential impacts of AI technologies applied to their functions and using their data.\n*Playbook:* Require each business unit using AI to maintain an AI risk register. Include AI risk documentation in project intake processes.\n\n**GV-5: Organizational Risk Strategy**\n\nGV-5.1 — Organizational risk policies include and are inclusive of AI risks.\n*Playbook:* Update enterprise risk management policies to explicitly include AI risks. Map AI risks to existing risk categories (operational, reputational, legal, financial).\n\nGV-5.2 — Risk tolerance for the development and deployment of AI systems — including organizational risk tolerance for known trustworthiness limitations of AI systems — is established, communicated, and regularly reviewed.\n*Playbook:* Define risk tolerance thresholds for each AI risk category. Document acceptable levels of AI system error rates, bias thresholds, and explainability requirements. Review tolerance annually or upon significant AI deployment changes.\n\n**GV-6: Policies and Procedures**\n\nGV-6.1 — Policies and procedures are in place for the identification and documentation of legal requirements related to AI use, including international requirements for AI systems used in multiple jurisdictions.\n*Playbook:* Conduct legal inventory of applicable AI regulations per jurisdiction. Map AI systems to applicable requirements (EU AI Act, CCPA, HIPAA, sector-specific rules). Update as regulations change.\n\nGV-6.2 — Organizational risk policies are inclusive of regulatory compliance and legal requirements.\n*Playbook:* Incorporate regulatory requirements into AI risk management policies. Assign compliance owners for each applicable regulation. Track compliance posture in governance reporting.\n\n---\n\n### MAP Categories and Subcategories\n\n**MP-1: Context Is Established**\n\nMP-1.1 — Intended purpose, potentially beneficial uses, context of use, and risks of AI systems are understood and documented.\n*Playbook:* Create an AI system fact sheet for every AI deployment. Document intended use cases, foreseeable misuse, affected populations, and deployment environment.\n\nMP-1.2 — Scientific findings, technical standards, and trustworthiness of AI systems are understood, documented, and communicated.\n*Playbook:* Produce or obtain model cards for AI models in use. Document training data sources, architecture, known limitations, and applicable standards.\n\nMP-1.3 — Potential benefits of intended AI system deployment — including financial, societal, and broadly beneficial uses — are examined and documented.\n*Playbook:* Document the anticipated benefits of the AI system. Include quantified estimates where possible. Consider benefits to all stakeholder groups.\n\nMP-1.4 — Risks or harms of deployed AI systems — and their potential consequences to individuals, groups, communities, organizations, and society — are examined and documented.\n*Playbook:* Conduct AI impact assessment before deployment. Identify affected populations. Document high-risk harm scenarios. Engage affected communities for high-impact systems.\n\nMP-1.5 — Likelihood and magnitude of each identified AI system risk or impact are estimated and documented.\n*Playbook:* Score each identified risk on likelihood and magnitude. Use a consistent scoring methodology. Document rationale for scores.\n\nMP-1.6 — Risks or harms from third-party use of the organization's data or AI systems, including data provenance, data quality, and supply chain risks, are documented.\n*Playbook:* Assess data provenance and quality for all training and inference data. Document third-party data use agreements. Evaluate AI supply chain risks.\n\n**MP-2: Scientific Basis of AI Risk**\n\nMP-2.1 — Scientific community norms for validating AI risks and potential impacts are followed.\n*Playbook:* Reference peer-reviewed methods for AI evaluation. Use standardized benchmarks where available. Document validation methodology and limitations.\n\nMP-2.2 — Risk classifications are defined by the organization and used in AI risk classification decisions.\n*Playbook:* Define a risk taxonomy with clear classification criteria. Apply consistently across AI systems. Document classification decisions with rationale.\n\nMP-2.3 — AI system risk and benefit analysis incorporates considerations of affected individuals and groups.\n*Playbook:* Disaggregate risk and benefit analysis by affected population. Identify groups at disproportionate risk. Engage stakeholder representation in analysis.\n\n**MP-3: AI Capabilities and Limitations**\n\nMP-3.1 — Potential impacts of bias are characterized in data, models, and downstream uses and impacts are documented.\n*Playbook:* Conduct bias analysis on training data and model outputs. Use established bias metrics (demographic parity, equalized odds, etc.). Document known bias characteristics and acceptable thresholds.\n\nMP-3.2 — Scientific methods — including those from risk sciences, harm sciences, and social sciences — are used to inform bias assessments and documentation.\n*Playbook:* Engage multidisciplinary expertise in bias assessments. Reference validated bias assessment methodologies. Document methodology choices and limitations.\n\nMP-3.3 — Processes for operator and user feedback about AI system performance and trustworthiness are established and integrated into AI system updates.\n*Playbook:* Establish feedback channels for operators and users. Define process for triaging and acting on feedback. Document feedback integration into model updates.\n\n**MP-4: Risks Are Prioritized**\n\nMP-4.1 — The organization's risk tolerance for the AI system under consideration is established, communicated, and incorporated into the risk identification and classification process.\n*Playbook:* Apply organizational risk tolerance thresholds at the system level. Document whether system risk level is within tolerance. Escalate systems outside tolerance before deployment.\n\nMP-4.2 — Risk levels of AI systems at deployment are documented per risk classification and tolerance levels.\n*Playbook:* Assign a risk rating to each AI system at deployment. Document the basis for the rating. Update ratings as system context changes.\n\n**MP-5: Organizational Risk Management**\n\nMP-5.1 — Likelihood of encountering AI risks given use of AI and organizational risk tolerances is determined.\n*Playbook:* Calculate exposure to AI risk across the AI portfolio. Consider frequency of AI use, affected populations, and deployment environment. Document exposure analysis.\n\nMP-5.2 — Organizations are transparent about known limitations and where knowledge is incomplete.\n*Playbook:* Publish limitations documentation for AI systems. Communicate limitations to operators and users. Acknowledge uncertainty in risk estimates.\n\nMP-5.3 — Organizational risk policies include and are inclusive of AI risks.\n*Playbook:* Verify AI risk is explicitly addressed in enterprise risk policies. Update policies as AI use evolves.\n\nMP-5.4 — Risk tolerance for the development and deployment of AI systems is established, communicated, and regularly reviewed.\n*Playbook:* Establish formal risk tolerance review cadence. Document tolerance levels and their basis. Communicate tolerance levels to all AI-involved teams.\n\nMP-5.5 — Practices and documentation establish how identified risks will be addressed and where they fall in the organization's risk management framework.\n*Playbook:* Document risk treatment methodology. Map AI risks to enterprise risk management processes. Ensure AI risks receive equivalent treatment as other enterprise risks.\n\n---\n\n### MEASURE Categories and Subcategories\n\n**MS-1: Risk Metrics and Methods**\n\nMS-1.1 — Approaches and metrics for measurement of AI risks and trustworthiness characteristics reflect deployment context and organizational risk tolerance.\n*Playbook:* Define metrics for each NIST AI trustworthiness dimension: accuracy, fairness, transparency, privacy, security, reliability. Calibrate metric thresholds to risk tolerance.\n\nMS-1.2 — Trustworthiness characteristics of AI systems are assessed independently and in the context of AI systems to which they may be connected.\n*Playbook:* Conduct standalone system assessments. Also assess AI systems in the context of their integrations and dependencies. Document interconnected system risks.\n\nMS-1.3 — Internal experts are consulted to assess AI risks.\n*Playbook:* Define which AI risk assessments require expert review. Maintain a list of qualified internal reviewers. Document expert review findings.\n\n**MS-2: Risk Analysis**\n\nMS-2.1 — Test sets, metrics, and details about the tools used during test, evaluation, validation, and verification (TEVV) are documented.\n*Playbook:* Document all test datasets, evaluation metrics, validation methods, and tools used in AI system assessment. Retain test artifacts. Track TEVV coverage.\n\nMS-2.2 — AI system trustworthiness characteristics are calibrated for risks of under- and over-reliance on AI systems.\n*Playbook:* Test for appropriate confidence calibration. Evaluate uncertainty quantification. Assess whether users appropriately rely on AI outputs in practice.\n\nMS-2.3 — AI system performance and trustworthiness characteristics are evaluated regularly against benchmarks.\n*Playbook:* Define performance benchmarks for each AI system. Establish evaluation cadence (minimum annually; more frequently for high-risk systems). Document benchmark results.\n\nMS-2.4 — The ability of humans to interpret AI system outputs when needed is evaluated on a regular basis.\n*Playbook:* Test explainability mechanisms with representative users. Measure whether explanations improve appropriate reliance. Document explainability evaluation results.\n\nMS-2.5 — Risk characteristics established in MAP are employed in the measurement and analysis of AI system risks and trustworthiness.\n*Playbook:* Verify traceability from MAP risk inventory to MEASURE evaluation plan. Ensure all identified risks have corresponding measurement activities.\n\nMS-2.6 — Risk or performance characteristics established in and of AI systems are verified with the relevant populations.\n*Playbook:* Conduct evaluation studies with representative samples of affected populations. Disaggregate results by demographic group. Document population-level validation findings.\n\n**MS-3: Performance Monitoring**\n\nMS-3.1 — Ongoing monitoring plans are in place to address the identified AI risks and trustworthiness characteristics of the AI system.\n*Playbook:* Document a monitoring plan for each deployed AI system. Define monitored metrics, monitoring frequency, alert thresholds, and escalation procedures.\n\nMS-3.2 — The risk or performance characteristics of the AI system to be deployed are examined and documented.\n*Playbook:* Complete pre-deployment performance review. Document performance against defined thresholds. Obtain approval before deployment.\n\nMS-3.3 — AI system risks and trustworthiness are measured in deployment and monitoring contexts.\n*Playbook:* Implement production monitoring for key metrics. Capture performance data continuously. Store monitoring data for review.\n\nMS-3.4 — Feedback processes for end users and impacted communities to report problems and provide feedback are established.\n*Playbook:* Create accessible feedback channels for end users. Establish triage process for reported issues. Close the loop by communicating actions taken.\n\n**MS-4: Feedback Integration**\n\nMS-4.1 — Measurement approaches for identifying AI risks are connected to organizational risk tolerance and relevant laws, regulations, and standards.\n*Playbook:* Map measurement methodologies to applicable regulatory requirements. Verify that measured thresholds satisfy legal requirements. Update measurement approaches as regulations change.\n\nMS-4.2 — Measurement results inform updates to the risk mapping and risk management approaches.\n*Playbook:* Establish a process for measurement findings to feed back into MAP risk classification and MG treatment plans. Document feedback loop. Track improvements resulting from measurement.\n\n---\n\n### MANAGE Categories and Subcategories\n\n**MG-1: Risk Response Plans**\n\nMG-1.1 — A set of risk treatment options (responses) are documented for AI risks including the avoidance, acceptance, transfer, and control of risks.\n*Playbook:* Define available risk treatment options. Document criteria for selecting each treatment type. Document selected treatment with rationale for each identified risk.\n\nMG-1.2 — Treatment of AI risks includes a determination of residual risks after the risk response plan has been implemented.\n*Playbook:* Assess residual risk after each treatment. Document residual risk level and acceptability. Obtain approval for deployment if residual risk is within tolerance.\n\nMG-1.3 — Responses to the AI risks deemed high priority are developed, planned, and documented.\n*Playbook:* Create expedited response planning process for high-priority risks. Define SLA for high-priority risk treatment. Track response implementation.\n\n**MG-2: Risk Response Execution**\n\nMG-2.1 — Resources required to manage AI risks are taken into account including the staff, budget, and compute required for implementation.\n*Playbook:* Document resource requirements for AI risk management activities. Include AI risk management in organizational budgeting. Track resource utilization.\n\nMG-2.2 — Mechanisms are in place and applied to sustain the value of deployed AI systems and to manage the risks of AI system decommissioning, including appropriate archiving of useful elements.\n*Playbook:* Document AI system lifecycle stages including decommissioning. Create decommissioning checklist. Archive model artifacts, documentation, and decision records before decommission.\n\nMG-2.3 — Procedures are followed to respond to and recover from a previously unknown risk.\n*Playbook:* Create AI incident response procedure. Include discovery, triage, containment, notification, and recovery steps. Test procedure periodically.\n\nMG-2.4 — Mechanisms are in place to allow personnel to report problems to management.\n*Playbook:* Establish internal reporting channels for AI risk findings. Protect reporters from retaliation. Define escalation process. Track report resolution.\n\n**MG-3: Risk Treatment Feedback**\n\nMG-3.1 — Risk treatment strategies and methods are documented, as are the reasons for the selection of risk treatment options.\n*Playbook:* Document each treatment decision with rationale. Record alternatives considered. Maintain treatment rationale for audit purposes.\n\nMG-3.2 — Treatment of AI risks includes a determination of residual risk after the risk response plan has been implemented.\n*Playbook:* Conduct post-treatment residual risk assessment. Document residual risk level. Verify residual risk is within organizational tolerance.\n\nMG-3.3 — Feedback processes are in place to inform updates to the risk mapping, risk analysis, risk treatment, and monitoring activities.\n*Playbook:* Define feedback loop from MANAGE findings to MAP and MEASURE. Review effectiveness of risk treatments periodically. Update MAP risk inventory based on treatment outcomes.\n\nMG-3.4 — Risk treatment plans for AI systems are maintained and updated regularly.\n*Playbook:* Schedule regular treatment plan reviews. Update plans when AI system context changes. Document plan revision history.\n\n**MG-4: Risk Communication**\n\nMG-4.1 — Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors across the AI lifecycle.\n*Playbook:* Activate monitoring plan at deployment. Capture user feedback and operational data. Review monitoring data on defined cadence.\n\nMG-4.2 — Measurable performance improvements or declines and other changes in deployed AI system trustworthiness are evaluated and documented.\n*Playbook:* Track performance trends over time. Document significant changes in AI system behavior. Evaluate whether changes require risk re-assessment.\n\nMG-4.3 — Feedback processes for improvement are followed for deployed AI systems.\n*Playbook:* Use monitoring and feedback data to drive AI system improvements. Document improvement actions taken. Track improvement outcomes.\n\nMG-4.4 — Organizational teams communicate with personnel to report problems and suggest opportunities for improvement across the AI lifecycle.\n*Playbook:* Create internal communication forums for AI risk findings. Include AI risk in team retrospectives and reviews. Reward problem identification and improvement suggestions.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-7b656b862163cd8f8e41","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":67,"lineEnd":136,"originalCells":{"A":"### GOVERN Categories and Subcategories\n\n**GV-1: Policies, Processes, Procedures, and Practices**\n\nGV-1.1 — Organizational policies and practices are in place to plan, prioritize, govern, and monitor AI risk management activities.\n*Playbook:* Document an AI governance policy. Assign an AI risk owner. Define scope of covered AI systems. Establish a review cadence. Communicate the policy organization-wide.\n\nGV-1.2 — Organizational teams are committed to a culture that considers and communicates AI risks.\n*Playbook:* Executive messaging on responsible AI. Include AI risk in team onboarding. Hold periodic AI risk awareness sessions. Create channels for raising AI risk concerns.\n\nGV-1.3 — Organizational leadership takes responsibility for decisions about risks associated with AI system development and deployment.\n*Playbook:* Assign a named AI executive sponsor. Document leadership sign-off on high-risk AI decisions. Create escalation paths for unresolved AI risks.\n\nGV-1.4 — Organizational teams are committed to transparent organizational practices and policies.\n*Playbook:* Publish AI system disclosure policies. Define what AI use is disclosed to users. Maintain an internal inventory of AI systems.\n\nGV-1.5 — Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review.\n*Playbook:* Set a minimum annual review of AI governance practices. Define who owns each monitoring activity. Track metrics on governance effectiveness.\n\nGV-1.6 — Policies and procedures are in place for the organizational risk governance and oversight of AI systems developed, used, or acquired from third parties, and for risk management of AI-specific supply chain issues including third-party data and AI components.\n*Playbook:* Require AI risk documentation from AI vendors. Assess third-party AI models against the same criteria as internal models. Track AI components in the software supply chain.\n\n**GV-2: Accountability Structures**\n\nGV-2.1 — Roles and responsibilities and organizational accountabilities for personnel involved with the design, development, deployment, assessment and monitoring of AI systems are established.\n*Playbook:* Publish a RACI matrix for AI lifecycle roles. Define AI-specific responsibilities for existing roles (data scientists, engineers, product managers, legal, compliance, audit).\n\nGV-2.2 — The risk or legal review function is documented and accountable to senior leadership.\n*Playbook:* Establish AI legal/risk review function with direct reporting to senior leadership. Document review authority and scope.\n\nGV-2.3 — Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.\n*Playbook:* Document board-level or C-suite AI risk acknowledgments. Create board AI risk reporting cadence. Obtain leadership attestation for high-risk AI deployments.\n\n**GV-3: Workforce Diversity, Equity, Inclusion, and Accessibility**\n\nGV-3.1 — Organizational policies and practices are in place to foster a critical thinking culture.\n*Playbook:* Create a structured process for raising AI concerns. Ensure no retaliation for raising AI risks. Establish red-team or devil's advocate processes for high-risk AI decisions.\n\nGV-3.2 — Policies, practices, and mechanisms are in place for the training and certification of AI personnel.\n*Playbook:* Define AI literacy requirements by role. Provide AI ethics training. Track completion. Consider external certifications for key AI risk roles.\n\nGV-3.3 — Fairness and bias — human factors and diversity considerations exist in organizational policies and practices across the AI lifecycle.\n*Playbook:* Assess AI team demographic diversity. Document processes for incorporating diverse perspectives in AI system design reviews. Engage external reviewers from affected communities for high-impact systems.\n\n**GV-4: Organizational Teams Are Committed**\n\nGV-4.1 — Organizational policies and practices are in place to foster AI risk awareness and to create a culture of trustworthy, responsible AI.\n*Playbook:* Publish organizational AI ethics principles. Incorporate AI responsibility into performance expectations. Make AI risk training mandatory for AI-involved roles.\n\nGV-4.2 — Organizational teams document the risks and potential impacts of AI technologies applied to their functions and using their data.\n*Playbook:* Require each business unit using AI to maintain an AI risk register. Include AI risk documentation in project intake processes.\n\n**GV-5: Organizational Risk Strategy**\n\nGV-5.1 — Organizational risk policies include and are inclusive of AI risks.\n*Playbook:* Update enterprise risk management policies to explicitly include AI risks. Map AI risks to existing risk categories (operational, reputational, legal, financial).\n\nGV-5.2 — Risk tolerance for the development and deployment of AI systems — including organizational risk tolerance for known trustworthiness limitations of AI systems — is established, communicated, and regularly reviewed.\n*Playbook:* Define risk tolerance thresholds for each AI risk category. Document acceptable levels of AI system error rates, bias thresholds, and explainability requirements. Review tolerance annually or upon significant AI deployment changes.\n\n**GV-6: Policies and Procedures**\n\nGV-6.1 — Policies and procedures are in place for the identification and documentation of legal requirements related to AI use, including international requirements for AI systems used in multiple jurisdictions.\n*Playbook:* Conduct legal inventory of applicable AI regulations per jurisdiction. Map AI systems to applicable requirements (EU AI Act, CCPA, HIPAA, sector-specific rules). Update as regulations change.\n\nGV-6.2 — Organizational risk policies are inclusive of regulatory compliance and legal requirements.\n*Playbook:* Incorporate regulatory requirements into AI risk management policies. Assign compliance owners for each applicable regulation. Track compliance posture in governance reporting.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-787d2743cf0dcc708d67","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":137,"lineEnd":207,"originalCells":{"A":"### MAP Categories and Subcategories\n\n**MP-1: Context Is Established**\n\nMP-1.1 — Intended purpose, potentially beneficial uses, context of use, and risks of AI systems are understood and documented.\n*Playbook:* Create an AI system fact sheet for every AI deployment. Document intended use cases, foreseeable misuse, affected populations, and deployment environment.\n\nMP-1.2 — Scientific findings, technical standards, and trustworthiness of AI systems are understood, documented, and communicated.\n*Playbook:* Produce or obtain model cards for AI models in use. Document training data sources, architecture, known limitations, and applicable standards.\n\nMP-1.3 — Potential benefits of intended AI system deployment — including financial, societal, and broadly beneficial uses — are examined and documented.\n*Playbook:* Document the anticipated benefits of the AI system. Include quantified estimates where possible. Consider benefits to all stakeholder groups.\n\nMP-1.4 — Risks or harms of deployed AI systems — and their potential consequences to individuals, groups, communities, organizations, and society — are examined and documented.\n*Playbook:* Conduct AI impact assessment before deployment. Identify affected populations. Document high-risk harm scenarios. Engage affected communities for high-impact systems.\n\nMP-1.5 — Likelihood and magnitude of each identified AI system risk or impact are estimated and documented.\n*Playbook:* Score each identified risk on likelihood and magnitude. Use a consistent scoring methodology. Document rationale for scores.\n\nMP-1.6 — Risks or harms from third-party use of the organization's data or AI systems, including data provenance, data quality, and supply chain risks, are documented.\n*Playbook:* Assess data provenance and quality for all training and inference data. Document third-party data use agreements. Evaluate AI supply chain risks.\n\n**MP-2: Scientific Basis of AI Risk**\n\nMP-2.1 — Scientific community norms for validating AI risks and potential impacts are followed.\n*Playbook:* Reference peer-reviewed methods for AI evaluation. Use standardized benchmarks where available. Document validation methodology and limitations.\n\nMP-2.2 — Risk classifications are defined by the organization and used in AI risk classification decisions.\n*Playbook:* Define a risk taxonomy with clear classification criteria. Apply consistently across AI systems. Document classification decisions with rationale.\n\nMP-2.3 — AI system risk and benefit analysis incorporates considerations of affected individuals and groups.\n*Playbook:* Disaggregate risk and benefit analysis by affected population. Identify groups at disproportionate risk. Engage stakeholder representation in analysis.\n\n**MP-3: AI Capabilities and Limitations**\n\nMP-3.1 — Potential impacts of bias are characterized in data, models, and downstream uses and impacts are documented.\n*Playbook:* Conduct bias analysis on training data and model outputs. Use established bias metrics (demographic parity, equalized odds, etc.). Document known bias characteristics and acceptable thresholds.\n\nMP-3.2 — Scientific methods — including those from risk sciences, harm sciences, and social sciences — are used to inform bias assessments and documentation.\n*Playbook:* Engage multidisciplinary expertise in bias assessments. Reference validated bias assessment methodologies. Document methodology choices and limitations.\n\nMP-3.3 — Processes for operator and user feedback about AI system performance and trustworthiness are established and integrated into AI system updates.\n*Playbook:* Establish feedback channels for operators and users. Define process for triaging and acting on feedback. Document feedback integration into model updates.\n\n**MP-4: Risks Are Prioritized**\n\nMP-4.1 — The organization's risk tolerance for the AI system under consideration is established, communicated, and incorporated into the risk identification and classification process.\n*Playbook:* Apply organizational risk tolerance thresholds at the system level. Document whether system risk level is within tolerance. Escalate systems outside tolerance before deployment.\n\nMP-4.2 — Risk levels of AI systems at deployment are documented per risk classification and tolerance levels.\n*Playbook:* Assign a risk rating to each AI system at deployment. Document the basis for the rating. Update ratings as system context changes.\n\n**MP-5: Organizational Risk Management**\n\nMP-5.1 — Likelihood of encountering AI risks given use of AI and organizational risk tolerances is determined.\n*Playbook:* Calculate exposure to AI risk across the AI portfolio. Consider frequency of AI use, affected populations, and deployment environment. Document exposure analysis.\n\nMP-5.2 — Organizations are transparent about known limitations and where knowledge is incomplete.\n*Playbook:* Publish limitations documentation for AI systems. Communicate limitations to operators and users. Acknowledge uncertainty in risk estimates.\n\nMP-5.3 — Organizational risk policies include and are inclusive of AI risks.\n*Playbook:* Verify AI risk is explicitly addressed in enterprise risk policies. Update policies as AI use evolves.\n\nMP-5.4 — Risk tolerance for the development and deployment of AI systems is established, communicated, and regularly reviewed.\n*Playbook:* Establish formal risk tolerance review cadence. Document tolerance levels and their basis. Communicate tolerance levels to all AI-involved teams.\n\nMP-5.5 — Practices and documentation establish how identified risks will be addressed and where they fall in the organization's risk management framework.\n*Playbook:* Document risk treatment methodology. Map AI risks to enterprise risk management processes. Ensure AI risks receive equivalent treatment as other enterprise risks.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-59c93071255208109ce7","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":208,"lineEnd":264,"originalCells":{"A":"### MEASURE Categories and Subcategories\n\n**MS-1: Risk Metrics and Methods**\n\nMS-1.1 — Approaches and metrics for measurement of AI risks and trustworthiness characteristics reflect deployment context and organizational risk tolerance.\n*Playbook:* Define metrics for each NIST AI trustworthiness dimension: accuracy, fairness, transparency, privacy, security, reliability. Calibrate metric thresholds to risk tolerance.\n\nMS-1.2 — Trustworthiness characteristics of AI systems are assessed independently and in the context of AI systems to which they may be connected.\n*Playbook:* Conduct standalone system assessments. Also assess AI systems in the context of their integrations and dependencies. Document interconnected system risks.\n\nMS-1.3 — Internal experts are consulted to assess AI risks.\n*Playbook:* Define which AI risk assessments require expert review. Maintain a list of qualified internal reviewers. Document expert review findings.\n\n**MS-2: Risk Analysis**\n\nMS-2.1 — Test sets, metrics, and details about the tools used during test, evaluation, validation, and verification (TEVV) are documented.\n*Playbook:* Document all test datasets, evaluation metrics, validation methods, and tools used in AI system assessment. Retain test artifacts. Track TEVV coverage.\n\nMS-2.2 — AI system trustworthiness characteristics are calibrated for risks of under- and over-reliance on AI systems.\n*Playbook:* Test for appropriate confidence calibration. Evaluate uncertainty quantification. Assess whether users appropriately rely on AI outputs in practice.\n\nMS-2.3 — AI system performance and trustworthiness characteristics are evaluated regularly against benchmarks.\n*Playbook:* Define performance benchmarks for each AI system. Establish evaluation cadence (minimum annually; more frequently for high-risk systems). Document benchmark results.\n\nMS-2.4 — The ability of humans to interpret AI system outputs when needed is evaluated on a regular basis.\n*Playbook:* Test explainability mechanisms with representative users. Measure whether explanations improve appropriate reliance. Document explainability evaluation results.\n\nMS-2.5 — Risk characteristics established in MAP are employed in the measurement and analysis of AI system risks and trustworthiness.\n*Playbook:* Verify traceability from MAP risk inventory to MEASURE evaluation plan. Ensure all identified risks have corresponding measurement activities.\n\nMS-2.6 — Risk or performance characteristics established in and of AI systems are verified with the relevant populations.\n*Playbook:* Conduct evaluation studies with representative samples of affected populations. Disaggregate results by demographic group. Document population-level validation findings.\n\n**MS-3: Performance Monitoring**\n\nMS-3.1 — Ongoing monitoring plans are in place to address the identified AI risks and trustworthiness characteristics of the AI system.\n*Playbook:* Document a monitoring plan for each deployed AI system. Define monitored metrics, monitoring frequency, alert thresholds, and escalation procedures.\n\nMS-3.2 — The risk or performance characteristics of the AI system to be deployed are examined and documented.\n*Playbook:* Complete pre-deployment performance review. Document performance against defined thresholds. Obtain approval before deployment.\n\nMS-3.3 — AI system risks and trustworthiness are measured in deployment and monitoring contexts.\n*Playbook:* Implement production monitoring for key metrics. Capture performance data continuously. Store monitoring data for review.\n\nMS-3.4 — Feedback processes for end users and impacted communities to report problems and provide feedback are established.\n*Playbook:* Create accessible feedback channels for end users. Establish triage process for reported issues. Close the loop by communicating actions taken.\n\n**MS-4: Feedback Integration**\n\nMS-4.1 — Measurement approaches for identifying AI risks are connected to organizational risk tolerance and relevant laws, regulations, and standards.\n*Playbook:* Map measurement methodologies to applicable regulatory requirements. Verify that measured thresholds satisfy legal requirements. Update measurement approaches as regulations change.\n\nMS-4.2 — Measurement results inform updates to the risk mapping and risk management approaches.\n*Playbook:* Establish a process for measurement findings to feed back into MAP risk classification and MG treatment plans. Document feedback loop. Track improvements resulting from measurement.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-22acb400550dc2c3972b","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":265,"lineEnd":321,"originalCells":{"A":"### MANAGE Categories and Subcategories\n\n**MG-1: Risk Response Plans**\n\nMG-1.1 — A set of risk treatment options (responses) are documented for AI risks including the avoidance, acceptance, transfer, and control of risks.\n*Playbook:* Define available risk treatment options. Document criteria for selecting each treatment type. Document selected treatment with rationale for each identified risk.\n\nMG-1.2 — Treatment of AI risks includes a determination of residual risks after the risk response plan has been implemented.\n*Playbook:* Assess residual risk after each treatment. Document residual risk level and acceptability. Obtain approval for deployment if residual risk is within tolerance.\n\nMG-1.3 — Responses to the AI risks deemed high priority are developed, planned, and documented.\n*Playbook:* Create expedited response planning process for high-priority risks. Define SLA for high-priority risk treatment. Track response implementation.\n\n**MG-2: Risk Response Execution**\n\nMG-2.1 — Resources required to manage AI risks are taken into account including the staff, budget, and compute required for implementation.\n*Playbook:* Document resource requirements for AI risk management activities. Include AI risk management in organizational budgeting. Track resource utilization.\n\nMG-2.2 — Mechanisms are in place and applied to sustain the value of deployed AI systems and to manage the risks of AI system decommissioning, including appropriate archiving of useful elements.\n*Playbook:* Document AI system lifecycle stages including decommissioning. Create decommissioning checklist. Archive model artifacts, documentation, and decision records before decommission.\n\nMG-2.3 — Procedures are followed to respond to and recover from a previously unknown risk.\n*Playbook:* Create AI incident response procedure. Include discovery, triage, containment, notification, and recovery steps. Test procedure periodically.\n\nMG-2.4 — Mechanisms are in place to allow personnel to report problems to management.\n*Playbook:* Establish internal reporting channels for AI risk findings. Protect reporters from retaliation. Define escalation process. Track report resolution.\n\n**MG-3: Risk Treatment Feedback**\n\nMG-3.1 — Risk treatment strategies and methods are documented, as are the reasons for the selection of risk treatment options.\n*Playbook:* Document each treatment decision with rationale. Record alternatives considered. Maintain treatment rationale for audit purposes.\n\nMG-3.2 — Treatment of AI risks includes a determination of residual risk after the risk response plan has been implemented.\n*Playbook:* Conduct post-treatment residual risk assessment. Document residual risk level. Verify residual risk is within organizational tolerance.\n\nMG-3.3 — Feedback processes are in place to inform updates to the risk mapping, risk analysis, risk treatment, and monitoring activities.\n*Playbook:* Define feedback loop from MANAGE findings to MAP and MEASURE. Review effectiveness of risk treatments periodically. Update MAP risk inventory based on treatment outcomes.\n\nMG-3.4 — Risk treatment plans for AI systems are maintained and updated regularly.\n*Playbook:* Schedule regular treatment plan reviews. Update plans when AI system context changes. Document plan revision history.\n\n**MG-4: Risk Communication**\n\nMG-4.1 — Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors across the AI lifecycle.\n*Playbook:* Activate monitoring plan at deployment. Capture user feedback and operational data. Review monitoring data on defined cadence.\n\nMG-4.2 — Measurable performance improvements or declines and other changes in deployed AI system trustworthiness are evaluated and documented.\n*Playbook:* Track performance trends over time. Document significant changes in AI system behavior. Evaluate whether changes require risk re-assessment.\n\nMG-4.3 — Feedback processes for improvement are followed for deployed AI systems.\n*Playbook:* Use monitoring and feedback data to drive AI system improvements. Document improvement actions taken. Track improvement outcomes.\n\nMG-4.4 — Organizational teams communicate with personnel to report problems and suggest opportunities for improvement across the AI lifecycle.\n*Playbook:* Create internal communication forums for AI risk findings. Include AI risk in team retrospectives and reviews. Reward problem identification and improvement suggestions.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-317b8884b3314e305c00","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":322,"lineEnd":364,"originalCells":{"A":"## Key Profiles\n\n### GenAI Profile (NIST AI 600-1, July 2024)\n\nThe Generative AI Profile addresses AI RMF implementation for generative AI systems, including large language models, image generation models, and multimodal systems. Key additions:\n\n**Unique risks addressed by the GenAI Profile:**\n- Confabulation (hallucination)\n- Data privacy and model inversion attacks\n- Homogenization of outputs and perspectives\n- Harmful content generation\n- Overreliance on AI-generated content\n- Data provenance and training data quality\n- Prompt injection and jailbreaking\n- Value alignment and emergent behaviors\n\n**GenAI-specific GOVERN additions:**\n- Policies for AI-generated content disclosure\n- Human oversight requirements for high-stakes GenAI use\n- Policies on AI-generated content in regulated domains (legal, medical, financial)\n\n**GenAI-specific MAP additions:**\n- Characterize confabulation risk per use case\n- Map training data sources and assess contamination risks\n- Identify downstream uses of AI-generated content\n\n**GenAI-specific MEASURE additions:**\n- Benchmark hallucination rates\n- Evaluate output diversity and homogenization\n- Test for harmful content generation across demographic groups\n- Measure human oversight effectiveness\n\n**GenAI-specific MANAGE additions:**\n- Response plans for confabulation-related harms\n- Procedures for managing viral harmful content\n- Human-in-the-loop protocols for high-stakes decisions\n\n### Critical Infrastructure Profile\n\nBeing developed in collaboration with CISA and sector-specific agencies. Applies AI RMF in 16 critical infrastructure sectors (energy, water, transportation, healthcare, financial services, etc.). Key additions: sector-specific risk thresholds, mandatory MEASURE activities for critical safety functions, coordination requirements with sector regulators.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-c83090e093da550f4e03","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":324,"lineEnd":358,"originalCells":{"A":"### GenAI Profile (NIST AI 600-1, July 2024)\n\nThe Generative AI Profile addresses AI RMF implementation for generative AI systems, including large language models, image generation models, and multimodal systems. Key additions:\n\n**Unique risks addressed by the GenAI Profile:**\n- Confabulation (hallucination)\n- Data privacy and model inversion attacks\n- Homogenization of outputs and perspectives\n- Harmful content generation\n- Overreliance on AI-generated content\n- Data provenance and training data quality\n- Prompt injection and jailbreaking\n- Value alignment and emergent behaviors\n\n**GenAI-specific GOVERN additions:**\n- Policies for AI-generated content disclosure\n- Human oversight requirements for high-stakes GenAI use\n- Policies on AI-generated content in regulated domains (legal, medical, financial)\n\n**GenAI-specific MAP additions:**\n- Characterize confabulation risk per use case\n- Map training data sources and assess contamination risks\n- Identify downstream uses of AI-generated content\n\n**GenAI-specific MEASURE additions:**\n- Benchmark hallucination rates\n- Evaluate output diversity and homogenization\n- Test for harmful content generation across demographic groups\n- Measure human oversight effectiveness\n\n**GenAI-specific MANAGE additions:**\n- Response plans for confabulation-related harms\n- Procedures for managing viral harmful content\n- Human-in-the-loop protocols for high-stakes decisions\n"},"originalFormulas":{}},{"id":"ROW-MD-1608f5be0e5b32cc30d5","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":359,"lineEnd":364,"originalCells":{"A":"### Critical Infrastructure Profile\n\nBeing developed in collaboration with CISA and sector-specific agencies. Applies AI RMF in 16 critical infrastructure sectors (energy, water, transportation, healthcare, financial services, etc.). Key additions: sector-specific risk thresholds, mandatory MEASURE activities for critical safety functions, coordination requirements with sector regulators.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-866c8c4b5b71daa5022d","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":365,"lineEnd":411,"originalCells":{"A":"## How GOVERN Implements Each Function\n\n### GOVERN Function Implementation\n\n| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| GV-1.1 — AI governance policies | Policy Engine — loads, versions, and tracks AI governance policies |\n| GV-1.5 — Ongoing monitoring | Continuous Monitoring Dashboard — tracks governance posture |\n| GV-1.6 — Third-party risk | Third-Party Assess Mode — vendor AI risk assessment workflow |\n| GV-2.1 — Roles and responsibilities | Accountability Ledger — role registry, RACI matrix |\n| GV-5.2 — Risk tolerance | Risk Tolerance Configuration — per-system tolerance thresholds |\n| GV-6.1 — Legal requirements | Regulatory Mapping Engine — jurisdiction inventory, regulation tracker |\n\n### MAP Function Implementation\n\n| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| MP-1.1 — System purpose and context | System Inventory — AI system fact sheets, use case registry |\n| MP-1.2 — Model documentation | Model Card Integration — model card ingestion and display |\n| MP-1.4 — Risk and harm documentation | Harm Assessment Module — structured impact assessment workflow |\n| MP-1.5 — Risk likelihood and magnitude | Risk Scoring Engine — probability-impact matrix, risk scoring |\n| MP-2.2 — Risk classification | Risk Classification Workflow — taxonomy engine, classification records |\n| MP-3.1 — Bias characterization | Bias Assessment Module — bias analysis workflows, bias report generator |\n\n### MEASURE Function Implementation\n\n| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| MS-1.1 — Trustworthiness metrics | Metrics Library — pre-built metric templates per trustworthiness dimension |\n| MS-2.1 — TEVV documentation | TEVV Documentation Module — test artifact registry, coverage tracking |\n| MS-2.3 — Performance benchmarking | Benchmarking Scheduler — benchmark runs, result ledger, trend tracking |\n| MS-2.4 — Explainability evaluation | Explainability Assessment — interpretability testing workflow |\n| MS-3.1 — Monitoring plans | Monitoring Plan Builder — plan templates, monitoring schedule |\n| MS-3.3 — Deployment monitoring | Live Monitoring Dashboard — real-time metric tracking, alert engine |\n\n### MANAGE Function Implementation\n\n| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| MG-1.1 — Risk treatment options | Risk Treatment Library — treatment templates, selection workflow |\n| MG-1.3 — High-priority responses | Priority Risk Response Queue — SLA tracking, escalation workflows |\n| MG-2.3 — Incident response | Incident Response Playbook — structured response procedures |\n| MG-3.3 — Feedback loop | Cross-Function Feedback Loop — MAP/MEASURE/MANAGE integration |\n| MG-4.2 — Performance trends | Performance Trend Tracker — delta reporting, trend visualization |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-fa86f5cd609ffba0d920","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":367,"lineEnd":377,"originalCells":{"A":"### GOVERN Function Implementation\n\n| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| GV-1.1 — AI governance policies | Policy Engine — loads, versions, and tracks AI governance policies |\n| GV-1.5 — Ongoing monitoring | Continuous Monitoring Dashboard — tracks governance posture |\n| GV-1.6 — Third-party risk | Third-Party Assess Mode — vendor AI risk assessment workflow |\n| GV-2.1 — Roles and responsibilities | Accountability Ledger — role registry, RACI matrix |\n| GV-5.2 — Risk tolerance | Risk Tolerance Configuration — per-system tolerance thresholds |\n| GV-6.1 — Legal requirements | Regulatory Mapping Engine — jurisdiction inventory, regulation tracker |\n"},"originalFormulas":{}},{"id":"ROW-MD-90e6003977e026dca827","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":378,"lineEnd":388,"originalCells":{"A":"### MAP Function Implementation\n\n| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| MP-1.1 — System purpose and context | System Inventory — AI system fact sheets, use case registry |\n| MP-1.2 — Model documentation | Model Card Integration — model card ingestion and display |\n| MP-1.4 — Risk and harm documentation | Harm Assessment Module — structured impact assessment workflow |\n| MP-1.5 — Risk likelihood and magnitude | Risk Scoring Engine — probability-impact matrix, risk scoring |\n| MP-2.2 — Risk classification | Risk Classification Workflow — taxonomy engine, classification records |\n| MP-3.1 — Bias characterization | Bias Assessment Module — bias analysis workflows, bias report generator |\n"},"originalFormulas":{}},{"id":"ROW-MD-3e74406bfb5f5ad3c8bf","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":389,"lineEnd":399,"originalCells":{"A":"### MEASURE Function Implementation\n\n| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| MS-1.1 — Trustworthiness metrics | Metrics Library — pre-built metric templates per trustworthiness dimension |\n| MS-2.1 — TEVV documentation | TEVV Documentation Module — test artifact registry, coverage tracking |\n| MS-2.3 — Performance benchmarking | Benchmarking Scheduler — benchmark runs, result ledger, trend tracking |\n| MS-2.4 — Explainability evaluation | Explainability Assessment — interpretability testing workflow |\n| MS-3.1 — Monitoring plans | Monitoring Plan Builder — plan templates, monitoring schedule |\n| MS-3.3 — Deployment monitoring | Live Monitoring Dashboard — real-time metric tracking, alert engine |\n"},"originalFormulas":{}},{"id":"ROW-MD-05babb0a2336fd090d25","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":400,"lineEnd":411,"originalCells":{"A":"### MANAGE Function Implementation\n\n| AI RMF Requirement | GOVERN Component |\n|-------------------|-----------------|\n| MG-1.1 — Risk treatment options | Risk Treatment Library — treatment templates, selection workflow |\n| MG-1.3 — High-priority responses | Priority Risk Response Queue — SLA tracking, escalation workflows |\n| MG-2.3 — Incident response | Incident Response Playbook — structured response procedures |\n| MG-3.3 — Feedback loop | Cross-Function Feedback Loop — MAP/MEASURE/MANAGE integration |\n| MG-4.2 — Performance trends | Performance Trend Tracker — delta reporting, trend visualization |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-7b56f7d01998b7dfae1e","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":412,"lineEnd":454,"originalCells":{"A":"## Relationship to Other Frameworks\n\n### ISO/IEC 42001:2023\n\nISO 42001 is the international AI management system standard. It shares significant structural overlap with NIST AI RMF:\n- ISO 42001 Clause 6 (Planning) aligns with MAP and parts of GOVERN\n- ISO 42001 Clause 8 (Operation) aligns with MEASURE\n- ISO 42001 Clause 9 (Performance evaluation) aligns with MEASURE and MANAGE\n- ISO 42001 Clause 10 (Improvement) aligns with MANAGE feedback loops\n\nGOVERN supports dual-framework assessment: a single assessment can produce evidence satisfying both NIST AI RMF and ISO 42001 requirements.\n\n### EU AI Act (2024)\n\nThe EU AI Act imposes mandatory requirements for high-risk AI systems deployed in the EU. The AI RMF's voluntary structure maps onto EU AI Act mandatory requirements:\n- AI RMF GOVERN → EU AI Act Articles 9, 17 (risk management, quality management)\n- AI RMF MAP → EU AI Act Articles 10, 13 (data governance, transparency)\n- AI RMF MEASURE → EU AI Act Articles 15, 61 (accuracy, post-market monitoring)\n- AI RMF MANAGE → EU AI Act Articles 9, 62 (risk management, incident reporting)\n\nOrganizations subject to the EU AI Act can use NIST AI RMF compliance as the foundation for demonstrating EU AI Act compliance, supplemented by EU-specific mandatory requirements.\n\n### Executive Order 14110 (October 2023)\n\nEO 14110 directed federal agencies to:\n- Apply the NIST AI RMF to AI systems they use or develop\n- Report on high-impact AI systems to OMB\n- Conduct AI risk assessments before deploying high-impact AI\n- Designate Chief AI Officers with AI RMF responsibilities\n\nThe AI RMF is the primary technical standard for EO 14110 implementation.\n\n### NIST Cybersecurity Framework (CSF)\n\nThe AI RMF is designed as a companion to the NIST CSF. Organizations with mature CSF implementations can extend them to AI risk by mapping CSF functions (Identify, Protect, Detect, Respond, Recover) to AI RMF functions. GOVERN provides a unified assessment that covers both CSF and AI RMF.\n\n### NIST 800-53 Rev 5\n\nFor federal systems, NIST 800-53 controls apply to the AI system infrastructure. The AI RMF addresses AI-specific risks that 800-53 does not directly cover (bias, fairness, transparency, AI-specific adversarial attacks). Together, they provide comprehensive coverage: 800-53 for system security and privacy; AI RMF for AI-specific trustworthiness.\n\n---\n\n*This document is maintained in GOVERN's Policy Engine as the NIST AI RMF framework template. Content is derived from NIST AI 100-1 (public domain) and NIST AI 600-1 (public domain).*"},"originalFormulas":{}},{"id":"ROW-MD-3a3a54e97d08b772cb7f","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":414,"lineEnd":423,"originalCells":{"A":"### ISO/IEC 42001:2023\n\nISO 42001 is the international AI management system standard. It shares significant structural overlap with NIST AI RMF:\n- ISO 42001 Clause 6 (Planning) aligns with MAP and parts of GOVERN\n- ISO 42001 Clause 8 (Operation) aligns with MEASURE\n- ISO 42001 Clause 9 (Performance evaluation) aligns with MEASURE and MANAGE\n- ISO 42001 Clause 10 (Improvement) aligns with MANAGE feedback loops\n\nGOVERN supports dual-framework assessment: a single assessment can produce evidence satisfying both NIST AI RMF and ISO 42001 requirements.\n"},"originalFormulas":{}},{"id":"ROW-MD-35c8ec8afeac024a7ed7","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":424,"lineEnd":433,"originalCells":{"A":"### EU AI Act (2024)\n\nThe EU AI Act imposes mandatory requirements for high-risk AI systems deployed in the EU. The AI RMF's voluntary structure maps onto EU AI Act mandatory requirements:\n- AI RMF GOVERN → EU AI Act Articles 9, 17 (risk management, quality management)\n- AI RMF MAP → EU AI Act Articles 10, 13 (data governance, transparency)\n- AI RMF MEASURE → EU AI Act Articles 15, 61 (accuracy, post-market monitoring)\n- AI RMF MANAGE → EU AI Act Articles 9, 62 (risk management, incident reporting)\n\nOrganizations subject to the EU AI Act can use NIST AI RMF compliance as the foundation for demonstrating EU AI Act compliance, supplemented by EU-specific mandatory requirements.\n"},"originalFormulas":{}},{"id":"ROW-MD-e7504852f3c433dbfffa","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":434,"lineEnd":443,"originalCells":{"A":"### Executive Order 14110 (October 2023)\n\nEO 14110 directed federal agencies to:\n- Apply the NIST AI RMF to AI systems they use or develop\n- Report on high-impact AI systems to OMB\n- Conduct AI risk assessments before deploying high-impact AI\n- Designate Chief AI Officers with AI RMF responsibilities\n\nThe AI RMF is the primary technical standard for EO 14110 implementation.\n"},"originalFormulas":{}},{"id":"ROW-MD-a677e8da9eeeb0f24ec6","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":444,"lineEnd":447,"originalCells":{"A":"### NIST Cybersecurity Framework (CSF)\n\nThe AI RMF is designed as a companion to the NIST CSF. Organizations with mature CSF implementations can extend them to AI risk by mapping CSF functions (Identify, Protect, Detect, Respond, Recover) to AI RMF functions. GOVERN provides a unified assessment that covers both CSF and AI RMF.\n"},"originalFormulas":{}},{"id":"ROW-MD-65d831a9ae863fccd60f","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":448,"lineEnd":454,"originalCells":{"A":"### NIST 800-53 Rev 5\n\nFor federal systems, NIST 800-53 controls apply to the AI system infrastructure. The AI RMF addresses AI-specific risks that 800-53 does not directly cover (bias, fairness, transparency, AI-specific adversarial attacks). Together, they provide comprehensive coverage: 800-53 for system security and privacy; AI RMF for AI-specific trustworthiness.\n\n---\n\n*This document is maintained in GOVERN's Policy Engine as the NIST AI RMF framework template. Content is derived from NIST AI 100-1 (public domain) and NIST AI 600-1 (public domain).*"},"originalFormulas":{}},{"id":"ROW-MD-4e31b79db300d683abfe","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":69,"lineEnd":70,"originalCells":{"A":"**GV-1: Policies, Processes, Procedures, and Practices**\n"},"originalFormulas":{}},{"id":"ROW-MD-177bdd7507a00da3c8af","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":71,"lineEnd":73,"originalCells":{"A":"GV-1.1 — Organizational policies and practices are in place to plan, prioritize, govern, and monitor AI risk management activities.\n*Playbook:* Document an AI governance policy. Assign an AI risk owner. Define scope of covered AI systems. Establish a review cadence. Communicate the policy organization-wide.\n"},"originalFormulas":{}},{"id":"ROW-MD-c918a1eaed5f8c55ccff","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":74,"lineEnd":76,"originalCells":{"A":"GV-1.2 — Organizational teams are committed to a culture that considers and communicates AI risks.\n*Playbook:* Executive messaging on responsible AI. Include AI risk in team onboarding. Hold periodic AI risk awareness sessions. Create channels for raising AI risk concerns.\n"},"originalFormulas":{}},{"id":"ROW-MD-5d3ab65281558b5939bd","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":77,"lineEnd":79,"originalCells":{"A":"GV-1.3 — Organizational leadership takes responsibility for decisions about risks associated with AI system development and deployment.\n*Playbook:* Assign a named AI executive sponsor. Document leadership sign-off on high-risk AI decisions. Create escalation paths for unresolved AI risks.\n"},"originalFormulas":{}},{"id":"ROW-MD-f4e383914149cfbcfdb8","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":80,"lineEnd":82,"originalCells":{"A":"GV-1.4 — Organizational teams are committed to transparent organizational practices and policies.\n*Playbook:* Publish AI system disclosure policies. Define what AI use is disclosed to users. Maintain an internal inventory of AI systems.\n"},"originalFormulas":{}},{"id":"ROW-MD-8c9d1cb692ce9d67f515","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":83,"lineEnd":85,"originalCells":{"A":"GV-1.5 — Ongoing monitoring and periodic review of the risk management process and its outcomes are planned and organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review.\n*Playbook:* Set a minimum annual review of AI governance practices. Define who owns each monitoring activity. Track metrics on governance effectiveness.\n"},"originalFormulas":{}},{"id":"ROW-MD-021470f190c347ae99ad","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":86,"lineEnd":88,"originalCells":{"A":"GV-1.6 — Policies and procedures are in place for the organizational risk governance and oversight of AI systems developed, used, or acquired from third parties, and for risk management of AI-specific supply chain issues including third-party data and AI components.\n*Playbook:* Require AI risk documentation from AI vendors. Assess third-party AI models against the same criteria as internal models. Track AI components in the software supply chain.\n"},"originalFormulas":{}},{"id":"ROW-MD-171ebf4d85342840a87f","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":89,"lineEnd":90,"originalCells":{"A":"**GV-2: Accountability Structures**\n"},"originalFormulas":{}},{"id":"ROW-MD-e5dd501b1e5fe82d5748","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":91,"lineEnd":93,"originalCells":{"A":"GV-2.1 — Roles and responsibilities and organizational accountabilities for personnel involved with the design, development, deployment, assessment and monitoring of AI systems are established.\n*Playbook:* Publish a RACI matrix for AI lifecycle roles. Define AI-specific responsibilities for existing roles (data scientists, engineers, product managers, legal, compliance, audit).\n"},"originalFormulas":{}},{"id":"ROW-MD-a6c34de9758059bc1f32","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":94,"lineEnd":96,"originalCells":{"A":"GV-2.2 — The risk or legal review function is documented and accountable to senior leadership.\n*Playbook:* Establish AI legal/risk review function with direct reporting to senior leadership. Document review authority and scope.\n"},"originalFormulas":{}},{"id":"ROW-MD-5564d90de92b8a2e402a","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":97,"lineEnd":99,"originalCells":{"A":"GV-2.3 — Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.\n*Playbook:* Document board-level or C-suite AI risk acknowledgments. Create board AI risk reporting cadence. Obtain leadership attestation for high-risk AI deployments.\n"},"originalFormulas":{}},{"id":"ROW-MD-03b8b151a6160ae888e4","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":100,"lineEnd":101,"originalCells":{"A":"**GV-3: Workforce Diversity, Equity, Inclusion, and Accessibility**\n"},"originalFormulas":{}},{"id":"ROW-MD-b982eb91741a12814bec","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":102,"lineEnd":104,"originalCells":{"A":"GV-3.1 — Organizational policies and practices are in place to foster a critical thinking culture.\n*Playbook:* Create a structured process for raising AI concerns. Ensure no retaliation for raising AI risks. Establish red-team or devil's advocate processes for high-risk AI decisions.\n"},"originalFormulas":{}},{"id":"ROW-MD-7b7ac68e5047f6bb5c97","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":105,"lineEnd":107,"originalCells":{"A":"GV-3.2 — Policies, practices, and mechanisms are in place for the training and certification of AI personnel.\n*Playbook:* Define AI literacy requirements by role. Provide AI ethics training. Track completion. Consider external certifications for key AI risk roles.\n"},"originalFormulas":{}},{"id":"ROW-MD-70ee7153467b9d0d8f77","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":108,"lineEnd":110,"originalCells":{"A":"GV-3.3 — Fairness and bias — human factors and diversity considerations exist in organizational policies and practices across the AI lifecycle.\n*Playbook:* Assess AI team demographic diversity. Document processes for incorporating diverse perspectives in AI system design reviews. Engage external reviewers from affected communities for high-impact systems.\n"},"originalFormulas":{}},{"id":"ROW-MD-f1f14fb3100558c99a02","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":111,"lineEnd":112,"originalCells":{"A":"**GV-4: Organizational Teams Are Committed**\n"},"originalFormulas":{}},{"id":"ROW-MD-e6310d8c79736ece3cae","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":113,"lineEnd":115,"originalCells":{"A":"GV-4.1 — Organizational policies and practices are in place to foster AI risk awareness and to create a culture of trustworthy, responsible AI.\n*Playbook:* Publish organizational AI ethics principles. Incorporate AI responsibility into performance expectations. Make AI risk training mandatory for AI-involved roles.\n"},"originalFormulas":{}},{"id":"ROW-MD-a8455722a0e98b4b2fdf","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":116,"lineEnd":118,"originalCells":{"A":"GV-4.2 — Organizational teams document the risks and potential impacts of AI technologies applied to their functions and using their data.\n*Playbook:* Require each business unit using AI to maintain an AI risk register. Include AI risk documentation in project intake processes.\n"},"originalFormulas":{}},{"id":"ROW-MD-763999a5c1b68a2dce43","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":119,"lineEnd":120,"originalCells":{"A":"**GV-5: Organizational Risk Strategy**\n"},"originalFormulas":{}},{"id":"ROW-MD-8ddf0ec21ccd7aae80ca","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":121,"lineEnd":123,"originalCells":{"A":"GV-5.1 — Organizational risk policies include and are inclusive of AI risks.\n*Playbook:* Update enterprise risk management policies to explicitly include AI risks. Map AI risks to existing risk categories (operational, reputational, legal, financial).\n"},"originalFormulas":{}},{"id":"ROW-MD-2589d922aef35ca16195","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":124,"lineEnd":126,"originalCells":{"A":"GV-5.2 — Risk tolerance for the development and deployment of AI systems — including organizational risk tolerance for known trustworthiness limitations of AI systems — is established, communicated, and regularly reviewed.\n*Playbook:* Define risk tolerance thresholds for each AI risk category. Document acceptable levels of AI system error rates, bias thresholds, and explainability requirements. Review tolerance annually or upon significant AI deployment changes.\n"},"originalFormulas":{}},{"id":"ROW-MD-05b44b54908867bbf74e","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":127,"lineEnd":128,"originalCells":{"A":"**GV-6: Policies and Procedures**\n"},"originalFormulas":{}},{"id":"ROW-MD-a00df580d4203690b628","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":129,"lineEnd":131,"originalCells":{"A":"GV-6.1 — Policies and procedures are in place for the identification and documentation of legal requirements related to AI use, including international requirements for AI systems used in multiple jurisdictions.\n*Playbook:* Conduct legal inventory of applicable AI regulations per jurisdiction. Map AI systems to applicable requirements (EU AI Act, CCPA, HIPAA, sector-specific rules). Update as regulations change.\n"},"originalFormulas":{}},{"id":"ROW-MD-2a88ac4934bcf1e3fbf4","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":132,"lineEnd":136,"originalCells":{"A":"GV-6.2 — Organizational risk policies are inclusive of regulatory compliance and legal requirements.\n*Playbook:* Incorporate regulatory requirements into AI risk management policies. Assign compliance owners for each applicable regulation. Track compliance posture in governance reporting.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-141a3272174e25b613e4","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":139,"lineEnd":140,"originalCells":{"A":"**MP-1: Context Is Established**\n"},"originalFormulas":{}},{"id":"ROW-MD-08c4012662b309e53e15","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":141,"lineEnd":143,"originalCells":{"A":"MP-1.1 — Intended purpose, potentially beneficial uses, context of use, and risks of AI systems are understood and documented.\n*Playbook:* Create an AI system fact sheet for every AI deployment. Document intended use cases, foreseeable misuse, affected populations, and deployment environment.\n"},"originalFormulas":{}},{"id":"ROW-MD-3824088982f7a18b7c27","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":144,"lineEnd":146,"originalCells":{"A":"MP-1.2 — Scientific findings, technical standards, and trustworthiness of AI systems are understood, documented, and communicated.\n*Playbook:* Produce or obtain model cards for AI models in use. Document training data sources, architecture, known limitations, and applicable standards.\n"},"originalFormulas":{}},{"id":"ROW-MD-31e46f2c859975d5ac28","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":147,"lineEnd":149,"originalCells":{"A":"MP-1.3 — Potential benefits of intended AI system deployment — including financial, societal, and broadly beneficial uses — are examined and documented.\n*Playbook:* Document the anticipated benefits of the AI system. Include quantified estimates where possible. Consider benefits to all stakeholder groups.\n"},"originalFormulas":{}},{"id":"ROW-MD-a503a1b3ab39ea3e66a6","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":150,"lineEnd":152,"originalCells":{"A":"MP-1.4 — Risks or harms of deployed AI systems — and their potential consequences to individuals, groups, communities, organizations, and society — are examined and documented.\n*Playbook:* Conduct AI impact assessment before deployment. Identify affected populations. Document high-risk harm scenarios. Engage affected communities for high-impact systems.\n"},"originalFormulas":{}},{"id":"ROW-MD-acaddaebe97e2f82e741","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":153,"lineEnd":155,"originalCells":{"A":"MP-1.5 — Likelihood and magnitude of each identified AI system risk or impact are estimated and documented.\n*Playbook:* Score each identified risk on likelihood and magnitude. Use a consistent scoring methodology. Document rationale for scores.\n"},"originalFormulas":{}},{"id":"ROW-MD-f748f73f8e2f09a41b3e","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":156,"lineEnd":158,"originalCells":{"A":"MP-1.6 — Risks or harms from third-party use of the organization's data or AI systems, including data provenance, data quality, and supply chain risks, are documented.\n*Playbook:* Assess data provenance and quality for all training and inference data. Document third-party data use agreements. Evaluate AI supply chain risks.\n"},"originalFormulas":{}},{"id":"ROW-MD-848e120ae1c5eadbe2eb","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":159,"lineEnd":160,"originalCells":{"A":"**MP-2: Scientific Basis of AI Risk**\n"},"originalFormulas":{}},{"id":"ROW-MD-82e32368ca32e7e0d0f6","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":161,"lineEnd":163,"originalCells":{"A":"MP-2.1 — Scientific community norms for validating AI risks and potential impacts are followed.\n*Playbook:* Reference peer-reviewed methods for AI evaluation. Use standardized benchmarks where available. Document validation methodology and limitations.\n"},"originalFormulas":{}},{"id":"ROW-MD-7a9ce958aaf36ce10606","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":164,"lineEnd":166,"originalCells":{"A":"MP-2.2 — Risk classifications are defined by the organization and used in AI risk classification decisions.\n*Playbook:* Define a risk taxonomy with clear classification criteria. Apply consistently across AI systems. Document classification decisions with rationale.\n"},"originalFormulas":{}},{"id":"ROW-MD-c11b0e2fb6a02bbbba85","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":167,"lineEnd":169,"originalCells":{"A":"MP-2.3 — AI system risk and benefit analysis incorporates considerations of affected individuals and groups.\n*Playbook:* Disaggregate risk and benefit analysis by affected population. Identify groups at disproportionate risk. Engage stakeholder representation in analysis.\n"},"originalFormulas":{}},{"id":"ROW-MD-216981fd25eb8f120377","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":170,"lineEnd":171,"originalCells":{"A":"**MP-3: AI Capabilities and Limitations**\n"},"originalFormulas":{}},{"id":"ROW-MD-1a8e735258bbf92a2a4b","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":172,"lineEnd":174,"originalCells":{"A":"MP-3.1 — Potential impacts of bias are characterized in data, models, and downstream uses and impacts are documented.\n*Playbook:* Conduct bias analysis on training data and model outputs. Use established bias metrics (demographic parity, equalized odds, etc.). Document known bias characteristics and acceptable thresholds.\n"},"originalFormulas":{}},{"id":"ROW-MD-14e15e3564e981f42b08","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":175,"lineEnd":177,"originalCells":{"A":"MP-3.2 — Scientific methods — including those from risk sciences, harm sciences, and social sciences — are used to inform bias assessments and documentation.\n*Playbook:* Engage multidisciplinary expertise in bias assessments. Reference validated bias assessment methodologies. Document methodology choices and limitations.\n"},"originalFormulas":{}},{"id":"ROW-MD-ee4c9677708f642a98c1","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":178,"lineEnd":180,"originalCells":{"A":"MP-3.3 — Processes for operator and user feedback about AI system performance and trustworthiness are established and integrated into AI system updates.\n*Playbook:* Establish feedback channels for operators and users. Define process for triaging and acting on feedback. Document feedback integration into model updates.\n"},"originalFormulas":{}},{"id":"ROW-MD-583fc8b7920a0ae1d1e5","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":181,"lineEnd":182,"originalCells":{"A":"**MP-4: Risks Are Prioritized**\n"},"originalFormulas":{}},{"id":"ROW-MD-d6ddca35ad7fa8d2e941","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":183,"lineEnd":185,"originalCells":{"A":"MP-4.1 — The organization's risk tolerance for the AI system under consideration is established, communicated, and incorporated into the risk identification and classification process.\n*Playbook:* Apply organizational risk tolerance thresholds at the system level. Document whether system risk level is within tolerance. Escalate systems outside tolerance before deployment.\n"},"originalFormulas":{}},{"id":"ROW-MD-990a679ee17bc0a802af","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":186,"lineEnd":188,"originalCells":{"A":"MP-4.2 — Risk levels of AI systems at deployment are documented per risk classification and tolerance levels.\n*Playbook:* Assign a risk rating to each AI system at deployment. Document the basis for the rating. Update ratings as system context changes.\n"},"originalFormulas":{}},{"id":"ROW-MD-92bad368146b3d515ade","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":189,"lineEnd":190,"originalCells":{"A":"**MP-5: Organizational Risk Management**\n"},"originalFormulas":{}},{"id":"ROW-MD-39ad28f428e04b59f67a","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":191,"lineEnd":193,"originalCells":{"A":"MP-5.1 — Likelihood of encountering AI risks given use of AI and organizational risk tolerances is determined.\n*Playbook:* Calculate exposure to AI risk across the AI portfolio. Consider frequency of AI use, affected populations, and deployment environment. Document exposure analysis.\n"},"originalFormulas":{}},{"id":"ROW-MD-2a8d6f1e55b3422abbb2","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":194,"lineEnd":196,"originalCells":{"A":"MP-5.2 — Organizations are transparent about known limitations and where knowledge is incomplete.\n*Playbook:* Publish limitations documentation for AI systems. Communicate limitations to operators and users. Acknowledge uncertainty in risk estimates.\n"},"originalFormulas":{}},{"id":"ROW-MD-7635411ad8e787dd6113","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":197,"lineEnd":199,"originalCells":{"A":"MP-5.3 — Organizational risk policies include and are inclusive of AI risks.\n*Playbook:* Verify AI risk is explicitly addressed in enterprise risk policies. Update policies as AI use evolves.\n"},"originalFormulas":{}},{"id":"ROW-MD-cf6a0d612707fc9160ee","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":200,"lineEnd":202,"originalCells":{"A":"MP-5.4 — Risk tolerance for the development and deployment of AI systems is established, communicated, and regularly reviewed.\n*Playbook:* Establish formal risk tolerance review cadence. Document tolerance levels and their basis. Communicate tolerance levels to all AI-involved teams.\n"},"originalFormulas":{}},{"id":"ROW-MD-cbcddc5c168d37b977de","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":203,"lineEnd":207,"originalCells":{"A":"MP-5.5 — Practices and documentation establish how identified risks will be addressed and where they fall in the organization's risk management framework.\n*Playbook:* Document risk treatment methodology. Map AI risks to enterprise risk management processes. Ensure AI risks receive equivalent treatment as other enterprise risks.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-673782116109b494c4e2","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":210,"lineEnd":211,"originalCells":{"A":"**MS-1: Risk Metrics and Methods**\n"},"originalFormulas":{}},{"id":"ROW-MD-088cbb12b7bde0228c71","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":212,"lineEnd":214,"originalCells":{"A":"MS-1.1 — Approaches and metrics for measurement of AI risks and trustworthiness characteristics reflect deployment context and organizational risk tolerance.\n*Playbook:* Define metrics for each NIST AI trustworthiness dimension: accuracy, fairness, transparency, privacy, security, reliability. Calibrate metric thresholds to risk tolerance.\n"},"originalFormulas":{}},{"id":"ROW-MD-0119b31b1e8722334425","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":215,"lineEnd":217,"originalCells":{"A":"MS-1.2 — Trustworthiness characteristics of AI systems are assessed independently and in the context of AI systems to which they may be connected.\n*Playbook:* Conduct standalone system assessments. Also assess AI systems in the context of their integrations and dependencies. Document interconnected system risks.\n"},"originalFormulas":{}},{"id":"ROW-MD-5e0e044a8140dd05544b","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":218,"lineEnd":220,"originalCells":{"A":"MS-1.3 — Internal experts are consulted to assess AI risks.\n*Playbook:* Define which AI risk assessments require expert review. Maintain a list of qualified internal reviewers. Document expert review findings.\n"},"originalFormulas":{}},{"id":"ROW-MD-2a23cd02ddae6b708a33","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":221,"lineEnd":222,"originalCells":{"A":"**MS-2: Risk Analysis**\n"},"originalFormulas":{}},{"id":"ROW-MD-72dc10cef1b1804134cb","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":223,"lineEnd":225,"originalCells":{"A":"MS-2.1 — Test sets, metrics, and details about the tools used during test, evaluation, validation, and verification (TEVV) are documented.\n*Playbook:* Document all test datasets, evaluation metrics, validation methods, and tools used in AI system assessment. Retain test artifacts. Track TEVV coverage.\n"},"originalFormulas":{}},{"id":"ROW-MD-ea9b77e42a0de216f725","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":226,"lineEnd":228,"originalCells":{"A":"MS-2.2 — AI system trustworthiness characteristics are calibrated for risks of under- and over-reliance on AI systems.\n*Playbook:* Test for appropriate confidence calibration. Evaluate uncertainty quantification. Assess whether users appropriately rely on AI outputs in practice.\n"},"originalFormulas":{}},{"id":"ROW-MD-919d39689b34388321c0","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":229,"lineEnd":231,"originalCells":{"A":"MS-2.3 — AI system performance and trustworthiness characteristics are evaluated regularly against benchmarks.\n*Playbook:* Define performance benchmarks for each AI system. Establish evaluation cadence (minimum annually; more frequently for high-risk systems). Document benchmark results.\n"},"originalFormulas":{}},{"id":"ROW-MD-e48400367b294f27e3a6","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":232,"lineEnd":234,"originalCells":{"A":"MS-2.4 — The ability of humans to interpret AI system outputs when needed is evaluated on a regular basis.\n*Playbook:* Test explainability mechanisms with representative users. Measure whether explanations improve appropriate reliance. Document explainability evaluation results.\n"},"originalFormulas":{}},{"id":"ROW-MD-4a6e287bc097281d957c","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":235,"lineEnd":237,"originalCells":{"A":"MS-2.5 — Risk characteristics established in MAP are employed in the measurement and analysis of AI system risks and trustworthiness.\n*Playbook:* Verify traceability from MAP risk inventory to MEASURE evaluation plan. Ensure all identified risks have corresponding measurement activities.\n"},"originalFormulas":{}},{"id":"ROW-MD-eeb5173e52a4da839c68","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":238,"lineEnd":240,"originalCells":{"A":"MS-2.6 — Risk or performance characteristics established in and of AI systems are verified with the relevant populations.\n*Playbook:* Conduct evaluation studies with representative samples of affected populations. Disaggregate results by demographic group. Document population-level validation findings.\n"},"originalFormulas":{}},{"id":"ROW-MD-397159b6fc49c7468759","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":241,"lineEnd":242,"originalCells":{"A":"**MS-3: Performance Monitoring**\n"},"originalFormulas":{}},{"id":"ROW-MD-be0780f98227c042dc01","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":243,"lineEnd":245,"originalCells":{"A":"MS-3.1 — Ongoing monitoring plans are in place to address the identified AI risks and trustworthiness characteristics of the AI system.\n*Playbook:* Document a monitoring plan for each deployed AI system. Define monitored metrics, monitoring frequency, alert thresholds, and escalation procedures.\n"},"originalFormulas":{}},{"id":"ROW-MD-ace36b47747e84c5a577","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":246,"lineEnd":248,"originalCells":{"A":"MS-3.2 — The risk or performance characteristics of the AI system to be deployed are examined and documented.\n*Playbook:* Complete pre-deployment performance review. Document performance against defined thresholds. Obtain approval before deployment.\n"},"originalFormulas":{}},{"id":"ROW-MD-8a096612c794d33bdfe4","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":249,"lineEnd":251,"originalCells":{"A":"MS-3.3 — AI system risks and trustworthiness are measured in deployment and monitoring contexts.\n*Playbook:* Implement production monitoring for key metrics. Capture performance data continuously. Store monitoring data for review.\n"},"originalFormulas":{}},{"id":"ROW-MD-ed8dd4f418eb5d72a7a0","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":252,"lineEnd":254,"originalCells":{"A":"MS-3.4 — Feedback processes for end users and impacted communities to report problems and provide feedback are established.\n*Playbook:* Create accessible feedback channels for end users. Establish triage process for reported issues. Close the loop by communicating actions taken.\n"},"originalFormulas":{}},{"id":"ROW-MD-f629e496fe3c12ddb6f2","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":255,"lineEnd":256,"originalCells":{"A":"**MS-4: Feedback Integration**\n"},"originalFormulas":{}},{"id":"ROW-MD-fc762be4b889b5375ff0","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":257,"lineEnd":259,"originalCells":{"A":"MS-4.1 — Measurement approaches for identifying AI risks are connected to organizational risk tolerance and relevant laws, regulations, and standards.\n*Playbook:* Map measurement methodologies to applicable regulatory requirements. Verify that measured thresholds satisfy legal requirements. Update measurement approaches as regulations change.\n"},"originalFormulas":{}},{"id":"ROW-MD-2ce2db2ec831495e5732","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":260,"lineEnd":264,"originalCells":{"A":"MS-4.2 — Measurement results inform updates to the risk mapping and risk management approaches.\n*Playbook:* Establish a process for measurement findings to feed back into MAP risk classification and MG treatment plans. Document feedback loop. Track improvements resulting from measurement.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-96a51ce79a72205b8104","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":267,"lineEnd":268,"originalCells":{"A":"**MG-1: Risk Response Plans**\n"},"originalFormulas":{}},{"id":"ROW-MD-e184ed513d043dc6d053","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":269,"lineEnd":271,"originalCells":{"A":"MG-1.1 — A set of risk treatment options (responses) are documented for AI risks including the avoidance, acceptance, transfer, and control of risks.\n*Playbook:* Define available risk treatment options. Document criteria for selecting each treatment type. Document selected treatment with rationale for each identified risk.\n"},"originalFormulas":{}},{"id":"ROW-MD-41998f04c8cbdf4d0af1","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":272,"lineEnd":274,"originalCells":{"A":"MG-1.2 — Treatment of AI risks includes a determination of residual risks after the risk response plan has been implemented.\n*Playbook:* Assess residual risk after each treatment. Document residual risk level and acceptability. Obtain approval for deployment if residual risk is within tolerance.\n"},"originalFormulas":{}},{"id":"ROW-MD-a8997e9c26146a1013d6","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":275,"lineEnd":277,"originalCells":{"A":"MG-1.3 — Responses to the AI risks deemed high priority are developed, planned, and documented.\n*Playbook:* Create expedited response planning process for high-priority risks. Define SLA for high-priority risk treatment. Track response implementation.\n"},"originalFormulas":{}},{"id":"ROW-MD-31cac3b2b69acb944887","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":278,"lineEnd":279,"originalCells":{"A":"**MG-2: Risk Response Execution**\n"},"originalFormulas":{}},{"id":"ROW-MD-f46fed402b61a1793ab9","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":280,"lineEnd":282,"originalCells":{"A":"MG-2.1 — Resources required to manage AI risks are taken into account including the staff, budget, and compute required for implementation.\n*Playbook:* Document resource requirements for AI risk management activities. Include AI risk management in organizational budgeting. Track resource utilization.\n"},"originalFormulas":{}},{"id":"ROW-MD-94de39ecb15f49200fce","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":283,"lineEnd":285,"originalCells":{"A":"MG-2.2 — Mechanisms are in place and applied to sustain the value of deployed AI systems and to manage the risks of AI system decommissioning, including appropriate archiving of useful elements.\n*Playbook:* Document AI system lifecycle stages including decommissioning. Create decommissioning checklist. Archive model artifacts, documentation, and decision records before decommission.\n"},"originalFormulas":{}},{"id":"ROW-MD-f9e1251f0d96dfbae4e2","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":286,"lineEnd":288,"originalCells":{"A":"MG-2.3 — Procedures are followed to respond to and recover from a previously unknown risk.\n*Playbook:* Create AI incident response procedure. Include discovery, triage, containment, notification, and recovery steps. Test procedure periodically.\n"},"originalFormulas":{}},{"id":"ROW-MD-360545ebdc2335ea124a","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":289,"lineEnd":291,"originalCells":{"A":"MG-2.4 — Mechanisms are in place to allow personnel to report problems to management.\n*Playbook:* Establish internal reporting channels for AI risk findings. Protect reporters from retaliation. Define escalation process. Track report resolution.\n"},"originalFormulas":{}},{"id":"ROW-MD-63caf64e931f921b1add","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":292,"lineEnd":293,"originalCells":{"A":"**MG-3: Risk Treatment Feedback**\n"},"originalFormulas":{}},{"id":"ROW-MD-8c8ee9abe89f7d93df75","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":294,"lineEnd":296,"originalCells":{"A":"MG-3.1 — Risk treatment strategies and methods are documented, as are the reasons for the selection of risk treatment options.\n*Playbook:* Document each treatment decision with rationale. Record alternatives considered. Maintain treatment rationale for audit purposes.\n"},"originalFormulas":{}},{"id":"ROW-MD-5c183d6c10ac8b190bee","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":297,"lineEnd":299,"originalCells":{"A":"MG-3.2 — Treatment of AI risks includes a determination of residual risk after the risk response plan has been implemented.\n*Playbook:* Conduct post-treatment residual risk assessment. Document residual risk level. Verify residual risk is within organizational tolerance.\n"},"originalFormulas":{}},{"id":"ROW-MD-ced34cc91892b4b08444","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":300,"lineEnd":302,"originalCells":{"A":"MG-3.3 — Feedback processes are in place to inform updates to the risk mapping, risk analysis, risk treatment, and monitoring activities.\n*Playbook:* Define feedback loop from MANAGE findings to MAP and MEASURE. Review effectiveness of risk treatments periodically. Update MAP risk inventory based on treatment outcomes.\n"},"originalFormulas":{}},{"id":"ROW-MD-d4febbbdf002104c0c7d","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":303,"lineEnd":305,"originalCells":{"A":"MG-3.4 — Risk treatment plans for AI systems are maintained and updated regularly.\n*Playbook:* Schedule regular treatment plan reviews. Update plans when AI system context changes. Document plan revision history.\n"},"originalFormulas":{}},{"id":"ROW-MD-80839cc4b0565f8dde71","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":306,"lineEnd":307,"originalCells":{"A":"**MG-4: Risk Communication**\n"},"originalFormulas":{}},{"id":"ROW-MD-4d5cd7cbabf5ceefdce6","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":308,"lineEnd":310,"originalCells":{"A":"MG-4.1 — Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors across the AI lifecycle.\n*Playbook:* Activate monitoring plan at deployment. Capture user feedback and operational data. Review monitoring data on defined cadence.\n"},"originalFormulas":{}},{"id":"ROW-MD-1317688f3a3f22a51b1f","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":311,"lineEnd":313,"originalCells":{"A":"MG-4.2 — Measurable performance improvements or declines and other changes in deployed AI system trustworthiness are evaluated and documented.\n*Playbook:* Track performance trends over time. Document significant changes in AI system behavior. Evaluate whether changes require risk re-assessment.\n"},"originalFormulas":{}},{"id":"ROW-MD-3850b6cbc7817f0de44f","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":314,"lineEnd":316,"originalCells":{"A":"MG-4.3 — Feedback processes for improvement are followed for deployed AI systems.\n*Playbook:* Use monitoring and feedback data to drive AI system improvements. Document improvement actions taken. Track improvement outcomes.\n"},"originalFormulas":{}},{"id":"ROW-MD-ba198ca0f572efd4455a","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","sheet":"POLICY(9).md","row":317,"lineEnd":321,"originalCells":{"A":"MG-4.4 — Organizational teams communicate with personnel to report problems and suggest opportunities for improvement across the AI lifecycle.\n*Playbook:* Create internal communication forums for AI risk findings. Include AI risk in team retrospectives and reviews. Reward problem identification and improvement suggestions.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-1fffbe224e8fdf3e89fd","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":1,"lineEnd":10,"originalCells":{"A":"# OWASP LLM Top 10 (2025)\n\n**Version:** 2025 Edition\n**Framework:** OWASP Top 10 for Large Language Model Applications\n**Scope:** LLM-powered applications, agentic systems, RAG pipelines, LLM API integrations\n**GOVERN Components:** Probe (runtime detection), Assess (evaluation), Policy Engine (enforcement rules)\n\n---\n\n## Overview"},"originalFormulas":{}},{"id":"ROW-MD-596ecabce0458b03d2bc","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":10,"lineEnd":15,"originalCells":{"A":"## Overview\n\nThe OWASP LLM Top 10 identifies the most critical security and safety vulnerabilities specific to large language model applications. These risks are distinct from traditional application vulnerabilities — they exploit the probabilistic, generative nature of LLMs and their increasing agency in production systems. GOVERN's three-layer architecture addresses each risk through complementary enforcement points.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-c43688e9ef0893977ad1","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":16,"lineEnd":52,"originalCells":{"A":"## LLM01 — Prompt Injection\n\n### Description\nAttackers craft inputs that override or subvert an LLM's intended instructions. Direct prompt injection manipulates the system prompt or user prompt directly. Indirect prompt injection embeds adversarial instructions in data the LLM processes — web pages, documents, emails, database records — causing the LLM to follow attacker instructions when reading that data.\n\n### Real-World Examples\n- Indirect injection via malicious web content causing an AI browsing assistant to exfiltrate user data\n- System prompt override through user message framing (\"Ignore previous instructions and...\")\n- Injection via retrieved RAG documents causing a customer service bot to provide false information\n- Jailbreak attacks using role-play framing to bypass safety systems\n- Multi-turn injection accumulating context across conversation turns\n\n### Detection Methods\n- Pattern matching on known injection templates (prefix-based, delimiter confusion, role-play framing)\n- Input/output semantic consistency checking\n- Instruction hierarchy enforcement with explicit delimiting\n- Sandboxed LLM as judge for injection detection\n- Canary tokens in system prompts to detect leakage\n\n### Mitigations\n- Strict input/output delimiting with clearly marked instruction boundaries\n- Least-privilege tool permissions for agentic systems\n- Human approval checkpoints for high-consequence actions\n- Separate trusted and untrusted data pipelines\n- Output validation before action execution\n\n### GOVERN Policy Engine\nPolicy rules: flag inputs containing injection pattern signatures, block system-prompt-override attempts, require human approval before agentic actions on externally-sourced data.\n\n### GOVERN Assess\nEvaluates LLM application prompt architecture for injection resistance. Runs injection attack battery (100+ templates) against the application. Scores injection resilience and flags structural vulnerabilities.\n\n### GOVERN Probe\nRuntime monitors input patterns for injection signatures. Detects prompt boundary violations and unexpected instruction overrides. Flags indirect injection attempts via content ingestion pipelines.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-ea765c1684ae13394cdc","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":18,"lineEnd":20,"originalCells":{"A":"### Description\nAttackers craft inputs that override or subvert an LLM's intended instructions. Direct prompt injection manipulates the system prompt or user prompt directly. Indirect prompt injection embeds adversarial instructions in data the LLM processes — web pages, documents, emails, database records — causing the LLM to follow attacker instructions when reading that data.\n"},"originalFormulas":{}},{"id":"ROW-MD-8138f832664c3b3c77ce","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":21,"lineEnd":27,"originalCells":{"A":"### Real-World Examples\n- Indirect injection via malicious web content causing an AI browsing assistant to exfiltrate user data\n- System prompt override through user message framing (\"Ignore previous instructions and...\")\n- Injection via retrieved RAG documents causing a customer service bot to provide false information\n- Jailbreak attacks using role-play framing to bypass safety systems\n- Multi-turn injection accumulating context across conversation turns\n"},"originalFormulas":{}},{"id":"ROW-MD-a77b0188bd65915ce5f7","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":28,"lineEnd":34,"originalCells":{"A":"### Detection Methods\n- Pattern matching on known injection templates (prefix-based, delimiter confusion, role-play framing)\n- Input/output semantic consistency checking\n- Instruction hierarchy enforcement with explicit delimiting\n- Sandboxed LLM as judge for injection detection\n- Canary tokens in system prompts to detect leakage\n"},"originalFormulas":{}},{"id":"ROW-MD-00c032ac3878e4d66e08","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":35,"lineEnd":41,"originalCells":{"A":"### Mitigations\n- Strict input/output delimiting with clearly marked instruction boundaries\n- Least-privilege tool permissions for agentic systems\n- Human approval checkpoints for high-consequence actions\n- Separate trusted and untrusted data pipelines\n- Output validation before action execution\n"},"originalFormulas":{}},{"id":"ROW-MD-f6ab7a1b6320228a3ccf","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":42,"lineEnd":44,"originalCells":{"A":"### GOVERN Policy Engine\nPolicy rules: flag inputs containing injection pattern signatures, block system-prompt-override attempts, require human approval before agentic actions on externally-sourced data.\n"},"originalFormulas":{}},{"id":"ROW-MD-02504f87cdd7116ef664","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":45,"lineEnd":47,"originalCells":{"A":"### GOVERN Assess\nEvaluates LLM application prompt architecture for injection resistance. Runs injection attack battery (100+ templates) against the application. Scores injection resilience and flags structural vulnerabilities.\n"},"originalFormulas":{}},{"id":"ROW-MD-c43ddd4b05a65ab16a4f","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":48,"lineEnd":52,"originalCells":{"A":"### GOVERN Probe\nRuntime monitors input patterns for injection signatures. Detects prompt boundary violations and unexpected instruction overrides. Flags indirect injection attempts via content ingestion pipelines.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-d510d185b3da7f4a68ff","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":53,"lineEnd":89,"originalCells":{"A":"## LLM02 — Sensitive Information Disclosure\n\n### Description\nLLMs may reveal confidential information including training data, system prompts, internal architecture details, proprietary business logic, or user data from other sessions. This occurs through direct extraction, contextual inference, or memorization leakage.\n\n### Real-World Examples\n- System prompt extraction revealing proprietary AI persona instructions\n- Training data reconstruction revealing PII from pre-training corpora\n- Cross-session data leakage in misconfigured context management\n- Internal API key or credential exposure through LLM tool call verbosity\n- Model revealing business logic embedded in its fine-tuning\n\n### Detection Methods\n- Output scanning for PII patterns (SSN, credit card, email, phone formats)\n- System prompt similarity detection in outputs\n- Credential and secret pattern scanning in generated content\n- Session isolation verification\n- Regular red-team extraction attempts\n\n### Mitigations\n- Mark system prompts as confidential and instruct LLM accordingly\n- Output filtering for PII and secret patterns before serving\n- Session isolation with strict context boundaries\n- Minimal system prompt footprint — avoid embedding sensitive business logic\n- Differential privacy in fine-tuning for sensitive domains\n\n### GOVERN Policy Engine\nPolicy rules: block outputs containing PII regex matches, reject responses that reproduce system prompt contents verbatim, require output sanitization for regulated data categories.\n\n### GOVERN Assess\nScans LLM application configuration for sensitive data exposure risks. Tests system prompt extraction resistance. Evaluates fine-tuned model memorization for PII from training data.\n\n### GOVERN Probe\nRuntime scans all LLM outputs for PII, credentials, and system prompt signatures before delivery. Logs disclosure attempts with full context for forensic review.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-c4b5b41c4a53237b777d","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":55,"lineEnd":57,"originalCells":{"A":"### Description\nLLMs may reveal confidential information including training data, system prompts, internal architecture details, proprietary business logic, or user data from other sessions. This occurs through direct extraction, contextual inference, or memorization leakage.\n"},"originalFormulas":{}},{"id":"ROW-MD-7ec4b34e673752d4a5bb","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":58,"lineEnd":64,"originalCells":{"A":"### Real-World Examples\n- System prompt extraction revealing proprietary AI persona instructions\n- Training data reconstruction revealing PII from pre-training corpora\n- Cross-session data leakage in misconfigured context management\n- Internal API key or credential exposure through LLM tool call verbosity\n- Model revealing business logic embedded in its fine-tuning\n"},"originalFormulas":{}},{"id":"ROW-MD-b9f5c6cb3f7369eba43c","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":65,"lineEnd":71,"originalCells":{"A":"### Detection Methods\n- Output scanning for PII patterns (SSN, credit card, email, phone formats)\n- System prompt similarity detection in outputs\n- Credential and secret pattern scanning in generated content\n- Session isolation verification\n- Regular red-team extraction attempts\n"},"originalFormulas":{}},{"id":"ROW-MD-b3e1543d20ba9950562f","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":72,"lineEnd":78,"originalCells":{"A":"### Mitigations\n- Mark system prompts as confidential and instruct LLM accordingly\n- Output filtering for PII and secret patterns before serving\n- Session isolation with strict context boundaries\n- Minimal system prompt footprint — avoid embedding sensitive business logic\n- Differential privacy in fine-tuning for sensitive domains\n"},"originalFormulas":{}},{"id":"ROW-MD-e7db0a5e48700740bd93","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":79,"lineEnd":81,"originalCells":{"A":"### GOVERN Policy Engine\nPolicy rules: block outputs containing PII regex matches, reject responses that reproduce system prompt contents verbatim, require output sanitization for regulated data categories.\n"},"originalFormulas":{}},{"id":"ROW-MD-e164fbb411d4f68efa60","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":82,"lineEnd":84,"originalCells":{"A":"### GOVERN Assess\nScans LLM application configuration for sensitive data exposure risks. Tests system prompt extraction resistance. Evaluates fine-tuned model memorization for PII from training data.\n"},"originalFormulas":{}},{"id":"ROW-MD-d53d9f267f2bb961b31f","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":85,"lineEnd":89,"originalCells":{"A":"### GOVERN Probe\nRuntime scans all LLM outputs for PII, credentials, and system prompt signatures before delivery. Logs disclosure attempts with full context for forensic review.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-3087cc35824223090148","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":90,"lineEnd":126,"originalCells":{"A":"## LLM03 — Supply Chain\n\n### Description\nVulnerabilities introduced through compromised components in the LLM supply chain: pre-trained model weights, training datasets, inference frameworks, RAG data sources, plugins, and third-party integrations. Adversaries can compromise any layer and have that compromise propagate to production.\n\n### Real-World Examples\n- Backdoored pre-trained models distributed on public model hubs\n- Poisoned fine-tuning datasets from untrusted third-party sources\n- Compromised LLM inference libraries with embedded data exfiltration\n- Malicious LLM plugins with excessive permissions\n- Vulnerable vector databases in RAG pipelines enabling injection\n\n### Detection Methods\n- Model artifact hash verification against signed manifests\n- SBOM (Software Bill of Materials) for all ML dependencies\n- Behavioral testing of integrated third-party components\n- Plugin permission auditing\n- CVE monitoring for ML framework dependencies\n\n### Mitigations\n- Private model registry with signed artifacts and audit logs\n- Vendor security assessment for all LLM component providers\n- Minimal permission grants for plugins and integrations\n- Dependency pinning and automated vulnerability scanning\n- Regular integrity verification of deployed model artifacts\n\n### GOVERN Policy Engine\nPolicy rules: require verified provenance for all model artifacts, block plugins requesting excessive permissions, enforce dependency scanning before deployment approval.\n\n### GOVERN Assess\nConducts supply chain risk assessment: verifies model artifact provenance, scans dependencies for known CVEs, audits plugin permission requests against principle of least privilege.\n\n### GOVERN Probe\nRuntime verifies model artifact integrity on each load. Monitors third-party integration behavior for anomalous patterns. Detects unauthorized model replacement.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-05c958cb8fd90873abc8","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":92,"lineEnd":94,"originalCells":{"A":"### Description\nVulnerabilities introduced through compromised components in the LLM supply chain: pre-trained model weights, training datasets, inference frameworks, RAG data sources, plugins, and third-party integrations. Adversaries can compromise any layer and have that compromise propagate to production.\n"},"originalFormulas":{}},{"id":"ROW-MD-a4a7c007d1b522715349","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":95,"lineEnd":101,"originalCells":{"A":"### Real-World Examples\n- Backdoored pre-trained models distributed on public model hubs\n- Poisoned fine-tuning datasets from untrusted third-party sources\n- Compromised LLM inference libraries with embedded data exfiltration\n- Malicious LLM plugins with excessive permissions\n- Vulnerable vector databases in RAG pipelines enabling injection\n"},"originalFormulas":{}},{"id":"ROW-MD-2ecc1d454e7d7b5b3da5","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":102,"lineEnd":108,"originalCells":{"A":"### Detection Methods\n- Model artifact hash verification against signed manifests\n- SBOM (Software Bill of Materials) for all ML dependencies\n- Behavioral testing of integrated third-party components\n- Plugin permission auditing\n- CVE monitoring for ML framework dependencies\n"},"originalFormulas":{}},{"id":"ROW-MD-e8f0614bff3ac7777033","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":109,"lineEnd":115,"originalCells":{"A":"### Mitigations\n- Private model registry with signed artifacts and audit logs\n- Vendor security assessment for all LLM component providers\n- Minimal permission grants for plugins and integrations\n- Dependency pinning and automated vulnerability scanning\n- Regular integrity verification of deployed model artifacts\n"},"originalFormulas":{}},{"id":"ROW-MD-ee6f84ba67be2388564d","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":116,"lineEnd":118,"originalCells":{"A":"### GOVERN Policy Engine\nPolicy rules: require verified provenance for all model artifacts, block plugins requesting excessive permissions, enforce dependency scanning before deployment approval.\n"},"originalFormulas":{}},{"id":"ROW-MD-b145b33bf04745628411","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":119,"lineEnd":121,"originalCells":{"A":"### GOVERN Assess\nConducts supply chain risk assessment: verifies model artifact provenance, scans dependencies for known CVEs, audits plugin permission requests against principle of least privilege.\n"},"originalFormulas":{}},{"id":"ROW-MD-6e9403dc2fe5791991ce","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":122,"lineEnd":126,"originalCells":{"A":"### GOVERN Probe\nRuntime verifies model artifact integrity on each load. Monitors third-party integration behavior for anomalous patterns. Detects unauthorized model replacement.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-7443063355b74ccd9517","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":127,"lineEnd":162,"originalCells":{"A":"## LLM04 — Data and Model Poisoning\n\n### Description\nAdversarial manipulation of training or fine-tuning data to corrupt model behavior. Unlike ML supply chain attacks, this focuses on the training pipeline itself — attackers who can influence training data can embed biases, backdoors, or behavioral modifications that survive into production.\n\n### Real-World Examples\n- Fine-tuning dataset poisoned to make a customer service bot provide incorrect information about a competitor\n- Retrieval-augmented generation (RAG) knowledge base poisoned with false information\n- RLHF preference data manipulation causing model to favor harmful outputs\n- Continuous learning systems poisoned through adversarial user feedback\n\n### Detection Methods\n- Training data provenance and chain-of-custody logging\n- Influence function analysis to identify anomalous training samples\n- Behavioral testing comparing base model vs fine-tuned model on adversarial inputs\n- Knowledge base integrity monitoring for RAG systems\n- Feedback quality scoring before incorporation into training\n\n### Mitigations\n- Cryptographic signing of training datasets\n- Human review of high-influence training samples before inclusion\n- Anomaly detection on crowdsourced or user-generated labels\n- Immutable knowledge base storage with change audit trails\n- Separate validation pipeline with clean, verified ground truth data\n\n### GOVERN Policy Engine\nPolicy rules: require signed provenance for all training data, mandate human review of data samples flagged as anomalous by influence analysis, block knowledge base updates without integrity verification.\n\n### GOVERN Assess\nEvaluates training and fine-tuning data pipeline for poisoning risk. Runs influence function analysis on current training data. Tests RAG knowledge bases for injected false information.\n\n### GOVERN Probe\nMonitors knowledge base for unauthorized modifications. Detects behavioral drift indicating poisoning effects. Validates training data integrity before each fine-tuning cycle.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-5c8ddc8e9dcd58c5181a","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":129,"lineEnd":131,"originalCells":{"A":"### Description\nAdversarial manipulation of training or fine-tuning data to corrupt model behavior. Unlike ML supply chain attacks, this focuses on the training pipeline itself — attackers who can influence training data can embed biases, backdoors, or behavioral modifications that survive into production.\n"},"originalFormulas":{}},{"id":"ROW-MD-93d1861a27f88816bc71","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":132,"lineEnd":137,"originalCells":{"A":"### Real-World Examples\n- Fine-tuning dataset poisoned to make a customer service bot provide incorrect information about a competitor\n- Retrieval-augmented generation (RAG) knowledge base poisoned with false information\n- RLHF preference data manipulation causing model to favor harmful outputs\n- Continuous learning systems poisoned through adversarial user feedback\n"},"originalFormulas":{}},{"id":"ROW-MD-a0b95924b82326fd9740","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":138,"lineEnd":144,"originalCells":{"A":"### Detection Methods\n- Training data provenance and chain-of-custody logging\n- Influence function analysis to identify anomalous training samples\n- Behavioral testing comparing base model vs fine-tuned model on adversarial inputs\n- Knowledge base integrity monitoring for RAG systems\n- Feedback quality scoring before incorporation into training\n"},"originalFormulas":{}},{"id":"ROW-MD-eaea333aca845d752877","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":145,"lineEnd":151,"originalCells":{"A":"### Mitigations\n- Cryptographic signing of training datasets\n- Human review of high-influence training samples before inclusion\n- Anomaly detection on crowdsourced or user-generated labels\n- Immutable knowledge base storage with change audit trails\n- Separate validation pipeline with clean, verified ground truth data\n"},"originalFormulas":{}},{"id":"ROW-MD-6589842a7e5928631cbd","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":152,"lineEnd":154,"originalCells":{"A":"### GOVERN Policy Engine\nPolicy rules: require signed provenance for all training data, mandate human review of data samples flagged as anomalous by influence analysis, block knowledge base updates without integrity verification.\n"},"originalFormulas":{}},{"id":"ROW-MD-98d59a9856255e9d3c6b","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":155,"lineEnd":157,"originalCells":{"A":"### GOVERN Assess\nEvaluates training and fine-tuning data pipeline for poisoning risk. Runs influence function analysis on current training data. Tests RAG knowledge bases for injected false information.\n"},"originalFormulas":{}},{"id":"ROW-MD-da2adb70dfab2dd220c3","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":158,"lineEnd":162,"originalCells":{"A":"### GOVERN Probe\nMonitors knowledge base for unauthorized modifications. Detects behavioral drift indicating poisoning effects. Validates training data integrity before each fine-tuning cycle.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-6cd868d7e4efdfd0ffea","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":163,"lineEnd":198,"originalCells":{"A":"## LLM05 — Improper Output Handling\n\n### Description\nInsufficient validation, sanitization, or handling of LLM-generated content before passing it to downstream systems. LLM outputs can contain executable code, SQL, HTML, OS commands, or other content that causes injection vulnerabilities when passed unsanitized to interpreters, databases, or rendering engines.\n\n### Real-World Examples\n- LLM-generated SQL passed directly to a database without sanitization enabling SQL injection\n- LLM-generated HTML rendered without escaping enabling stored XSS\n- LLM-generated code executed directly enabling arbitrary code execution\n- LLM-generated OS commands passed to shell without validation\n- SSRF via LLM-generated URLs in agentic web-browsing contexts\n\n### Detection Methods\n- Static analysis of LLM output handling code\n- Dynamic testing with injection payloads in LLM responses\n- Context-sensitive output encoding verification\n- Code execution sandbox for LLM-generated code\n\n### Mitigations\n- Treat all LLM outputs as untrusted user input\n- Context-sensitive output encoding (HTML encode for HTML context, parameterized queries for SQL)\n- Sandboxed execution environments for LLM-generated code\n- Schema validation of structured LLM outputs before use\n- Output length and format constraints\n\n### GOVERN Policy Engine\nPolicy rules: require output sanitization for all LLM content passed to downstream systems, enforce sandboxed execution for LLM-generated code, validate structured outputs against defined schemas.\n\n### GOVERN Assess\nAudits LLM application code for improper output handling patterns. Tests output encoding and injection prevention. Evaluates code execution controls for agentic systems.\n\n### GOVERN Probe\nRuntime scans LLM outputs for injection patterns before downstream consumption. Validates structured outputs against schemas. Enforces sandboxing for code execution requests.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-f7a6d44249d4266a2254","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":165,"lineEnd":167,"originalCells":{"A":"### Description\nInsufficient validation, sanitization, or handling of LLM-generated content before passing it to downstream systems. LLM outputs can contain executable code, SQL, HTML, OS commands, or other content that causes injection vulnerabilities when passed unsanitized to interpreters, databases, or rendering engines.\n"},"originalFormulas":{}},{"id":"ROW-MD-c5fbf32aa5cbb6a07e6e","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":168,"lineEnd":174,"originalCells":{"A":"### Real-World Examples\n- LLM-generated SQL passed directly to a database without sanitization enabling SQL injection\n- LLM-generated HTML rendered without escaping enabling stored XSS\n- LLM-generated code executed directly enabling arbitrary code execution\n- LLM-generated OS commands passed to shell without validation\n- SSRF via LLM-generated URLs in agentic web-browsing contexts\n"},"originalFormulas":{}},{"id":"ROW-MD-f791c89d2f742da932df","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":175,"lineEnd":180,"originalCells":{"A":"### Detection Methods\n- Static analysis of LLM output handling code\n- Dynamic testing with injection payloads in LLM responses\n- Context-sensitive output encoding verification\n- Code execution sandbox for LLM-generated code\n"},"originalFormulas":{}},{"id":"ROW-MD-65b5b08bcd50b1cb10d1","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":181,"lineEnd":187,"originalCells":{"A":"### Mitigations\n- Treat all LLM outputs as untrusted user input\n- Context-sensitive output encoding (HTML encode for HTML context, parameterized queries for SQL)\n- Sandboxed execution environments for LLM-generated code\n- Schema validation of structured LLM outputs before use\n- Output length and format constraints\n"},"originalFormulas":{}},{"id":"ROW-MD-3bcb46c85cfb0ceae43e","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":188,"lineEnd":190,"originalCells":{"A":"### GOVERN Policy Engine\nPolicy rules: require output sanitization for all LLM content passed to downstream systems, enforce sandboxed execution for LLM-generated code, validate structured outputs against defined schemas.\n"},"originalFormulas":{}},{"id":"ROW-MD-8b53ea0786c3c1c87216","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":191,"lineEnd":193,"originalCells":{"A":"### GOVERN Assess\nAudits LLM application code for improper output handling patterns. Tests output encoding and injection prevention. Evaluates code execution controls for agentic systems.\n"},"originalFormulas":{}},{"id":"ROW-MD-935807c4889d62f5ec93","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":194,"lineEnd":198,"originalCells":{"A":"### GOVERN Probe\nRuntime scans LLM outputs for injection patterns before downstream consumption. Validates structured outputs against schemas. Enforces sandboxing for code execution requests.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-df47bf77ed3e1161b021","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":199,"lineEnd":233,"originalCells":{"A":"## LLM06 — Excessive Agency\n\n### Description\nLLM agents granted more permissions, capabilities, or autonomy than necessary for their intended function. When an over-privileged agent is compromised (via prompt injection or other attacks), the blast radius is proportional to its granted permissions. The principle of least privilege is the primary defense.\n\n### Real-World Examples\n- Customer service LLM with write access to production databases enabling data destruction via prompt injection\n- AI coding assistant with full filesystem access exfiltrating sensitive files\n- LLM email assistant with send permissions used to execute spear-phishing campaigns\n- Agentic system with unrestricted web access performing unauthorized transactions\n\n### Detection Methods\n- Permission audit of all LLM tool grants\n- Action logging for all tool invocations by LLM agents\n- Anomaly detection on action frequency and type\n- Human review requirements for high-consequence actions\n\n### Mitigations\n- Minimal permission grants — only tools required for the specific task\n- Human-in-the-loop approval for irreversible or high-consequence actions\n- Rate limiting on automated action execution\n- Separate permission scopes for different agent roles\n- Audit logging of all agent-initiated actions\n\n### GOVERN Policy Engine\nPolicy rules: block agent deployments with excessive tool permissions relative to stated purpose, require human approval for irreversible actions (delete, send, execute), enforce action rate limits per agent instance.\n\n### GOVERN Assess\nEvaluates all tool permission grants for each LLM agent. Maps permissions to stated use case and flags over-provisioning. Scores agency risk based on permission scope and action reversibility.\n\n### GOVERN Probe\nRuntime logs all agent tool invocations. Detects anomalous action patterns. Enforces human approval gates for high-consequence actions. Monitors action rate against configured limits.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-46c2ed7325d97aa99695","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":201,"lineEnd":203,"originalCells":{"A":"### Description\nLLM agents granted more permissions, capabilities, or autonomy than necessary for their intended function. When an over-privileged agent is compromised (via prompt injection or other attacks), the blast radius is proportional to its granted permissions. The principle of least privilege is the primary defense.\n"},"originalFormulas":{}},{"id":"ROW-MD-4f461162c13766da63c5","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":204,"lineEnd":209,"originalCells":{"A":"### Real-World Examples\n- Customer service LLM with write access to production databases enabling data destruction via prompt injection\n- AI coding assistant with full filesystem access exfiltrating sensitive files\n- LLM email assistant with send permissions used to execute spear-phishing campaigns\n- Agentic system with unrestricted web access performing unauthorized transactions\n"},"originalFormulas":{}},{"id":"ROW-MD-21c9b6388410c85ad242","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":210,"lineEnd":215,"originalCells":{"A":"### Detection Methods\n- Permission audit of all LLM tool grants\n- Action logging for all tool invocations by LLM agents\n- Anomaly detection on action frequency and type\n- Human review requirements for high-consequence actions\n"},"originalFormulas":{}},{"id":"ROW-MD-3426706924a0f4ed4177","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":216,"lineEnd":222,"originalCells":{"A":"### Mitigations\n- Minimal permission grants — only tools required for the specific task\n- Human-in-the-loop approval for irreversible or high-consequence actions\n- Rate limiting on automated action execution\n- Separate permission scopes for different agent roles\n- Audit logging of all agent-initiated actions\n"},"originalFormulas":{}},{"id":"ROW-MD-3859973906b22795b299","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":223,"lineEnd":225,"originalCells":{"A":"### GOVERN Policy Engine\nPolicy rules: block agent deployments with excessive tool permissions relative to stated purpose, require human approval for irreversible actions (delete, send, execute), enforce action rate limits per agent instance.\n"},"originalFormulas":{}},{"id":"ROW-MD-e4336095233d5226d9f5","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":226,"lineEnd":228,"originalCells":{"A":"### GOVERN Assess\nEvaluates all tool permission grants for each LLM agent. Maps permissions to stated use case and flags over-provisioning. Scores agency risk based on permission scope and action reversibility.\n"},"originalFormulas":{}},{"id":"ROW-MD-442f3fe4ed30038c75bc","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":229,"lineEnd":233,"originalCells":{"A":"### GOVERN Probe\nRuntime logs all agent tool invocations. Detects anomalous action patterns. Enforces human approval gates for high-consequence actions. Monitors action rate against configured limits.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-d26a12680e2f837bc0f8","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":234,"lineEnd":268,"originalCells":{"A":"## LLM07 — System Prompt Leakage\n\n### Description\nUnauthorized disclosure of system prompt contents, revealing proprietary instructions, business logic, security constraints, or persona configuration. System prompts often contain sensitive intellectual property and security-relevant instructions whose disclosure enables more effective attacks.\n\n### Real-World Examples\n- Extraction of competitor AI assistant system prompts revealing proprietary persona configurations\n- System prompt disclosure revealing the exact safety constraint wording, enabling targeted bypass\n- Internal tool instructions revealed through model verbosity in error states\n- Multi-model routing logic exposed through system prompt extraction\n\n### Detection Methods\n- Output similarity comparison against system prompt contents\n- Red team extraction attempt battery\n- Model instruction-following robustness testing\n- Monitoring for verbatim system prompt reproduction\n\n### Mitigations\n- Instruct LLM explicitly not to reveal system prompt contents\n- Minimize sensitive content in system prompts (avoid embedding credentials or business secrets)\n- Test system prompt confidentiality before deployment\n- Use separate confidential and operational instruction layers\n- Monitor production outputs for system prompt signatures\n\n### GOVERN Policy Engine\nPolicy rules: flag outputs with high similarity to known system prompt contents, require system prompt confidentiality testing before deployment approval, block embedding of credentials or secrets in system prompts.\n\n### GOVERN Assess\nTests system prompt extraction resistance using known jailbreak and extraction techniques. Measures similarity between model outputs and system prompt contents. Flags inadequate confidentiality configurations.\n\n### GOVERN Probe\nRuntime computes cosine similarity between outputs and registered system prompt signatures. Triggers alert when similarity exceeds threshold. Logs all suspected leakage events.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-2cced0c20f59b602d37f","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":236,"lineEnd":238,"originalCells":{"A":"### Description\nUnauthorized disclosure of system prompt contents, revealing proprietary instructions, business logic, security constraints, or persona configuration. System prompts often contain sensitive intellectual property and security-relevant instructions whose disclosure enables more effective attacks.\n"},"originalFormulas":{}},{"id":"ROW-MD-ba0a4efb5c6a5219ebc6","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":239,"lineEnd":244,"originalCells":{"A":"### Real-World Examples\n- Extraction of competitor AI assistant system prompts revealing proprietary persona configurations\n- System prompt disclosure revealing the exact safety constraint wording, enabling targeted bypass\n- Internal tool instructions revealed through model verbosity in error states\n- Multi-model routing logic exposed through system prompt extraction\n"},"originalFormulas":{}},{"id":"ROW-MD-2c0469c361a8a74fae1d","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":245,"lineEnd":250,"originalCells":{"A":"### Detection Methods\n- Output similarity comparison against system prompt contents\n- Red team extraction attempt battery\n- Model instruction-following robustness testing\n- Monitoring for verbatim system prompt reproduction\n"},"originalFormulas":{}},{"id":"ROW-MD-f209a42b0df6f0a80ba9","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":251,"lineEnd":257,"originalCells":{"A":"### Mitigations\n- Instruct LLM explicitly not to reveal system prompt contents\n- Minimize sensitive content in system prompts (avoid embedding credentials or business secrets)\n- Test system prompt confidentiality before deployment\n- Use separate confidential and operational instruction layers\n- Monitor production outputs for system prompt signatures\n"},"originalFormulas":{}},{"id":"ROW-MD-b0e592ce65871c5d78e8","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":258,"lineEnd":260,"originalCells":{"A":"### GOVERN Policy Engine\nPolicy rules: flag outputs with high similarity to known system prompt contents, require system prompt confidentiality testing before deployment approval, block embedding of credentials or secrets in system prompts.\n"},"originalFormulas":{}},{"id":"ROW-MD-52f02590fe36df23dac8","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":261,"lineEnd":263,"originalCells":{"A":"### GOVERN Assess\nTests system prompt extraction resistance using known jailbreak and extraction techniques. Measures similarity between model outputs and system prompt contents. Flags inadequate confidentiality configurations.\n"},"originalFormulas":{}},{"id":"ROW-MD-41b2216d7c9b0bdee073","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":264,"lineEnd":268,"originalCells":{"A":"### GOVERN Probe\nRuntime computes cosine similarity between outputs and registered system prompt signatures. Triggers alert when similarity exceeds threshold. Logs all suspected leakage events.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-705fd1081d624ca63dec","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":269,"lineEnd":303,"originalCells":{"A":"## LLM08 — Vector and Embedding Weaknesses\n\n### Description\nVulnerabilities in the vector databases, embedding models, and retrieval systems that underpin RAG (Retrieval-Augmented Generation) architectures. Attackers can exploit vector search to inject adversarial documents, manipulate semantic similarity to retrieve inappropriate content, or attack the embedding model itself.\n\n### Real-World Examples\n- Adversarial documents crafted to be semantically similar to benign queries, poisoning RAG retrieval\n- Embedding model manipulation causing incorrect semantic similarity computation\n- Vector database access control gaps exposing documents from other tenants\n- Prompt injection payloads embedded in chunked document storage\n\n### Detection Methods\n- Adversarial retrieval testing with crafted attack documents\n- Document content scanning before vectorization\n- Multi-tenant isolation verification in vector databases\n- Embedding model robustness evaluation\n\n### Mitigations\n- Scan documents for injection payloads before vectorization and storage\n- Implement strong multi-tenant isolation in vector databases\n- Apply access controls at retrieval time, not just storage time\n- Use diverse retrieval strategies (not only nearest-neighbor) for resilience\n- Monitor retrieved document relevance distributions for anomalies\n\n### GOVERN Policy Engine\nPolicy rules: require document scanning before RAG ingestion, enforce multi-tenant isolation verification for shared vector stores, mandate access control audits for retrieval systems.\n\n### GOVERN Assess\nAudits RAG architecture for vector database security controls. Tests adversarial retrieval resistance. Verifies multi-tenant isolation. Evaluates embedding model robustness.\n\n### GOVERN Probe\nScans documents before vectorization for injection payloads. Monitors retrieval distributions for anomalous document surfacing. Validates access control enforcement at retrieval time.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-ea95dd45948c8957e56b","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":271,"lineEnd":273,"originalCells":{"A":"### Description\nVulnerabilities in the vector databases, embedding models, and retrieval systems that underpin RAG (Retrieval-Augmented Generation) architectures. Attackers can exploit vector search to inject adversarial documents, manipulate semantic similarity to retrieve inappropriate content, or attack the embedding model itself.\n"},"originalFormulas":{}},{"id":"ROW-MD-1233b725f1a3994f53d2","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":274,"lineEnd":279,"originalCells":{"A":"### Real-World Examples\n- Adversarial documents crafted to be semantically similar to benign queries, poisoning RAG retrieval\n- Embedding model manipulation causing incorrect semantic similarity computation\n- Vector database access control gaps exposing documents from other tenants\n- Prompt injection payloads embedded in chunked document storage\n"},"originalFormulas":{}},{"id":"ROW-MD-ad0a1d44f2148ec1f3b2","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":280,"lineEnd":285,"originalCells":{"A":"### Detection Methods\n- Adversarial retrieval testing with crafted attack documents\n- Document content scanning before vectorization\n- Multi-tenant isolation verification in vector databases\n- Embedding model robustness evaluation\n"},"originalFormulas":{}},{"id":"ROW-MD-64109db54079ed2d0aee","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":286,"lineEnd":292,"originalCells":{"A":"### Mitigations\n- Scan documents for injection payloads before vectorization and storage\n- Implement strong multi-tenant isolation in vector databases\n- Apply access controls at retrieval time, not just storage time\n- Use diverse retrieval strategies (not only nearest-neighbor) for resilience\n- Monitor retrieved document relevance distributions for anomalies\n"},"originalFormulas":{}},{"id":"ROW-MD-491025ca7ddd64669640","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":293,"lineEnd":295,"originalCells":{"A":"### GOVERN Policy Engine\nPolicy rules: require document scanning before RAG ingestion, enforce multi-tenant isolation verification for shared vector stores, mandate access control audits for retrieval systems.\n"},"originalFormulas":{}},{"id":"ROW-MD-b53d16e203ff9fb351a9","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":296,"lineEnd":298,"originalCells":{"A":"### GOVERN Assess\nAudits RAG architecture for vector database security controls. Tests adversarial retrieval resistance. Verifies multi-tenant isolation. Evaluates embedding model robustness.\n"},"originalFormulas":{}},{"id":"ROW-MD-cd4c30a6ae901fcd0a48","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":299,"lineEnd":303,"originalCells":{"A":"### GOVERN Probe\nScans documents before vectorization for injection payloads. Monitors retrieval distributions for anomalous document surfacing. Validates access control enforcement at retrieval time.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-4d60299c5c5e67a01637","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":304,"lineEnd":339,"originalCells":{"A":"## LLM09 — Misinformation\n\n### Description\nLLMs generating plausible but factually incorrect, misleading, or fabricated content (hallucinations). Unlike other LLM vulnerabilities, misinformation risk is inherent to LLM architecture — models generate statistically plausible sequences regardless of factual grounding.\n\n### Real-World Examples\n- AI legal research tools hallucinating case citations that don't exist\n- Medical AI providing incorrect dosing information with high apparent confidence\n- AI-generated news summaries fabricating quotes and statistics\n- Customer service bots providing incorrect product specifications\n\n### Detection Methods\n- Groundedness evaluation against authoritative sources\n- Confidence calibration measurement\n- Factual consistency checking for retrievable claims\n- Human expert review sampling for domain-specific applications\n- Hallucination benchmark evaluation (TruthfulQA, HaluEval)\n\n### Mitigations\n- Retrieval-augmented generation with authoritative sources\n- Citation requirements for factual claims\n- Confidence thresholding with fallback to human review\n- Domain expert review for regulated content (medical, legal, financial)\n- User disclosure of AI-generated content with accuracy caveats\n\n### GOVERN Policy Engine\nPolicy rules: require RAG grounding for factual claims in regulated domains, mandate confidence disclosure in outputs, block deployment of LLM applications making medical/legal/financial claims without human review checkpoints.\n\n### GOVERN Assess\nEvaluates model on standardized hallucination benchmarks. Tests groundedness in RAG configurations. Measures confidence calibration. Scores factual accuracy for domain-specific deployments.\n\n### GOVERN Probe\nRuntime evaluates output groundedness against retrieved sources for RAG systems. Monitors confidence scores for calibration drift. Flags low-confidence outputs in high-stakes domains for human review.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-d13518a0257900cc86ae","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":306,"lineEnd":308,"originalCells":{"A":"### Description\nLLMs generating plausible but factually incorrect, misleading, or fabricated content (hallucinations). Unlike other LLM vulnerabilities, misinformation risk is inherent to LLM architecture — models generate statistically plausible sequences regardless of factual grounding.\n"},"originalFormulas":{}},{"id":"ROW-MD-4b110d30528f0207875f","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":309,"lineEnd":314,"originalCells":{"A":"### Real-World Examples\n- AI legal research tools hallucinating case citations that don't exist\n- Medical AI providing incorrect dosing information with high apparent confidence\n- AI-generated news summaries fabricating quotes and statistics\n- Customer service bots providing incorrect product specifications\n"},"originalFormulas":{}},{"id":"ROW-MD-e722c82e4f3cc18b1cd7","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":315,"lineEnd":321,"originalCells":{"A":"### Detection Methods\n- Groundedness evaluation against authoritative sources\n- Confidence calibration measurement\n- Factual consistency checking for retrievable claims\n- Human expert review sampling for domain-specific applications\n- Hallucination benchmark evaluation (TruthfulQA, HaluEval)\n"},"originalFormulas":{}},{"id":"ROW-MD-41e3868cf7a18be32be5","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":322,"lineEnd":328,"originalCells":{"A":"### Mitigations\n- Retrieval-augmented generation with authoritative sources\n- Citation requirements for factual claims\n- Confidence thresholding with fallback to human review\n- Domain expert review for regulated content (medical, legal, financial)\n- User disclosure of AI-generated content with accuracy caveats\n"},"originalFormulas":{}},{"id":"ROW-MD-ecde04d14371140e41eb","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":329,"lineEnd":331,"originalCells":{"A":"### GOVERN Policy Engine\nPolicy rules: require RAG grounding for factual claims in regulated domains, mandate confidence disclosure in outputs, block deployment of LLM applications making medical/legal/financial claims without human review checkpoints.\n"},"originalFormulas":{}},{"id":"ROW-MD-2e79c62ed015ce5c2136","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":332,"lineEnd":334,"originalCells":{"A":"### GOVERN Assess\nEvaluates model on standardized hallucination benchmarks. Tests groundedness in RAG configurations. Measures confidence calibration. Scores factual accuracy for domain-specific deployments.\n"},"originalFormulas":{}},{"id":"ROW-MD-685390583072acddb703","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":335,"lineEnd":339,"originalCells":{"A":"### GOVERN Probe\nRuntime evaluates output groundedness against retrieved sources for RAG systems. Monitors confidence scores for calibration drift. Flags low-confidence outputs in high-stakes domains for human review.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-ad7689e486171f46823f","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":340,"lineEnd":374,"originalCells":{"A":"## LLM10 — Unbounded Consumption\n\n### Description\nExcessive resource consumption by LLM applications enabling denial of service, cost amplification, or service degradation. Attackers can craft inputs that cause disproportionately expensive computation (context window exhaustion, recursive reasoning loops, excessive tool calls) or simply flood the API.\n\n### Real-World Examples\n- \"Prompt flooding\" attacks exhausting context windows with irrelevant content to force expensive completions\n- Agentic loops triggered by crafted inputs causing recursive tool call chains\n- Context injection attacks maximizing token generation to amplify per-request cost\n- Jailbroken LLMs used to proxy expensive API calls at attacker direction\n\n### Detection Methods\n- Token consumption monitoring per request and per user\n- Tool call chain depth monitoring for agentic systems\n- Latency anomaly detection for unusually long completions\n- Cost per session tracking with alert thresholds\n\n### Mitigations\n- Per-user and per-session token budgets\n- Maximum context window size enforcement\n- Tool call depth limits for agentic systems\n- Rate limiting at API gateway and application layers\n- Cost circuit breakers triggering review above thresholds\n\n### GOVERN Policy Engine\nPolicy rules: enforce per-user token consumption limits, set maximum tool call chain depth (default: 10), require cost circuit breakers above configurable thresholds, mandate rate limiting at all API surfaces.\n\n### GOVERN Assess\nEvaluates LLM application resource consumption controls. Tests for DoS vulnerability via context flooding. Reviews agentic loop depth constraints. Assesses cost control architecture.\n\n### GOVERN Probe\nRuntime monitors token consumption, latency, and tool call chains per request. Triggers cost circuit breakers when thresholds exceeded. Detects anomalous consumption patterns consistent with abuse.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-8e2e9b4dc5a6db699077","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":342,"lineEnd":344,"originalCells":{"A":"### Description\nExcessive resource consumption by LLM applications enabling denial of service, cost amplification, or service degradation. Attackers can craft inputs that cause disproportionately expensive computation (context window exhaustion, recursive reasoning loops, excessive tool calls) or simply flood the API.\n"},"originalFormulas":{}},{"id":"ROW-MD-ea4aef6f5bce0a7b8e39","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":345,"lineEnd":350,"originalCells":{"A":"### Real-World Examples\n- \"Prompt flooding\" attacks exhausting context windows with irrelevant content to force expensive completions\n- Agentic loops triggered by crafted inputs causing recursive tool call chains\n- Context injection attacks maximizing token generation to amplify per-request cost\n- Jailbroken LLMs used to proxy expensive API calls at attacker direction\n"},"originalFormulas":{}},{"id":"ROW-MD-042a6393279cc669bc48","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":351,"lineEnd":356,"originalCells":{"A":"### Detection Methods\n- Token consumption monitoring per request and per user\n- Tool call chain depth monitoring for agentic systems\n- Latency anomaly detection for unusually long completions\n- Cost per session tracking with alert thresholds\n"},"originalFormulas":{}},{"id":"ROW-MD-ecbd9af1dde9be45b3dc","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":357,"lineEnd":363,"originalCells":{"A":"### Mitigations\n- Per-user and per-session token budgets\n- Maximum context window size enforcement\n- Tool call depth limits for agentic systems\n- Rate limiting at API gateway and application layers\n- Cost circuit breakers triggering review above thresholds\n"},"originalFormulas":{}},{"id":"ROW-MD-c045926634cde18239d2","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":364,"lineEnd":366,"originalCells":{"A":"### GOVERN Policy Engine\nPolicy rules: enforce per-user token consumption limits, set maximum tool call chain depth (default: 10), require cost circuit breakers above configurable thresholds, mandate rate limiting at all API surfaces.\n"},"originalFormulas":{}},{"id":"ROW-MD-549fc8dc3feffc770d09","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":367,"lineEnd":369,"originalCells":{"A":"### GOVERN Assess\nEvaluates LLM application resource consumption controls. Tests for DoS vulnerability via context flooding. Reviews agentic loop depth constraints. Assesses cost control architecture.\n"},"originalFormulas":{}},{"id":"ROW-MD-336dda202e993752b778","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":370,"lineEnd":374,"originalCells":{"A":"### GOVERN Probe\nRuntime monitors token consumption, latency, and tool call chains per request. Triggers cost circuit breakers when thresholds exceeded. Detects anomalous consumption patterns consistent with abuse.\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-4ec71568b0fa1a91d697","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":375,"lineEnd":391,"originalCells":{"A":"## GOVERN Component Coverage Matrix\n\n| Risk | Policy Engine | Assess | Probe |\n|------|:---:|:---:|:---:|\n| LLM01 Prompt Injection | Injection pattern rules | Injection battery testing | Real-time input monitoring |\n| LLM02 Sensitive Info Disclosure | PII block rules | Extraction resistance testing | Output scanning |\n| LLM03 Supply Chain | Provenance requirements | Component risk assessment | Artifact integrity monitoring |\n| LLM04 Data Poisoning | Data signing requirements | Influence function analysis | Knowledge base monitoring |\n| LLM05 Improper Output Handling | Sanitization enforcement | Code audit | Output validation |\n| LLM06 Excessive Agency | Permission scope rules | Permission audit | Action logging + gates |\n| LLM07 System Prompt Leakage | Confidentiality rules | Extraction testing | Similarity detection |\n| LLM08 Vector/Embedding | RAG scanning requirements | Architecture audit | Pre-ingestion scanning |\n| LLM09 Misinformation | Grounding requirements | Hallucination benchmarks | Groundedness monitoring |\n| LLM10 Unbounded Consumption | Rate/budget limits | DoS resistance testing | Consumption monitoring |\n\n---\n"},"originalFormulas":{}},{"id":"ROW-MD-54413fd9f83f7a07e72c","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","sheet":"POLICY(10).md","row":392,"lineEnd":398,"originalCells":{"A":"## References\n\n- OWASP Top 10 for LLM Applications 2025: https://owasp.org/www-project-top-10-for-large-language-model-applications/\n- NIST AI 100-1: Artificial Intelligence Risk Management Framework\n- MITRE ATLAS: Adversarial Threat Landscape for AI Systems\n- OWASP WSTG (Web Security Testing Guide) — adapted for LLM contexts\n- Anthropic Model Card: Claude 3 Safety Evaluation"},"originalFormulas":{}}],"provenance":[{"id":"PRV-00f6c8e226eac3c8dfdd379a","recordKey":"FW-NIST-AI-RMF@aba341d53497210b","sourceRowId":"ROW-73ae5c8d6d76da722c7cbaad","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":5,"locator":"'04 Framework Catalog'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9059228717a86bf0f0d52cee","recordKey":"FW-NIST-AI-600-1@91e5bc3b14f2a84b","sourceRowId":"ROW-eea746eaa776d1004c48a97e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":6,"locator":"'04 Framework Catalog'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d8735190405465b269d88586","recordKey":"FW-NIST-CSF2@e2682aacee87a7d8","sourceRowId":"ROW-80a19ee37e5c8a39a94c4430","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":7,"locator":"'04 Framework Catalog'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-89fbc3e3ffe40b4df15606cc","recordKey":"FW-NIST-800-53@df620e4e08f309b9","sourceRowId":"ROW-abb22caa6cac267762b34574","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":8,"locator":"'04 Framework Catalog'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8ee4f950975c13e2ce6827a6","recordKey":"FW-FEDRAMP@0431d549dd6dc7e6","sourceRowId":"ROW-b4e26730b069df54fe2c4431","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":9,"locator":"'04 Framework Catalog'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4e5dae70312782c70b902a8d","recordKey":"FW-ISO-42001@6d004f01fd1dd6f5","sourceRowId":"ROW-8c5c9cbcfa995fdab7bf6c52","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":10,"locator":"'04 Framework Catalog'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7bd9479074cd774730106ce2","recordKey":"FW-ISO-42005@b02139bf544ce4bf","sourceRowId":"ROW-88ab72918d81a546deb54d40","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":11,"locator":"'04 Framework Catalog'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-872d0d4f591a75d768d60b51","recordKey":"FW-ISO-23894@b87e8d19fc73b809","sourceRowId":"ROW-d866faab7434a392a05c8077","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":12,"locator":"'04 Framework Catalog'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7e2f54f36764dba34ade2b1e","recordKey":"FW-ISO-38507@3a21d46272e4d98f","sourceRowId":"ROW-780eec363401f6c7ab3ef9ed","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":13,"locator":"'04 Framework Catalog'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1184a70443c5458186dc39bd","recordKey":"FW-ISO-5338@5384b7599ab287e8","sourceRowId":"ROW-b1b53188bb14f4816982db5d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":14,"locator":"'04 Framework Catalog'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8b594256a55f5833b26f10ff","recordKey":"FW-ISO-24028@3d472e5cbcce5b94","sourceRowId":"ROW-5f4f858b01c24dc023378ecd","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":15,"locator":"'04 Framework Catalog'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0cb377e5013af2f6dbd3782c","recordKey":"FW-EU-AI-ACT@46561a486a4c008b","sourceRowId":"ROW-548c940ac91d34d10266b030","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":16,"locator":"'04 Framework Catalog'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5641b5773e3a7a83173d9e2a","recordKey":"FW-GDPR@ee1443d6c0919bfd","sourceRowId":"ROW-a5b964d0f8fb608f909addb2","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":17,"locator":"'04 Framework Catalog'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d873d3f30969bfe0e5f16e18","recordKey":"FW-HIPAA@024563eb5b7c33a6","sourceRowId":"ROW-5a2eea07e54357f98a3bc76c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":18,"locator":"'04 Framework Catalog'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bcabe24c0c1e2b9486444751","recordKey":"FW-PCI-DSS@26b432290466d636","sourceRowId":"ROW-bec6795cdc61b0b63b20edf3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":19,"locator":"'04 Framework Catalog'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-071ddec219619bcc92f10f9c","recordKey":"FW-SOC2@db7c79c2dbfb20ed","sourceRowId":"ROW-9e5c2493221240f760707703","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":20,"locator":"'04 Framework Catalog'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3219adaf45d8f99dc58d6c93","recordKey":"FW-GLBA@ce5eb5a36e567a3b","sourceRowId":"ROW-880a0349c80e702a19802fa9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":21,"locator":"'04 Framework Catalog'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ea0e2a63f655ac8213460f48","recordKey":"FW-FERPA@adba7da3b8b49ee6","sourceRowId":"ROW-e697421b09e4c6c895476f7a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":22,"locator":"'04 Framework Catalog'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f25f0bafeaa36a377c3818fc","recordKey":"FW-CCPA-CPRA@2726437e0cff599a","sourceRowId":"ROW-63642d79d6dd1161886b4d4c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":23,"locator":"'04 Framework Catalog'!23:23","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-437a4eddc3fa1a9c84d67360","recordKey":"FW-CO-AI@dc656cacb5cb1e38","sourceRowId":"ROW-6de696f06f216ca70407b33c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":24,"locator":"'04 Framework Catalog'!24:24","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-19e0dd855b55323afaf400e1","recordKey":"FW-TX-TRAIGA@9b71af35f63ed5f3","sourceRowId":"ROW-d46fa160b8d1aee1749ce463","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":25,"locator":"'04 Framework Catalog'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a10908d620641ca6a283cb8b","recordKey":"FW-OMB-M25-21@02c619879520c6e4","sourceRowId":"ROW-8c351c3be05735ddb5d79641","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":26,"locator":"'04 Framework Catalog'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-469e7221926a1c8b6fab2558","recordKey":"FW-OMB-M25-22@1dd0effe69b2dd83","sourceRowId":"ROW-18e155872b5714755c72a6b4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":27,"locator":"'04 Framework Catalog'!27:27","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a123c694ae54d0b8c79d68bf","recordKey":"FW-OWASP-LLM-2026@44fda67005e1638f","sourceRowId":"ROW-0df173c786f2542b4a71ccbf","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":28,"locator":"'04 Framework Catalog'!28:28","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7ee8811b8b9df4a40b3540f3","recordKey":"FW-SOX@6b53f8d76c60deb9","sourceRowId":"ROW-a84d0053d81f2ee411bd1159","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"04 Framework Catalog","row":29,"locator":"'04 Framework Catalog'!29:29","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1cedeab02716ffa933df40fe","recordKey":"MS-RULE-DP-01@82066dbd9b9a4f14","sourceRowId":"ROW-cd85062e7ac0c61b25b7ccfa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":5,"locator":"'05 Canonical Rules'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0b2d9c40de963313b7a07ffa","recordKey":"TEST-MS-RULE-DP-01@0bc48774d2f0f1dd","sourceRowId":"ROW-cd85062e7ac0c61b25b7ccfa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":5,"locator":"'05 Canonical Rules'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-64d097af7f392afbf9fccbf7","recordKey":"MS-RULE-DP-02@d20cd6810e42f858","sourceRowId":"ROW-929d008e90b940386f30ebc2","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":6,"locator":"'05 Canonical Rules'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cc2ace0f176bcc61086b7076","recordKey":"TEST-MS-RULE-DP-02@ca4ef66ca268a10a","sourceRowId":"ROW-929d008e90b940386f30ebc2","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":6,"locator":"'05 Canonical Rules'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-72a3c10cb7fd18b037fcf8f9","recordKey":"MS-RULE-DP-03@4cbb47b109e98f4a","sourceRowId":"ROW-eef7147d9c917353b1a7b327","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":7,"locator":"'05 Canonical Rules'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-47b895dc0397d9db6029022a","recordKey":"TEST-MS-RULE-DP-03@50eab23253df5cb7","sourceRowId":"ROW-eef7147d9c917353b1a7b327","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":7,"locator":"'05 Canonical Rules'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-30bb612996d635a5f49e0c39","recordKey":"MS-RULE-DP-04@13c6ba85197d9a69","sourceRowId":"ROW-84fc11489a5ebc391562c935","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":8,"locator":"'05 Canonical Rules'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ad99c9a2c1b4b3b66197dbd1","recordKey":"TEST-MS-RULE-DP-04@f3aef5f922894a93","sourceRowId":"ROW-84fc11489a5ebc391562c935","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":8,"locator":"'05 Canonical Rules'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2796731b58f32004d9cf47f8","recordKey":"MS-RULE-DP-05@30a7a6fc8d2d373f","sourceRowId":"ROW-9a76f87f30da7fc372c24829","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":9,"locator":"'05 Canonical Rules'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1390c8e281db48da2abe5be0","recordKey":"TEST-MS-RULE-DP-05@77349f3499851451","sourceRowId":"ROW-9a76f87f30da7fc372c24829","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":9,"locator":"'05 Canonical Rules'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1fff03c91c03dbbe934c7f59","recordKey":"MS-RULE-DP-06@af062b3863346b41","sourceRowId":"ROW-0def1aba93921a9ff3fba01b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":10,"locator":"'05 Canonical Rules'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c6cc989af5a863573807a02a","recordKey":"TEST-MS-RULE-DP-06@59256ca2a153a840","sourceRowId":"ROW-0def1aba93921a9ff3fba01b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":10,"locator":"'05 Canonical Rules'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-51395d3107b8cb5eb98cce8c","recordKey":"MS-RULE-DP-07@94c870d43e4286ab","sourceRowId":"ROW-58a8154b909954796bccc76e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":11,"locator":"'05 Canonical Rules'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ebd0bb1f862b7a272ef9995d","recordKey":"TEST-MS-RULE-DP-07@5002f8ed22b072a4","sourceRowId":"ROW-58a8154b909954796bccc76e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":11,"locator":"'05 Canonical Rules'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-903bd8f0f7fa27c7fcd05d2e","recordKey":"MS-RULE-DP-08@f94b476097640eb3","sourceRowId":"ROW-f72722eda829ef9ce6269d45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":12,"locator":"'05 Canonical Rules'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-68027f34efc0455638a9c604","recordKey":"TEST-MS-RULE-DP-08@5952c57b4ceafdbd","sourceRowId":"ROW-f72722eda829ef9ce6269d45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":12,"locator":"'05 Canonical Rules'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fa3aaeec4f69778281a75e7e","recordKey":"MS-RULE-DP-09@e32553c4840951b3","sourceRowId":"ROW-e9bd0cc93e5eb03bf6ec5b6a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":13,"locator":"'05 Canonical Rules'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-16cd90d1c39261b30c77eadd","recordKey":"TEST-MS-RULE-DP-09@c4ed5280df2d8691","sourceRowId":"ROW-e9bd0cc93e5eb03bf6ec5b6a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":13,"locator":"'05 Canonical Rules'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-13cbd66ed1168a68d177a14a","recordKey":"MS-RULE-DP-10@fc6f0a161d4f201f","sourceRowId":"ROW-a518471a5fc987744bd95763","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":14,"locator":"'05 Canonical Rules'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e8110acb63e5f5ef7830ef22","recordKey":"TEST-MS-RULE-DP-10@6d512691a22458cc","sourceRowId":"ROW-a518471a5fc987744bd95763","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":14,"locator":"'05 Canonical Rules'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f70f245636d1a0815b50803a","recordKey":"MS-RULE-DP-11@b7d96f7e1501e4ed","sourceRowId":"ROW-7ee8130d46b59de4bfc10fcb","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":15,"locator":"'05 Canonical Rules'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-104c0a01e6114e87dd844e91","recordKey":"TEST-MS-RULE-DP-11@e6424832265654e7","sourceRowId":"ROW-7ee8130d46b59de4bfc10fcb","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":15,"locator":"'05 Canonical Rules'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9b4c188f68c2b7186a30b637","recordKey":"MS-RULE-DP-12@4ae51c2523134e28","sourceRowId":"ROW-c5131579cff5cbaa095a5549","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":16,"locator":"'05 Canonical Rules'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7090357a174348928cffef15","recordKey":"TEST-MS-RULE-DP-12@95d98ba0364aec85","sourceRowId":"ROW-c5131579cff5cbaa095a5549","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":16,"locator":"'05 Canonical Rules'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f44de56ae0dde162ba9dac2d","recordKey":"MS-RULE-DP-13@1299bbf89c50bd1a","sourceRowId":"ROW-52136b64326c448aea9fe218","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":17,"locator":"'05 Canonical Rules'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-63d1848ee72017f7e951a205","recordKey":"TEST-MS-RULE-DP-13@f983ef5d4e01924d","sourceRowId":"ROW-52136b64326c448aea9fe218","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":17,"locator":"'05 Canonical Rules'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a39b5efe32c3499eeddb4710","recordKey":"MS-RULE-DP-14@7b898303f53ec49b","sourceRowId":"ROW-71c72c3c0d19d67e23657f98","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":18,"locator":"'05 Canonical Rules'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8f9c403c7f4d220304ddf827","recordKey":"TEST-MS-RULE-DP-14@ab80d0fa0d8db15e","sourceRowId":"ROW-71c72c3c0d19d67e23657f98","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":18,"locator":"'05 Canonical Rules'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5c98a4023574be3b8ef2cdf5","recordKey":"MS-RULE-DP-15@208a0f796d79405e","sourceRowId":"ROW-8f14f3d1efa189e73a0a4307","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":19,"locator":"'05 Canonical Rules'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a281372f97e7afc3e17a9011","recordKey":"TEST-MS-RULE-DP-15@cea9c93668f602e0","sourceRowId":"ROW-8f14f3d1efa189e73a0a4307","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":19,"locator":"'05 Canonical Rules'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-421d64a1fa913f1e7acb5947","recordKey":"MS-RULE-DP-16@d0dca88853814a51","sourceRowId":"ROW-3e49c6649b3cff114fbf1c6b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":20,"locator":"'05 Canonical Rules'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5fbcfb018b7e3d437ad59599","recordKey":"TEST-MS-RULE-DP-16@97bda9e88e479e68","sourceRowId":"ROW-3e49c6649b3cff114fbf1c6b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":20,"locator":"'05 Canonical Rules'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-94bbfdfdd6ed795530a71c01","recordKey":"MS-RULE-DP-17@d1c8e0c542b0a6f6","sourceRowId":"ROW-41b8c84cd95a456bd89094e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":21,"locator":"'05 Canonical Rules'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-33fce9a76743366ee7130688","recordKey":"TEST-MS-RULE-DP-17@811ed55e191f631e","sourceRowId":"ROW-41b8c84cd95a456bd89094e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":21,"locator":"'05 Canonical Rules'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-997f889a26fb2e79ec45c657","recordKey":"MS-RULE-DP-18@082a5a202e1a48ef","sourceRowId":"ROW-c404a28782b7d517ded8f4dd","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":22,"locator":"'05 Canonical Rules'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-388a626523f42c205d786c8e","recordKey":"TEST-MS-RULE-DP-18@8a543089559677bc","sourceRowId":"ROW-c404a28782b7d517ded8f4dd","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":22,"locator":"'05 Canonical Rules'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bd5fd1b381f0461f77422b31","recordKey":"MS-RULE-AU-01@32b7d4ac14b06f7b","sourceRowId":"ROW-6111647deee222de2daa6a83","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":23,"locator":"'05 Canonical Rules'!23:23","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cfaad904d65de0da2986bef2","recordKey":"TEST-MS-RULE-AU-01@0084a371cf0309b9","sourceRowId":"ROW-6111647deee222de2daa6a83","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":23,"locator":"'05 Canonical Rules'!23:23","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d733693e7623cfcbab7364e9","recordKey":"MS-RULE-AU-02@1a166eaeb8f7f1ad","sourceRowId":"ROW-bfbbf81768db82dcd2a5e4ec","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":24,"locator":"'05 Canonical Rules'!24:24","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d313fc184f052c2345980691","recordKey":"TEST-MS-RULE-AU-02@ab1063b0ed9fa8a0","sourceRowId":"ROW-bfbbf81768db82dcd2a5e4ec","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":24,"locator":"'05 Canonical Rules'!24:24","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dc0fe4381a0cf7bc850297d2","recordKey":"MS-RULE-AU-03@ece0c972ca2c62e1","sourceRowId":"ROW-0bf8ca3a5d57cb98ec9e264a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":25,"locator":"'05 Canonical Rules'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5fd4094bd33b071035a45c3e","recordKey":"TEST-MS-RULE-AU-03@2c0164b9ceb762fe","sourceRowId":"ROW-0bf8ca3a5d57cb98ec9e264a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":25,"locator":"'05 Canonical Rules'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9d7e6a822538badc3c2d5266","recordKey":"MS-RULE-AU-04@d51101a040857487","sourceRowId":"ROW-ddc212acfe65d6301eac2a81","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":26,"locator":"'05 Canonical Rules'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-17b9a9ffa5cb15b82772a6c7","recordKey":"TEST-MS-RULE-AU-04@d64cd4d5b62ae1d2","sourceRowId":"ROW-ddc212acfe65d6301eac2a81","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":26,"locator":"'05 Canonical Rules'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7ec73fc160b4474357512f10","recordKey":"MS-RULE-AU-05@7c58fddd6817f607","sourceRowId":"ROW-4dc45e13d8c202a54e1e9d0b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":27,"locator":"'05 Canonical Rules'!27:27","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c26fe3f975b9bda2e455256b","recordKey":"TEST-MS-RULE-AU-05@0f305d8c832c7e2f","sourceRowId":"ROW-4dc45e13d8c202a54e1e9d0b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":27,"locator":"'05 Canonical Rules'!27:27","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3996725fd6c306097ee89454","recordKey":"MS-RULE-AU-06@e8c8f3b771054fbc","sourceRowId":"ROW-11830073254b5fd8ee324eda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":28,"locator":"'05 Canonical Rules'!28:28","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-06ab09746621ec62075b5eb4","recordKey":"TEST-MS-RULE-AU-06@750f23cda17c3c4b","sourceRowId":"ROW-11830073254b5fd8ee324eda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":28,"locator":"'05 Canonical Rules'!28:28","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-63ad7753c6f8be4141a79236","recordKey":"MS-RULE-AU-07@989c3a6787fc6689","sourceRowId":"ROW-94934e8e6dbbab1b6aa88abd","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":29,"locator":"'05 Canonical Rules'!29:29","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-38eb893fc9592675845b8268","recordKey":"TEST-MS-RULE-AU-07@5ffa142ce7218527","sourceRowId":"ROW-94934e8e6dbbab1b6aa88abd","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":29,"locator":"'05 Canonical Rules'!29:29","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-329662d6bf0a4187b79e4f68","recordKey":"MS-RULE-AU-08@4eda0a221f3ef380","sourceRowId":"ROW-7118de4af53232513d8f01a7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":30,"locator":"'05 Canonical Rules'!30:30","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e5c7127259d2a3e51e1b3012","recordKey":"TEST-MS-RULE-AU-08@1572d78ad2ecacee","sourceRowId":"ROW-7118de4af53232513d8f01a7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":30,"locator":"'05 Canonical Rules'!30:30","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8c6b6b4e7b58690c5c0e22d6","recordKey":"MS-RULE-IN-01@e4fe11be1a20f12f","sourceRowId":"ROW-d7cfd5fbc7957e3d786e7a71","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":31,"locator":"'05 Canonical Rules'!31:31","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-28fc6ffde2e5e02f201820fe","recordKey":"TEST-MS-RULE-IN-01@9d4be1fbcaec2bf2","sourceRowId":"ROW-d7cfd5fbc7957e3d786e7a71","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":31,"locator":"'05 Canonical Rules'!31:31","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-76dc340be87c7c36501841c8","recordKey":"MS-RULE-IN-02@dbb47a84e8a96c05","sourceRowId":"ROW-6000e6cd4fcdc79de8a2ba74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":32,"locator":"'05 Canonical Rules'!32:32","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6d89eb91a6b8cb0d376dde98","recordKey":"TEST-MS-RULE-IN-02@1d2838ae3e1a57ab","sourceRowId":"ROW-6000e6cd4fcdc79de8a2ba74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":32,"locator":"'05 Canonical Rules'!32:32","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-97d3e1d892e91d7635d56302","recordKey":"MS-RULE-IN-03@900d1ac2806dab1c","sourceRowId":"ROW-51ff4e19ab0458c9ef6e8738","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":33,"locator":"'05 Canonical Rules'!33:33","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-aa1f2196825f161039d4396b","recordKey":"TEST-MS-RULE-IN-03@900d1236d564a9d6","sourceRowId":"ROW-51ff4e19ab0458c9ef6e8738","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":33,"locator":"'05 Canonical Rules'!33:33","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b5dc1170b82088100f0b0162","recordKey":"MS-RULE-IN-04@40341d186f0bd606","sourceRowId":"ROW-7b84c8e27682cba512ff0b29","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":34,"locator":"'05 Canonical Rules'!34:34","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ed9c7d28dc1a271f54a1928c","recordKey":"TEST-MS-RULE-IN-04@2643ff56cf23a729","sourceRowId":"ROW-7b84c8e27682cba512ff0b29","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":34,"locator":"'05 Canonical Rules'!34:34","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e1a49ab1ac55e495c7e660ef","recordKey":"MS-RULE-IN-05@8dff43ab30881e3f","sourceRowId":"ROW-90c3adacab4b4ba0aa7f6621","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":35,"locator":"'05 Canonical Rules'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3b82587d6883744a4764b36a","recordKey":"TEST-MS-RULE-IN-05@3c95bf3267fc393c","sourceRowId":"ROW-90c3adacab4b4ba0aa7f6621","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":35,"locator":"'05 Canonical Rules'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c8b4aff9e0cd20cec78fbcb2","recordKey":"MS-RULE-IN-06@478a04da335c1e7f","sourceRowId":"ROW-a4346b58308bfe3bede1da44","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":36,"locator":"'05 Canonical Rules'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6a62baf34ac66e1c32058ce0","recordKey":"TEST-MS-RULE-IN-06@858400572c4c71c1","sourceRowId":"ROW-a4346b58308bfe3bede1da44","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":36,"locator":"'05 Canonical Rules'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-29444e54e5d0c3eff35e8bc9","recordKey":"MS-RULE-IN-07@31e317962beaeb5b","sourceRowId":"ROW-c39d877712e62c3bec7eacfa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":37,"locator":"'05 Canonical Rules'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-497a9b2cd821d98832e94016","recordKey":"TEST-MS-RULE-IN-07@375f07965e1612f9","sourceRowId":"ROW-c39d877712e62c3bec7eacfa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":37,"locator":"'05 Canonical Rules'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-745e5af1ea21ffc9fefd72be","recordKey":"MS-RULE-IN-08@94324ccfd3a491ef","sourceRowId":"ROW-1d5e2c906a234d9790564589","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":38,"locator":"'05 Canonical Rules'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6f05d339c75fa59a90507301","recordKey":"TEST-MS-RULE-IN-08@d7fc8b0e56e8838b","sourceRowId":"ROW-1d5e2c906a234d9790564589","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":38,"locator":"'05 Canonical Rules'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-95d6ea0e3bef56996fb48395","recordKey":"MS-RULE-OU-01@d0805195b855c7dd","sourceRowId":"ROW-dc0d119c2f9a7a247f3b9683","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":39,"locator":"'05 Canonical Rules'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-86521c22ee988c351c166884","recordKey":"TEST-MS-RULE-OU-01@b9fd24d42e46a0aa","sourceRowId":"ROW-dc0d119c2f9a7a247f3b9683","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":39,"locator":"'05 Canonical Rules'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-61c17f97872795f43ece3105","recordKey":"MS-RULE-OU-02@4965655028a3d485","sourceRowId":"ROW-4ba888a1a528a9f9d4305343","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":40,"locator":"'05 Canonical Rules'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5e34fe9a001b66162e6ef3fd","recordKey":"TEST-MS-RULE-OU-02@82b9b07bac4d235a","sourceRowId":"ROW-4ba888a1a528a9f9d4305343","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":40,"locator":"'05 Canonical Rules'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4bf7d43c9abb63f5152e0d6d","recordKey":"MS-RULE-OU-03@ce8e31e07eb4da96","sourceRowId":"ROW-b9adffd312e6e4031cac7d98","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":41,"locator":"'05 Canonical Rules'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bb46501df27c0f24f524c001","recordKey":"TEST-MS-RULE-OU-03@855aa6350f3b6faf","sourceRowId":"ROW-b9adffd312e6e4031cac7d98","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":41,"locator":"'05 Canonical Rules'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a66361ba85f858996cad8e04","recordKey":"MS-RULE-OU-04@4f3b3444715b2744","sourceRowId":"ROW-13057f76ff7965908a2b45f2","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":42,"locator":"'05 Canonical Rules'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-424e8fcc84622897d7826aab","recordKey":"TEST-MS-RULE-OU-04@b8d5604c6e6cac3b","sourceRowId":"ROW-13057f76ff7965908a2b45f2","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":42,"locator":"'05 Canonical Rules'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ebcce1b2fe8ca79e3ab76b69","recordKey":"MS-RULE-OU-05@cb5aeaa742fb4521","sourceRowId":"ROW-8b9d417b4f742444d1f53adc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":43,"locator":"'05 Canonical Rules'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dd0794a9cda38822554d279c","recordKey":"TEST-MS-RULE-OU-05@790ba5609481741c","sourceRowId":"ROW-8b9d417b4f742444d1f53adc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":43,"locator":"'05 Canonical Rules'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-58f394d7e7c84b853c116d70","recordKey":"MS-RULE-OU-06@ce0137df984ac601","sourceRowId":"ROW-a9aff2087160059ac7b9cfae","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":44,"locator":"'05 Canonical Rules'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-66c3c4b36e21544ca92148ac","recordKey":"TEST-MS-RULE-OU-06@3389a94a06402212","sourceRowId":"ROW-a9aff2087160059ac7b9cfae","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":44,"locator":"'05 Canonical Rules'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-131eb5cb68441a7c03260980","recordKey":"MS-RULE-OU-07@7d5bc203e83e95c9","sourceRowId":"ROW-b2c1ef7b5f817494ba947d42","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":45,"locator":"'05 Canonical Rules'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6524877cd56e18eaf0118b60","recordKey":"TEST-MS-RULE-OU-07@c8b8661e517fb395","sourceRowId":"ROW-b2c1ef7b5f817494ba947d42","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":45,"locator":"'05 Canonical Rules'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7f1256b4b9deb79eb7ca20a4","recordKey":"MS-RULE-OU-08@4c7bb6dc00dfcbfd","sourceRowId":"ROW-14a036264a680f76850ed20a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":46,"locator":"'05 Canonical Rules'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f9cfbdd65e35105b439cb647","recordKey":"TEST-MS-RULE-OU-08@2da28a7f88e05c49","sourceRowId":"ROW-14a036264a680f76850ed20a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":46,"locator":"'05 Canonical Rules'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c2cc2d692efa36f41932232a","recordKey":"MS-RULE-OU-09@2ffb1322457172b3","sourceRowId":"ROW-085264d9c4ac8a84fada7ed6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":47,"locator":"'05 Canonical Rules'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-93a7ac68111e0ee5605708fc","recordKey":"TEST-MS-RULE-OU-09@225611971feba396","sourceRowId":"ROW-085264d9c4ac8a84fada7ed6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":47,"locator":"'05 Canonical Rules'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2c0dabbd93143097905e253b","recordKey":"MS-RULE-OU-10@2332653b89bcd331","sourceRowId":"ROW-b6b85bcd685a48725b010f71","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":48,"locator":"'05 Canonical Rules'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6f88f79ff50480dbd6f03c15","recordKey":"TEST-MS-RULE-OU-10@f6e5d3d4dc45e98f","sourceRowId":"ROW-b6b85bcd685a48725b010f71","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":48,"locator":"'05 Canonical Rules'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d2d57095cd3c729de6969955","recordKey":"MS-RULE-OU-11@0710643d8a955cf6","sourceRowId":"ROW-d908d819dc6355d7f986a60c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":49,"locator":"'05 Canonical Rules'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e3b3348f9638efb57a97d1e0","recordKey":"TEST-MS-RULE-OU-11@786090aa4216d6dd","sourceRowId":"ROW-d908d819dc6355d7f986a60c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":49,"locator":"'05 Canonical Rules'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a215d6105f335b846853ed18","recordKey":"MS-RULE-OU-12@295cdecda41b8b55","sourceRowId":"ROW-8389bc866148e023e41da011","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":50,"locator":"'05 Canonical Rules'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e58a994b804d1e3b651c27d1","recordKey":"TEST-MS-RULE-OU-12@249ad604ebb6fff7","sourceRowId":"ROW-8389bc866148e023e41da011","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":50,"locator":"'05 Canonical Rules'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-61a1f20a46ad4dc1853d329b","recordKey":"MS-RULE-AG-01@e6aee1767c267990","sourceRowId":"ROW-c6d9c9d7a4c18b01bc83ceed","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":51,"locator":"'05 Canonical Rules'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d416ec6d539bf9530d21b54c","recordKey":"TEST-MS-RULE-AG-01@ff7a0e8e2da5d17b","sourceRowId":"ROW-c6d9c9d7a4c18b01bc83ceed","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":51,"locator":"'05 Canonical Rules'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dd1a74a1102b53b1a9b7acd4","recordKey":"MS-RULE-AG-02@d4d178c0433fd6d4","sourceRowId":"ROW-a969a0119ede43d7da6cf4c9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":52,"locator":"'05 Canonical Rules'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1276686da209ea80b9da1722","recordKey":"TEST-MS-RULE-AG-02@aade6035a0855241","sourceRowId":"ROW-a969a0119ede43d7da6cf4c9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":52,"locator":"'05 Canonical Rules'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c96c99cd23a53ad51e2276e4","recordKey":"MS-RULE-AG-03@20aa3c90fa880f0d","sourceRowId":"ROW-87efe05b0f1bc8e240689826","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":53,"locator":"'05 Canonical Rules'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7c044823c130b2b12f5bf53e","recordKey":"TEST-MS-RULE-AG-03@015e6c738b015bd2","sourceRowId":"ROW-87efe05b0f1bc8e240689826","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":53,"locator":"'05 Canonical Rules'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-eba90da299a26161940b0c35","recordKey":"MS-RULE-AG-04@c7af717b1d68045e","sourceRowId":"ROW-c44212e5712afccffa0b9a8d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":54,"locator":"'05 Canonical Rules'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-70acbe9fc25c68cd4c6c0606","recordKey":"TEST-MS-RULE-AG-04@098ca0df2ff02a79","sourceRowId":"ROW-c44212e5712afccffa0b9a8d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":54,"locator":"'05 Canonical Rules'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-87815c07f0c9451fff4a4954","recordKey":"MS-RULE-AG-05@8829d873310f18f9","sourceRowId":"ROW-57091a93092d37831b3f1c82","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":55,"locator":"'05 Canonical Rules'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-94d5b0079a63898ab4f15d09","recordKey":"TEST-MS-RULE-AG-05@8edc0dd979fb9441","sourceRowId":"ROW-57091a93092d37831b3f1c82","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":55,"locator":"'05 Canonical Rules'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c6e5fd130fa1cdf5fcb7b5f9","recordKey":"MS-RULE-AG-06@6371f819b40b0d97","sourceRowId":"ROW-6c965d648b3a87a0d63206e1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":56,"locator":"'05 Canonical Rules'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d2dbee47d225f7ef7933d4b0","recordKey":"TEST-MS-RULE-AG-06@ee1eb5a987831137","sourceRowId":"ROW-6c965d648b3a87a0d63206e1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":56,"locator":"'05 Canonical Rules'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1f6b6d734c654b26247c2763","recordKey":"MS-RULE-AG-07@c2fb36c556cb8a62","sourceRowId":"ROW-ac0806c0d1cab126f0536869","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":57,"locator":"'05 Canonical Rules'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a206d9f7b18c141c479e2e9c","recordKey":"TEST-MS-RULE-AG-07@ba65d33eee3e267b","sourceRowId":"ROW-ac0806c0d1cab126f0536869","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":57,"locator":"'05 Canonical Rules'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2d8b7f608dcceef837cdb83f","recordKey":"MS-RULE-AG-08@b98e349c6e27f319","sourceRowId":"ROW-189dfa37186c642f2addce8b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":58,"locator":"'05 Canonical Rules'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2d292671f34d84b9d0173432","recordKey":"TEST-MS-RULE-AG-08@416a45e0a0b25761","sourceRowId":"ROW-189dfa37186c642f2addce8b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":58,"locator":"'05 Canonical Rules'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-34ceace42ac4f741864130e0","recordKey":"MS-RULE-AG-09@2bd07e82a72d4f2e","sourceRowId":"ROW-280320ff896a3aacfd285852","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":59,"locator":"'05 Canonical Rules'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7ea4f3f3d4215a6c91e4fc19","recordKey":"TEST-MS-RULE-AG-09@77f7bead2ff59d1f","sourceRowId":"ROW-280320ff896a3aacfd285852","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":59,"locator":"'05 Canonical Rules'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3a62a980c646bf2b9c77a2e7","recordKey":"MS-RULE-AG-10@41b899de0bf0744b","sourceRowId":"ROW-45538072cfb8a4ac2f2c68b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":60,"locator":"'05 Canonical Rules'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5578f4e88b3c8e4feb89aedd","recordKey":"TEST-MS-RULE-AG-10@fcfc304af4142870","sourceRowId":"ROW-45538072cfb8a4ac2f2c68b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":60,"locator":"'05 Canonical Rules'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2bcab942664b74dba5fa726e","recordKey":"MS-RULE-OP-01@ce84968e8045ef9e","sourceRowId":"ROW-4407fd9b1be93893e86716c1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":61,"locator":"'05 Canonical Rules'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dd44feb172d6d5d3e06655e1","recordKey":"TEST-MS-RULE-OP-01@1650910477cab89a","sourceRowId":"ROW-4407fd9b1be93893e86716c1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":61,"locator":"'05 Canonical Rules'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ace40823dc49bda199f64344","recordKey":"MS-RULE-OP-02@7147e78f71e89fcb","sourceRowId":"ROW-37f85a5306a23567bae52640","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":62,"locator":"'05 Canonical Rules'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b1e84a34db494d94224145ba","recordKey":"TEST-MS-RULE-OP-02@e6bebdee13a2794f","sourceRowId":"ROW-37f85a5306a23567bae52640","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":62,"locator":"'05 Canonical Rules'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d278fbec84b50d0d35b515eb","recordKey":"MS-RULE-OP-03@410599212edc432e","sourceRowId":"ROW-1200071da5361e498925f66d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":63,"locator":"'05 Canonical Rules'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-db3ffc5142b4f5b81a0bc908","recordKey":"TEST-MS-RULE-OP-03@63af44dbe3b87025","sourceRowId":"ROW-1200071da5361e498925f66d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":63,"locator":"'05 Canonical Rules'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b16f9d3aa5c345e44b09f309","recordKey":"MS-RULE-OP-04@63fbf478664e5e99","sourceRowId":"ROW-175b00fabbd5d258e5898143","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":64,"locator":"'05 Canonical Rules'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8b843072c7749b2e6cba1f70","recordKey":"TEST-MS-RULE-OP-04@10af1b4283fbdf52","sourceRowId":"ROW-175b00fabbd5d258e5898143","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":64,"locator":"'05 Canonical Rules'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-78f1437d482223c0233ce9a8","recordKey":"MS-RULE-OP-05@98df9a80a2151ad4","sourceRowId":"ROW-34493db48d50cf94487bf888","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":65,"locator":"'05 Canonical Rules'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3469464b58653e1e35bef416","recordKey":"TEST-MS-RULE-OP-05@0d20359d25737fc8","sourceRowId":"ROW-34493db48d50cf94487bf888","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":65,"locator":"'05 Canonical Rules'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-623e5f50198dc8964dbd7d6a","recordKey":"MS-RULE-OP-06@6ecbeba4e14a59af","sourceRowId":"ROW-ecc37b8adb3bf4edc29641df","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":66,"locator":"'05 Canonical Rules'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8b6706b38a6919e6ef71dcd4","recordKey":"TEST-MS-RULE-OP-06@a9f506c8bff242f1","sourceRowId":"ROW-ecc37b8adb3bf4edc29641df","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":66,"locator":"'05 Canonical Rules'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-230b82907af7684b18c4c32e","recordKey":"MS-RULE-OP-07@f1df2cbcb724af3b","sourceRowId":"ROW-59bc89bf3aae5a54613196b3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":67,"locator":"'05 Canonical Rules'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f53e12c1e7036cb278e45b14","recordKey":"TEST-MS-RULE-OP-07@8efbac703c680b3b","sourceRowId":"ROW-59bc89bf3aae5a54613196b3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":67,"locator":"'05 Canonical Rules'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-399e2eac48cba86c113d3ee0","recordKey":"MS-RULE-OP-08@a38dff87950aa40f","sourceRowId":"ROW-237b7b1abe3296e64d82564c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":68,"locator":"'05 Canonical Rules'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-891cc339e47a293920c95222","recordKey":"TEST-MS-RULE-OP-08@438a6f5faac23af7","sourceRowId":"ROW-237b7b1abe3296e64d82564c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":68,"locator":"'05 Canonical Rules'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ccd24756fe0773efa7bb861e","recordKey":"MS-RULE-OP-09@ec587343b8220a51","sourceRowId":"ROW-de1c87cc194c6a00cb60129a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":69,"locator":"'05 Canonical Rules'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c4a276493744da532d635724","recordKey":"TEST-MS-RULE-OP-09@30152b169dd9d2ae","sourceRowId":"ROW-de1c87cc194c6a00cb60129a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":69,"locator":"'05 Canonical Rules'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-91a6f13e0a7f20436902ea6a","recordKey":"MS-RULE-OP-10@8c831bc5659a4340","sourceRowId":"ROW-4ee8f3a80704716a5667cb17","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":70,"locator":"'05 Canonical Rules'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3caad195007387d472ae49f3","recordKey":"TEST-MS-RULE-OP-10@e71f274c4901fd3c","sourceRowId":"ROW-4ee8f3a80704716a5667cb17","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":70,"locator":"'05 Canonical Rules'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-317ce336b6422170b38c3ff5","recordKey":"MS-RULE-OP-11@a024a5509524bfa2","sourceRowId":"ROW-2d9dfa60a6e7c51a566dadad","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":71,"locator":"'05 Canonical Rules'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e78ed5429c0122b20dda54a6","recordKey":"TEST-MS-RULE-OP-11@431f6754fa078c78","sourceRowId":"ROW-2d9dfa60a6e7c51a566dadad","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":71,"locator":"'05 Canonical Rules'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ee2ba142fa1f975c16b03aea","recordKey":"MS-RULE-OP-12@04d0287d10225094","sourceRowId":"ROW-aae33c20baece0f398f9ed04","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":72,"locator":"'05 Canonical Rules'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-adabd0782523909c6e2de6ad","recordKey":"TEST-MS-RULE-OP-12@e2e102960c613341","sourceRowId":"ROW-aae33c20baece0f398f9ed04","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"05 Canonical Rules","row":72,"locator":"'05 Canonical Rules'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fd969ded1079a3e29aed6d44","recordKey":"TAIM-GOVERN-1.1@35b911ad2aa6f0f1","sourceRowId":"ROW-819ca9a790466294c7880fb4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":5,"locator":"'07 TAIM Control Map'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-202edf4abbebecc7274a98fc","recordKey":"TAIM-GOVERN-1.2@ad2860a2fbdee92d","sourceRowId":"ROW-2195baf47ca237d8f8b078bf","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":6,"locator":"'07 TAIM Control Map'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-accc2ff54bedd6ceb9124a4a","recordKey":"TAIM-GOVERN-1.3@6129b834f8908bde","sourceRowId":"ROW-921e23b09bdc5e163c46fe50","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":7,"locator":"'07 TAIM Control Map'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-743ea3c191c5c981b139dadb","recordKey":"TAIM-GOVERN-1.4@2cf04928037dcfee","sourceRowId":"ROW-b6d04d8bc54145f7347502da","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":8,"locator":"'07 TAIM Control Map'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ae7bb694506f5ae1cbd59012","recordKey":"TAIM-GOVERN-1.5@92357b32e10b5e02","sourceRowId":"ROW-6cd11a5191a0a19b246a52f9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":9,"locator":"'07 TAIM Control Map'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-689ac2a16b50ebdc0b2b591a","recordKey":"TAIM-GOVERN-1.6@382c72c8bff29604","sourceRowId":"ROW-80e2b8b967081ab07201119f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":10,"locator":"'07 TAIM Control Map'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-544b02cfcdeff062472a01cd","recordKey":"TAIM-GOVERN-1.7@198eee5654f91ae3","sourceRowId":"ROW-4c0b2945e58d182da9acd33f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":11,"locator":"'07 TAIM Control Map'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-21371b3af9b1e5b52f929013","recordKey":"TAIM-GOVERN-2.1@198893140402361c","sourceRowId":"ROW-720973fc2d47ba02f1b079ef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":12,"locator":"'07 TAIM Control Map'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3725d1af7c6ee89007ce5f3b","recordKey":"TAIM-GOVERN-2.2@9b46d32788988ef2","sourceRowId":"ROW-e02a2343b7f25a791a1b2256","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":13,"locator":"'07 TAIM Control Map'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d3e502a942f08d0da6e65b08","recordKey":"TAIM-GOVERN-2.3@e28fde83a8cc90e1","sourceRowId":"ROW-8e1c612547a7de5a2e632de8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":14,"locator":"'07 TAIM Control Map'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ab1ccf9075fbd0c4bb632352","recordKey":"TAIM-GOVERN-3.1@2427dcd86ebd4f7b","sourceRowId":"ROW-45b630cce465294238ed89f8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":15,"locator":"'07 TAIM Control Map'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-04de809963c547819173f878","recordKey":"TAIM-GOVERN-3.2@9c41c08d8d6c9ac6","sourceRowId":"ROW-1784a41903043a624059f22f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":16,"locator":"'07 TAIM Control Map'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-55b5c629f5494fbe8d8e0b25","recordKey":"TAIM-GOVERN-4.1@104e4747b0fad479","sourceRowId":"ROW-4b3dc974f164a4b5e109d0af","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":17,"locator":"'07 TAIM Control Map'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cca094c6a4b72784284f0941","recordKey":"TAIM-GOVERN-4.2@c1e4d61854eedbe8","sourceRowId":"ROW-7e8e994b919a67ffca09fae2","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":18,"locator":"'07 TAIM Control Map'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-27ead68d8dec2144f9d5dd95","recordKey":"TAIM-GOVERN-4.3@6c63b10d0830b670","sourceRowId":"ROW-10d6bb10236ced7d53f9949f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":19,"locator":"'07 TAIM Control Map'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-73ff4816f5ce6be2d95818f8","recordKey":"TAIM-GOVERN-5.1@68f585618af89993","sourceRowId":"ROW-5b7b586a45a1461f449a76b3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":20,"locator":"'07 TAIM Control Map'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a20c7a3d7489dfb9790b25b8","recordKey":"TAIM-GOVERN-5.2@fe8607850f8d2ca6","sourceRowId":"ROW-04be8f2df3ae25975a9ebf84","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":21,"locator":"'07 TAIM Control Map'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-440794a752174e0fcafb1f98","recordKey":"TAIM-GOVERN-6.1@b8216e0b6ff98607","sourceRowId":"ROW-b17388eb898ca526dcf2128a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":22,"locator":"'07 TAIM Control Map'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3ae9399e7f9cbf0c453f0352","recordKey":"TAIM-GOVERN-6.2@054b3cd3c85b2f5d","sourceRowId":"ROW-caa9d3285b423733cc899c98","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":23,"locator":"'07 TAIM Control Map'!23:23","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0add12d7a0ee7f1dfe17d1da","recordKey":"TAIM-MAP-1.1@f7aec3e0fde77d65","sourceRowId":"ROW-0b87ecc2f01c76a0ba3b33a9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":24,"locator":"'07 TAIM Control Map'!24:24","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9c0fdd688acd6dc64562c08d","recordKey":"TAIM-MAP-1.2@93024a692d8324ff","sourceRowId":"ROW-215a102019628e3c4d652e99","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":25,"locator":"'07 TAIM Control Map'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-42900c8a0e635bd150d23cdd","recordKey":"TAIM-MAP-1.3@405b97af733bc900","sourceRowId":"ROW-8bdb150e2ff44341573e05b6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":26,"locator":"'07 TAIM Control Map'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-824daeee10099241e7e12b76","recordKey":"TAIM-MAP-1.4@867a4ceeddb4119d","sourceRowId":"ROW-aaeee90e8d90db2adb9fb2d2","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":27,"locator":"'07 TAIM Control Map'!27:27","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2bc1b368fdadc41fb7408d4f","recordKey":"TAIM-MAP-1.5@7b28c9d1495f3a89","sourceRowId":"ROW-9922351b2195eed5dfa42ba9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":28,"locator":"'07 TAIM Control Map'!28:28","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-42c33b81164f1ba79784658d","recordKey":"TAIM-MAP-1.6@0ca81605dd8ee088","sourceRowId":"ROW-83698ba923f75cd1d3ca6589","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":29,"locator":"'07 TAIM Control Map'!29:29","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d7125b74a61c560cefbadc8a","recordKey":"TAIM-MAP-2.1@24236a0f4fe9d355","sourceRowId":"ROW-94df4ccd334d59365fbbf4a0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":30,"locator":"'07 TAIM Control Map'!30:30","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-343e94d7bbb2672b6333f4ee","recordKey":"TAIM-MAP-2.2@c9b1594e914d9478","sourceRowId":"ROW-0eec6bfec20219f0e8e1d9b6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":31,"locator":"'07 TAIM Control Map'!31:31","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6fb2a1ca22de46743a7871e7","recordKey":"TAIM-MAP-2.3@98b8065b9500c2b5","sourceRowId":"ROW-a0c014848bc2d99867212098","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":32,"locator":"'07 TAIM Control Map'!32:32","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fad2a17678fec8b4effad99a","recordKey":"TAIM-MAP-3.1@5aadf0f832148043","sourceRowId":"ROW-9ac26e37c4f025accee63696","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":33,"locator":"'07 TAIM Control Map'!33:33","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-46ca221791985c8693c40c42","recordKey":"TAIM-MAP-3.2@68f17d5dab909a30","sourceRowId":"ROW-93f001d7b0378773e7c1b98c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":34,"locator":"'07 TAIM Control Map'!34:34","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cd44833f84e743f7476b23e5","recordKey":"TAIM-MAP-3.3@2dcbe4ab43aa4492","sourceRowId":"ROW-fc59f9ff12a1c8237c692ba5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":35,"locator":"'07 TAIM Control Map'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4b7ec6a8248e195ee4b3dd8e","recordKey":"TAIM-MAP-3.4@e310d1f6e2a1ea35","sourceRowId":"ROW-a4ec73c06b3ad39443e9522d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":36,"locator":"'07 TAIM Control Map'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-60ff43e0440293985bf9d379","recordKey":"TAIM-MAP-3.5@03aad24c9f287fab","sourceRowId":"ROW-a974fb669a31a61df0e3b141","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":37,"locator":"'07 TAIM Control Map'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-62c6a19401600dda13179ad7","recordKey":"TAIM-MAP-4.1@47a77b8622793a72","sourceRowId":"ROW-0e85023ec55115e7e271d14c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":38,"locator":"'07 TAIM Control Map'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f31f86746fc67215e78a217d","recordKey":"TAIM-MAP-4.2@ba7614350b99a7d0","sourceRowId":"ROW-39b6c49b172b8af5fc3a36a4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":39,"locator":"'07 TAIM Control Map'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1544b0ef1145bcc4a5d1f0f8","recordKey":"TAIM-MAP-5.1@4170d53e4eea6a66","sourceRowId":"ROW-c4e2fe28b81cda7e42722f07","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":40,"locator":"'07 TAIM Control Map'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-43887400b1aac124e8b3109c","recordKey":"TAIM-MAP-5.2@4fe1fea3a40c08e0","sourceRowId":"ROW-d6ee7c96e3777b0f5d6ebf3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":41,"locator":"'07 TAIM Control Map'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3cdd1df3a3b4ed85f02cec33","recordKey":"TAIM-MEASURE-1.1@80d658f30e1d4e80","sourceRowId":"ROW-99a4d52682f010765d327ba7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":42,"locator":"'07 TAIM Control Map'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6692a97b6693feadac689d23","recordKey":"TAIM-MEASURE-1.2@b5c24007b17017b3","sourceRowId":"ROW-349960ceac0918aa7e021655","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":43,"locator":"'07 TAIM Control Map'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7a364ef18592741203440a92","recordKey":"TAIM-MEASURE-1.3@438e7613521eceac","sourceRowId":"ROW-c04df19fe669a9c1ca3c4a0d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":44,"locator":"'07 TAIM Control Map'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9fff521dd52f4de26feb3d78","recordKey":"TAIM-MEASURE-2.1@bfec014736abe868","sourceRowId":"ROW-2fcb0ac62c49cef1f0479501","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":45,"locator":"'07 TAIM Control Map'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b4a25819235041c84d984801","recordKey":"TAIM-MEASURE-2.2@f1b91c01b8b926be","sourceRowId":"ROW-4ca771d6203286b618acbe4a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":46,"locator":"'07 TAIM Control Map'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ec807e38e569d859388d138b","recordKey":"TAIM-MEASURE-2.3@f396bee25387e21c","sourceRowId":"ROW-50f4fc9e3fd1e499c939abc1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":47,"locator":"'07 TAIM Control Map'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-04c84b5819a4eb21d4a646ab","recordKey":"TAIM-MEASURE-2.4@30416b6b4c6068dd","sourceRowId":"ROW-27735a0781a3135107ba3a8d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":48,"locator":"'07 TAIM Control Map'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-aefd636ecebaab8204510919","recordKey":"TAIM-MEASURE-2.5@f17bf250e010d494","sourceRowId":"ROW-73081055a72521811089739e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":49,"locator":"'07 TAIM Control Map'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ea992b1acf5034b83dfaeecd","recordKey":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","sourceRowId":"ROW-7eb2896fb88f9b19be4ffce6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":50,"locator":"'07 TAIM Control Map'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-838a5f9ec74aae308adc56cd","recordKey":"TAIM-MEASURE-2.7@4fefc7d979469953","sourceRowId":"ROW-18b25465a830cb6f6d9f896c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":51,"locator":"'07 TAIM Control Map'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2369911cdd753c1e13e653c6","recordKey":"TAIM-MEASURE-2.8@927b0554749a76e0","sourceRowId":"ROW-e8d0231694e1a725ccc376a1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":52,"locator":"'07 TAIM Control Map'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-51b91151066b050c33a3c54a","recordKey":"TAIM-MEASURE-2.9@3e99c99461743bec","sourceRowId":"ROW-926c7f2887b076252ce54493","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":53,"locator":"'07 TAIM Control Map'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d2008ca60c992e133c5b80f9","recordKey":"TAIM-MEASURE-2.10@6df5b5c790a49492","sourceRowId":"ROW-54ba0806fe4a4aca9c0ab84f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":54,"locator":"'07 TAIM Control Map'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-32365c77127500b51a281b68","recordKey":"TAIM-MEASURE-2.11@69c078796341cd3b","sourceRowId":"ROW-51da5c412025d9777b3782a5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":55,"locator":"'07 TAIM Control Map'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a3dfc4cc1fc1a4a3667d8e28","recordKey":"TAIM-MEASURE-2.12@12d74b82b770347a","sourceRowId":"ROW-cfe54aa1f403a5d504bd1d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":56,"locator":"'07 TAIM Control Map'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-02434cf864c648593f7ec187","recordKey":"TAIM-MEASURE-2.13@12d2da14f2779af3","sourceRowId":"ROW-3b42a7b9ec139dc3fde4432d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":57,"locator":"'07 TAIM Control Map'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-020ee2441d6e4fd2220ccd1b","recordKey":"TAIM-MEASURE-3.1@6a9415a16f00ace2","sourceRowId":"ROW-f5914e7e97e40b7f1fa2e2ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":58,"locator":"'07 TAIM Control Map'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0fb956c553093d338620ef17","recordKey":"TAIM-MEASURE-3.2@0a3eca3853caf2e2","sourceRowId":"ROW-ef4854ea3dbef189c3a7e1d9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":59,"locator":"'07 TAIM Control Map'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a2630e1199d58a1569a8f97b","recordKey":"TAIM-MEASURE-3.3@6a5560394079e008","sourceRowId":"ROW-6b202c73b7b3e671d3d0cb34","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":60,"locator":"'07 TAIM Control Map'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bb6795e4411619479017a7f4","recordKey":"TAIM-MEASURE-4.1@87efb87b60ce14d1","sourceRowId":"ROW-ec2a27ba67737971b2a4a521","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":61,"locator":"'07 TAIM Control Map'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-eb1b5f2deffd3c5efc89cce5","recordKey":"TAIM-MEASURE-4.2@441148e8e1148dbe","sourceRowId":"ROW-2bc07653b579d5333e99e4ad","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":62,"locator":"'07 TAIM Control Map'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-27d617175255a924bad10a0b","recordKey":"TAIM-MEASURE-4.3@759303d11da3ea95","sourceRowId":"ROW-a47bedbef8d9135c8ab149c0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":63,"locator":"'07 TAIM Control Map'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b45ea98790e30e99dee4304b","recordKey":"TAIM-MANAGE-1.1@8f95b18554d187df","sourceRowId":"ROW-3a47798c22e62e9e0b038014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":64,"locator":"'07 TAIM Control Map'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8d8dc328fb9177247814c9c5","recordKey":"TAIM-MANAGE-1.2@725fe00a61b98e10","sourceRowId":"ROW-c6edd71cb273b8c132e929ca","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":65,"locator":"'07 TAIM Control Map'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9e92b1f57b1bb38fb7d80cd0","recordKey":"TAIM-MANAGE-1.3@113dba8419d60368","sourceRowId":"ROW-bbe3d5547c0025d0b38ca118","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":66,"locator":"'07 TAIM Control Map'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c6672ae0ff25961ae91a94cf","recordKey":"TAIM-MANAGE-1.4@706dd15eb7c4daeb","sourceRowId":"ROW-765c7ddf2aea1cd0784d4c50","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":67,"locator":"'07 TAIM Control Map'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-452e348b4a37049a6174aacb","recordKey":"TAIM-MANAGE-2.1@a1ff21e73495f39c","sourceRowId":"ROW-d4b32502690ef3a37d30a30c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":68,"locator":"'07 TAIM Control Map'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fa7ae501cdb4404edc8942cf","recordKey":"TAIM-MANAGE-2.2@f861fb2340eaa0c6","sourceRowId":"ROW-02ddd08a21cbd27ffae950c5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":69,"locator":"'07 TAIM Control Map'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7b7dbbf7df22f6994e165e07","recordKey":"TAIM-MANAGE-2.3@f69713d6045063b5","sourceRowId":"ROW-5d8ae79d964066c23cc63550","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":70,"locator":"'07 TAIM Control Map'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-077563d7ccc584e35f7d4e71","recordKey":"TAIM-MANAGE-2.4@4c58d159afdc4362","sourceRowId":"ROW-1adb04c39171e7766e76fc5d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":71,"locator":"'07 TAIM Control Map'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1d290045e8b3b72ffe9a62f2","recordKey":"TAIM-MANAGE-3.1@fa0c648cdd610fd5","sourceRowId":"ROW-277f45e8c9581b43d549fcf4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":72,"locator":"'07 TAIM Control Map'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-15384f2fc41be33834a15532","recordKey":"TAIM-MANAGE-3.2@72d098f451a97bfc","sourceRowId":"ROW-ad893d6bffed920415c0cd73","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":73,"locator":"'07 TAIM Control Map'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e75d7b8ef046c5d57ddde19e","recordKey":"TAIM-MANAGE-4.1@ba6d42802623e508","sourceRowId":"ROW-bafbb6ea73fe8bdc0f57d94d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":74,"locator":"'07 TAIM Control Map'!74:74","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5716ecb30cfc5019f5902a60","recordKey":"TAIM-MANAGE-4.2@6622b89a3cfef575","sourceRowId":"ROW-0320adf66ffc4a146bbec926","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":75,"locator":"'07 TAIM Control Map'!75:75","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-518ac358f96965171857f3e4","recordKey":"TAIM-MANAGE-4.3@6d72e9f28c581992","sourceRowId":"ROW-5584b1cee9a2142804f15377","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"07 TAIM Control Map","row":76,"locator":"'07 TAIM Control Map'!76:76","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-744610620202b0aeac98f732","recordKey":"MS-POL-POL-01@49c4c01e6c0532bb","sourceRowId":"ROW-5da53578f6fffe1a35146cd6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":5,"locator":"'08 Internal Policies'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0e489f123e2a56fcfe1bea64","recordKey":"MS-POL-POL-02@aa0847ee55585424","sourceRowId":"ROW-38ce44d1dc499090b643aed2","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":6,"locator":"'08 Internal Policies'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cb2598d5c2a7bf3c7cdbe8ba","recordKey":"MS-POL-POL-03@11c99e7398913f0f","sourceRowId":"ROW-7c00f7ce413857f0ff12a98a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":7,"locator":"'08 Internal Policies'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-88210ee8de60fadbb37c106b","recordKey":"MS-POL-POL-04@44f05efa6918df27","sourceRowId":"ROW-e65db8b635839726933f7fb0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":8,"locator":"'08 Internal Policies'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-50ea10c49863c5a90c4518c4","recordKey":"MS-POL-POL-05@9c8c386d8437959c","sourceRowId":"ROW-cdb947fc5d4636afb9bacf8a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":9,"locator":"'08 Internal Policies'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9bdb67c790d2166b22312def","recordKey":"MS-POL-POL-06@8603eff3ea33a61f","sourceRowId":"ROW-d59e9216537c711e7ff48551","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":10,"locator":"'08 Internal Policies'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5591ea9b7eff0364d3da88fe","recordKey":"MS-POL-POL-07@a1b6f11dcbba27b5","sourceRowId":"ROW-5f6af58462b3b2f8163b0c0b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":11,"locator":"'08 Internal Policies'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-889c2751d41ea5ecc9a988a7","recordKey":"MS-POL-POL-08@ee4729bdeed9ad16","sourceRowId":"ROW-d14547299ed69f1d735621a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":12,"locator":"'08 Internal Policies'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0fd58647ebfd8fc19e6aa355","recordKey":"MS-POL-POL-09@30cd5cb249f58ae2","sourceRowId":"ROW-0197cedf341fccac5d3b8ac3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":13,"locator":"'08 Internal Policies'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7ba4b2085a749a6293ad0fed","recordKey":"MS-POL-POL-10@cce53ffd6ac04512","sourceRowId":"ROW-fd311e7164231814415386d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":14,"locator":"'08 Internal Policies'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d28ed795cbf81ef7316d7b1a","recordKey":"MS-POL-POL-11@4cbd6ed56751cc97","sourceRowId":"ROW-b3ddf8be8f31002572820bcf","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":15,"locator":"'08 Internal Policies'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-29740f0865e5c5f75878b222","recordKey":"MS-POL-POL-12@2bcf920fc5a05e6b","sourceRowId":"ROW-5bdaacda2cc4b3c9aa5dcc40","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":16,"locator":"'08 Internal Policies'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f355e27862eaf41c683e25ea","recordKey":"MS-POL-POL-13@e8a7e91b791104ce","sourceRowId":"ROW-74090ea0bfcc75669f6984e8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":17,"locator":"'08 Internal Policies'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6483ff13251a10faa0524f7e","recordKey":"MS-POL-POL-14@aa241dc1520b8ab5","sourceRowId":"ROW-ed9444c9e4dff6f2ac173b6c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":18,"locator":"'08 Internal Policies'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9eac08ff5414f6ab6617a1fa","recordKey":"MS-POL-POL-15@66ce06439b6303c8","sourceRowId":"ROW-4dc710b8b6b2304b15a162a8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":19,"locator":"'08 Internal Policies'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e887b9b7ed8d650fa1e78df5","recordKey":"MS-POL-POL-16@e96f7674899ecd20","sourceRowId":"ROW-1522dc6215e15cf85b8cbd15","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":20,"locator":"'08 Internal Policies'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a0c461687c763597173b92c1","recordKey":"MS-POL-POL-17@fbd2f1193b92724a","sourceRowId":"ROW-bfc4dd3736f13ccb042e5f1c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":21,"locator":"'08 Internal Policies'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8dc3f0a823d54b7e8d9f1f8d","recordKey":"MS-POL-POL-18@97f5690fa7f7084e","sourceRowId":"ROW-27f5a0fee6815e6237068b33","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":22,"locator":"'08 Internal Policies'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0d2edc8935438d14459ddee5","recordKey":"MS-POL-POL-19@d6f23b7346439395","sourceRowId":"ROW-143dcabb1090241751b5685e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":23,"locator":"'08 Internal Policies'!23:23","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-22abafc7f705cc8aef2b4e87","recordKey":"MS-POL-POL-20@ea163decd6c07a16","sourceRowId":"ROW-256a27618683d4bcaa50dd44","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":24,"locator":"'08 Internal Policies'!24:24","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d321b09c07722e92c85c3c1b","recordKey":"MS-POL-POL-21@9a99a10275e80192","sourceRowId":"ROW-bd83089f2f5413ec22ca24ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":25,"locator":"'08 Internal Policies'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fa30ba6cf481f66176a125e6","recordKey":"MS-POL-POL-22@7864cb607001d95d","sourceRowId":"ROW-e3efd503495ea12c43748ea7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"08 Internal Policies","row":26,"locator":"'08 Internal Policies'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-50c9430559293da7e783f0b3","recordKey":"MS-OVERLAY-CUS-01@ef016720fa4b77d5","sourceRowId":"ROW-5837ef1c1de1a9c4c4677821","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":5,"locator":"'09 Custom Rule Backlog'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-88bf2ae3aaeb36d446d99fd9","recordKey":"MS-OVERLAY-CUS-02@2bdb2cb7097a15c7","sourceRowId":"ROW-53db398e966bc5a803d2d295","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":6,"locator":"'09 Custom Rule Backlog'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-02106dd3aa0dd59e8abe9697","recordKey":"MS-OVERLAY-CUS-03@9e0dd72cbcd36d06","sourceRowId":"ROW-0222b802d5383ebf9987e28a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":7,"locator":"'09 Custom Rule Backlog'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e82d93e139dc4cdf1146c7bb","recordKey":"MS-OVERLAY-CUS-04@1f8a3af1c8e871ca","sourceRowId":"ROW-25ebd4f9bd7e77f9f547b02e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":8,"locator":"'09 Custom Rule Backlog'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-26c90a2382da661792711202","recordKey":"MS-OVERLAY-CUS-05@312949a220d7aa56","sourceRowId":"ROW-2520994108320ff8743ae060","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":9,"locator":"'09 Custom Rule Backlog'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7f114e129756ee7673d9767f","recordKey":"MS-OVERLAY-CUS-06@b76726eea76800fb","sourceRowId":"ROW-ebb1ce2a43b6830c6e1a67ad","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":10,"locator":"'09 Custom Rule Backlog'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cdd6a440f019ca1cf78ce65e","recordKey":"MS-OVERLAY-CUS-07@e7e1902f4641a2b9","sourceRowId":"ROW-fb2002829e950fafd2429b52","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":11,"locator":"'09 Custom Rule Backlog'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-aff6523799276428fd994c24","recordKey":"MS-OVERLAY-CUS-08@f2e9d1cd2e00bcf6","sourceRowId":"ROW-65a7eadd76e544a3fc9a7a63","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":12,"locator":"'09 Custom Rule Backlog'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f888f50616c818ac412abf7f","recordKey":"MS-OVERLAY-CUS-09@fa0395a46d9792dd","sourceRowId":"ROW-b3c5f0638e5ec659c13e79f4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":13,"locator":"'09 Custom Rule Backlog'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-00ec2b1622114c07760973e1","recordKey":"MS-OVERLAY-CUS-10@d2a5b80a68088779","sourceRowId":"ROW-c93b748422bc054f47a76e8b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":14,"locator":"'09 Custom Rule Backlog'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b576b7f0a12446392b1b9b15","recordKey":"MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7","sourceRowId":"ROW-e9ac42c75d1e4c2fcd2001c8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":15,"locator":"'09 Custom Rule Backlog'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-664a8537aa06b95e1fdc7db4","recordKey":"MS-OVERLAY-CUS-12@b7241f443c6c3622","sourceRowId":"ROW-ec5426214da8d72f6f3427b9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":16,"locator":"'09 Custom Rule Backlog'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-21da5b09ea64ba087469c01d","recordKey":"MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7","sourceRowId":"ROW-0575be55fa3a4cd51e9b852f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":17,"locator":"'09 Custom Rule Backlog'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bbd9ffab191a989038d901a9","recordKey":"MS-OVERLAY-CUS-14@360b13cad7621179","sourceRowId":"ROW-c082c97f14511e542b1beb34","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":18,"locator":"'09 Custom Rule Backlog'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4f8e9024e157ad8011d80a41","recordKey":"MS-OVERLAY-CUS-15@bdd9abeff8cb9654","sourceRowId":"ROW-3248f07d2f746592c085c7d6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":19,"locator":"'09 Custom Rule Backlog'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5bd887933c8563f1a543e8ce","recordKey":"MS-OVERLAY-CUS-16@5dc4891c003c8c70","sourceRowId":"ROW-3805638448f295dec9a68c8b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":20,"locator":"'09 Custom Rule Backlog'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-05865221c9976ca5462aad00","recordKey":"MS-OVERLAY-CUS-17@3b8c3e6e3715795f","sourceRowId":"ROW-60bb97f031278089309f789f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":21,"locator":"'09 Custom Rule Backlog'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-67f8bbbcc747a6ce15e1bb64","recordKey":"MS-OVERLAY-CUS-18@d7a54daf6d4edffb","sourceRowId":"ROW-25d29dfc5348c104d2341251","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"09 Custom Rule Backlog","row":22,"locator":"'09 Custom Rule Backlog'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-84fb6c4a4db7529ef492b443","recordKey":"MS-HISTORICAL-GAP-01@ef333861512e5931","sourceRowId":"ROW-3c32fa1a320e57da550dbfef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":5,"locator":"'11 Implementation Gaps'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e1ae251391edfe001fe7acab","recordKey":"MS-HISTORICAL-GAP-02@704ee5c4492909d6","sourceRowId":"ROW-18577722d757f7ebc5ffbc19","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":6,"locator":"'11 Implementation Gaps'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-42339e31d16b00999ca4caa9","recordKey":"MS-HISTORICAL-GAP-03@a613206359c61d90","sourceRowId":"ROW-8b9f2a485a46d6f89bb00bc4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":7,"locator":"'11 Implementation Gaps'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e5c1b377db19fc164d0ce715","recordKey":"MS-HISTORICAL-GAP-04@a2b05c620c5f50ed","sourceRowId":"ROW-aa07a7f67dc6dd86c8f0d00f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":8,"locator":"'11 Implementation Gaps'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-92c716d0720d3572c0f8e4e5","recordKey":"MS-HISTORICAL-GAP-05@fd1e5fbd26653f52","sourceRowId":"ROW-c7a91815fd88d84d49b57ca1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":9,"locator":"'11 Implementation Gaps'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b6c8ca031f597bb8d3707c27","recordKey":"MS-HISTORICAL-GAP-06@638e326b96b3fcf3","sourceRowId":"ROW-f63728a42af3993a003b6afc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":10,"locator":"'11 Implementation Gaps'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6562a6dca493df462c10bcbd","recordKey":"MS-HISTORICAL-GAP-07@9c8fde7f6beb59a9","sourceRowId":"ROW-9a812774feea1369b1964134","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":11,"locator":"'11 Implementation Gaps'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4bf5b47a6a0664c945896c2d","recordKey":"MS-HISTORICAL-GAP-08@454bf9cdcc63df06","sourceRowId":"ROW-f0e14d8626c89447d977f580","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":12,"locator":"'11 Implementation Gaps'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-930c685db35680b0d0dd99c0","recordKey":"MS-HISTORICAL-GAP-09@3df71044c3ecb595","sourceRowId":"ROW-6566eaffd39f4ecff911cafb","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":13,"locator":"'11 Implementation Gaps'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-30b3123eeb4a0cad3f67ccc2","recordKey":"MS-HISTORICAL-GAP-10@9d50c828fd6ea39b","sourceRowId":"ROW-f15a98f09dbd9d3c6e9cc901","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":14,"locator":"'11 Implementation Gaps'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-86f13b770f18cda671097fd8","recordKey":"MS-HISTORICAL-GAP-11@4ae486b4e3826e21","sourceRowId":"ROW-3d66e190539131e805e55863","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":15,"locator":"'11 Implementation Gaps'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4dbee40d3d04e1f8280f94e6","recordKey":"MS-HISTORICAL-GAP-12@a7a5a6c9616fce50","sourceRowId":"ROW-2489926295b9f60e266bc3d9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":16,"locator":"'11 Implementation Gaps'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-02793e88259ee6aceb2be0bd","recordKey":"MS-HISTORICAL-GAP-13@17c770c42c111ef5","sourceRowId":"ROW-21cc82e99afc68e0acaff97b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":17,"locator":"'11 Implementation Gaps'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cf61d98a960011ad6ff1754a","recordKey":"MS-HISTORICAL-GAP-14@9547f69026f10453","sourceRowId":"ROW-eb1643de74425e536329deaf","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":18,"locator":"'11 Implementation Gaps'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f0344c5ad6ac6958384b2deb","recordKey":"MS-HISTORICAL-GAP-15@b99678b120eb54ee","sourceRowId":"ROW-eb5532f556081090f23ad6f5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":19,"locator":"'11 Implementation Gaps'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1394ceead0017fc3cab4a33c","recordKey":"MS-HISTORICAL-GAP-16@f32af55c238717e3","sourceRowId":"ROW-3b863926540fb475913a713a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":20,"locator":"'11 Implementation Gaps'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ef9c6cbefa1222895cc11b7c","recordKey":"MS-HISTORICAL-GAP-17@64b248d8f26e8ce8","sourceRowId":"ROW-fe97fad606370097362c7b35","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":21,"locator":"'11 Implementation Gaps'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2aeef27c24af6aec06206057","recordKey":"MS-HISTORICAL-GAP-18@f5078914a88d60e6","sourceRowId":"ROW-7067a6b6c365cbd9a551baa1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"11 Implementation Gaps","row":22,"locator":"'11 Implementation Gaps'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-18d307034487170e0437efcf","recordKey":"MS-SEED-fc49123874e83c92@1ed210287f703b82","sourceRowId":"ROW-a926db0600ee12ef3a597fa4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":5,"locator":"'12 Code Seed Crosswalk'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-af345752f900a75a3e3f6cd3","recordKey":"MS-SEED-98c36050538db5d1@65ffe1e6e8668a51","sourceRowId":"ROW-77ca0c8f72c0719974367f20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":6,"locator":"'12 Code Seed Crosswalk'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-39f11f63a943c388b157a088","recordKey":"MS-SEED-ea7497b6cbeba00e@7470eaf94aa87c41","sourceRowId":"ROW-44e9aba8014a0eadf08b5b29","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":7,"locator":"'12 Code Seed Crosswalk'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a35aa85795c7a0a05f1dd1a3","recordKey":"MS-SEED-ad9fe38d530f8f1e@d7fcddbdb30bd016","sourceRowId":"ROW-bb80811229fb723e57c9dfc8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":8,"locator":"'12 Code Seed Crosswalk'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-94d847b9fffc6884c2a836c7","recordKey":"MS-SEED-3c262146dff584d9@65146e1683c930ec","sourceRowId":"ROW-77763a56ad06ab2382475bef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":9,"locator":"'12 Code Seed Crosswalk'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1ad4c47e5376bca61dbfeead","recordKey":"MS-SEED-71dcb43d4ab69039@2cb8ac94477f4fc1","sourceRowId":"ROW-678d76e62e8a11e88a46f982","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":10,"locator":"'12 Code Seed Crosswalk'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fb13eb0e16474c8f769ba8ca","recordKey":"MS-SEED-189bbb416d04da7a@9eca359a04a266eb","sourceRowId":"ROW-dd628b7b57dc33d63a0f07f7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":11,"locator":"'12 Code Seed Crosswalk'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-39570ccfd94538357bc3abf8","recordKey":"MS-SEED-fa17b2e8b13c54ec@c3bb1f47e455b596","sourceRowId":"ROW-13eb8127539b05d28d18cca8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":12,"locator":"'12 Code Seed Crosswalk'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-988c6c85dd30fee1f99b2ea5","recordKey":"MS-SEED-0d5943f602c4e0c6@0b72544338892151","sourceRowId":"ROW-fdf1823c5417f62f1432e773","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":13,"locator":"'12 Code Seed Crosswalk'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1dd5e403e5ac725709133061","recordKey":"MS-SEED-fabd8a5fa3829b34@a1173a790d6af788","sourceRowId":"ROW-ab14203398e4dd98dd01b9c6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":14,"locator":"'12 Code Seed Crosswalk'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-22eee5d0cfe2ba3477ce834e","recordKey":"MS-SEED-18fc98793e3aa932@1b1b44969e446920","sourceRowId":"ROW-7c7fd4f71894df5b8ba94d66","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":15,"locator":"'12 Code Seed Crosswalk'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-53f50d350af2ac8ff472e04a","recordKey":"MS-SEED-68e6b67355afdda4@2380ad816add7da2","sourceRowId":"ROW-54f9aa1befd37917a916881f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":16,"locator":"'12 Code Seed Crosswalk'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ba63e89170dc97a7e5f425c0","recordKey":"MS-SEED-1362e1ef9da30d6a@a69019f699a9743e","sourceRowId":"ROW-afe2f370808f221765b14714","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":17,"locator":"'12 Code Seed Crosswalk'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e11be04506d617ee1e72135d","recordKey":"MS-SEED-fc55d1561526efc3@99d4d53f8b22179d","sourceRowId":"ROW-53762de86e62ef90691cfe16","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":18,"locator":"'12 Code Seed Crosswalk'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-eaabcf82f07092027efa2f4f","recordKey":"MS-SEED-273c936c3ac5a321@609ed6ce29a693b3","sourceRowId":"ROW-e2492afee0a48b2cf658d3bd","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":19,"locator":"'12 Code Seed Crosswalk'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-03ab983ead0e65d253321eb3","recordKey":"MS-SEED-38a0f0c058b76861@f7e97b882e8d03d9","sourceRowId":"ROW-6348dde435b116323b72dd60","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":20,"locator":"'12 Code Seed Crosswalk'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9030088a42835c2001e976c2","recordKey":"MS-SEED-59116351fad45b18@cef308c28bb05b77","sourceRowId":"ROW-b12387c96c751c9cbacbe0b9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":21,"locator":"'12 Code Seed Crosswalk'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c55562a197fcd19b19001cbf","recordKey":"MS-SEED-c3235745be75933b@c2946015ae62bccb","sourceRowId":"ROW-548f3a790ac62678ce7f99ca","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":22,"locator":"'12 Code Seed Crosswalk'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-785f8f4d169e9ad56b129063","recordKey":"MS-SEED-7c38f47e89353be2@c668276dcce2c02c","sourceRowId":"ROW-044aaac38a652e366871785b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":23,"locator":"'12 Code Seed Crosswalk'!23:23","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-146d4b783b683063a38d18db","recordKey":"MS-SEED-3545abaedc039060@41f9aeca34965328","sourceRowId":"ROW-8360d1514c202a8f0cbda1a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":24,"locator":"'12 Code Seed Crosswalk'!24:24","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0a0aed8dfc543b16f478bd53","recordKey":"MS-SEED-f14ef687ebdcf6dd@e868935a9f5522b7","sourceRowId":"ROW-0ebd4344938da8b3f5bcd86c","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":25,"locator":"'12 Code Seed Crosswalk'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-37b52f0b60be0d7179e3e16b","recordKey":"MS-SEED-72c2d3940fb2e07d@a30b48de591bab74","sourceRowId":"ROW-9beb93964e6e3eaaf4db1914","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":26,"locator":"'12 Code Seed Crosswalk'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7821a3bba2e7ae1ee9bd2053","recordKey":"MS-SEED-f24cc8315666f56b@0b522650197658e0","sourceRowId":"ROW-dcef05efe6e510cce063009a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":27,"locator":"'12 Code Seed Crosswalk'!27:27","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-74a273ec473e6afabd6ec728","recordKey":"MS-SEED-af63591ae8a0d1d3@cf9fcbd0c3f96907","sourceRowId":"ROW-2ebcca3da3ac2a761196f4b3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":28,"locator":"'12 Code Seed Crosswalk'!28:28","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-53f3f0161bc400842a5add8f","recordKey":"MS-SEED-9b9cda9c97338d12@ceb60bcac22b5550","sourceRowId":"ROW-14737a1144781541233b114f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":29,"locator":"'12 Code Seed Crosswalk'!29:29","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-84e0c3753098d5a710179aa5","recordKey":"MS-SEED-45c0aa82a09ceac4@b7de303ed373dc1e","sourceRowId":"ROW-977d58e5cc41b61d8619ef5b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":30,"locator":"'12 Code Seed Crosswalk'!30:30","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5f335d4c6a12cd7aae9acb3c","recordKey":"MS-SEED-6962f396beb2c752@af6c264d193e2846","sourceRowId":"ROW-9c27d33d3f4fa7c5958400e1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":31,"locator":"'12 Code Seed Crosswalk'!31:31","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-af678881ca74585b287e4ade","recordKey":"MS-SEED-274a1827288fe0cb@596d8feb02101b0a","sourceRowId":"ROW-1eea5c66a13b9afc1dc1e0bd","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":32,"locator":"'12 Code Seed Crosswalk'!32:32","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-eb9ede3b10fe88961d1b0985","recordKey":"MS-SEED-af6d2822af49aa78@15cfcad58c3a6910","sourceRowId":"ROW-08d1e68f2858f3dfc9d22516","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":33,"locator":"'12 Code Seed Crosswalk'!33:33","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3d63eabcfca70bcc3c371680","recordKey":"MS-SEED-773a80bd6da7f832@fbd7a85624f21c94","sourceRowId":"ROW-9152ffd4da54399ae25acd97","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":34,"locator":"'12 Code Seed Crosswalk'!34:34","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-44ec13211d6c4fd4fca3c773","recordKey":"MS-SEED-db227e3fca1cbc72@ad3e673390385458","sourceRowId":"ROW-6dd820003c993e98daf97bcf","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":35,"locator":"'12 Code Seed Crosswalk'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-29349919eef27fc4139efb91","recordKey":"MS-SEED-3b2df0684d924bea@d76862e507e52a9e","sourceRowId":"ROW-d2baa81daa8f6659d47974d6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":36,"locator":"'12 Code Seed Crosswalk'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f9a294355a307f3a48d2477e","recordKey":"MS-SEED-3a800d0a422ff4cf@bb27bd955ce6ac5b","sourceRowId":"ROW-193e9904a93da1caa713e278","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":37,"locator":"'12 Code Seed Crosswalk'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dd0aacdb78c714670b4a5a9d","recordKey":"MS-SEED-e7da922c47d356c8@a8f292c00608d481","sourceRowId":"ROW-6d53464179b39d3103f46cf4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":38,"locator":"'12 Code Seed Crosswalk'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-af76e4ada63232c7f2fa3a3e","recordKey":"MS-SEED-0318ca8123595a60@ce3f096f7c803475","sourceRowId":"ROW-f1054800c42e969b1738ec4d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"12 Code Seed Crosswalk","row":39,"locator":"'12 Code Seed Crosswalk'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6a8128de2d9ab1f74c9bba94","recordKey":"MS-SOURCE-NOTE-NIST-AI-RMF@98431fe675258378","sourceRowId":"ROW-6afd775adaeef56adc83e18e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":5,"locator":"'13 Sources'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a4b527e74b9b10cb897e6d64","recordKey":"MS-SOURCE-NOTE-NIST-AI-600-1@9f18ca8a12bc344d","sourceRowId":"ROW-60bb29d6f40f2638e0ae194b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":6,"locator":"'13 Sources'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9edccba91419d897eadf1fbb","recordKey":"MS-SOURCE-NOTE-NIST-CSF2@a272302d62ba1740","sourceRowId":"ROW-dd85bd9f50bb53640f4f9d02","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":7,"locator":"'13 Sources'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b102433f9d0765fe24d6f601","recordKey":"MS-SOURCE-NOTE-NIST-800-53@e121d1d1460084ec","sourceRowId":"ROW-794143327d3bd6f6a8677b5b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":8,"locator":"'13 Sources'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-93b89404eba92759c8cedca6","recordKey":"MS-SOURCE-NOTE-FEDRAMP@5e0472e4d1ffabac","sourceRowId":"ROW-27f2a8d67f22f644d8e567c8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":9,"locator":"'13 Sources'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2159592d331971ff0e28b9c6","recordKey":"MS-SOURCE-NOTE-ISO-42001@87c0a2b5412aa0e9","sourceRowId":"ROW-74f27ae0f73e17c216b3d9c8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":10,"locator":"'13 Sources'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d5909634adbe70acce3ce3b3","recordKey":"MS-SOURCE-NOTE-ISO-42005@e17e06ae157a1f98","sourceRowId":"ROW-f8834d598368e17253182266","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":11,"locator":"'13 Sources'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6a97ca5221e262767ef34910","recordKey":"MS-SOURCE-NOTE-ISO-23894@80e543ddeca562e5","sourceRowId":"ROW-c59c1ccc2c6b51dd77eca452","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":12,"locator":"'13 Sources'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a61b79bc4e4a197db0cac9f2","recordKey":"MS-SOURCE-NOTE-ISO-38507@770b79062960bed3","sourceRowId":"ROW-8e617d94ab0942c5f0ee9b47","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":13,"locator":"'13 Sources'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-259a735a5e7ad4bf07cc927f","recordKey":"MS-SOURCE-NOTE-ISO-5338@643c4b69567eef27","sourceRowId":"ROW-9e71c47c1044027a85490368","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":14,"locator":"'13 Sources'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1a329d9babc3bacbc357d39a","recordKey":"MS-SOURCE-NOTE-ISO-24028@6163ca05af07cd39","sourceRowId":"ROW-d3a4b2cf2f047c233100d3b4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":15,"locator":"'13 Sources'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0ca0bb7dc8381cbf925e6648","recordKey":"MS-SOURCE-NOTE-EU-AI-ACT@52f0bd02c9eb6511","sourceRowId":"ROW-55f0d39e423c96e97070d666","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":16,"locator":"'13 Sources'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-19a107a24ab7acd8e8ebe743","recordKey":"MS-SOURCE-NOTE-GDPR@df5de80066779850","sourceRowId":"ROW-4d71b63e68fcc1e7ad3a4fcf","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":17,"locator":"'13 Sources'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a28fef86a48d94b377d15240","recordKey":"MS-SOURCE-NOTE-HIPAA@4a70cd2d5098a0c7","sourceRowId":"ROW-969cec8f5f514da859ec292b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":18,"locator":"'13 Sources'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b0bac1a90be8367f26d0c1d4","recordKey":"MS-SOURCE-NOTE-PCI-DSS@3bf9369883365902","sourceRowId":"ROW-d174bffcb151e650d54aa69b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":19,"locator":"'13 Sources'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4698759e1a49ff03ca9884c7","recordKey":"MS-SOURCE-NOTE-SOC2@4545ab4b9080158e","sourceRowId":"ROW-a92bc7ea8aed8b0b24d17711","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":20,"locator":"'13 Sources'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2e01753ef90ef2300769a4ce","recordKey":"MS-SOURCE-NOTE-GLBA@dc735550e5b449c0","sourceRowId":"ROW-8943de9e224f99f851e4ad72","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":21,"locator":"'13 Sources'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4ad46cfb525b494fe04512d4","recordKey":"MS-SOURCE-NOTE-FERPA@07e23ebe6259be8e","sourceRowId":"ROW-9a44d42740dda31e13edade8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":22,"locator":"'13 Sources'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-21eafc9ea02ec609b05a26fd","recordKey":"MS-SOURCE-NOTE-CCPA-CPRA@dfbd85b2a322fe7a","sourceRowId":"ROW-ef2d08260188fcf13b964335","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":23,"locator":"'13 Sources'!23:23","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0a5458f4e668fa3a5d63c9a5","recordKey":"MS-SOURCE-NOTE-CO-AI@0990e7efdb70bde9","sourceRowId":"ROW-7ad35a64020580ec266f292f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":24,"locator":"'13 Sources'!24:24","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a6941f391b4b37200f488f66","recordKey":"MS-SOURCE-NOTE-TX-TRAIGA@ad2fe809b6252e8e","sourceRowId":"ROW-e847646abbf73e93f3ee1043","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":25,"locator":"'13 Sources'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8dc27257aadda3251b105e73","recordKey":"MS-SOURCE-NOTE-OMB-M25-21@df948b26494bab24","sourceRowId":"ROW-53009e594bc335a673d95b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":26,"locator":"'13 Sources'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-db0d5aeae025448e75e05d78","recordKey":"MS-SOURCE-NOTE-OMB-M25-22@281271ae37faf796","sourceRowId":"ROW-8d41ed1f4fb17d37f610c5a3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":27,"locator":"'13 Sources'!27:27","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-68c78d8735cb2c20ce931bf0","recordKey":"MS-SOURCE-NOTE-OWASP-LLM-2026@c3439a2d9e8b7618","sourceRowId":"ROW-b2cb27cba8e6a21320d5c668","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":28,"locator":"'13 Sources'!28:28","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f2c30176f6a994a40e89d663","recordKey":"MS-SOURCE-NOTE-SOX@3765787d692c0bdd","sourceRowId":"ROW-33b5719dcc6f74088e7ec665","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":29,"locator":"'13 Sources'!29:29","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c151fb80a79be9b94388e439","recordKey":"MS-SOURCE-NOTE-EO-14110-RESCISSION@b1e1206ab8a875f8","sourceRowId":"ROW-be42105bdecf7a8dd1e3aadb","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":30,"locator":"'13 Sources'!30:30","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0fa74d4d9bf914bf0ccb9123","recordKey":"MS-SOURCE-NOTE-CO-SB26-189@bc07181d7e90a278","sourceRowId":"ROW-9c94471549386392075ac3b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":31,"locator":"'13 Sources'!31:31","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-507c010e031a7286e45a4e2a","recordKey":"MS-SOURCE-NOTE-OMB-M26-04@4394ab01566ed077","sourceRowId":"ROW-49822c4a4d79af610118c366","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"13 Sources","row":32,"locator":"'13 Sources'!32:32","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d1bec8e906ff35a87f3bfc5f","recordKey":"TAIM-GOVERN-1.1@26b8d9618cddf058","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-500726d53abc8d4f76bb9555","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ff1dd71b401c51b7beb70f06","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c3a83429217f2edeac7f325d","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ad4180930cf7f9527ba8c4dc","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-69699a6d86e5f27480ad39c7","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-926655fb147cf86b1f37475f","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-37431535bd0c346c717c6f08","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7acebeb685d7973af10e55de","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c7d850fef58975d85bef2006","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b425f9c5fb48def1738de968","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ffeca10a503cb412255ca105","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6618ed4138bec0914e68d4dc","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-79d7f10ce3238de6901f7c01","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-14359e33611aa3e5e872d480","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bda01d349366d64ab7dd18dc","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-388c438172831f07f24d0c61","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-43534542f467c7486d68e30c","recordKey":"TAIM-GOVERN-1.2@91a9127ceb89507e","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d79f92cc2133383025faf4e4","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8d445588336b52b9c6bd4251","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4979047384599d6594209233","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0de433b409dc87ad6c2f3fd5","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ea6a72af0996fc432076354a","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ffcce20a3d04711fb8fb4717","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2bc4d6642998daf2a38f2f02","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0134dfadc5294b05253cf17b","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-286db56cc3e3e15a982df29b","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-97a3c68136c64dd75ba8e8fc","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cc9e300a882c11fea9a7338c","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6b267c8d4563fb35621fbb4a","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-03f34908280d13c2185c94aa","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8bb685bd660fd03cd46c3bc9","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2d8ed354f6e4b11789708fc5","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4cf60458ef06b930e3ff866a","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-a670655457fe6ece540cb41d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b9ae356fbddfcc095cf0aaf8","recordKey":"TAIM-GOVERN-1.3@d61a82d09de245d3","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9c40208dd09c2d9f137ba5ae","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c50292f0156b988fbc1857a2","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c537ee508ab4a3eeed955491","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7389b3ad1f1bdbe4219c1610","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-41a298c64c6c2ce0b210438f","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-de69e5cd6de26fefaaefc673","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a944afe39defdb9cf842dba7","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f20ac2052b7b0e7a697fbfe3","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0b4bef16656d13759ed178b7","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c9631be17c795fcfedb55540","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-eddf4d89badfe1e5f1b07ab7","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b9f44a9e0524397baa559a6b","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-eafd38cff9b60145c7064024","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-71a0a9702fc422800aecded1","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9a211c8a69bf7258103e7747","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6c8060b7f6843346135d7a70","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-77b115aaed354a83b01288c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cec2a9e027f429c177574e5f","recordKey":"TAIM-GOVERN-1.4@a744d71de8e42bb8","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d5ec6cb7e60392c65c449e83","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0abf67b333566ef67d5a01a8","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2058a91f0f9d0ce5628bfe6b","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d1e86aeb637311f696a8c8c2","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-850a4fea8449164466aae709","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4b2049624c669474e370d7f7","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c1f1c440f9455ef3d94a6220","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8833c22bbaa936a0306fdf43","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4ad5fc2ecb7f963b0a6416c5","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8aabc4fec534649e2430108e","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-482fb6b40c56a1e934edb96d","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-30e57141ea9abf97d2f44447","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7e8a726f5eb5bfef0927a66a","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-52051407ef5356c9cf465f6d","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e8ce9afa51c56ff6d2ae1087","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9efcd1187385bb208284ec8c","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-880a7d0ff47f20ad61482f87","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cf996a80e4b2df652f4428b0","recordKey":"TAIM-GOVERN-1.5@e6be6927d32f915f","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4302a77cfd7289c222037e2f","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cf8423150140d50e4d6a37ba","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5c67e783ff7464834e946e16","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9a1ac3ab9354c38aa837df6a","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e6d6c8fb61ee6fe203ed79e8","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9609f3a4e0a2bac7eefa621b","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cc81237bcb9e8cc80eeaae88","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-79db7e9c6de0fd7f2047296d","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b8de48119b444ca690bb2c13","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3d9a1a020881f3d6fef66f28","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-36ee07ba0f45099957fb11a3","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f7b250620dd39aea99237d6f","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b6cafc58183257e12b71d2e1","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5dbe17c3927763b789c0e61d","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4d06a8dbedc1f76e32f4a9fc","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-58376c5d51897b554bd7c92d","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-d639a47a62e9a59f1af26369","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-56d4cd5b32bfe38e2123ff66","recordKey":"TAIM-GOVERN-1.6@26f041bc196d2f20","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7395d81a6736fcd436f35438","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0187af25b37076ad4ca9547c","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-426bd14545208594b0073423","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d7c9dbf54ee04d53a39050da","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-276daf689f64158e13ff5f82","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-58c0a04d8fd4143bfb68c9de","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6fe6cef023e1b70f26a1c1d1","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5853905552ad40eed7ec58d8","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6fc6344b4539c47bd416fa1a","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9249152703ee3a76d3ae50db","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ef8be3097603f49625bb8374","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-84264982d51f874032077112","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1baeab5fb5daf42e9e707f8d","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-97b9ba399951b786cd65b2cd","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d2313078b0f34c5b74cf68b9","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-f76cbf7271edb5ca5d2ea359","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4f3fc43f915bb2333ee57e6a","recordKey":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","sourceRowId":"ROW-61cc7a9e3d5af3e4a28903bb","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-023313bd9e6131e617beb502","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-61cc7a9e3d5af3e4a28903bb","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-31c21b2b3ef4b739185e86c1","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-61cc7a9e3d5af3e4a28903bb","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-57750e07ba6e853aeea03e96","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-61cc7a9e3d5af3e4a28903bb","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2ddf4d937471049b259c1c11","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-61cc7a9e3d5af3e4a28903bb","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-866c2ee006f846935c766284","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-61cc7a9e3d5af3e4a28903bb","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-11828e7f1e30035dab10b015","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-61cc7a9e3d5af3e4a28903bb","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-974b4843548a23ad2bb80b60","recordKey":"TAIM-GOVERN-2.1@677e9c1589774ef7","sourceRowId":"ROW-a48f708bf6e0c780ea4502ef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ed7c22f3c94ce7f2bc681597","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-a48f708bf6e0c780ea4502ef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-249393b94d60bf6145e4f61b","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-a48f708bf6e0c780ea4502ef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b4e153db63505b22cd0dd8c5","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-a48f708bf6e0c780ea4502ef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-03a47855e19de2435502cee5","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-a48f708bf6e0c780ea4502ef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9ddd6b61600f6fe6e8170847","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-a48f708bf6e0c780ea4502ef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-78815de9c421588c04620b9d","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-a48f708bf6e0c780ea4502ef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-403edecacf9c3d6f270fb34c","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-a48f708bf6e0c780ea4502ef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d58655415dba6d42b25dc5fd","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-a48f708bf6e0c780ea4502ef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-968fb402eda0f5d0986fccb7","recordKey":"TAIM-GOVERN-2.2@212a87832b3bc07a","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fc6f8e4195a5438aad5211ee","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7f7b8e185bcccc93ae398e5b","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-01d7997e2b261ef47643a314","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-578d36eaf745c300f5df91a4","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-234538a3d5be77f9584f604d","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-abdc12f6dc9e1d0eb13ede61","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7cc4b7697accf64be3b5ed3f","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-48982f0cea98c2f8700ba870","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ba720195e1485cefa0267c65","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f989c7eab6f8ce43bc0aee1d","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9806f2f19691fc7cb9a288b9","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-93e549550d9670a5c56dbe41","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-80ddeb06208f32ad4c465a38","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c2a86559df0dceb4371da6e9","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ab1789dc08e333fcdf8a921a","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-5af05ff8485acfdbba9fe1aa","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f3599665d6054edb93bb7a6b","recordKey":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5282cfec10fbbf8f215d9213","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-92f26189d719072f6de94fcb","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f6691ed0d14a91e9672175c1","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5de0e6b8274be64ae3125f58","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6e56b5ef01105f933d7365a1","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1b168e6d8f0ccf41e8fd718a","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0d1fee90541cf077f9646be7","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b97c8be837754fec2418001f","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5c3798147e520244d6dc21c6","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c37a5b8238e8736627a0794f","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bbe984e9dc066aefea165845","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-06cba0d33ec654f975f88e2e","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1482742d1b8683d292e0e97e","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9d0d4d475ea8cc966e930dc7","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1315974a2c76430366b309fe","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-8422c101048b420b4fd60a93","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d6be2a1c2993e70953497652","recordKey":"TAIM-GOVERN-3.1@0f38f1685d8ed670","sourceRowId":"ROW-0098fef5b5465970b83a35a3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-58eedfe33c8ecdbf8b86f792","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-0098fef5b5465970b83a35a3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4dcf0c7efb77999c601cca08","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-0098fef5b5465970b83a35a3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9daedaee4f6b1b9ce525b93a","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-0098fef5b5465970b83a35a3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d15360ac1e6f73d00c6d8d72","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-0098fef5b5465970b83a35a3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b4931ddcd83a1941f2e7d9df","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-0098fef5b5465970b83a35a3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-76515131625d43240c41263d","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-0098fef5b5465970b83a35a3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c7266f77949e8aaef040d6ed","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-0098fef5b5465970b83a35a3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f6a46c540195f912ea7818ad","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-0098fef5b5465970b83a35a3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e1f6d4cd5f4609e56569bd24","recordKey":"TAIM-GOVERN-3.2@c47019573b68992a","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d6e44930cc2b1c1c62095264","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-217a7f35038252924bd2c3ab","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7f2d1229e70095292290d414","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-343d11407e7162a79227ad36","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-615c70fc49c01ea6f971f803","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-87cbcd02c1aba55c2afae070","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7843efc682b228c561582483","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d6a6739ef274ceea5354c63a","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7aa0eeccf853f4a0c4f51c83","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-152a6cc19dc622e41cc823fa","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-16dd203e17be78f1c3020821","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-eb35c0e7f259c4971fe6c708","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8e20585e1210b1804599c39e","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-088ebdc0adfbb04cd37b66e5","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-46ad714074f69820a832bbbf","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2c410f76564a4a80db5b6cf9","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-8b57e7ae7548094bb9ff5071","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-46d6a511a0dc0622d7407b7c","recordKey":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ff1a97b35cfb0b26ef084e7d","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-feb3676752d2d91ee8daebfb","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cf15e214cb997c9aad34e135","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3de265fed078e4cb77a57e15","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5cab93c39bdae2d9c11b400d","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-33e071c93cb4a30774bbcd78","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-689c44ca19871af9cb8e1ca4","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7b813d8d62ef453ca3cdcf5f","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7d2c5d6701cf8d73ca656af6","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-12d29fb83488e15876aaaeac","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-78b89ee548934ddac8d2db24","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-914cbd633872b26e28b6207f","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-07d124b861e81fe6c45bf5d4","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c15fa79f825e3babb9cc1e8e","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-616fffbe2ed77da6db9f01c4","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8246938a8e5bd831809ef8c2","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-716914cc4bd19dfb4119000d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0966c3e0255fcc8e3f9a4486","recordKey":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-51befe69e64786a5fe14a686","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-66d3a910b66509391fcac6f2","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d1da13a783a5b8976f685f08","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-36ddcb7a61bef7f192aa1039","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f42d270f644f6895300bd6a5","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1ae43a1b9c433181251b7dc1","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6722d11449cfff79e769a320","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-77f5f0367a7721e974986f22","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-695e5401b2077a9a430684fb","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-620c0b604ed4797cf9f0b811","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0810ab431e116dc390e64270","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-46ffcae031cd26ca55e8facf","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6d865e4d1867e3f1fb8295d5","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-61abd0d37b37736522b3e315","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-21dd9bbd6890dac3af38307b","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-51bdfb1d6fd17ef613ba5aee","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ecb16ab5811dc1635f107fb3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-97eb80252ae6e1446941d23c","recordKey":"TAIM-GOVERN-4.3@87ee4878e85c702a","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-47c42c2c4af27da13c1bb4a7","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-909b1c544f4f087a313a2106","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e57b5ec5bf7efd1022f7a8f5","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-470ef0553973fed2300ef2cc","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0f8b568a5bb9256eb84aa955","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8f75fc1c7a8c97953f058958","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-61384c0ef96c2252d70bf8ae","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6a97191692fa7bf5f89ee582","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2f9c9c799c6750242616ccce","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-75436bd788a1267667f946d7","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bc07c7a7a4cd8924639ed4d2","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-31b77c2833d51f9155b8fcd0","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5a93bc133932150f482374d2","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a1e0c76eda49c76449a334b8","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2fa65582774f8dfea0585d8e","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c5b429d2138dbbe1afb09be5","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-a2ac872913e95115c47d4121","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a0ca9208764c71d243a6238b","recordKey":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cad66dbcb2389524dead4db0","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3592e7d94030dead60d0270e","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5c9ffcba7372d671e3cce26d","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6e53614b3a82d117f4dab56f","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-283f10e079b3dbb4c2a9ecb8","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b13a90aa7bda4346ca4bb639","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-23074872d765ebcf56b44f72","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d35b3f0f6e2175e7e33b7367","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cfb3f8f28085be72a18aa028","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-45ae25053a9dc51254a3f831","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c90c76435e6328d69272099f","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-835975580188b6c96fa25264","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f69e995a75a5197679a1eedc","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a700e323f98548f989739fe4","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b4a396c01ce32da43e701b9b","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-afb8159b4d7af0d68667cc25","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-f77e5c0977310ff4c7261cda","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-43ecba8b3defcc82aafe6b5a","recordKey":"TAIM-GOVERN-5.2@0c282eb98e0d233a","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c39f3bc2ed9d644b0bde39f7","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-acc1730e1cdd6a04f89dffd2","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-19c275dc271341f7ec5dba4e","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b9c9c59df67ab958c0cc7b6f","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-78ed7a21cd6468c9afe22313","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3065e48fd70cd52efe6618fd","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bf0497c0ef9271922ce30736","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-01e0ac05f711b438ba686f16","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5b7607dde324fc8b9617c626","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2cbf68cdc708e3c953928cd4","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f170a9ba6eb3635e2abe7616","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ae252e7490e922f7aedef2f1","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8e114cf8b81a2ba6afcc11b5","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cb4868a20c77535aa9b9dc3b","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-475d1fd64c1139729a5e8b9d","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a5a6a29fafd689e68df50472","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-176a4600601727feac1aee45","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f1aa426af3f9df1e33677207","recordKey":"TAIM-GOVERN-6.1@fc5e93781b104482","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-904383fe2c9f2ee1813fbfb8","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e82aff74069a0080965e4cd4","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e446dd7cadf8f352a565a2af","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a1374ea92c95623f6e952f08","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4c0ee934597a8953b258c56c","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-98b3fa01e85f1c29993d62a8","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-047a493f03dfeea96178656e","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fed66b408aaa2ef0717c8748","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cfe4daf16b2e1bd3229815b2","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b71276bd0eb62dd5aef38c84","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ec7b5d12c22fc01baf10ebeb","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-abcd9f39fae6d98d99d013b0","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ead1ec41a9fbf5f9c8253a6b","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-85a9599b8f9b6ca330429792","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-76d1a5d210f7c3fac48d62ce","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-3f5defbd7384ed9a034c2db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8e55975bed317273cd453579","recordKey":"TAIM-GOVERN-6.2@bfdb82176b6f4825","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-13b5b91cc480138811f2149a","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-861a1df6720609f4bfc90c56","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1ebff28f7144642b418f559e","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0ea2c0dde446df7192f9a344","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c54b420305a1d520c0c1628b","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c4a037bec02a6b5b943bde45","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c4dab4062d074fb6e4c5e7d9","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f17b10efe43671c6f9588210","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-14f7a1c5f4c6815686467a4d","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-20b602c912375a2cabcd9aab","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e9ee837add2f7754cf6d7497","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-623c3fda8a5a449bd4eb9e5d","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bbaca606c1e20d6b3ce7a7d4","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0fddabd4ec6f973a524e957d","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-adc378b000e4f25365e0b705","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b1d5f1886a317884d5ed8876","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-5bec0aa14e7ef993167230b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0d76b70c1f99b83bd82345a2","recordKey":"TAIM-MAP-1.1@78b3fb055e68bb28","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e6f1a70632e872924424577d","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1cf40de71c29e2e93d903231","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ba8c140492c66b5f03dcaa5f","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b5885bc365f3eb0608a014c7","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ca94ab861a5e2c245e244188","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e532d812a67d9417916c4536","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cff98f30ef0c664d4245e483","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2804db90f21902a6812c098a","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1b47a12c2014746aeab09400","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-027bd7cf4662241b4dc7651b","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5df4b5165374636f50621ad9","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1aa373f2355a8f3fb3f424f6","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d88d5ff105503235a3a3c867","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0399947032d58c0a3e52d993","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-71255c37662133f510c7091f","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c6fa55b07b92233d08aa1b9d","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-12c23dad3d5b995714800eef","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-96c5848d6069591529dbcc26","recordKey":"TAIM-MAP-1.2@88267d6e5486e9ff","sourceRowId":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-93563a5704885c33eca58567","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3650ee371340294f6143bd85","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a1558d73f53c1516b372faaf","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dfb1bb59a3180a59cfadae65","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5a3b111a54497841b04480bb","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e12de5e9754c9a15a3f5622c","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0fcdc843500fe0e4de13fb66","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-95305b33e3f357b55fa8e5bd","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4c82bb66eac892b089f16731","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-214cd1547578c27c38d897a6","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5fbf736a85769ffaaf8b84d2","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d08261a0f956e589e7116a92","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e616facaeb86684d1270daec","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8b81f3716b627f45e2458964","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-f2dfe7c2449944e1b896d5d5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-93d1882742a228c39b40e77c","recordKey":"TAIM-MAP-1.3@1e631023c1414ce6","sourceRowId":"ROW-85932760270a1fa0ded7c021","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4847a00d9f1cd25d90d8df60","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-85932760270a1fa0ded7c021","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cb633630a4fb07629954287c","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-85932760270a1fa0ded7c021","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9060c90055dc7f1a8b4b0f25","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-85932760270a1fa0ded7c021","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cc7c0062e01e98c3ed4f9de7","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-85932760270a1fa0ded7c021","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cb2e8787eb20a8bb9ab2e3aa","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-85932760270a1fa0ded7c021","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-497a1717154227f440132e8b","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-85932760270a1fa0ded7c021","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-903beeb320203ae1d9227274","recordKey":"TAIM-MAP-1.4@576a9621f7b44f60","sourceRowId":"ROW-703b31d88fa158ac7a58b26f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e69ad8adc678e7dedd3aa1ae","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-703b31d88fa158ac7a58b26f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-846011c33f2e3bd224051b50","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-703b31d88fa158ac7a58b26f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-40df12e3bed849ca72c8b734","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-703b31d88fa158ac7a58b26f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4eebec346860dbbad98bd876","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-703b31d88fa158ac7a58b26f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d4858b68811d1193f4394300","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-703b31d88fa158ac7a58b26f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fecc0e4b6974928fe7e41fe6","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-703b31d88fa158ac7a58b26f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1b292965df17864cff473fc0","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-703b31d88fa158ac7a58b26f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-47dcf3e621fcf2ec7069f22f","recordKey":"TAIM-MAP-1.5@076d4983d14ef5a0","sourceRowId":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b54197a96d98b875e130c871","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7cb7f375441a38e2dc503ff3","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-25c8965a1663dc44071dc6cf","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6ae967c1a36f89f1b944fb9f","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-80b7f2cc63d418ecc901073f","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-20b24aeb3dd6ff6b9c99f0af","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e0936a3b3d7de935e47c5571","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a4dfd76660fa95bcac650e23","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fcdfe135e01f157917331bfb","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6715db857592ae809e41b381","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-21052183bef9343b0be89175","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-62f256cf5895c7826dd88f9d","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2cd5901f90068e541f463d8c","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d4cc9a09466493ea6e59050e","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-e1ef5702dd374de7e3e9dd88","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e27ecf4c930f533c0cce6006","recordKey":"TAIM-MAP-1.6@be58945d827b6db0","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a1dbda9ae9bef97eb289f30e","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-58cd352507d3195d8c8f8eac","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-77943252c6294f353861ae4a","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ee450ee76eb5b8aec598acc0","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-86222bea816d378919bf30ec","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-540056a97a02aefacc03c260","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6447200ba5ebd8b90ca090b1","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e0976b2ae41bf86b7dac851e","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1988863f375ba5bd783abdb0","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a8a31944a0bef28ec2a7ef8d","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-53ac813895a351b00bb9b891","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bb26a307ebe0f917ba1bca82","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-433007111c824e3f4d460f52","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-be153d0426a46b1bea96e519","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-77cd919425007aa5325b76de","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-9e861175706a574194dde1ac","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-107e867131ba14805c3e5d15","recordKey":"TAIM-MAP-2.1@4508ecde43a2dc95","sourceRowId":"ROW-ba52e3e7b4f68cefe2772138","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6702bb04e012c59a5649f55e","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ba52e3e7b4f68cefe2772138","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-92e5c2977721694336210d03","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ba52e3e7b4f68cefe2772138","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fca551b175e9a4449b505545","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ba52e3e7b4f68cefe2772138","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-90faa24efcdab116bb1f762d","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ba52e3e7b4f68cefe2772138","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8eaee66be9133b375954d09e","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ba52e3e7b4f68cefe2772138","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3507a2e666159dfd9dec0e8e","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ba52e3e7b4f68cefe2772138","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-40ed7be26e7439a9be4944b5","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ba52e3e7b4f68cefe2772138","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-745a6bb41ba6c9a372c6428d","recordKey":"TAIM-MAP-2.2@318e6e5f8367a840","sourceRowId":"ROW-46e67c638cc2b2eda5d9c56f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-62f8ff83d3c5f44918322c1d","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-46e67c638cc2b2eda5d9c56f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6d2d5876530b4214ec640329","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-46e67c638cc2b2eda5d9c56f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9b7510f21b6831d3e5993390","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-46e67c638cc2b2eda5d9c56f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0627ce14fe4ba27d4dfca1ea","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-46e67c638cc2b2eda5d9c56f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c60eb0241615d3a5e9e56470","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-46e67c638cc2b2eda5d9c56f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-143700f5f2fe7d5d4380f278","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-46e67c638cc2b2eda5d9c56f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3bdd4de65c3fa8b56bdeeede","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-46e67c638cc2b2eda5d9c56f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-efb511791782db014c068a00","recordKey":"TAIM-MAP-2.3@595fdc3a6417dcba","sourceRowId":"ROW-d9f06df2f305738c6ee22a37","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-62c3ea13194b22e06cdb248f","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-d9f06df2f305738c6ee22a37","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-501983ffee9b8ea3855e1a42","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-d9f06df2f305738c6ee22a37","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-eae1d3b374e3ad2228c1ddde","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-d9f06df2f305738c6ee22a37","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-02c576e7a469a239d0ed1e7d","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-d9f06df2f305738c6ee22a37","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3c50b71ff43ffe252197ae04","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-d9f06df2f305738c6ee22a37","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a11d8c0b990b237ad7118dd5","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-d9f06df2f305738c6ee22a37","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-412eefed426262f155ec5ce7","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-d9f06df2f305738c6ee22a37","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9a5903c7220f0ae57aed0c20","recordKey":"TAIM-MAP-3.1@8cf079d1257ee929","sourceRowId":"ROW-a667c7e4bfa9ed4093d8339e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-639a6f6b4ec00f35da42cae5","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-a667c7e4bfa9ed4093d8339e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9ffc39a39151e5b994e11d54","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-a667c7e4bfa9ed4093d8339e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-76c0703539e256b76a4b61d4","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-a667c7e4bfa9ed4093d8339e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-602377a8beaa89f00fb75ded","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-a667c7e4bfa9ed4093d8339e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c9a2977269f61d1bfbb252f0","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-a667c7e4bfa9ed4093d8339e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dc68bd1b00155f61414e5a0f","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-a667c7e4bfa9ed4093d8339e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b7c5724c50788613844b91ac","recordKey":"TAIM-MAP-3.2@b4079d9aebeb395d","sourceRowId":"ROW-b02ffae768353b3e8eaa71a0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f997e3dc849375bf082e0fe1","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-b02ffae768353b3e8eaa71a0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3898a9ff4706a601718a2533","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-b02ffae768353b3e8eaa71a0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-53a5bd05fed18a6a8e3f0b34","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-b02ffae768353b3e8eaa71a0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1040c0e1efd833d2911708ee","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-b02ffae768353b3e8eaa71a0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-68f3bda238de4e5f033b9133","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-b02ffae768353b3e8eaa71a0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-576fd1aa1950dbcbdbbfcfb2","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-b02ffae768353b3e8eaa71a0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-936ac2313433fe78b720b9fc","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-b02ffae768353b3e8eaa71a0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4f7b56f7f0e0c23f870c5daa","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-b02ffae768353b3e8eaa71a0","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6a8a1b11dab2f01779f3db44","recordKey":"TAIM-MAP-3.3@db54472c934e7816","sourceRowId":"ROW-8602a79ba41c9dd322dc03f3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fa7dd54b68436b2e0cfe42da","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-8602a79ba41c9dd322dc03f3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b82f610dee1c2d27bc7caf0e","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-8602a79ba41c9dd322dc03f3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-29f273e8141ae9e3449e2a44","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-8602a79ba41c9dd322dc03f3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0b097a64db5f20533685e41c","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-8602a79ba41c9dd322dc03f3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6698b4f2112d90e656043144","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-8602a79ba41c9dd322dc03f3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-87a78e8043e3e2c36473f716","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-8602a79ba41c9dd322dc03f3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-147dbbc9342bafb034c582d0","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-8602a79ba41c9dd322dc03f3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1ea88b1548823fec19cfbe56","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-8602a79ba41c9dd322dc03f3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b7910acdd331b44e14672e95","recordKey":"TAIM-MAP-3.4@171bc4d2aa86131b","sourceRowId":"ROW-3f93b4efa0dcd201822467db","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-56680ebefdb3c98c017dab39","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-3f93b4efa0dcd201822467db","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b98a2b250dbdb29aed5668bd","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-3f93b4efa0dcd201822467db","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1557a6c6904d033bd7e37734","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-3f93b4efa0dcd201822467db","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2a9661ec12bd4398c57a5112","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-3f93b4efa0dcd201822467db","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e8f052cf1dfd811475c37eb1","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-3f93b4efa0dcd201822467db","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ad6028c986d68f6af2a7af4f","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-3f93b4efa0dcd201822467db","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-70b5ef1977e94aa715958330","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-3f93b4efa0dcd201822467db","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ab854a2c35a741777d22086b","recordKey":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","sourceRowId":"ROW-8116ca7de2a78bfcee4bf523","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bfe7ae86f31334a2135aea27","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-8116ca7de2a78bfcee4bf523","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ac120e7e0a952dbfcec4f0be","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-8116ca7de2a78bfcee4bf523","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5882bd2d8d095181f375778c","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-8116ca7de2a78bfcee4bf523","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3096cea7d0fc9852fdb645cb","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-8116ca7de2a78bfcee4bf523","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7ff7735be7a2dea9c208aa44","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-8116ca7de2a78bfcee4bf523","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-71d04326ad097649b7a2ef7d","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-8116ca7de2a78bfcee4bf523","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d8c010316538835e8f097b26","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-8116ca7de2a78bfcee4bf523","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8301a4942d39852b8b704df1","recordKey":"TAIM-MAP-4.1@59a21bb34b454e39","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-efd03aaccb54b12627d32d25","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0a9a794d0996e42436ed5bfd","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5ce21d4df192b8733c21dddc","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1165b594f0a3df9c0cdbeea1","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d15ad222d0a2e1e54edf1cb1","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-215c552b78218da378801e17","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-05d802c75e2e26ac9a01e4de","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dfb6de7daa4d91c4e18bcdc4","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-75be08fb10c445101a7ef652","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6a99da7abb36aadd96317d12","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5bb696fdeb1282a966fefedb","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cccc3b317a797ff2e86b53a0","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0d26cb55141e8f9489881686","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6cf03b2f70a3df9e62b278c9","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c877de10254593181119bd12","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-2a8a21c85f2e3dc389cb5e76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-829dd303d29f0191fbd25f1b","recordKey":"TAIM-MAP-4.2@0287d8ad2ea3574d","sourceRowId":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8a5f2115e38cd95f71f6b9fe","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-650675a7613bea2841a36ae0","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e5c3477bb6ea0f5ba2685030","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-590b95c5c610d6b4c1e4fab7","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9a9e1c2433c0bccd68afd704","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b7562d07cf082662e1b3424d","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fa21e14b0a6895322f483650","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-04b658b0e8136ccf622d38f5","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3a9a87267fe63a6dba9f80d8","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-76c05462de6194821b434ea2","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8240c2fd6ad203e057935499","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0bd1ccf25b96b9d8c39d0d74","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-83c4d4587884cb426426081b","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3d0c383e7c032b264a38ccdc","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-d62283f0704e3c9a3a5e2b65","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c02ccd6eb31f72a331f54c50","recordKey":"TAIM-MAP-5.1@eeeb1c9210779883","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b4f2eb2bb44daf2a43448b59","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9c1686d1159869360e58e9b7","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7f5f416a8b28840d46d08365","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0cb79da0c3bb8a181eb942dd","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-41dfd2dbc9aa6f0a90fea9a0","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ef2c94e97fd11e147df8edd2","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3a2238d011956cbd4fe75fb3","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-94b599977a4bd970d28cf3e8","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d573a8c26dcb4df1e426498f","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a9871dbd3f3e47101b4cdffe","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-58e9a89207707e88b4b0dbdb","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0b598e5dfcef12a953cacee4","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-81f922a3b86c23e453a549ac","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-40f30f0e93429c864521ea69","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2cbbf94985cf9ac02ec48aa6","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-fd0c2d3154f2aaa6cac97347","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-db43fb6f779136733366b774","recordKey":"TAIM-MAP-5.2@d9cbb5e90cd723ff","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cd7b3f58c0a4349423e752a7","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-04527c5f3e6f01d68bb51b8b","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a4e95f525e88db3d506260c0","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ba6f89bd85eda2c4bfd749c6","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ccfcfa2e4a036b8082d47a64","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-55fdf43e2284fdf620b6da36","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-84ed8fe10320de55f3a575be","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-08b53e6262537d5d565ab314","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-46a24cfe44af9699bbf9541c","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-41a11663b68a386f08ca4c0e","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ea59b21396e7f15286e32653","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-74aabba376b46e54c30f3c40","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-33fb8681ed3b749f0aca866a","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e4f13b79caecaf83efd4a2fd","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-104b3a022e36c76e887168a1","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-6af635d9a7daaf4c13810207","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-97787d4be266fbe30c30eeb2","recordKey":"TAIM-MEASURE-1.1@06bafc72fb94bf95","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6bb998bc6c97ae46c992d6b7","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b5ab32bbe20dc5e095f11b5a","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1be8d9e2e9cf04b92be85dea","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ced45dc5b163a09304aaa24f","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-169af51b01a7b61a8b3a334d","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bd7dfb05cdeeb1ad827b6daa","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-557d88e19e54849791721b0b","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-663f81cbe38bcb027d244883","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-291c61464b30b19889b5742b","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5a73d54ae11646e09c4d7e68","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-43fda39d4e3a624ed34e8911","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-df26ca43c8522df7fb89d5e1","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-878dcb2c7ae1d891489355af","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8bea33c05ff2fd43f214caea","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-43c49a65fe756b9dd4ad5c37","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-2226cb28b0b121cc64d12a43","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-af9bf598a3f6e8659490d267","recordKey":"TAIM-MEASURE-1.2@6a15ee51fbe22034","sourceRowId":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6a9a4d1cf945257ea4c4538d","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e1dee5875ca03984155aa593","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ad0896947acd02bba0b434b7","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0c2c057d8e61adf60115d31c","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-de6e8138de3b6a8614f90ab3","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2b56f83f36daa7467ebc8356","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d9adee3bd2ade50597d7eb49","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6ab3b850328467eee42295c1","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8899600d043740f24c3b7b5a","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1cd41d538e381d5bcc8cac2b","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-34567f92f954e90d5937f30f","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1f7ea3600403bb55abf2339b","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1df561df517d876a5ed4c558","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-106657a35beea38c6f785d07","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ead42200fb1329c996579ff7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7b67c81c6fb3128c75cf854a","recordKey":"TAIM-MEASURE-1.3@4da0283611f39f57","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9a65b85e5babd6295ec2a115","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-30ee23dc94e091acfb8a59bb","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-018baccfe318f1ec78fc9896","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-082ec1da0f86f880835cd488","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-489f5fe4fd8f3b8f8e3f2ae6","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-005cbd256069454a31ac5c8c","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4d68b392142d61b861c612e9","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a880b2844445faf53ec9af7f","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d258e858983fb305c661d376","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bcef46be2d01736b5b8b80de","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1746c40611a923b1b9438549","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-53e298d7ab8d3d50ca6f5148","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-42e36811ea6f4ad0f5b45e2e","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3ea1335df492595668f479a5","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cf2655226e129fb24245b16b","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ba10b6209eb6aa555f9a8c0a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-107e1cd43d15a76ec9600847","recordKey":"TAIM-MEASURE-2.1@e9330844656a4ab1","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-32f4075bf07f10e31cda25b9","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4d55cc3dce6a7ed8e8bb04f2","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6786089dc2084df41592e62b","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0420eaeb94e9d811f944bd8b","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-aab959c6db9d4005ee2d1ac2","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3896dd9ea8c1b33d77287b13","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c90db45ac14a461f5b5eae1f","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8e2773f2b5a3032cd28a6d8f","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ec798052362a4300a8bf3a15","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1148bca003dadf7192322f68","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-336a84aaa82a1a9368ba022f","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f13f5139deb4a78c8bb16de1","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a42709f572eee46f8c7c3ed5","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f2660c0afcf2f5dac9529061","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7be0e7810a882188a2ff5b36","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8ebe64fec0d81cf2b9b736cc","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-eb7824c10291f5e7bc37aa76","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-32f85ae86d43f4aae1b3477e","recordKey":"TAIM-MEASURE-2.2@10cd0cb098928172","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0c75a71915725359466c2c22","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-103e5c9c6ecb36ffc2849bcf","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fbb0c3ac61fa51861eccb1dd","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-93779da26831a57cd4a5eda2","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3e74b2e734c476b8f834495d","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2b77b8fe5a75045f543627f8","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fba4bd203543d296e47462ea","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cabd2a98ed6d71d61cef9b84","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3f176fcf33258c12f007cd21","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2c702a3209abfb7dc7ea8e5d","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6fec5b999d7ff5b7930c04f2","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ebe919a7702430e56595d9e5","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2e23ae4ce2d97bd1a962c2e5","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2e5cd074f027e3383d7ddf3f","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6c287a770c76169bfccb7944","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2e5c56f8adcf831f3437b439","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-31182cfbec682492b0f1c970","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8fed0b002e62792aefd27c6d","recordKey":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","sourceRowId":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1afea4e912735f9e100b90cb","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b460e3595944772ad2de5c0e","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-14c81f52748407af4bf65207","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5d74b20451f90e9cda58156d","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-90b5e221dc75d7691724651e","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-efcea7fd57b9e77ac484b597","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bfdff85d600d582792772efb","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a8962985840e73eef76f4602","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bed5f25fd13916a130fe6b2c","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ee5bcef68dce7d08b57fd334","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-021128c58eaa84688f2b059a","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-eaff42180f0c806035f072ec","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-27d5a8894f00cc89eec3af15","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ebdde55955ead0aa160cb4b1","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-c5fef7b1dd68c5a90bee5d89","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b15ae1344d6643d091c2e21e","recordKey":"TAIM-MEASURE-2.4@4f759def92d244b2","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7eb4f4afc2d2e87a72c5d9ba","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3a46b3735a01a7a66105ffa2","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-208dd02859e6b4d1dee75024","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-156d2fdc0be29f205f8d66c2","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a62a1a958870ee4c65154759","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b24f56e22341db0dedab6995","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a472e740056ef5e0904ec120","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f3123e30f9c317fa9a2aca0d","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ecf33ab08cd9affc6d61da27","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9afb4a393799ec7941a28bc5","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ba80d3a9b9cde61997566fd7","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-54db41205ce54412be72e657","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0e94e2c396f8b3092074574d","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8b3adf13138393696cfa79f2","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e308d8c88a6a882192597378","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-d9f7f3c790b45bfef57a5014","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cdcc2c59714dad0eae83b819","recordKey":"TAIM-MEASURE-2.5@530446e7cdd7b14a","sourceRowId":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-58672dd443cfbb9552c8c50a","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2860a9d84301f0e87013ccb6","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-04a0faf6dcef1558e5a6f71a","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c3af8d69f35288b0fa7c8cec","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2c81d4ca9ecdbe6392debbc4","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-355efacdf39792a0c2f151a7","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-97bb19fa698ce20bce2c0d91","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-753739d870dabec56b3a86cd","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-87be10710f5257a0f878201f","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-730d03bcbd66f766c5e78704","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4df39ebc157b466b93fa61f5","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a57e75d60ddd25fefaa37c73","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e421b73409d8e3effc97b4ec","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a0f02d662e8807d1898cb1ef","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-789cfe0cdac5afa043b896a6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-68a34df6f1c4e2c17f003f30","recordKey":"TAIM-MEASURE-2.6@36a069327f5d2611","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a185d8e845f27ca940bc820e","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a397977fe1dcf6184b103a4e","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a47b24612c641b470d8093f8","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3bdb08d8c07c31e5452093cf","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d1f8653de46183e904ad7f22","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9f817b21019a13e48a79ea1b","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8cb5e3ee544fdb262e95fe86","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c0a6bd387634668af9bf78a6","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b54efab075699ac7f37f125a","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8d290f15e16fe90fe67577bd","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f32448d3e4544f2026b40fc8","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-109560dbbb8f581c0b7210f2","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2a48f834aa22bd433ac2d318","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c6c38aa1847ea181fece65dc","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7f469787d49dad5ff5ca5969","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-93885311a56c9dd5d5d35fb2","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ccfeba564db420d222e77db1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d3c18b17a0d50068d9118fef","recordKey":"TAIM-MEASURE-2.7@5b57e3e360c405ae","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f20079d4255e278bfcaf8237","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d9abb37aa7f84e4eade82a6f","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-35c886e6b5aa2d7088ab2814","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d126e133723f9c79cd8aa678","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-55e9c09334e2893a26557936","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-83fb08bb610c88d110875227","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bb9e897b9d48c4ef48b93bbe","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-457c61306b3f1e99823d72c5","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d937cb2508362caac2323e27","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c71170886b55e138f5b57ff0","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-aac7078baf9e323a4784a26b","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6d08d4792661567650abed00","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b4bf5e8981295908349fc1a2","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c4590ee1defc3346ec86b56f","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d43a5dfcc717fef6b28596da","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a8b251bf14d13990d2c69fb4","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-e4f3af541c41506b4784de25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-51667df0e206f0288c35c060","recordKey":"TAIM-MEASURE-2.8@263030dd27d71a53","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-51cb9fc3e090f395b60598ce","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8d80859094c10a23a6e6dc10","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d1e8a6ed18b9c8413c229777","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-13e28215063d7865f51aabfb","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9b87f2d75b13e6a4b433fcb4","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b881521640979e6dcb5dd165","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d8381b5642a6a7e4d1c0024d","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3cf6c11d66ca5a050cdb5e7a","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-676786d13e4f71ce17ac76f5","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-95911274295a62267f8c5a77","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bfa50e70a0c79e300c0f5290","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-34ba4ac813136bba2697a17d","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-92abf6c5b1ecb87703ec4fdd","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-36a5c0bf6eed529d1e9b86cd","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6ef67994c36d97d924cf9b87","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b16b173c6c5c4d87dfdc5b93","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-da6c28b963de9541a015f779","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7eccc0c5d1fdf09eefe8e8de","recordKey":"TAIM-MEASURE-2.9@81925d68d826c01b","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8874339061dd9ffb34e6c6e0","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-db2ab6a666a5d6fdc7575dc0","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9746c0a70308b8fd5f09fb3a","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-aab0d3e4b3c0e9c8313a7904","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f24297c2956bd98c3284a3a0","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e539d7d24c0c9bf22a2ccf46","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cf515973815b5ce08bb1aed9","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5f98b8cb4a078c189304d3c7","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4e473c4ad1ecdee6cbd6dbdb","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2a93dff16f1b9c17414673e3","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c3a81552d130cab62f84aaac","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6b799ceeb83e726fef2afcc6","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-45bef5eebf84e5a134f3a6fd","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f20151ba64160cf58847fd85","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f44b182558a5a270d76c16c3","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-e5b3e44f5e677d648068dc20","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0d66587d5294282ca545b897","recordKey":"TAIM-MEASURE-2.10@00041240562d2f6b","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2cdfbb6d7ec3afae8e6fdc87","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e43e47f2380b6813ed142cdd","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-436e73db2a0f89e4678691d4","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9beb1147c74e9a94d19c984c","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c608f468f66c1b0055849c09","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-941d143d61184b40714a871d","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5ae746366ecac3db88b71aae","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4a450f0b1a45248064673cb5","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ad0fcb3ca06c9c948876ed5b","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2cc6526168801d76781e2f83","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c80df851f4c2d7eab92194b4","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-32e8963d7486287b5fdde767","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3215fcdfdc60d90331debc84","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dc1976b38fc5a5adf1003efa","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ca562b81f7fd0ac461711e63","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ba21e561eda5c07a4c4f575d","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-03f6218ca3fefcfdcbbd2331","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-57f0ac7ed7abd1f12445a7cc","recordKey":"TAIM-MEASURE-2.11@c547147a38410e2a","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a191e64c11bf376b5bbaa138","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6c339e100da64ea4dc4cd5cd","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-745380bf4f5b66d6cf0e2eb8","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-020a5e8259343ac9f47d1ad0","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3505aee866332f93147406a5","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e70300ab74005e0418af3c40","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-498040ed36e03e93acdbf977","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-807e517bd5f0b9ebab1593de","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c6fb5ad7d356ecebbc62b7ec","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2b858e484b9196ffff708f19","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9d0bc9f02712f8b8a1f5e8e0","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0549cd5023b94f2fc3263724","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d9783cd475450c1e5445fa78","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1c818deafa6f3e4301a88771","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-655a2c9b770020f043ef1aca","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2e33b17b318bc7dc5f9cda5a","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-4768aafc2b74e38e6911885f","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0b93336de822d55faa865bec","recordKey":"TAIM-MEASURE-2.12@242501cce6559442","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-243226a861e9611c93e8175b","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dc6f4a67151da9972770c8df","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-355755b863da894de03a2c27","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7109852020f37614a8585087","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-276dcb6f3ccdf63e7cce1556","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-746ba2ee516f33f78a1f7051","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-44b5aec3b332fe62038b07c6","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b081d261610a41886eea97a8","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0ae981b6aa33434bf09405a4","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dadb2813360aa57844b86ccc","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fb0aacf1b009f6babd4e4fe9","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-208a508251e6bea7a7e2d192","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3d0371d34c7e0c841b5fc894","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-945b12afca53be2900f0fc52","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4bfa26153f5ddd1bbe00d73b","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0dfd7201fd1bac50189066ee","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-e7c3c97c1e54bfe3b5932ca3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b783b8007daa158cd01f44a4","recordKey":"TAIM-MEASURE-2.13@48fc4cc20ecff047","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4b11f631fc7def8fb828b755","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d552be64a3c31aff17695f03","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fb3d086a022e9674f1372d52","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4afda739b8ab8cd331475640","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cf02ef1a7177cd9abefdba7d","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6a84139cfcebd749f882b324","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-84b3d7df7292e7db0b403829","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0894471f4af8ef8fdeccb46d","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-db334c6fb7aec8fdebf5cb2e","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f49e3ef962e50b40b2464ba5","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a8a868175acd1461e9226c11","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cdd460d2d601d78f1ab7e582","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6e4fb5556760ad5426527d82","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-744451b67e4215186480fa6b","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-38d983b2da3096f5680d62d8","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cae9c7f4b75716f277521021","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-5ad08851a43583289232e7d4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-53f00b3e410c5ac5bf2fd65d","recordKey":"TAIM-MEASURE-3.1@1a8a34c7269bc006","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-05a935b140f582153c2b7f30","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e1ca1a14248745a5954d850c","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-977ebf09a271f207dc59da81","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-37922ada599ee1cbae975a8d","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-324824e31fdb55f2f1a77f44","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f59d47d62ea4d0d70b8962f1","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-db5059632236316039c3819f","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5b92314f5985fbe5ed584bfd","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d69f1d7907f2f7665cf31a51","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-19a4e4c2bb840ed67f61cd63","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4fc0f05c85375ae8a12311c9","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c700d24f0b934b257e590af2","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4e5840432716318fb948642a","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0646084a1c2bb27476f2df57","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2ff3d57ac5cba5c5cc1b7282","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-27c74e02d4b6a58b7a2476ff","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-84793a35dded43fe9a8cc142","recordKey":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","sourceRowId":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1e1695d59d24ba981ce2f3e6","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-187bbfff71ff08e68334b4cb","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a881cb0903e5ad701c77e638","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-808a1c017127693595dc8be0","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d19c45b95e978794a7b50d2a","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c265dadf3aa37600b2d007b5","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6218db6c2acaa1b4c94d76eb","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-267fc089506bb4a8a0cd3d7a","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-84f2638a0ac1a2b470b458d7","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-77df2be10af73c7a3cc156f9","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-27d03fbab2fee3d25e416723","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fd09a521392f743b250224d9","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5e91e5c151f26b537b835cc2","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-50ee55911833deb4e46e9ff5","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-6d0a9f302335f027449c3808","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-602c25c4f62b5478b679540d","recordKey":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-89bffd57ce4b3e0f29df92c6","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dda965def3d2ef17d8a0924a","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8eb5aa50c4f33c2098f0bf7c","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7326bb90a67fe1dd84357312","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d80e0f0dd4898fbcb18cc97b","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-45e6d40c877accac9b706eb0","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b4abdd4c18ae97afed6c9c1b","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-afd815af5553a06f2e1df2d2","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ba648c93d98c11ea57518699","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c03c966447843b0d3c82a9ed","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-54623ded7bbc8e0376439370","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7075d6a3b554960b29589ced","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6d7a31ecd42aa253be3d8b5c","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-58486624c7a3226aaf5c4abc","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4d0051fe4628d860ad99a694","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-daff1253687526d0bc0eb8e6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8624853f26e98d6bae98e511","recordKey":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f6ea3a8d42289ddd4d10b754","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a760b603db1ac2c48f799e9b","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b0d1c7c0782f7b7dd2f6b06a","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4cd1f2c4947b043636c85ae9","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3dabd93e163292af6a706a98","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4e539c13866aec354803ed64","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b78e409a7bda5a15f4d8810d","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f7da913beb5692f1070ea8be","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d2b342ae2a02e9ef15211a02","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6864578dce2b6f60993f36e1","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-11d38bfca3e3d3b1e2f82d6b","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-62ed376b1bfca682f90c86f8","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2f79d360f717f151d1ec0797","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5125387653dd2f798f124b7d","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5e5f399ad5bd214c6a80931e","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-13b82342ac13d621fa2feb74","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5f5c90c8f83842029dfef621","recordKey":"TAIM-MEASURE-4.2@3880f07b20cefd80","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9ffaf79e1810493681e36bd9","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d00da751cc79e808f584f8b8","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0722989b56ed234c28e80945","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-408af267e5abac33e1ae214a","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2de1a1a684f8fe1006bff14c","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3723cf26c9569a04c63f5fb6","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8ee7f4f8c73f3efe62631211","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1adacbb544156adf778cf0f5","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-45877c68341eb7f13c313ecf","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b7a4e7bc2eff5c4e18b88abd","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-535a319edcf66c92eadfde6c","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a8a650c0416cdb7df701f204","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2bca0248ff7abe190fb146a6","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dcad4c5814732441066a13e2","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-338620a986fba4edc630fe9e","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-4299e0deb9f2aef9788fecc7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6a237b220684b73a1e891270","recordKey":"TAIM-MEASURE-4.3@0b263792260e087e","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-555eb253276c9878c38f5aa9","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ccee3bc9681f0cd923b4f7e1","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bdd3aa39e70fea0d3b6b3ca8","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ee43dc1d1c5079f9ae4de95b","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-22f1000b70a31377f61087ee","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-187b9e08fafbc7416163863d","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-23b64d0d53a8bb543ad82688","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4d9c71a3bc4be0080b10c9aa","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9cbab065a9b205cc792d1808","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-818a5e979a71bc44f8d2b56b","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-82c449ef179396cbb513165b","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-41cdb9fe80212096beea0745","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7d7b9a4e256ecd457df9be02","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fbd8b1cd8da18a12bc44401d","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-541792c297cfc25c6e6268d1","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-4c38b59dd50dbb8b572a2c3d","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ed6d8ec7738ccb9d91adf525","recordKey":"TAIM-MANAGE-1.1@b474c5c19115a785","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9fd5c405003520b004ce234b","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0a3f031166ab8f748a48e6da","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9c4c25fbece6fdec29c3d63e","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b6366dc6619f87e2541b9d8a","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-afe053211619a7593014bbd4","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c97f9cad49055fb03e7eef7b","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b4b6ab62c34ad9c4edc87310","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-49e34dde105ee36ee281a29a","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c3944445bac89b80263f12cc","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8aa88d0a74af8c8d981a7c1a","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0fd3e5ab1c59791adc2b48f7","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3cff21ea5b51263e715310b2","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fcd7eb815fab0c886db9c4ca","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-17651f5c73a0a02d4aaab419","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-295cd53a1e14e1f68969685c","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-a885a363b3856bb31a56989a","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-03de519ec9ba3865f510bc21","recordKey":"TAIM-MANAGE-1.2@a705fc2f096d2e46","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8853473f45ce312b8fd7d585","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5fe9271a6b5a84bab6658a1d","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d5947b56cd675176733d3774","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b2e2d07210b9af05a0d22ca1","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-44cedebe3d755983266264b8","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6f3cf05eed87a9c2528c3463","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b931cea847219463edd67b88","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-71a95cb081e23e2751f6ffcb","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2ed887cb83e0b778b3aeb7f2","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-29acb596c8443d8ad1196c82","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-57b03314eadd92f05848114a","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dba62e6ca9a9c807de4472fc","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-065376115f4523851fbdf2ae","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-26ad43d7b39c7681e5fa8324","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fe6981bf95e1c43a174dad22","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-2e1d903c15dbcda705ae24fc","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c47e249b4e203b2fa0c88c9b","recordKey":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d837bf218cba2b621e15e5e3","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-34207a6062ab080609318deb","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-018e492dde5087fdc4d74eb6","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0f772456c537b392d57221cd","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-34dce80f5f01e28e9d2ef1a5","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ac57a800fb4bfa0c2924e331","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-32d79496a94aab1827c5fca6","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fc8d748ed953576d36a193bf","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-90bb86498ba2d024f2b6356c","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0c10480c219b3bbdf1aa8f85","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8c0571e6039ddcf1ded5f57a","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1bc3b08079a0a97c718fa5ae","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-308f115163ced4b712e8922f","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0ec412f29463b052ab83f084","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d7dd6fffc7a969f85f4f8d51","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-16ed622516da397d892e7d3e","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c846b58bdb851df7a06002e6","recordKey":"TAIM-MANAGE-1.4@614e57f0276eaccf","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6505e91fee08510e12b188c3","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0781a7347f6e9c5581101c9a","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b48d18b25a008512549a4c7c","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-41d3c2d007259cfa08ec6d4b","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-84e2b51ac2208ddfc480a7b3","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ea86a5fba2696ca285248fd4","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ef3ab1ed28c9dfcb53426c90","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-bdfcb08960e85f0c3f4f2321","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-21c3da51149fbc76dbabab5d","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5478ae4fa20f0461a29f17f7","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ede574f03a62d039c692a217","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-abbde158d9e77efd07bed740","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b8cad03ba17b2126b0e596f2","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e04a0aeef368adb06ecaf444","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-22b65db088a05b8315559940","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-b1f3855350706823b067c9e9","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cb0e04a02be29e0a60f0d299","recordKey":"TAIM-MANAGE-2.1@aa163cc990ffc547","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6b5d134749e8107728b9bf4c","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fea17c48e368801097436c48","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5a68fc743e434609b3d98af6","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-31a1648cce1c2b9d621f0c21","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6123c33fd7e1f4436d10bd7f","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a6bc6616eaace4a2576787e2","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7960ba2f2ee612afcfdfad2e","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f417710b6ccb77710ba9c49c","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5513fc6f52917e96a7d48b09","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2de789512edea3ef63815f53","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-144534ceeb961520f72bd792","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5bbaf28b5a10734b4d184dde","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-df19cea3f33fe2e748f352b7","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4902899f77215849569ef7f9","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ae6458af233f2d5cdf4b9093","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-7e6ea841d92e3e6033065456","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cd63ae5fc1060623f58955c0","recordKey":"TAIM-MANAGE-2.2@14538be506abb510","sourceRowId":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4b0824403d65126efa04d6ef","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4cee99400f85c82078f8942a","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-566f3927fe077e39c7af9a98","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5ec9260f789dc26db778c326","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-06f2f0daa690e1195be5eb45","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d9fa417eb7f2dfb0a121e768","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c6a83ccf44cf12d3daf3e919","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-51cdab3f696dd0f3f2e3f245","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-48e6679c2b839377e09bbddd","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-27cf0ac2708e6434ebfcda61","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-102776e65146ae84f13ac5fd","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8d09beed36f1b842e353be9e","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0d3d2a69c7c8724380bd6f1b","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ec2740fcf78e26db461dbd33","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-01d81b7b79e2e628806676b8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-555ec1de90875fd6b93bae6f","recordKey":"TAIM-MANAGE-2.3@438a1a9f5069b57c","sourceRowId":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7101bfbe3feb51c15e8fb9f8","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-11981bb79cfe33724443c184","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-37defaf88a45bf523384e269","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d5c5ed309530b514cb689518","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3830d3cac01901db17e0c3b6","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-994e4a552318d6731a2fb125","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6923dfd840ff8bc0511d8dc1","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a714f41b657896b0432cd8c4","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7dbc5d13d9252ff155fd083e","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-aba61f449f351867f14df2fc","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-12844c8ff0d91d2b9443da2a","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-462b6214f5d460cf611fed8a","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d55deae718e346c6b1c46ed8","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8e8355a54ab4267b235ff408","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-224a5f1225992d89294433c4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4b5af78b663084388040a6a2","recordKey":"TAIM-MANAGE-2.4@7716c58006958476","sourceRowId":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1a5544a62540cd19c871b1ad","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-558b7cd89da5759fa405dd54","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-97ba4ef7e515ee60dff144a4","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0c691566648d51f7ae882230","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dae53823358037fc6a86ac19","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5a13c589c7e9242d4b1688d5","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-362bb0319c40c0135cb08e56","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3eb12a5152784bbd0246b3de","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-dd4f4aa4265fe4a5b493479a","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3f53f5861d61d3857cfd3538","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a855722cbf0680fdfb5452ea","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5b592b98da1460cfc9feb9e0","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-36ed084e3807b81aa595790f","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4ae5e192622ce3c55c07d866","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-b132de83beeb16ed54ceab30","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f6e2ddc43141938829023d5c","recordKey":"TAIM-MANAGE-3.1@019b36616e569086","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-72b51334ceeac2b5df6dcfd3","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b6d64025d2237720e1bb568a","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-838a35b98fe0f32f06647265","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-15cc16343f1c594cccc40e40","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6a00159cf47d5ae8814218a7","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-013bcd8143ac1284689a9700","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-914af6774a9f47cd5ec3b34e","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f6b7bea5b0f9bd1600b2efcd","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4325ea9c083f1e6f62c6ca2c","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-2f252d2595dd21876a4497f0","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-be8ff155c23af50a9c88e29e","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b7b272eef245068a2f1e0f45","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a18423fe28d5d78b2f41f32c","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1ee0679c4dd3cc8b1abca407","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4c66ed9d633a5bfba48b04fd","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-8ab09654542021dee580e341","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-411727a63bb90701b99fe17d","recordKey":"TAIM-MANAGE-3.2@3a8b74098cc691a2","sourceRowId":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-83ca6989d420a1414e465589","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-baf7517da8009361a1f265d8","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ca93fa3df6e3c670d7f63c8f","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7ae7a1b485036a6954cefab1","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-42ff808c4a44b679030a6e2c","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-09e62c70a50b2c78ad375670","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-66a50cfb237f7c99f0a102de","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9204b08e43431e94590f4a30","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c12f6621b7f218d188893754","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3708e270c802fcee777f9dd4","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-eb0c33d48dfaa04cd68c747e","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9d0d7c0d33bf30bfb883cb18","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-46a3f9710e398698cc61440b","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fe3e0cacb3671bc8b4189863","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-27953071db07b54ee0d73294","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-249c67e76efcf628bb8913c7","recordKey":"TAIM-MANAGE-4.1@46658ac358537223","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-160ecef2ae55daed244f3aa7","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b3f89e285ad2e6449be9d84b","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5ba936e8becf5e23ab8b5640","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-cc209e3a85c143968b6bd31a","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-409135b0c4c5b3f8cc464f67","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7a80707bc27135dbc771755e","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-e29de608f6e200ec6fb1edb3","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-20297fe20e39849320ff570c","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c90f9ffb31970416de6a4110","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d0668a86c072b538b0acf970","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-36c37bc3ca48728d9f845e36","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-57114a7dd3655272ebb9ffa8","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5e47d6daf97eaa77ae5c449f","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-0e289d1eb6a0f4066cfea9ab","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-f3dc76e807bc89eef42cef09","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-114b0e42e3b3fda8825f579b","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-85514a233e2865c6cd1ae55e","recordKey":"TAIM-MANAGE-4.2@c85453fdd5b795d2","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d4865b2b3830d3de14213864","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-b9b58c16947755ec44ec4050","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-26ae0b7e1982a8c15092c192","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-1d4b20b54fed8d2baf9cf21e","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-5ad5403ddfe424dea2ac2f0c","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-4dd6ac43f7ba4f908948605e","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-06d5d952b21d6e7c58a8c4ae","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ffb3069c542e2812c43e10b6","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-695860b646cc9999bcb331d4","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-468f4dda8c20186152dc1cad","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-c34a54d7cb43cea7eb315674","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-112ab05ade889dc067a93e5e","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3b5dad321759e93cea54a2f9","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-8494ba9d53900eaeac56297a","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-285efd7ff0658c09c5d9f1b4","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-29100780ecb40ceac68fe0c7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d02b76c4fe6207ad9989687a","recordKey":"TAIM-MANAGE-4.3@86067afb96e12a89","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-75130db2f27b2e8f0bc2d7a8","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-178c8b71d203fd84e086e9a9","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-d8acbfdef54e80feeaba3ae7","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-07cca557c266718aeede6c06","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-35701401075d8383fad26b4c","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-9f34c82d77230f070fe1834d","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-3e93bbb7a6d56be9cbcc13c8","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-ddaec217e69f45ff3d0416ec","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-66fa50b04baa09293aa16e95","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-deb0e4b2b5c6c64ad6c2842b","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-fa7bba0235bfc36256eccb67","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-7f3bdcf5897abf831fa98365","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-821f965f24af8ab902879ea1","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-49ecdac0bb3eb4f9a84ab646","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-6a01ed1e2e2fc7bab4d29674","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-d4728a81947a6f2d84e2c8b1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v1.xlsx","libraryFileId":"libfile_5ae2ebc1d450819191fcf97042845aac","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"38dbe80823a08687ffa72ec4cb93e2f5bd398ae0867a0c0caaba97c5b7ac858b"},{"id":"PRV-a4219697066b666bd81d6d8e","recordKey":"MS-PROPOSAL-506a1d2644af5ca2@3afc264e970a0dc5","sourceRowId":"ROW-a3825fd52e03a23a138e6c7c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":2,"locator":"'01 Proposed Expansions'!2:2","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-829afefd8e25ba8b65177c8d","recordKey":"MS-PROPOSAL-6f68ea1d889cf656@0cf934ea0be48502","sourceRowId":"ROW-640cebeeb69ede6e45df7610","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":3,"locator":"'01 Proposed Expansions'!3:3","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-73f8c123469d0dabe4f9f8da","recordKey":"MS-PROPOSAL-adbad1df6911bf37@20a0fea803b2e326","sourceRowId":"ROW-bdf5de5fa6b1619e15b396bd","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":4,"locator":"'01 Proposed Expansions'!4:4","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-3ae58e8d25723de38cf669b6","recordKey":"MS-PROPOSAL-0667934981c1ec5f@2c8bde4ea140f761","sourceRowId":"ROW-326e4c84892d85985c5058a7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":5,"locator":"'01 Proposed Expansions'!5:5","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-92987515bf46059368e35572","recordKey":"MS-PROPOSAL-b768963a8f382071@6af99077b1e22c00","sourceRowId":"ROW-3e34ea4aaa5aba804cf86693","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":6,"locator":"'01 Proposed Expansions'!6:6","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-e6fe370b14269737a419a918","recordKey":"MS-PROPOSAL-a9cd05757ef9ca8e@5add95a24b8b2e22","sourceRowId":"ROW-fd234595ddd4a6137ed11668","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":7,"locator":"'01 Proposed Expansions'!7:7","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d688bc3bd5988a9581515ca0","recordKey":"MS-PROPOSAL-8ec797f3de89a1ec@5da8bc0529385f12","sourceRowId":"ROW-66b7acd52479a97aa7540ac1","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":8,"locator":"'01 Proposed Expansions'!8:8","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-7050d42fd79c273373d4b3b9","recordKey":"MS-PROPOSAL-e740125818f04c9b@3d1d2400e5d07aa2","sourceRowId":"ROW-ea35141a741aeaf2cba7124f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":9,"locator":"'01 Proposed Expansions'!9:9","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5e60d54e1760cb410a12218c","recordKey":"MS-PROPOSAL-dea82959fec98f9a@fb54f162fc07c7cc","sourceRowId":"ROW-64b63c2c53c3c8e76e3e14d2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":10,"locator":"'01 Proposed Expansions'!10:10","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-fc5355f6eb84ce8626494265","recordKey":"MS-PROPOSAL-142cc5f026b13fb3@ea74fa81eb847f3e","sourceRowId":"ROW-d3d51325f4bd49787fb5467a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":11,"locator":"'01 Proposed Expansions'!11:11","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-209514110e528f7ef7eac37f","recordKey":"MS-PROPOSAL-360eb4ffc4be5bd0@58d6a4f4f8ebbe58","sourceRowId":"ROW-1f6b2bce4f2975ea1190887e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":12,"locator":"'01 Proposed Expansions'!12:12","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-bd797ba97cfc603c0ed91a95","recordKey":"MS-PROPOSAL-f1c48f21fa979e7a@f40be4194d438a7f","sourceRowId":"ROW-b47fc0079d4b0d4f53295a48","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":13,"locator":"'01 Proposed Expansions'!13:13","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-a96f41513c25f87bc5c65562","recordKey":"MS-PROPOSAL-847984e1cf6b71ca@11486e59bd0f5e09","sourceRowId":"ROW-8ae0d92f14158369d5be099f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":14,"locator":"'01 Proposed Expansions'!14:14","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-3cfc1de3c0d6a6b2e3580e6d","recordKey":"MS-PROPOSAL-76e237f9cecac772@cf059b910c5f3968","sourceRowId":"ROW-41b37be51bdcd959b56077ea","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":15,"locator":"'01 Proposed Expansions'!15:15","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-003596b567aaf99f3f4ee3c2","recordKey":"MS-PROPOSAL-dd8ea20b6b46d7f8@d413dad9632cf38c","sourceRowId":"ROW-c08b9b82d7e602513f28fb11","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":16,"locator":"'01 Proposed Expansions'!16:16","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-474cd95918e635e93cb61fb7","recordKey":"MS-PROPOSAL-91977ab6033fc50e@2933d36b6b884cf3","sourceRowId":"ROW-b3b87930da7a18d060067f76","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":17,"locator":"'01 Proposed Expansions'!17:17","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5e537fc8a7eb95e400034b05","recordKey":"MS-PROPOSAL-f4cb1291ad18476e@095a64107deda61f","sourceRowId":"ROW-c52dd704ef892ba9c5a6da0a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":18,"locator":"'01 Proposed Expansions'!18:18","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-be93df61a439098a5ea466a8","recordKey":"MS-PROPOSAL-89b5ee189eb812ab@e89e92e4bbe14366","sourceRowId":"ROW-0dd487bc1b976aef45297bd4","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":19,"locator":"'01 Proposed Expansions'!19:19","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-eb5646e714242e1a4eb41feb","recordKey":"MS-PROPOSAL-7a89e937b0b92eeb@3bb7653b48d2eb29","sourceRowId":"ROW-1d901d5423258c69c45d479f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":20,"locator":"'01 Proposed Expansions'!20:20","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b4ef1cdaa5f9b1146d01a9b0","recordKey":"MS-PROPOSAL-54bef0badcd645e3@a91b49f9b39e14b5","sourceRowId":"ROW-74fb99791d99364b722a3723","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":21,"locator":"'01 Proposed Expansions'!21:21","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-8166715e022f1d2427997452","recordKey":"MS-PROPOSAL-4d94e48e6fcbbde5@91557292665d78f1","sourceRowId":"ROW-071f63ad3c28c8f170399599","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":22,"locator":"'01 Proposed Expansions'!22:22","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-3b01db3b51745e248cc49dbd","recordKey":"MS-PROPOSAL-00cd2cc8e14d4826@d106ca9a2b753b47","sourceRowId":"ROW-7b023cbc4fb415afcece1806","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":23,"locator":"'01 Proposed Expansions'!23:23","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d6c2ecff13d9cfc83b91d0c3","recordKey":"MS-PROPOSAL-1bdd72c858c1df51@2442074e2644eec0","sourceRowId":"ROW-7f3414fcb0b7a064aa47932b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":24,"locator":"'01 Proposed Expansions'!24:24","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4b74986d2e6221330805a65b","recordKey":"MS-PROPOSAL-076eb3dc3ae44fc2@cc3b53d79d026400","sourceRowId":"ROW-53f67697db1ca0c84d5158da","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":25,"locator":"'01 Proposed Expansions'!25:25","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-a74a003b1fec46aa42ab88f4","recordKey":"MS-PROPOSAL-83f291dc202b2f9e@0c3ad344046e19b8","sourceRowId":"ROW-974c71eb5d08d6dae3b42bb2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":26,"locator":"'01 Proposed Expansions'!26:26","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-0c2998d4303b5d0e87d901c5","recordKey":"MS-PROPOSAL-42d267a546fb50ab@789c4c7d936793a3","sourceRowId":"ROW-20a70b59b3d66c0b59309939","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":27,"locator":"'01 Proposed Expansions'!27:27","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5fcadd0b447cc1133338b38f","recordKey":"MS-PROPOSAL-4bc5330aa9719598@dad87fe4893e4bf2","sourceRowId":"ROW-92448f50341ee8bd9b789a55","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":28,"locator":"'01 Proposed Expansions'!28:28","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-ea135df3cd9263bbbc7a848b","recordKey":"MS-PROPOSAL-645c84845d09ab94@ea2271fd75c9a604","sourceRowId":"ROW-01dca4cee18c42123ac827c8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":29,"locator":"'01 Proposed Expansions'!29:29","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-3b47baf342d1df2c8433a477","recordKey":"MS-PROPOSAL-3d042969e2dd7283@4a5db8990aa161bb","sourceRowId":"ROW-081486ef0099744a9d2b74dc","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":30,"locator":"'01 Proposed Expansions'!30:30","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-a882a99e6ca9564bcdcc8fa5","recordKey":"MS-PROPOSAL-0cfb50ec0219d4a0@6caafe617501c815","sourceRowId":"ROW-414ff4101f22308b610f3ffb","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":31,"locator":"'01 Proposed Expansions'!31:31","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5153250d7417c2b6e5317307","recordKey":"MS-PROPOSAL-dc0f6149115ff494@208271654a02f362","sourceRowId":"ROW-e4e4b526670da1bdf3a9ec30","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":32,"locator":"'01 Proposed Expansions'!32:32","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-2d8dff0cb6a9cd5624da5fb6","recordKey":"MS-PROPOSAL-69075cae86117cb2@68d298c2e3f80b76","sourceRowId":"ROW-a396d332122ecad0ab3e0932","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":33,"locator":"'01 Proposed Expansions'!33:33","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-dcc089e934a58dcf7f122f04","recordKey":"MS-PROPOSAL-8e788525b874a12f@b96cbb3761820638","sourceRowId":"ROW-42bf9a64b0b7c04671b57fc6","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":34,"locator":"'01 Proposed Expansions'!34:34","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-fc7d8747f5f2454e3ac8e7d5","recordKey":"MS-PROPOSAL-d1e378f73b002350@21d3d782df317d92","sourceRowId":"ROW-4bb2a58a345a601f448f8c32","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":35,"locator":"'01 Proposed Expansions'!35:35","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-3f319a10473cebbed04ab093","recordKey":"MS-PROPOSAL-9a54b202264a974f@e3e9419848093815","sourceRowId":"ROW-ed47de10c32b620ddec4a484","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":36,"locator":"'01 Proposed Expansions'!36:36","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-01a41c46b065a4c2132c599d","recordKey":"MS-PROPOSAL-5059089017de2506@cab4bb554d9a1cd2","sourceRowId":"ROW-a203586b69564a0481b513e4","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":37,"locator":"'01 Proposed Expansions'!37:37","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4f64d58ff40cdce07d08767a","recordKey":"MS-PROPOSAL-a013544d01fee287@c3fd7c117141fbd2","sourceRowId":"ROW-30fe5e8784d87b824ff0ef19","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":38,"locator":"'01 Proposed Expansions'!38:38","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b3df825d2e8a927e8041f306","recordKey":"MS-PROPOSAL-ba4c99c27e7c0a69@e1b27a897b6f076b","sourceRowId":"ROW-f046d365d3d96d1b4c6e8bc8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":39,"locator":"'01 Proposed Expansions'!39:39","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-bac0411245ec720e55c4e783","recordKey":"MS-PROPOSAL-b1f44853d7f32a32@1f40bcec27b61ddf","sourceRowId":"ROW-ec717d785b83b86f5452fb20","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":40,"locator":"'01 Proposed Expansions'!40:40","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-9404e5485428b70dd88e55ea","recordKey":"MS-PROPOSAL-1696ab3086dea5a5@fc2ef3dc58a55ab7","sourceRowId":"ROW-a7157905a590de8a392187e5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":41,"locator":"'01 Proposed Expansions'!41:41","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-eaa6a4aadb5b8038d43765db","recordKey":"MS-PROPOSAL-f833e9ff4c4adec2@be4d99a8a6250989","sourceRowId":"ROW-94840abd40bb06472ce8214a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":42,"locator":"'01 Proposed Expansions'!42:42","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-73dad82c8983548f15e7895b","recordKey":"MS-PROPOSAL-760bf582e8f19709@cab03c5192a6a576","sourceRowId":"ROW-df10e0cdc86adf7851326c3a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":43,"locator":"'01 Proposed Expansions'!43:43","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d90e003cefa58b58ff3c079d","recordKey":"MS-PROPOSAL-32a87c02df063e8b@5dfa56307b5c5a25","sourceRowId":"ROW-a121819d17a6476331541d4a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":44,"locator":"'01 Proposed Expansions'!44:44","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-528f4140fddfc8decc9ef1d8","recordKey":"MS-PROPOSAL-cc97f1321e4a83b3@085fdf897d47a0ea","sourceRowId":"ROW-d277a3dc97c4272c5552ef0e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":45,"locator":"'01 Proposed Expansions'!45:45","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-116e7051f0eff3037f34f169","recordKey":"MS-PROPOSAL-52906f9344954603@05e5a8043989c722","sourceRowId":"ROW-206523e460ae7d5e37508a82","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":46,"locator":"'01 Proposed Expansions'!46:46","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-2705d575c7564dd8fe8695e5","recordKey":"MS-PROPOSAL-6754d5f027221287@0686f0026feec556","sourceRowId":"ROW-adb71c0d698d36ba91f8a711","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":47,"locator":"'01 Proposed Expansions'!47:47","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-17047fe9472c15b62d965292","recordKey":"MS-PROPOSAL-2fe0afebbb599c65@9feb7ca329f91f24","sourceRowId":"ROW-88d67d5267884192e27a58ee","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":48,"locator":"'01 Proposed Expansions'!48:48","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5dff8625fe7d6f3d0fe78848","recordKey":"MS-PROPOSAL-66641e97d4f18ff3@0733e169f0715701","sourceRowId":"ROW-a743367fd7bbfe78ca525fa8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":49,"locator":"'01 Proposed Expansions'!49:49","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-8dfef97a36410cdec7d8f598","recordKey":"MS-PROPOSAL-41b8fc86cf49abf4@02a8df88dd123c74","sourceRowId":"ROW-7e5891b66f1bfb5e4b3f44ad","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":50,"locator":"'01 Proposed Expansions'!50:50","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-6e94f3e1b8b3694022e59ddc","recordKey":"MS-PROPOSAL-aff5a4c774c3e66b@e94443031a0389d8","sourceRowId":"ROW-973fa26287432e78f88fdd97","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":51,"locator":"'01 Proposed Expansions'!51:51","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4866a2b15d9963be1a39e58c","recordKey":"MS-PROPOSAL-82cbbe360578240d@2a42bf79cfa9c3e0","sourceRowId":"ROW-3e8203318dc23f2c2ecc82a9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":52,"locator":"'01 Proposed Expansions'!52:52","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-02e0bbb7c41f845be1caa914","recordKey":"MS-PROPOSAL-0a17dcd51c44464f@90205cad9c49eb85","sourceRowId":"ROW-135e138eefd91d583f58e051","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":53,"locator":"'01 Proposed Expansions'!53:53","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-1a8e13aab4730cfd406493be","recordKey":"MS-PROPOSAL-84c559976cc7d642@21ade2548391dae3","sourceRowId":"ROW-e44f1d61efa90dc7e2c57ba6","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":54,"locator":"'01 Proposed Expansions'!54:54","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-729b67e80bdd120eea56c6c8","recordKey":"MS-PROPOSAL-25a757cf14a43bec@72c0774bfe859750","sourceRowId":"ROW-98eede2079330409090505bc","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":55,"locator":"'01 Proposed Expansions'!55:55","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-733bb8fb1b5e4d44c6dd7f5c","recordKey":"MS-PROPOSAL-49c1bb8df481c775@740f716c3c1f5131","sourceRowId":"ROW-861de93325f2dd51a8b59ffd","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":56,"locator":"'01 Proposed Expansions'!56:56","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-aaf2f793ee8d3fc5e23ddb4b","recordKey":"MS-PROPOSAL-65e6cebadb2c02ec@74a11ef76082e740","sourceRowId":"ROW-4300944491a0238122b3a5f1","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":57,"locator":"'01 Proposed Expansions'!57:57","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-7bb06121a16ef93474931da6","recordKey":"MS-PROPOSAL-1138c36f30d2f384@8b285e34a98e87bb","sourceRowId":"ROW-e7302c46a31e80de571c55da","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":58,"locator":"'01 Proposed Expansions'!58:58","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c5b19233e078f8805cfd7085","recordKey":"MS-PROPOSAL-1403c7b83626610a@f286a79d011c4a8e","sourceRowId":"ROW-67ccc1472f945ddac9c1f9f7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":59,"locator":"'01 Proposed Expansions'!59:59","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-acf71bd3b54ee7670a298494","recordKey":"MS-PROPOSAL-c1559724c3f73d52@a290a120522acfb8","sourceRowId":"ROW-8420b54bd6262206b35a1f43","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":60,"locator":"'01 Proposed Expansions'!60:60","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d3e2daf4a693e003eae75f63","recordKey":"MS-PROPOSAL-bb55b5b2157c3ffc@586778c3cc63c5a5","sourceRowId":"ROW-a9c6f0da94ea249a1fa05079","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":61,"locator":"'01 Proposed Expansions'!61:61","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-39ad7f8dce4bc66bdc0cdfea","recordKey":"MS-PROPOSAL-3c86836693534b52@113772d79e8aab91","sourceRowId":"ROW-657571006f3d8eed78a8d614","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":62,"locator":"'01 Proposed Expansions'!62:62","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-9b538cafda937b212942ebe5","recordKey":"MS-PROPOSAL-f0d3794e7b463764@be2e942c093049e7","sourceRowId":"ROW-0cf8407a2d40fba20bead1a1","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":63,"locator":"'01 Proposed Expansions'!63:63","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-49dccc6268f7568b26107300","recordKey":"MS-PROPOSAL-c0c6817ff57d97fb@eb28640456516466","sourceRowId":"ROW-a94d14d91111cf2fcec2ce7c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":64,"locator":"'01 Proposed Expansions'!64:64","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-2fe36af2e805125bd1ca13b8","recordKey":"MS-PROPOSAL-ae0534fced3aad40@255044216162f04c","sourceRowId":"ROW-d3ce801030f7261bdf22b6c3","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":65,"locator":"'01 Proposed Expansions'!65:65","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-cea7227fe2bc4c5efc9279c9","recordKey":"MS-PROPOSAL-ed84c49272c9d971@af33162ce7aa3cec","sourceRowId":"ROW-b4e6cea6104935d466767f59","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":66,"locator":"'01 Proposed Expansions'!66:66","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-596a6a55f06f172878508a2e","recordKey":"MS-PROPOSAL-9dd049dd5788ec7f@c920b947bf344f6e","sourceRowId":"ROW-dd48f710b4f50b54b9f10c8e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":67,"locator":"'01 Proposed Expansions'!67:67","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-fb8835c9a269007f910a3c09","recordKey":"MS-PROPOSAL-9ba3144fe67b0898@f8b4752a1474e56d","sourceRowId":"ROW-0c8f49072849f138f26dbbf2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":68,"locator":"'01 Proposed Expansions'!68:68","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-6dab34de35b4e330b09b46cc","recordKey":"MS-PROPOSAL-5d2ae0fa2c414b55@14f7f404bdc5a752","sourceRowId":"ROW-061155174c638c14c63ac416","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":69,"locator":"'01 Proposed Expansions'!69:69","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5f49b178f220952139f01cd5","recordKey":"MS-PROPOSAL-230f9559fe32d442@7794a91209244139","sourceRowId":"ROW-8b27236695c29762e61071a8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":70,"locator":"'01 Proposed Expansions'!70:70","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-36931e8a8feac6a2153301bb","recordKey":"MS-PROPOSAL-36e6bb635eee9b28@79d3198bd7df5314","sourceRowId":"ROW-991b04fe504db19a0be0666f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":71,"locator":"'01 Proposed Expansions'!71:71","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-7421276f76436e49991d147a","recordKey":"MS-PROPOSAL-c36b0a9c7e9b371f@01f9fb829e6bacd4","sourceRowId":"ROW-be52e7fdb3fe4aa029dd245f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":72,"locator":"'01 Proposed Expansions'!72:72","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-14516a78cba001d558b622c6","recordKey":"MS-PROPOSAL-bfbd4ed15b4d6e90@9fc0efe52c05a9e6","sourceRowId":"ROW-2a5e196c6feb71f2a2dc0d55","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":73,"locator":"'01 Proposed Expansions'!73:73","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-cab34b4aecf6265701bae5ea","recordKey":"MS-PROPOSAL-5aeacd2415011ab5@288698f3a52d9f8e","sourceRowId":"ROW-3b70940a57cced7892ad0af2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":74,"locator":"'01 Proposed Expansions'!74:74","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-cbd0a586f9490104ec889a9d","recordKey":"MS-PROPOSAL-b54d5bfe50348a03@b3d18212e7b62451","sourceRowId":"ROW-06ab36e3a10d4c020ff264ae","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":75,"locator":"'01 Proposed Expansions'!75:75","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-a24d7c66d94c0b79ce581380","recordKey":"MS-PROPOSAL-5fbeac2dc526ef57@ef8a8e394139f2e4","sourceRowId":"ROW-4a7cd9659f16f7155691077b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":76,"locator":"'01 Proposed Expansions'!76:76","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-1d07eff2e46c644bd548c38a","recordKey":"MS-PROPOSAL-bfa86fe3686b5314@9b33b24758f0f1c3","sourceRowId":"ROW-674447b3241ac25a9ab2e284","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":77,"locator":"'01 Proposed Expansions'!77:77","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-0f960cf29b13f5154979bafe","recordKey":"MS-PROPOSAL-0e1149ec5cb031c3@e14afe9e4c494dd2","sourceRowId":"ROW-19230a72d1a7c6edd9a826a9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":78,"locator":"'01 Proposed Expansions'!78:78","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f009b0470b6e8a03d48422b5","recordKey":"MS-PROPOSAL-46be5dea33b89cb5@368e67683bac1adc","sourceRowId":"ROW-db1955a080c20c5d8c4bc154","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":79,"locator":"'01 Proposed Expansions'!79:79","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-86dd8b24cf5382ac1b13148e","recordKey":"MS-PROPOSAL-a666d0d234297f32@939685e8d1b81471","sourceRowId":"ROW-8eb71d75154950acec1adf4e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":80,"locator":"'01 Proposed Expansions'!80:80","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-eeed19ef0e49ddb97ad0621b","recordKey":"MS-PROPOSAL-300bab388794cd89@84e23815566ae7bf","sourceRowId":"ROW-a16dd01b1372ccb87093baa5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"01 Proposed Expansions","row":81,"locator":"'01 Proposed Expansions'!81:81","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-dad0c44c0b078ad3cf33989b","recordKey":"MS-RULE-DP-01@82066dbd9b9a4f14","sourceRowId":"ROW-86e3f4fc741d7b7c685846c2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":2,"locator":"'02 Canonical Rules'!2:2","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c53e599b14523b12650122ff","recordKey":"TEST-MS-RULE-DP-01@0bc48774d2f0f1dd","sourceRowId":"ROW-86e3f4fc741d7b7c685846c2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":2,"locator":"'02 Canonical Rules'!2:2","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f1ffbc2624c5f5c0e06abc87","recordKey":"MS-RULE-DP-02@d20cd6810e42f858","sourceRowId":"ROW-4e0e2a513a548d8dd7f3ca4b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":3,"locator":"'02 Canonical Rules'!3:3","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-01e6a02c1c6533861e85a322","recordKey":"TEST-MS-RULE-DP-02@ca4ef66ca268a10a","sourceRowId":"ROW-4e0e2a513a548d8dd7f3ca4b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":3,"locator":"'02 Canonical Rules'!3:3","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-89f6738fb5ca512bda919d27","recordKey":"MS-RULE-DP-03@4cbb47b109e98f4a","sourceRowId":"ROW-b73e16e28eb998cbf5f4203c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":4,"locator":"'02 Canonical Rules'!4:4","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-cadff910aa3913ede4b588be","recordKey":"TEST-MS-RULE-DP-03@50eab23253df5cb7","sourceRowId":"ROW-b73e16e28eb998cbf5f4203c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":4,"locator":"'02 Canonical Rules'!4:4","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-2ae45186697f56edb3b95220","recordKey":"MS-RULE-DP-04@13c6ba85197d9a69","sourceRowId":"ROW-20cebb4d9194a3771b8c6c6b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":5,"locator":"'02 Canonical Rules'!5:5","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4b487e0c135a094fb25e323c","recordKey":"TEST-MS-RULE-DP-04@f3aef5f922894a93","sourceRowId":"ROW-20cebb4d9194a3771b8c6c6b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":5,"locator":"'02 Canonical Rules'!5:5","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-de2fdc0a14d3248e401caae5","recordKey":"MS-RULE-DP-05@30a7a6fc8d2d373f","sourceRowId":"ROW-3a20d304024c3b2668816a2b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":6,"locator":"'02 Canonical Rules'!6:6","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c2bf680c3900b7a209d67cd0","recordKey":"TEST-MS-RULE-DP-05@77349f3499851451","sourceRowId":"ROW-3a20d304024c3b2668816a2b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":6,"locator":"'02 Canonical Rules'!6:6","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-ea7ca7a0bcf30a2745957d23","recordKey":"MS-RULE-DP-06@af062b3863346b41","sourceRowId":"ROW-0470b0b43ca98bfa57d43a5c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":7,"locator":"'02 Canonical Rules'!7:7","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d480f503e802b2603581262a","recordKey":"TEST-MS-RULE-DP-06@59256ca2a153a840","sourceRowId":"ROW-0470b0b43ca98bfa57d43a5c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":7,"locator":"'02 Canonical Rules'!7:7","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-8c39d742a0d7d2e18216d15f","recordKey":"MS-RULE-DP-07@94c870d43e4286ab","sourceRowId":"ROW-543d2f615f6677dc525184fa","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":8,"locator":"'02 Canonical Rules'!8:8","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-db98d5d8308b3fceee4bbf8e","recordKey":"TEST-MS-RULE-DP-07@5002f8ed22b072a4","sourceRowId":"ROW-543d2f615f6677dc525184fa","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":8,"locator":"'02 Canonical Rules'!8:8","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d2b34deec35fccffdc7eebf6","recordKey":"MS-RULE-DP-08@f94b476097640eb3","sourceRowId":"ROW-82071b63dbc5fee0b9c7b7a0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":9,"locator":"'02 Canonical Rules'!9:9","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4b741ac28cea54634facdbe0","recordKey":"TEST-MS-RULE-DP-08@5952c57b4ceafdbd","sourceRowId":"ROW-82071b63dbc5fee0b9c7b7a0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":9,"locator":"'02 Canonical Rules'!9:9","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d8afc2a4f5d6cc96e693c7d9","recordKey":"MS-RULE-DP-09@e32553c4840951b3","sourceRowId":"ROW-db53f16f70cb95ba2382cd88","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":10,"locator":"'02 Canonical Rules'!10:10","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-8886c2ad0f1ae1b87713f524","recordKey":"TEST-MS-RULE-DP-09@c4ed5280df2d8691","sourceRowId":"ROW-db53f16f70cb95ba2382cd88","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":10,"locator":"'02 Canonical Rules'!10:10","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-91978b7988839b0ea26143d1","recordKey":"MS-RULE-DP-10@fc6f0a161d4f201f","sourceRowId":"ROW-8ab613b576bec5837cc83a8c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":11,"locator":"'02 Canonical Rules'!11:11","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-1190a593a41728fc15861548","recordKey":"TEST-MS-RULE-DP-10@6d512691a22458cc","sourceRowId":"ROW-8ab613b576bec5837cc83a8c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":11,"locator":"'02 Canonical Rules'!11:11","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b6a126097178a6df166d8c04","recordKey":"MS-RULE-DP-11@b7d96f7e1501e4ed","sourceRowId":"ROW-69d23cc85849f478ab07ec4d","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":12,"locator":"'02 Canonical Rules'!12:12","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-cba25b4c76969633a6644532","recordKey":"TEST-MS-RULE-DP-11@e6424832265654e7","sourceRowId":"ROW-69d23cc85849f478ab07ec4d","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":12,"locator":"'02 Canonical Rules'!12:12","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b40c2f7ee5c914bf6f0af3e1","recordKey":"MS-RULE-DP-12@4ae51c2523134e28","sourceRowId":"ROW-841c070198c06ad8b0aef2b7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":13,"locator":"'02 Canonical Rules'!13:13","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5a3a31e0c5e6e11fccd3648a","recordKey":"TEST-MS-RULE-DP-12@95d98ba0364aec85","sourceRowId":"ROW-841c070198c06ad8b0aef2b7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":13,"locator":"'02 Canonical Rules'!13:13","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-acc2b70ec1de8635920c717f","recordKey":"MS-RULE-DP-13@1299bbf89c50bd1a","sourceRowId":"ROW-0f0e46d0bdbb6f0cab5550ff","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":14,"locator":"'02 Canonical Rules'!14:14","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-2eca79b127a331c0b08c89bf","recordKey":"TEST-MS-RULE-DP-13@f983ef5d4e01924d","sourceRowId":"ROW-0f0e46d0bdbb6f0cab5550ff","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":14,"locator":"'02 Canonical Rules'!14:14","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-694244d1aca2756b326e8711","recordKey":"MS-RULE-DP-14@7b898303f53ec49b","sourceRowId":"ROW-f6d57cc20085f5b18a8c7e75","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":15,"locator":"'02 Canonical Rules'!15:15","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-83bdbf59ad8ee8db26cce9d6","recordKey":"TEST-MS-RULE-DP-14@ab80d0fa0d8db15e","sourceRowId":"ROW-f6d57cc20085f5b18a8c7e75","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":15,"locator":"'02 Canonical Rules'!15:15","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-1144c3c6e91a41282de60bbd","recordKey":"MS-RULE-DP-15@208a0f796d79405e","sourceRowId":"ROW-90a68bb520a07568b91ed065","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":16,"locator":"'02 Canonical Rules'!16:16","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-21d2948dc477c298bc87d7ed","recordKey":"TEST-MS-RULE-DP-15@cea9c93668f602e0","sourceRowId":"ROW-90a68bb520a07568b91ed065","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":16,"locator":"'02 Canonical Rules'!16:16","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c8e4f1db1afe081c74159848","recordKey":"MS-RULE-DP-16@d0dca88853814a51","sourceRowId":"ROW-a4ee8af405c3a0a34fc223ab","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":17,"locator":"'02 Canonical Rules'!17:17","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-713eebebf1d50a60f5bdff1c","recordKey":"TEST-MS-RULE-DP-16@97bda9e88e479e68","sourceRowId":"ROW-a4ee8af405c3a0a34fc223ab","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":17,"locator":"'02 Canonical Rules'!17:17","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b16f28c64ac38acc63930003","recordKey":"MS-RULE-DP-17@d1c8e0c542b0a6f6","sourceRowId":"ROW-a9251a103bdcaeec733e212f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":18,"locator":"'02 Canonical Rules'!18:18","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-87c2d503e11292228c50c9d4","recordKey":"TEST-MS-RULE-DP-17@811ed55e191f631e","sourceRowId":"ROW-a9251a103bdcaeec733e212f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":18,"locator":"'02 Canonical Rules'!18:18","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f69e5535c193fb631a2d636c","recordKey":"MS-RULE-DP-18@082a5a202e1a48ef","sourceRowId":"ROW-5474eae2c46ac8f100593524","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":19,"locator":"'02 Canonical Rules'!19:19","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-e7b48405edb8741f5f12efb4","recordKey":"TEST-MS-RULE-DP-18@8a543089559677bc","sourceRowId":"ROW-5474eae2c46ac8f100593524","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":19,"locator":"'02 Canonical Rules'!19:19","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-da02d873d455b04b216daae3","recordKey":"MS-RULE-AU-01@32b7d4ac14b06f7b","sourceRowId":"ROW-782fab1dc36e02c65be974e5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":20,"locator":"'02 Canonical Rules'!20:20","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f664141a444de0998ef5975d","recordKey":"TEST-MS-RULE-AU-01@0084a371cf0309b9","sourceRowId":"ROW-782fab1dc36e02c65be974e5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":20,"locator":"'02 Canonical Rules'!20:20","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f915bd5812107a4bcc60a34c","recordKey":"MS-RULE-AU-02@1a166eaeb8f7f1ad","sourceRowId":"ROW-4d23040325fead0527a294ed","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":21,"locator":"'02 Canonical Rules'!21:21","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-8469fd1d12d18e44a242f0ed","recordKey":"TEST-MS-RULE-AU-02@ab1063b0ed9fa8a0","sourceRowId":"ROW-4d23040325fead0527a294ed","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":21,"locator":"'02 Canonical Rules'!21:21","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-7737046a3feb0ed0016cafd6","recordKey":"MS-RULE-AU-03@ece0c972ca2c62e1","sourceRowId":"ROW-38d46fe6306b41d54c973855","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":22,"locator":"'02 Canonical Rules'!22:22","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c8cbc6f3739b8ca68d317008","recordKey":"TEST-MS-RULE-AU-03@2c0164b9ceb762fe","sourceRowId":"ROW-38d46fe6306b41d54c973855","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":22,"locator":"'02 Canonical Rules'!22:22","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f37a411a186d551c86fa584d","recordKey":"MS-RULE-AU-04@d51101a040857487","sourceRowId":"ROW-c20d8c45b4ec95b6436511ea","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":23,"locator":"'02 Canonical Rules'!23:23","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b3410839310c58d1c9fa5c56","recordKey":"TEST-MS-RULE-AU-04@d64cd4d5b62ae1d2","sourceRowId":"ROW-c20d8c45b4ec95b6436511ea","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":23,"locator":"'02 Canonical Rules'!23:23","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-ead73afb32e51e09bbcfd922","recordKey":"MS-RULE-AU-05@7c58fddd6817f607","sourceRowId":"ROW-d26c38075eb4ffc2a789277b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":24,"locator":"'02 Canonical Rules'!24:24","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-eb0cdd3ba9fcb94a548d7d97","recordKey":"TEST-MS-RULE-AU-05@0f305d8c832c7e2f","sourceRowId":"ROW-d26c38075eb4ffc2a789277b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":24,"locator":"'02 Canonical Rules'!24:24","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c087facaa4e9898de849a5aa","recordKey":"MS-RULE-AU-06@e8c8f3b771054fbc","sourceRowId":"ROW-b56697c2ec7805af5540f165","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":25,"locator":"'02 Canonical Rules'!25:25","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-3c1e4bac2bc076733eda0e8c","recordKey":"TEST-MS-RULE-AU-06@750f23cda17c3c4b","sourceRowId":"ROW-b56697c2ec7805af5540f165","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":25,"locator":"'02 Canonical Rules'!25:25","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c777fa3d864e0326550aa3d7","recordKey":"MS-RULE-AU-07@989c3a6787fc6689","sourceRowId":"ROW-364d221b3a5228998310f120","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":26,"locator":"'02 Canonical Rules'!26:26","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-2653cd42de4dc053ad2ed064","recordKey":"TEST-MS-RULE-AU-07@5ffa142ce7218527","sourceRowId":"ROW-364d221b3a5228998310f120","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":26,"locator":"'02 Canonical Rules'!26:26","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-776faade10abb781b5f4dac1","recordKey":"MS-RULE-AU-08@4eda0a221f3ef380","sourceRowId":"ROW-fec0174b736b55532640435b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":27,"locator":"'02 Canonical Rules'!27:27","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f281ab33e1d937b08e9563d6","recordKey":"TEST-MS-RULE-AU-08@1572d78ad2ecacee","sourceRowId":"ROW-fec0174b736b55532640435b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":27,"locator":"'02 Canonical Rules'!27:27","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-3bc23eb9cbb77540d5904520","recordKey":"MS-RULE-IN-01@e4fe11be1a20f12f","sourceRowId":"ROW-4dd87527564e9856d0fcb5dd","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":28,"locator":"'02 Canonical Rules'!28:28","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5bd8b7980be5dc6cc95ff539","recordKey":"TEST-MS-RULE-IN-01@9d4be1fbcaec2bf2","sourceRowId":"ROW-4dd87527564e9856d0fcb5dd","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":28,"locator":"'02 Canonical Rules'!28:28","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-80d8b37f825e43304d982e49","recordKey":"MS-RULE-IN-02@dbb47a84e8a96c05","sourceRowId":"ROW-4a4a6b083fa3ff4f5c7bdf9f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":29,"locator":"'02 Canonical Rules'!29:29","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-024136857d2da9adaaad23b9","recordKey":"TEST-MS-RULE-IN-02@1d2838ae3e1a57ab","sourceRowId":"ROW-4a4a6b083fa3ff4f5c7bdf9f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":29,"locator":"'02 Canonical Rules'!29:29","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-2583933b26e69eab8811b329","recordKey":"MS-RULE-IN-03@900d1ac2806dab1c","sourceRowId":"ROW-408d5455ddad39fd36c19849","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":30,"locator":"'02 Canonical Rules'!30:30","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-65767bee5893c26c4568c044","recordKey":"TEST-MS-RULE-IN-03@900d1236d564a9d6","sourceRowId":"ROW-408d5455ddad39fd36c19849","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":30,"locator":"'02 Canonical Rules'!30:30","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-86d1643c9bdfb555c4cf36b9","recordKey":"MS-RULE-IN-04@40341d186f0bd606","sourceRowId":"ROW-edf61709c7018dad70a3844a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":31,"locator":"'02 Canonical Rules'!31:31","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-100678321b6068669b653142","recordKey":"TEST-MS-RULE-IN-04@2643ff56cf23a729","sourceRowId":"ROW-edf61709c7018dad70a3844a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":31,"locator":"'02 Canonical Rules'!31:31","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-2ed05732aad973cb91925c46","recordKey":"MS-RULE-IN-05@8dff43ab30881e3f","sourceRowId":"ROW-d40071125eb37673ebb7ec2e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":32,"locator":"'02 Canonical Rules'!32:32","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-402de04622b2ce1196227055","recordKey":"TEST-MS-RULE-IN-05@3c95bf3267fc393c","sourceRowId":"ROW-d40071125eb37673ebb7ec2e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":32,"locator":"'02 Canonical Rules'!32:32","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-2162238ddda67fbdacd382f0","recordKey":"MS-RULE-IN-06@478a04da335c1e7f","sourceRowId":"ROW-528f215a93143808dd5b2168","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":33,"locator":"'02 Canonical Rules'!33:33","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4a44bfd1bae12a85e497087f","recordKey":"TEST-MS-RULE-IN-06@858400572c4c71c1","sourceRowId":"ROW-528f215a93143808dd5b2168","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":33,"locator":"'02 Canonical Rules'!33:33","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d83dce284501250f8e1964f2","recordKey":"MS-RULE-IN-07@31e317962beaeb5b","sourceRowId":"ROW-29067f0ed5669951ea1e016a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":34,"locator":"'02 Canonical Rules'!34:34","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-0afc14ca5e32c6b79ee760e8","recordKey":"TEST-MS-RULE-IN-07@375f07965e1612f9","sourceRowId":"ROW-29067f0ed5669951ea1e016a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":34,"locator":"'02 Canonical Rules'!34:34","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c3e740a46333da54435671c0","recordKey":"MS-RULE-IN-08@94324ccfd3a491ef","sourceRowId":"ROW-c907aceb243a3fcf0f955b62","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":35,"locator":"'02 Canonical Rules'!35:35","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-398e10ace292700863a254e7","recordKey":"TEST-MS-RULE-IN-08@d7fc8b0e56e8838b","sourceRowId":"ROW-c907aceb243a3fcf0f955b62","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":35,"locator":"'02 Canonical Rules'!35:35","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f2ec9ec03fb27ca59b073bd0","recordKey":"MS-RULE-OU-01@d0805195b855c7dd","sourceRowId":"ROW-c0f83a9010fbd14f20f5bc97","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":36,"locator":"'02 Canonical Rules'!36:36","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5cd07b21826d663cfc554314","recordKey":"TEST-MS-RULE-OU-01@b9fd24d42e46a0aa","sourceRowId":"ROW-c0f83a9010fbd14f20f5bc97","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":36,"locator":"'02 Canonical Rules'!36:36","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4d1655b0f882dc1995869a0e","recordKey":"MS-RULE-OU-02@4965655028a3d485","sourceRowId":"ROW-72ac21a552dc30830c79d569","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":37,"locator":"'02 Canonical Rules'!37:37","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-1628098fff7a306b827eb959","recordKey":"TEST-MS-RULE-OU-02@82b9b07bac4d235a","sourceRowId":"ROW-72ac21a552dc30830c79d569","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":37,"locator":"'02 Canonical Rules'!37:37","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b808e55ee16cb7c253edfc4d","recordKey":"MS-RULE-OU-03@ce8e31e07eb4da96","sourceRowId":"ROW-601d81f57bf7202ab63cb0fa","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":38,"locator":"'02 Canonical Rules'!38:38","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-04dd12cb58e7faae97a02073","recordKey":"TEST-MS-RULE-OU-03@855aa6350f3b6faf","sourceRowId":"ROW-601d81f57bf7202ab63cb0fa","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":38,"locator":"'02 Canonical Rules'!38:38","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-1206d4912f9617004157eeb3","recordKey":"MS-RULE-OU-04@4f3b3444715b2744","sourceRowId":"ROW-a643234da24b287941f49293","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":39,"locator":"'02 Canonical Rules'!39:39","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-0ad4195cb4a13b9ce3049b1f","recordKey":"TEST-MS-RULE-OU-04@b8d5604c6e6cac3b","sourceRowId":"ROW-a643234da24b287941f49293","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":39,"locator":"'02 Canonical Rules'!39:39","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-fdb3a2c45e72b403181186dd","recordKey":"MS-RULE-OU-05@cb5aeaa742fb4521","sourceRowId":"ROW-df320a4529ea31fcf2ae9cbc","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":40,"locator":"'02 Canonical Rules'!40:40","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d5434e2332fe7830401f5ab3","recordKey":"TEST-MS-RULE-OU-05@790ba5609481741c","sourceRowId":"ROW-df320a4529ea31fcf2ae9cbc","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":40,"locator":"'02 Canonical Rules'!40:40","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-da2f85324370fadbb9d3dcba","recordKey":"MS-RULE-OU-06@ce0137df984ac601","sourceRowId":"ROW-5c81bd1c83021a272f2102c6","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":41,"locator":"'02 Canonical Rules'!41:41","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-9f9622851cfbaf891a3d1411","recordKey":"TEST-MS-RULE-OU-06@3389a94a06402212","sourceRowId":"ROW-5c81bd1c83021a272f2102c6","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":41,"locator":"'02 Canonical Rules'!41:41","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-cb29e589d73daca1b684cfbc","recordKey":"MS-RULE-OU-07@7d5bc203e83e95c9","sourceRowId":"ROW-caa2266229df109ed98efd66","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":42,"locator":"'02 Canonical Rules'!42:42","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c3490596bad9631f05db306d","recordKey":"TEST-MS-RULE-OU-07@c8b8661e517fb395","sourceRowId":"ROW-caa2266229df109ed98efd66","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":42,"locator":"'02 Canonical Rules'!42:42","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-7e863f636b765ea2ddd5766d","recordKey":"MS-RULE-OU-08@4c7bb6dc00dfcbfd","sourceRowId":"ROW-adb1d76f0b379c04faa70c43","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":43,"locator":"'02 Canonical Rules'!43:43","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4e8da0b8c3df35408b329aae","recordKey":"TEST-MS-RULE-OU-08@2da28a7f88e05c49","sourceRowId":"ROW-adb1d76f0b379c04faa70c43","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":43,"locator":"'02 Canonical Rules'!43:43","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-e15cedd0cc8537cbbfed6af3","recordKey":"MS-RULE-OU-09@2ffb1322457172b3","sourceRowId":"ROW-f64b0d859b2196619fb2c427","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":44,"locator":"'02 Canonical Rules'!44:44","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-88496262f718fa78026825b9","recordKey":"TEST-MS-RULE-OU-09@225611971feba396","sourceRowId":"ROW-f64b0d859b2196619fb2c427","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":44,"locator":"'02 Canonical Rules'!44:44","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-17dd3380d990d87d11b9512e","recordKey":"MS-RULE-OU-10@2332653b89bcd331","sourceRowId":"ROW-c6d05c26b16973a094cfd665","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":45,"locator":"'02 Canonical Rules'!45:45","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d72f8cfc633f0e2b86959d05","recordKey":"TEST-MS-RULE-OU-10@f6e5d3d4dc45e98f","sourceRowId":"ROW-c6d05c26b16973a094cfd665","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":45,"locator":"'02 Canonical Rules'!45:45","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f2bcc78cbca49e7d22c46b8c","recordKey":"MS-RULE-OU-11@0710643d8a955cf6","sourceRowId":"ROW-98218b6ac291f30664af9ad7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":46,"locator":"'02 Canonical Rules'!46:46","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-a3e5050c05cf1a28cf84de7e","recordKey":"TEST-MS-RULE-OU-11@786090aa4216d6dd","sourceRowId":"ROW-98218b6ac291f30664af9ad7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":46,"locator":"'02 Canonical Rules'!46:46","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-fb0b3ef0e57fc328a8cee830","recordKey":"MS-RULE-OU-12@295cdecda41b8b55","sourceRowId":"ROW-fc117ab8bb5f67c50e5963a2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":47,"locator":"'02 Canonical Rules'!47:47","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f76b1e8dee8cdadaa54e3ffa","recordKey":"TEST-MS-RULE-OU-12@249ad604ebb6fff7","sourceRowId":"ROW-fc117ab8bb5f67c50e5963a2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":47,"locator":"'02 Canonical Rules'!47:47","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-3aad9a955d1e9d4cc1232afa","recordKey":"MS-RULE-AG-01@e6aee1767c267990","sourceRowId":"ROW-114fa87f83e261fe3af77418","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":48,"locator":"'02 Canonical Rules'!48:48","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-95ed261d9bd33879cb746532","recordKey":"TEST-MS-RULE-AG-01@ff7a0e8e2da5d17b","sourceRowId":"ROW-114fa87f83e261fe3af77418","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":48,"locator":"'02 Canonical Rules'!48:48","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-137481d5df6a23ee6964f6bd","recordKey":"MS-RULE-AG-02@d4d178c0433fd6d4","sourceRowId":"ROW-984d6e85d569410134ef680a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":49,"locator":"'02 Canonical Rules'!49:49","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-0685916de734749f46c8e6b3","recordKey":"TEST-MS-RULE-AG-02@aade6035a0855241","sourceRowId":"ROW-984d6e85d569410134ef680a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":49,"locator":"'02 Canonical Rules'!49:49","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-da46ca12820ddce8b7876c30","recordKey":"MS-RULE-AG-03@20aa3c90fa880f0d","sourceRowId":"ROW-af0bdfd5e8ab37b795436268","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":50,"locator":"'02 Canonical Rules'!50:50","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-de82f3889480338544a63d35","recordKey":"TEST-MS-RULE-AG-03@015e6c738b015bd2","sourceRowId":"ROW-af0bdfd5e8ab37b795436268","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":50,"locator":"'02 Canonical Rules'!50:50","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-42579d0e90dfba52a17d884b","recordKey":"MS-RULE-AG-04@c7af717b1d68045e","sourceRowId":"ROW-6d3a2aa74b369264845b3b6c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":51,"locator":"'02 Canonical Rules'!51:51","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-885e5b3e6cabe56832719c83","recordKey":"TEST-MS-RULE-AG-04@098ca0df2ff02a79","sourceRowId":"ROW-6d3a2aa74b369264845b3b6c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":51,"locator":"'02 Canonical Rules'!51:51","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f3e43f874a4896250fe4f7d7","recordKey":"MS-RULE-AG-05@8829d873310f18f9","sourceRowId":"ROW-26718331d45614880357c7c0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":52,"locator":"'02 Canonical Rules'!52:52","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-2134807b71133618808473ee","recordKey":"TEST-MS-RULE-AG-05@8edc0dd979fb9441","sourceRowId":"ROW-26718331d45614880357c7c0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":52,"locator":"'02 Canonical Rules'!52:52","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-9a103fa5cc36a8e133c0e6e8","recordKey":"MS-RULE-AG-06@6371f819b40b0d97","sourceRowId":"ROW-bfd6445923d7861ee351edf5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":53,"locator":"'02 Canonical Rules'!53:53","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f3724530adf45ddf3ec8ff09","recordKey":"TEST-MS-RULE-AG-06@ee1eb5a987831137","sourceRowId":"ROW-bfd6445923d7861ee351edf5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":53,"locator":"'02 Canonical Rules'!53:53","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-59b881fe7c4e658a124fe331","recordKey":"MS-RULE-AG-07@c2fb36c556cb8a62","sourceRowId":"ROW-916fa5d8583e6e6f76ea0875","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":54,"locator":"'02 Canonical Rules'!54:54","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-714d9fe4cdd4d384a5c66e05","recordKey":"TEST-MS-RULE-AG-07@ba65d33eee3e267b","sourceRowId":"ROW-916fa5d8583e6e6f76ea0875","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":54,"locator":"'02 Canonical Rules'!54:54","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-627683d430717d603699de27","recordKey":"MS-RULE-AG-08@b98e349c6e27f319","sourceRowId":"ROW-a5219f55d99efc88d602ff84","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":55,"locator":"'02 Canonical Rules'!55:55","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4342439cee39b2c81a1ab5fd","recordKey":"TEST-MS-RULE-AG-08@416a45e0a0b25761","sourceRowId":"ROW-a5219f55d99efc88d602ff84","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":55,"locator":"'02 Canonical Rules'!55:55","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d47b248ca411846f0a72d915","recordKey":"MS-RULE-AG-09@2bd07e82a72d4f2e","sourceRowId":"ROW-eeed8d9a3aee4b5d21ac7040","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":56,"locator":"'02 Canonical Rules'!56:56","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-0f4372fb400fa225d76cc08c","recordKey":"TEST-MS-RULE-AG-09@77f7bead2ff59d1f","sourceRowId":"ROW-eeed8d9a3aee4b5d21ac7040","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":56,"locator":"'02 Canonical Rules'!56:56","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-24baf73a197011aa1502e590","recordKey":"MS-RULE-AG-10@41b899de0bf0744b","sourceRowId":"ROW-aa378e6ff029af789ef534db","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":57,"locator":"'02 Canonical Rules'!57:57","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-2de03ad95e346d2332ad892d","recordKey":"TEST-MS-RULE-AG-10@fcfc304af4142870","sourceRowId":"ROW-aa378e6ff029af789ef534db","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":57,"locator":"'02 Canonical Rules'!57:57","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-71cdb44524e8df7de8363c25","recordKey":"MS-RULE-OP-01@ce84968e8045ef9e","sourceRowId":"ROW-a6a6aa3e4c4ce966234e2827","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":58,"locator":"'02 Canonical Rules'!58:58","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-3bfd9be78b85d587817b5377","recordKey":"TEST-MS-RULE-OP-01@1650910477cab89a","sourceRowId":"ROW-a6a6aa3e4c4ce966234e2827","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":58,"locator":"'02 Canonical Rules'!58:58","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-bce9d785a41dac9f621c174e","recordKey":"MS-RULE-OP-02@7147e78f71e89fcb","sourceRowId":"ROW-26db238193790b5b1e5f97d0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":59,"locator":"'02 Canonical Rules'!59:59","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c962dc1cce1520528960c72f","recordKey":"TEST-MS-RULE-OP-02@e6bebdee13a2794f","sourceRowId":"ROW-26db238193790b5b1e5f97d0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":59,"locator":"'02 Canonical Rules'!59:59","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-3c38d16e31f0b3d4c23c7d9a","recordKey":"MS-RULE-OP-03@410599212edc432e","sourceRowId":"ROW-fb6fd067e095726afc92217e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":60,"locator":"'02 Canonical Rules'!60:60","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-59e99dadeb6df6518cc578b5","recordKey":"TEST-MS-RULE-OP-03@63af44dbe3b87025","sourceRowId":"ROW-fb6fd067e095726afc92217e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":60,"locator":"'02 Canonical Rules'!60:60","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-68eb3a48899fe964d0f592a6","recordKey":"MS-RULE-OP-04@63fbf478664e5e99","sourceRowId":"ROW-887beb4293962f2da36053d7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":61,"locator":"'02 Canonical Rules'!61:61","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-2bb1b973da390fa3c651973d","recordKey":"TEST-MS-RULE-OP-04@10af1b4283fbdf52","sourceRowId":"ROW-887beb4293962f2da36053d7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":61,"locator":"'02 Canonical Rules'!61:61","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-9b6327687cadd87aa1672f99","recordKey":"MS-RULE-OP-05@98df9a80a2151ad4","sourceRowId":"ROW-94795e42825f39a59c19bfe7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":62,"locator":"'02 Canonical Rules'!62:62","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-8c9c9fa438bed13abd4e820b","recordKey":"TEST-MS-RULE-OP-05@0d20359d25737fc8","sourceRowId":"ROW-94795e42825f39a59c19bfe7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":62,"locator":"'02 Canonical Rules'!62:62","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c0eee528636336fe62679938","recordKey":"MS-RULE-OP-06@6ecbeba4e14a59af","sourceRowId":"ROW-aef351b0e7592d09d76a96bb","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":63,"locator":"'02 Canonical Rules'!63:63","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-487716e80b8aa6ad1d84788d","recordKey":"TEST-MS-RULE-OP-06@a9f506c8bff242f1","sourceRowId":"ROW-aef351b0e7592d09d76a96bb","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":63,"locator":"'02 Canonical Rules'!63:63","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-7da709c8f2a049e9be382958","recordKey":"MS-RULE-OP-07@f1df2cbcb724af3b","sourceRowId":"ROW-62ef684284b6095dd22629e4","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":64,"locator":"'02 Canonical Rules'!64:64","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-fa4658e62289e3e2fb8c9f86","recordKey":"TEST-MS-RULE-OP-07@8efbac703c680b3b","sourceRowId":"ROW-62ef684284b6095dd22629e4","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":64,"locator":"'02 Canonical Rules'!64:64","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-8c80ca6127a997d9aafff018","recordKey":"MS-RULE-OP-08@a38dff87950aa40f","sourceRowId":"ROW-6f656ea168f1e4099daaf3ba","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":65,"locator":"'02 Canonical Rules'!65:65","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-3eb75bc4ee462fce5f394072","recordKey":"TEST-MS-RULE-OP-08@438a6f5faac23af7","sourceRowId":"ROW-6f656ea168f1e4099daaf3ba","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":65,"locator":"'02 Canonical Rules'!65:65","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-29b94b5d797b450200b69bb5","recordKey":"MS-RULE-OP-09@ec587343b8220a51","sourceRowId":"ROW-4c00f748af2c3330178d5750","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":66,"locator":"'02 Canonical Rules'!66:66","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-76de961ba0666079fcabece5","recordKey":"TEST-MS-RULE-OP-09@30152b169dd9d2ae","sourceRowId":"ROW-4c00f748af2c3330178d5750","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":66,"locator":"'02 Canonical Rules'!66:66","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-800d6b338038f79acf3e2b25","recordKey":"MS-RULE-OP-10@8c831bc5659a4340","sourceRowId":"ROW-13be3f757edac94e7691dd96","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":67,"locator":"'02 Canonical Rules'!67:67","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5c38b3cf80cf81366c6bdbe0","recordKey":"TEST-MS-RULE-OP-10@e71f274c4901fd3c","sourceRowId":"ROW-13be3f757edac94e7691dd96","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":67,"locator":"'02 Canonical Rules'!67:67","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-eeb30cb808e0059891f647cd","recordKey":"MS-RULE-OP-11@a024a5509524bfa2","sourceRowId":"ROW-51650ac5692827ed4fb7d477","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":68,"locator":"'02 Canonical Rules'!68:68","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-8b84abfd5c838ec62a504a40","recordKey":"TEST-MS-RULE-OP-11@431f6754fa078c78","sourceRowId":"ROW-51650ac5692827ed4fb7d477","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":68,"locator":"'02 Canonical Rules'!68:68","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5839688d93712b6fd67f87d3","recordKey":"MS-RULE-OP-12@04d0287d10225094","sourceRowId":"ROW-28f058104d978bcff289784f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":69,"locator":"'02 Canonical Rules'!69:69","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-cb695f7d0e37ed9cb017930d","recordKey":"TEST-MS-RULE-OP-12@e2e102960c613341","sourceRowId":"ROW-28f058104d978bcff289784f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":69,"locator":"'02 Canonical Rules'!69:69","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-ad1cbeb302cc66d5d5f8c398","recordKey":"MS-CAND-NEW-001@509512b407ba323f","sourceRowId":"ROW-4927af9e9ba235a9f87bdf07","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":70,"locator":"'02 Canonical Rules'!70:70","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-218a5d4018aedf3cfa7c0573","recordKey":"TEST-MS-CAND-NEW-001@804a65653da341a1","sourceRowId":"ROW-4927af9e9ba235a9f87bdf07","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":70,"locator":"'02 Canonical Rules'!70:70","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-9aec4ec3f736e76462958943","recordKey":"MS-CAND-NEW-002@dd7cd2c2185cb3be","sourceRowId":"ROW-6802e7fdb9c3138d3fd1f944","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":71,"locator":"'02 Canonical Rules'!71:71","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-29a73a827983bbddea9c099b","recordKey":"TEST-MS-CAND-NEW-002@1e1a8bf090f45c60","sourceRowId":"ROW-6802e7fdb9c3138d3fd1f944","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":71,"locator":"'02 Canonical Rules'!71:71","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c06eaec730a5a715914a6c39","recordKey":"MS-CAND-NEW-003@7f66b26f02e70247","sourceRowId":"ROW-32c6baa2a2a104782c80709a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":72,"locator":"'02 Canonical Rules'!72:72","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-558c6c9b9b46c5ba12c60d88","recordKey":"TEST-MS-CAND-NEW-003@15292f2c27f6596a","sourceRowId":"ROW-32c6baa2a2a104782c80709a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":72,"locator":"'02 Canonical Rules'!72:72","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-8387a082883ecc9e9cb95fb0","recordKey":"MS-CAND-NEW-004@1f7783b7dfd1c8f0","sourceRowId":"ROW-8f9acebbc97a90ebe8dadd32","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":73,"locator":"'02 Canonical Rules'!73:73","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4eba2af35b2099a81ac33936","recordKey":"TEST-MS-CAND-NEW-004@19fe77e27bca9c1c","sourceRowId":"ROW-8f9acebbc97a90ebe8dadd32","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":73,"locator":"'02 Canonical Rules'!73:73","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-97a9d11d0a3a6f84a04c1a59","recordKey":"MS-CAND-NEW-005@661eef265a01d387","sourceRowId":"ROW-7e38a82df6e3119991c9e2a0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":74,"locator":"'02 Canonical Rules'!74:74","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b4ccd0312d3b92cbb3d2598a","recordKey":"TEST-MS-CAND-NEW-005@e974d8db1b83b550","sourceRowId":"ROW-7e38a82df6e3119991c9e2a0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":74,"locator":"'02 Canonical Rules'!74:74","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b6523ca31018aa4bbc65f997","recordKey":"MS-CAND-NEW-006@2b402714e7447ef9","sourceRowId":"ROW-b88b717824a82181df259e8c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":75,"locator":"'02 Canonical Rules'!75:75","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d36093151e3c2f17f214f1f2","recordKey":"TEST-MS-CAND-NEW-006@72750517fb4e520d","sourceRowId":"ROW-b88b717824a82181df259e8c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":75,"locator":"'02 Canonical Rules'!75:75","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-7b3ad5683e4e2ac29e721674","recordKey":"MS-CAND-NEW-007@1968c0b4da07c794","sourceRowId":"ROW-7ceb0e2684d9fec2887acd91","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":76,"locator":"'02 Canonical Rules'!76:76","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-2aa783638ceb6e9697d9cd0f","recordKey":"TEST-MS-CAND-NEW-007@b41e0e7067dc1ddd","sourceRowId":"ROW-7ceb0e2684d9fec2887acd91","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":76,"locator":"'02 Canonical Rules'!76:76","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b20b7fa54c0a2b40cb172043","recordKey":"MS-CAND-NEW-008@7f5e7d46a2aad819","sourceRowId":"ROW-1ee0889551db573489cc8525","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":77,"locator":"'02 Canonical Rules'!77:77","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f78b2a486080f19a69c9c5db","recordKey":"TEST-MS-CAND-NEW-008@364d304064ef45b9","sourceRowId":"ROW-1ee0889551db573489cc8525","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":77,"locator":"'02 Canonical Rules'!77:77","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-48268839a0c80ca21f0bc12e","recordKey":"MS-CAND-NEW-009@dc38476b6ec92927","sourceRowId":"ROW-dce2243867b9bea58a15da9a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":78,"locator":"'02 Canonical Rules'!78:78","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-3e495d0beb6953b2e2a951bd","recordKey":"TEST-MS-CAND-NEW-009@f3a207e8803196d6","sourceRowId":"ROW-dce2243867b9bea58a15da9a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":78,"locator":"'02 Canonical Rules'!78:78","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-17d5028842a74311e6dc00a9","recordKey":"MS-CAND-NEW-010@1f0aa4ed22f3b974","sourceRowId":"ROW-4b22ee7af6d2b1f1511b2092","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":79,"locator":"'02 Canonical Rules'!79:79","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c5d267566b4235302bd7d5fa","recordKey":"TEST-MS-CAND-NEW-010@3f9b72fb8a921418","sourceRowId":"ROW-4b22ee7af6d2b1f1511b2092","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":79,"locator":"'02 Canonical Rules'!79:79","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-881d904ee3ba417d96858597","recordKey":"MS-CAND-NEW-011@eb8c525f119b2451","sourceRowId":"ROW-2178cc84871e6c12497d028f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":80,"locator":"'02 Canonical Rules'!80:80","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f628c70616c35d29b6dba8c6","recordKey":"TEST-MS-CAND-NEW-011@1c2c675ccd83852e","sourceRowId":"ROW-2178cc84871e6c12497d028f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":80,"locator":"'02 Canonical Rules'!80:80","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-57ad65180a22626a3eaa9431","recordKey":"MS-CAND-NEW-012@63aeb4ef30b9a5ea","sourceRowId":"ROW-dd9b37827023891ae2e79757","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":81,"locator":"'02 Canonical Rules'!81:81","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-e6390dab72fe54cbff2f4d98","recordKey":"TEST-MS-CAND-NEW-012@a30365012a144327","sourceRowId":"ROW-dd9b37827023891ae2e79757","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":81,"locator":"'02 Canonical Rules'!81:81","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5106008c8da59889460e1651","recordKey":"MS-CAND-NEW-013@4a78d015b8aed3b2","sourceRowId":"ROW-a927da2d294d32c338b649a8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":82,"locator":"'02 Canonical Rules'!82:82","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-cc27f916eb98ecf54a098122","recordKey":"TEST-MS-CAND-NEW-013@9d144cfdaf6e87da","sourceRowId":"ROW-a927da2d294d32c338b649a8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":82,"locator":"'02 Canonical Rules'!82:82","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4409cf8eee61695a72f127ca","recordKey":"MS-CAND-NEW-014@a900830f86017334","sourceRowId":"ROW-13ef5894969c1e5431b4dd0e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":83,"locator":"'02 Canonical Rules'!83:83","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c0c980c106aae7733013e075","recordKey":"TEST-MS-CAND-NEW-014@1c8be2505e698afb","sourceRowId":"ROW-13ef5894969c1e5431b4dd0e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":83,"locator":"'02 Canonical Rules'!83:83","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-567282762ae2405c12fd3a74","recordKey":"MS-CAND-NEW-015@059ceef5f7f28f3e","sourceRowId":"ROW-55228df98030ecf1a31795bb","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":84,"locator":"'02 Canonical Rules'!84:84","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-67c5361d41f12a9fee58a91c","recordKey":"TEST-MS-CAND-NEW-015@a90ef5c9d9e5aefd","sourceRowId":"ROW-55228df98030ecf1a31795bb","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":84,"locator":"'02 Canonical Rules'!84:84","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-1e002c9953243095c64deee8","recordKey":"MS-CAND-NEW-016@a111ada45bf38256","sourceRowId":"ROW-8df0d2c5d48ac75dcc951a83","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":85,"locator":"'02 Canonical Rules'!85:85","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-6d96af31fd23e97217198e95","recordKey":"TEST-MS-CAND-NEW-016@86d7253774c45b19","sourceRowId":"ROW-8df0d2c5d48ac75dcc951a83","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":85,"locator":"'02 Canonical Rules'!85:85","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d5465958071417893289b4c7","recordKey":"MS-CAND-NEW-017@b5e5161410a8d580","sourceRowId":"ROW-925515712f4d9d94af781757","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":86,"locator":"'02 Canonical Rules'!86:86","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-9ba35ef6cb8b23c0e36b8bd4","recordKey":"TEST-MS-CAND-NEW-017@49a4a317df2adc95","sourceRowId":"ROW-925515712f4d9d94af781757","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":86,"locator":"'02 Canonical Rules'!86:86","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-ba393d8c1503debb62845ae8","recordKey":"MS-CAND-NEW-018@54f9a4e37a671e7a","sourceRowId":"ROW-ad082f1caa1aa2189d341e1a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":87,"locator":"'02 Canonical Rules'!87:87","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-cf1e9554f7c2602872cc14d9","recordKey":"TEST-MS-CAND-NEW-018@9c76916f938d826d","sourceRowId":"ROW-ad082f1caa1aa2189d341e1a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":87,"locator":"'02 Canonical Rules'!87:87","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-64d2b472628c03d418ede8f3","recordKey":"MS-CAND-NEW-019@cfda8bff95bda54a","sourceRowId":"ROW-3439be719f2aafe6c4814ddd","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":88,"locator":"'02 Canonical Rules'!88:88","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d5bb388413da4f430e36cd56","recordKey":"TEST-MS-CAND-NEW-019@965e896a6f565c67","sourceRowId":"ROW-3439be719f2aafe6c4814ddd","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":88,"locator":"'02 Canonical Rules'!88:88","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-64e6b094a7da5b6f42608c48","recordKey":"MS-CAND-NEW-020@49217c323c1ec189","sourceRowId":"ROW-f4afe9eb2f3bde75c8f1f3ca","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":89,"locator":"'02 Canonical Rules'!89:89","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-99dba4efbb84b4429db9325b","recordKey":"TEST-MS-CAND-NEW-020@08557fa822272669","sourceRowId":"ROW-f4afe9eb2f3bde75c8f1f3ca","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":89,"locator":"'02 Canonical Rules'!89:89","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-785f2c89b01dcbefdbfc6b81","recordKey":"MS-CAND-NEW-021@acf75b35650aad9b","sourceRowId":"ROW-f1953fc215ffbe487001d28f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":90,"locator":"'02 Canonical Rules'!90:90","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-add0fc2ab77362c1b03a9050","recordKey":"TEST-MS-CAND-NEW-021@2139d82ae984b402","sourceRowId":"ROW-f1953fc215ffbe487001d28f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":90,"locator":"'02 Canonical Rules'!90:90","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f0bde5a70c780b270dbb4dd8","recordKey":"MS-CAND-NEW-022@2d639205a30919ff","sourceRowId":"ROW-8c746d001f4f8dfa3392995e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":91,"locator":"'02 Canonical Rules'!91:91","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c59cef9928d165ac9bb6fdd1","recordKey":"TEST-MS-CAND-NEW-022@e22552660f4975ec","sourceRowId":"ROW-8c746d001f4f8dfa3392995e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":91,"locator":"'02 Canonical Rules'!91:91","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-55c643f4af94143db9692687","recordKey":"MS-CAND-NEW-023@2359834ed0531f83","sourceRowId":"ROW-f1bef7b89783b4c4860e3161","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":92,"locator":"'02 Canonical Rules'!92:92","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-75bcaa50138a893658bf2791","recordKey":"TEST-MS-CAND-NEW-023@c6bff479056786a6","sourceRowId":"ROW-f1bef7b89783b4c4860e3161","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":92,"locator":"'02 Canonical Rules'!92:92","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c392887b2ee0451497ee67db","recordKey":"MS-CAND-NEW-024@bbb6556715869f07","sourceRowId":"ROW-ae3e67e750dd6a83a5603b26","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":93,"locator":"'02 Canonical Rules'!93:93","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5e7d28bdcce2c87d08ccae75","recordKey":"TEST-MS-CAND-NEW-024@189d78e606a4e11e","sourceRowId":"ROW-ae3e67e750dd6a83a5603b26","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":93,"locator":"'02 Canonical Rules'!93:93","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-bacb01071d86d5a6c5be1274","recordKey":"MS-CAND-NEW-025@b5f600cff2931a26","sourceRowId":"ROW-7d3a660def7a0066f321cdfd","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":94,"locator":"'02 Canonical Rules'!94:94","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4dfcba209850f0a0a272590d","recordKey":"TEST-MS-CAND-NEW-025@6aedf0b387e1b6ae","sourceRowId":"ROW-7d3a660def7a0066f321cdfd","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":94,"locator":"'02 Canonical Rules'!94:94","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-0edf7e8ce33c617746daaa84","recordKey":"MS-CAND-NEW-026@3215de61044934fd","sourceRowId":"ROW-d36c6d6799b3a8e021727fbc","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":95,"locator":"'02 Canonical Rules'!95:95","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-e27e639f2e4f3ddb720f069e","recordKey":"TEST-MS-CAND-NEW-026@f630aba0d5b51962","sourceRowId":"ROW-d36c6d6799b3a8e021727fbc","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":95,"locator":"'02 Canonical Rules'!95:95","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-49686d0879875913940759ce","recordKey":"MS-CAND-NEW-027@75eb3c7b5cd5ffbf","sourceRowId":"ROW-0c09346d7367350cbb7fd52f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":96,"locator":"'02 Canonical Rules'!96:96","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-fd6fdd3dbdf1697e0505c3ca","recordKey":"TEST-MS-CAND-NEW-027@85bf63184025e223","sourceRowId":"ROW-0c09346d7367350cbb7fd52f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":96,"locator":"'02 Canonical Rules'!96:96","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5f1efe44320d79b61594b7de","recordKey":"MS-CAND-NEW-028@0bc326f2a1492a55","sourceRowId":"ROW-27a6ee90d3033e587fa19858","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":97,"locator":"'02 Canonical Rules'!97:97","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-be80e2dd748f6bb5b70c063c","recordKey":"TEST-MS-CAND-NEW-028@fca8d670cec753de","sourceRowId":"ROW-27a6ee90d3033e587fa19858","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":97,"locator":"'02 Canonical Rules'!97:97","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d07d81fb6768f0df0e50029e","recordKey":"MS-CAND-NEW-029@e06b2e60826dc541","sourceRowId":"ROW-fac6da77f651313ff2722cc9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":98,"locator":"'02 Canonical Rules'!98:98","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-fe371d56b9e9a68a5bde24f0","recordKey":"TEST-MS-CAND-NEW-029@6790a64ee4469992","sourceRowId":"ROW-fac6da77f651313ff2722cc9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":98,"locator":"'02 Canonical Rules'!98:98","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c982663f69596ee63f446b91","recordKey":"MS-CAND-NEW-030@97f8b2f2a700caa5","sourceRowId":"ROW-9a1973e5536ac23208f2ab3d","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":99,"locator":"'02 Canonical Rules'!99:99","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-0530378d7cf2a05abb5649eb","recordKey":"TEST-MS-CAND-NEW-030@c6236291b5178b5f","sourceRowId":"ROW-9a1973e5536ac23208f2ab3d","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":99,"locator":"'02 Canonical Rules'!99:99","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-774189864801f1ac6bcb2a32","recordKey":"MS-CAND-NEW-031@898c23d1d41d6929","sourceRowId":"ROW-973ac1ee3ddf1f71e074952c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":100,"locator":"'02 Canonical Rules'!100:100","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c2d3cfc6ac52f536bf7cc235","recordKey":"TEST-MS-CAND-NEW-031@a4395ae59ad10eac","sourceRowId":"ROW-973ac1ee3ddf1f71e074952c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":100,"locator":"'02 Canonical Rules'!100:100","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b99ee05dc0a2e5f0405ecad5","recordKey":"MS-CAND-NEW-032@e78704005029c4c5","sourceRowId":"ROW-170f90e94ef6cfb2d4e51157","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":101,"locator":"'02 Canonical Rules'!101:101","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-8e76244d2087802066971189","recordKey":"TEST-MS-CAND-NEW-032@89fb7122d4286449","sourceRowId":"ROW-170f90e94ef6cfb2d4e51157","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":101,"locator":"'02 Canonical Rules'!101:101","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-520f5b085f1449ddce5e9b33","recordKey":"MS-CAND-NEW-033@09f4aaa7beb703f8","sourceRowId":"ROW-34eab42b34c557810841329c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":102,"locator":"'02 Canonical Rules'!102:102","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-e60896fceb005d7b748e78a2","recordKey":"TEST-MS-CAND-NEW-033@d55c959ad062ef90","sourceRowId":"ROW-34eab42b34c557810841329c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":102,"locator":"'02 Canonical Rules'!102:102","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-67482c9a4f8b942c61dfafb1","recordKey":"MS-CAND-NEW-034@fc985e372c91fbe4","sourceRowId":"ROW-4d340a13cfa3cd96d373b3e5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":103,"locator":"'02 Canonical Rules'!103:103","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-fc473a8ebe361e03634c1acf","recordKey":"TEST-MS-CAND-NEW-034@2331eead6f0d4634","sourceRowId":"ROW-4d340a13cfa3cd96d373b3e5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":103,"locator":"'02 Canonical Rules'!103:103","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-952d6d0d01c7ce8993b5a8f3","recordKey":"MS-CAND-NEW-035@30e918c1ae393723","sourceRowId":"ROW-8e8f13f79ecc8bdf3bee6c27","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":104,"locator":"'02 Canonical Rules'!104:104","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-0a69d2a29b8d0bd6130943c1","recordKey":"TEST-MS-CAND-NEW-035@952f457c85878554","sourceRowId":"ROW-8e8f13f79ecc8bdf3bee6c27","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":104,"locator":"'02 Canonical Rules'!104:104","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-7373e3d04ee30e4d90a122b3","recordKey":"MS-CAND-NEW-036@a37923d38786c3fa","sourceRowId":"ROW-84b398e1f7f746f4fb163e7c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":105,"locator":"'02 Canonical Rules'!105:105","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-2bdfec26ce9e1957aae079e1","recordKey":"TEST-MS-CAND-NEW-036@af3dd73187f85813","sourceRowId":"ROW-84b398e1f7f746f4fb163e7c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":105,"locator":"'02 Canonical Rules'!105:105","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-1df9af0b1f8cd3130554cc12","recordKey":"MS-CAND-NEW-037@bf9ef6fc19602a76","sourceRowId":"ROW-1a5cd35305d322d57744a814","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":106,"locator":"'02 Canonical Rules'!106:106","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-9c338e20f9f712473f39c46e","recordKey":"TEST-MS-CAND-NEW-037@c794591109a14605","sourceRowId":"ROW-1a5cd35305d322d57744a814","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":106,"locator":"'02 Canonical Rules'!106:106","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5c11c9b9215f86c9746e3f40","recordKey":"MS-CAND-NEW-038@4decd1c8f441e4ba","sourceRowId":"ROW-8a28f59ae3f4c519d6b957b2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":107,"locator":"'02 Canonical Rules'!107:107","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-a3daa22db24b7b2ea4f4b755","recordKey":"TEST-MS-CAND-NEW-038@167338df2823c65a","sourceRowId":"ROW-8a28f59ae3f4c519d6b957b2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":107,"locator":"'02 Canonical Rules'!107:107","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-98e4b8c26c49d5d6a5f2b48d","recordKey":"MS-CAND-NEW-039@7695f412051bd33a","sourceRowId":"ROW-9f813ccbb388004e2f00b75c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":108,"locator":"'02 Canonical Rules'!108:108","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-fd0b8c684c7903810c49abdc","recordKey":"TEST-MS-CAND-NEW-039@bf7a2a553284be9c","sourceRowId":"ROW-9f813ccbb388004e2f00b75c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":108,"locator":"'02 Canonical Rules'!108:108","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f96eb29ece508d956fcf2a59","recordKey":"MS-CAND-NEW-040@b23f7245c8e57ed5","sourceRowId":"ROW-46a27197e07943dd4b12085f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":109,"locator":"'02 Canonical Rules'!109:109","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-ad2a133ce0fcecedb1e340e6","recordKey":"TEST-MS-CAND-NEW-040@4c5da53332591171","sourceRowId":"ROW-46a27197e07943dd4b12085f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":109,"locator":"'02 Canonical Rules'!109:109","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-9a58d23a44033e01025a8142","recordKey":"MS-CAND-NEW-041@5627d6c42d034b72","sourceRowId":"ROW-c7b6826d4a6f55026b9d97ba","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":110,"locator":"'02 Canonical Rules'!110:110","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4d9e97a10e7d1c4a95752ff8","recordKey":"TEST-MS-CAND-NEW-041@80a0db6f8533204b","sourceRowId":"ROW-c7b6826d4a6f55026b9d97ba","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":110,"locator":"'02 Canonical Rules'!110:110","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-e4575a97f5ce86190f554481","recordKey":"MS-CAND-NEW-042@09aa4b4698159abd","sourceRowId":"ROW-aa26960a5b505ead097d925d","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":111,"locator":"'02 Canonical Rules'!111:111","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-8557c4e56f3691c1a3baf61e","recordKey":"TEST-MS-CAND-NEW-042@e0b7f2003d7a973c","sourceRowId":"ROW-aa26960a5b505ead097d925d","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":111,"locator":"'02 Canonical Rules'!111:111","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-70a773888cf1251d17ab0cfe","recordKey":"MS-CAND-NEW-043@9bdbd1939cb002c5","sourceRowId":"ROW-2804a8f9846c69b2c552b554","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":112,"locator":"'02 Canonical Rules'!112:112","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d47649b594840cadd21e9ce5","recordKey":"TEST-MS-CAND-NEW-043@9b9f887cc11f3619","sourceRowId":"ROW-2804a8f9846c69b2c552b554","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":112,"locator":"'02 Canonical Rules'!112:112","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4b16ec3f68e06c2ec66aa3d7","recordKey":"MS-CAND-NEW-044@18c14a883f78168e","sourceRowId":"ROW-a966d3d7c804cc29c95da065","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":113,"locator":"'02 Canonical Rules'!113:113","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-8aec72cff473c3bcb4952a94","recordKey":"TEST-MS-CAND-NEW-044@b1e6c1c829ef67a3","sourceRowId":"ROW-a966d3d7c804cc29c95da065","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":113,"locator":"'02 Canonical Rules'!113:113","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-178b6bfc4b2efe6dd6e08522","recordKey":"MS-CAND-NEW-045@1acab126fb11a883","sourceRowId":"ROW-088751a8c0693da0200ec304","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":114,"locator":"'02 Canonical Rules'!114:114","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-ea0b324103e674f3e49537ef","recordKey":"TEST-MS-CAND-NEW-045@916238499cd18c33","sourceRowId":"ROW-088751a8c0693da0200ec304","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":114,"locator":"'02 Canonical Rules'!114:114","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-999ef79c25b24c1885a77eec","recordKey":"MS-CAND-NEW-046@8cbd72430eb7e76f","sourceRowId":"ROW-d1edc2769af8dfbd7603632e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":115,"locator":"'02 Canonical Rules'!115:115","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5a2a9c7b6054ce22328e6a77","recordKey":"TEST-MS-CAND-NEW-046@c169b927af8610cd","sourceRowId":"ROW-d1edc2769af8dfbd7603632e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":115,"locator":"'02 Canonical Rules'!115:115","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-56267865b1856253aec7c403","recordKey":"MS-CAND-NEW-047@f2cca3acb9056674","sourceRowId":"ROW-689eaed74ffb5baa7440d40b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":116,"locator":"'02 Canonical Rules'!116:116","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-6defb978ab743e7d878841c9","recordKey":"TEST-MS-CAND-NEW-047@7e5462afb0d8be67","sourceRowId":"ROW-689eaed74ffb5baa7440d40b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":116,"locator":"'02 Canonical Rules'!116:116","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-ce247661bdfb7dee41d0f56c","recordKey":"MS-CAND-NEW-048@469fd8f52e815ef3","sourceRowId":"ROW-4516039846daa897459958d9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":117,"locator":"'02 Canonical Rules'!117:117","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-82ffb2c8128d7585dade8b2d","recordKey":"TEST-MS-CAND-NEW-048@96bcf18d596c5657","sourceRowId":"ROW-4516039846daa897459958d9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":117,"locator":"'02 Canonical Rules'!117:117","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-e5f8bf3bd9e840138a5031bb","recordKey":"MS-CAND-NEW-049@414ff7309da7ef76","sourceRowId":"ROW-1ca70911864178da83b6d0b0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":118,"locator":"'02 Canonical Rules'!118:118","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f38073eb092d2c8368acae22","recordKey":"TEST-MS-CAND-NEW-049@a0b16de2de28f853","sourceRowId":"ROW-1ca70911864178da83b6d0b0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":118,"locator":"'02 Canonical Rules'!118:118","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c7de6086f94be7bfcd5e6c93","recordKey":"MS-CAND-NEW-050@e471430a56ad2ef1","sourceRowId":"ROW-39d48e35f200c47dcbeb3e73","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":119,"locator":"'02 Canonical Rules'!119:119","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-ea239bdf7fa59f04ea535541","recordKey":"TEST-MS-CAND-NEW-050@af4c9fda0a0406dc","sourceRowId":"ROW-39d48e35f200c47dcbeb3e73","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":119,"locator":"'02 Canonical Rules'!119:119","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-43ea6cbae990b9111dbd4ccb","recordKey":"MS-CAND-NEW-051@de412e97cc5acfc0","sourceRowId":"ROW-3847ac61ea7843c8c07be69f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":120,"locator":"'02 Canonical Rules'!120:120","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-a31e5089c7f76fffd562d2b6","recordKey":"TEST-MS-CAND-NEW-051@fa85799f46f53cbb","sourceRowId":"ROW-3847ac61ea7843c8c07be69f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":120,"locator":"'02 Canonical Rules'!120:120","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-7f9698b207a5e372516d3a6b","recordKey":"MS-CAND-NEW-052@3ff507cc0cd5b18d","sourceRowId":"ROW-4b3b95082b01639387c014d0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":121,"locator":"'02 Canonical Rules'!121:121","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-eeaaed593889f7d9a8da12ab","recordKey":"TEST-MS-CAND-NEW-052@d1a0e602f237267c","sourceRowId":"ROW-4b3b95082b01639387c014d0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":121,"locator":"'02 Canonical Rules'!121:121","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-436d92ce5c93403819fc5987","recordKey":"MS-CAND-NEW-053@d278701e70ca567c","sourceRowId":"ROW-3b49e4de129f672711ac76c4","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":122,"locator":"'02 Canonical Rules'!122:122","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-12e05ad89f405819468ef5fd","recordKey":"TEST-MS-CAND-NEW-053@8fea3e8f53f0d622","sourceRowId":"ROW-3b49e4de129f672711ac76c4","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":122,"locator":"'02 Canonical Rules'!122:122","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-463f711403e2fa2a455b699b","recordKey":"MS-CAND-NEW-054@5ae3dd8f9a5e0458","sourceRowId":"ROW-492d342002b1a654fd60aeb0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":123,"locator":"'02 Canonical Rules'!123:123","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-33505f70f238d47ab6f3dcf2","recordKey":"TEST-MS-CAND-NEW-054@20d7816ab8c8718b","sourceRowId":"ROW-492d342002b1a654fd60aeb0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":123,"locator":"'02 Canonical Rules'!123:123","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-00ea9f1d94a3b1adf4e19ce5","recordKey":"MS-CAND-NEW-055@fc1ce4188d8e37fb","sourceRowId":"ROW-d4fd216b5ab043e0e74a32e0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":124,"locator":"'02 Canonical Rules'!124:124","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-93279ef9bc8e7183d329bad1","recordKey":"TEST-MS-CAND-NEW-055@a96d2c3c2df24027","sourceRowId":"ROW-d4fd216b5ab043e0e74a32e0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":124,"locator":"'02 Canonical Rules'!124:124","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d9684f7de0f2454f08404ee4","recordKey":"MS-CAND-NEW-056@d3cbeb5b80268736","sourceRowId":"ROW-f227e834f5bda200e578d39b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":125,"locator":"'02 Canonical Rules'!125:125","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5fd7ae5d9e3ef99054cca2df","recordKey":"TEST-MS-CAND-NEW-056@8ddf472ae09f562c","sourceRowId":"ROW-f227e834f5bda200e578d39b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":125,"locator":"'02 Canonical Rules'!125:125","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-8e0b0850f6c5a653799806d9","recordKey":"MS-CAND-NEW-057@bb3ae2030b306c3a","sourceRowId":"ROW-dc25d7d0c42bd239584ead22","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":126,"locator":"'02 Canonical Rules'!126:126","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d551e6d189a67d06ac7ecc25","recordKey":"TEST-MS-CAND-NEW-057@63f85219baa3f681","sourceRowId":"ROW-dc25d7d0c42bd239584ead22","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":126,"locator":"'02 Canonical Rules'!126:126","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-875453209f46150e20be4d24","recordKey":"MS-CAND-NEW-058@c89dff651b4042aa","sourceRowId":"ROW-8138891de2a5222f47e4dfea","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":127,"locator":"'02 Canonical Rules'!127:127","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-052230d6a45d55c5521ed09e","recordKey":"TEST-MS-CAND-NEW-058@cea3ae2f413ff42b","sourceRowId":"ROW-8138891de2a5222f47e4dfea","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":127,"locator":"'02 Canonical Rules'!127:127","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d79eb2cb58eda36efa86297d","recordKey":"MS-CAND-NEW-059@ebad9ea249c278c2","sourceRowId":"ROW-f37c5ee8e184cc9634ee7722","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":128,"locator":"'02 Canonical Rules'!128:128","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b60e5513bdd836c0d3206830","recordKey":"TEST-MS-CAND-NEW-059@58f97f007a51acdf","sourceRowId":"ROW-f37c5ee8e184cc9634ee7722","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":128,"locator":"'02 Canonical Rules'!128:128","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-cfa65c31db7822277f12f1e8","recordKey":"MS-CAND-NEW-060@64c6f48b85080ba2","sourceRowId":"ROW-c9a9bff521d9fbd8b30951f5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":129,"locator":"'02 Canonical Rules'!129:129","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-2f9ce9197122a8b975aba321","recordKey":"TEST-MS-CAND-NEW-060@fd77edf53681010f","sourceRowId":"ROW-c9a9bff521d9fbd8b30951f5","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":129,"locator":"'02 Canonical Rules'!129:129","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-dea7b4da8e53832a839e21b1","recordKey":"MS-CAND-NEW-061@f9099cd979d61a91","sourceRowId":"ROW-9cd1bf02eb7d4c28dcb500f2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":130,"locator":"'02 Canonical Rules'!130:130","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-bd3080387dcfabd31703a1fe","recordKey":"TEST-MS-CAND-NEW-061@513d44197caf5c9c","sourceRowId":"ROW-9cd1bf02eb7d4c28dcb500f2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":130,"locator":"'02 Canonical Rules'!130:130","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-a328f8a3dd52666ea6649486","recordKey":"MS-CAND-NEW-062@df513b7c6e9ed060","sourceRowId":"ROW-6913ea14b3088bee51b09bff","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":131,"locator":"'02 Canonical Rules'!131:131","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-fb539663489875d6645e55a3","recordKey":"TEST-MS-CAND-NEW-062@0815bde8a002cc6d","sourceRowId":"ROW-6913ea14b3088bee51b09bff","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":131,"locator":"'02 Canonical Rules'!131:131","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-e5f1e1a2eb989ab1bc56b6ca","recordKey":"MS-CAND-NEW-063@4bd59069df557c8c","sourceRowId":"ROW-391f5e88f75b7fca72134ab6","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":132,"locator":"'02 Canonical Rules'!132:132","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-45ffee35c1a29ad9ad60c46d","recordKey":"TEST-MS-CAND-NEW-063@afa775da340c4b6c","sourceRowId":"ROW-391f5e88f75b7fca72134ab6","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":132,"locator":"'02 Canonical Rules'!132:132","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-1bec01346bf226e9fdc38222","recordKey":"MS-CAND-NEW-064@5dfca2afdff3ee98","sourceRowId":"ROW-ce35c3eedd29a960d4f6ebf4","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":133,"locator":"'02 Canonical Rules'!133:133","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-ccb2d62057a2c92438071b10","recordKey":"TEST-MS-CAND-NEW-064@d35bf350d32e740f","sourceRowId":"ROW-ce35c3eedd29a960d4f6ebf4","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":133,"locator":"'02 Canonical Rules'!133:133","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-93f77bd7fa5cc7bb6791e9eb","recordKey":"MS-CAND-NEW-065@96266b06cc2a95a8","sourceRowId":"ROW-28a7e3064d3eecabecb6a2a8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":134,"locator":"'02 Canonical Rules'!134:134","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-738a846b292299cc1b7c9014","recordKey":"TEST-MS-CAND-NEW-065@4135b82cdb079436","sourceRowId":"ROW-28a7e3064d3eecabecb6a2a8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":134,"locator":"'02 Canonical Rules'!134:134","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-cea2821ce429f1343e59c3e9","recordKey":"MS-CAND-NEW-066@79bc2d38ab7a3aa6","sourceRowId":"ROW-53e266dd8f7e694c53b3b15d","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":135,"locator":"'02 Canonical Rules'!135:135","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b408dc18ef7f13265cb7714d","recordKey":"TEST-MS-CAND-NEW-066@81ef71b269fba13a","sourceRowId":"ROW-53e266dd8f7e694c53b3b15d","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":135,"locator":"'02 Canonical Rules'!135:135","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-fbb84a2236320832666d7cdb","recordKey":"MS-CAND-NEW-067@71285db4258481c7","sourceRowId":"ROW-244800d54cc634d808a75249","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":136,"locator":"'02 Canonical Rules'!136:136","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-ac8ea1d865e41d14b76952e2","recordKey":"TEST-MS-CAND-NEW-067@e0ae37811c974daa","sourceRowId":"ROW-244800d54cc634d808a75249","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":136,"locator":"'02 Canonical Rules'!136:136","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c7b1528e3ad5b5aafe88b275","recordKey":"MS-CAND-NEW-068@4403f2bfe20d8ecc","sourceRowId":"ROW-77993780fb9c2b5c83f420ff","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":137,"locator":"'02 Canonical Rules'!137:137","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-1cfc05ff127c1be759075796","recordKey":"TEST-MS-CAND-NEW-068@d2a97ded15050acb","sourceRowId":"ROW-77993780fb9c2b5c83f420ff","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":137,"locator":"'02 Canonical Rules'!137:137","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-3081dab2883ef0be3b95bcfd","recordKey":"MS-CAND-NEW-069@f233806372e80118","sourceRowId":"ROW-1bc27f562216e2988fd2aa57","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":138,"locator":"'02 Canonical Rules'!138:138","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4967aabf2128245535867849","recordKey":"TEST-MS-CAND-NEW-069@4686d51801f6dff5","sourceRowId":"ROW-1bc27f562216e2988fd2aa57","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"02 Canonical Rules","row":138,"locator":"'02 Canonical Rules'!138:138","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-59065b6cc7369157f064eb97","recordKey":"FW-NIST-AI-RMF@aba341d53497210b","sourceRowId":"ROW-49914a1a30cc35761326577f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":2,"locator":"'03 Framework Catalog'!2:2","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-632e4f43cd96839709c8af0e","recordKey":"FW-NIST-AI-600-1@91e5bc3b14f2a84b","sourceRowId":"ROW-c1b210cedf7dfb1728d14938","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":3,"locator":"'03 Framework Catalog'!3:3","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-40825bc4779fcab435387b0e","recordKey":"FW-NIST-CSF2@e2682aacee87a7d8","sourceRowId":"ROW-9018d7e515c2f1822faf60aa","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":4,"locator":"'03 Framework Catalog'!4:4","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b445450d8da676059cab379e","recordKey":"FW-NIST-800-53@df620e4e08f309b9","sourceRowId":"ROW-68317dea1c9e9e7354699b2c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":5,"locator":"'03 Framework Catalog'!5:5","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-ca7baa7d82f38653c5372741","recordKey":"FW-FEDRAMP@0431d549dd6dc7e6","sourceRowId":"ROW-66672dfe819611200a31af6c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":6,"locator":"'03 Framework Catalog'!6:6","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-64f6628472f33fabd3106eb7","recordKey":"FW-ISO-42001@6d004f01fd1dd6f5","sourceRowId":"ROW-45a24e599b202518d9f34128","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":7,"locator":"'03 Framework Catalog'!7:7","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-102cae10b22fee848ece6889","recordKey":"FW-ISO-42005@b02139bf544ce4bf","sourceRowId":"ROW-12fdb9ee95ac7581ebbf5aaa","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":8,"locator":"'03 Framework Catalog'!8:8","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5513b9b970a88c46b96feae1","recordKey":"FW-ISO-23894@b87e8d19fc73b809","sourceRowId":"ROW-e522e4b9072ec351c6018c26","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":9,"locator":"'03 Framework Catalog'!9:9","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-e842545581e55f51c3a7c03d","recordKey":"FW-ISO-38507@3a21d46272e4d98f","sourceRowId":"ROW-f77b9f7a2133acadb28dc942","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":10,"locator":"'03 Framework Catalog'!10:10","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-1bf9f69936a81fd6340301e3","recordKey":"FW-ISO-5338@5384b7599ab287e8","sourceRowId":"ROW-74e89b264cd0d3639e83b96b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":11,"locator":"'03 Framework Catalog'!11:11","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-e8325a3c3a952a04ed33b907","recordKey":"FW-ISO-24028@3d472e5cbcce5b94","sourceRowId":"ROW-bb31171011f15249eb85b6e8","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":12,"locator":"'03 Framework Catalog'!12:12","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-78db259a8528920bec321275","recordKey":"FW-EU-AI-ACT@46561a486a4c008b","sourceRowId":"ROW-7ed3a0189d5718dbc2c950d9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":13,"locator":"'03 Framework Catalog'!13:13","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-e84aa4681e0b2f47cec17b56","recordKey":"FW-GDPR@ee1443d6c0919bfd","sourceRowId":"ROW-1a41218581da4ee2a18f3eee","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":14,"locator":"'03 Framework Catalog'!14:14","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5e6e65257890fb90b5551f14","recordKey":"FW-HIPAA@024563eb5b7c33a6","sourceRowId":"ROW-5e9c9d169c886924b58a55f1","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":15,"locator":"'03 Framework Catalog'!15:15","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-cd461729e7501d8c8ddc0ad3","recordKey":"FW-PCI-DSS@26b432290466d636","sourceRowId":"ROW-a93440b888063623943801d4","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":16,"locator":"'03 Framework Catalog'!16:16","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-61782a085a69e8c73e667e08","recordKey":"FW-SOC2@db7c79c2dbfb20ed","sourceRowId":"ROW-b55e1d93b1faa7a915928601","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":17,"locator":"'03 Framework Catalog'!17:17","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-ea71091981d9dd104da1b478","recordKey":"FW-GLBA@ce5eb5a36e567a3b","sourceRowId":"ROW-14c265f5d709b0bf9fa6c9af","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":18,"locator":"'03 Framework Catalog'!18:18","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c51acb773479596313485657","recordKey":"FW-FERPA@adba7da3b8b49ee6","sourceRowId":"ROW-1889a3af254f28761a9423fb","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":19,"locator":"'03 Framework Catalog'!19:19","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-94aafa3c2b2343101e55062f","recordKey":"FW-CCPA-CPRA@2726437e0cff599a","sourceRowId":"ROW-7e5f9ff79cd5a26ca5c56a30","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":20,"locator":"'03 Framework Catalog'!20:20","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-dd3a5380b6d62fde983d65a5","recordKey":"FW-CO-AI@dc656cacb5cb1e38","sourceRowId":"ROW-79f457400b49280d9f8e1043","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":21,"locator":"'03 Framework Catalog'!21:21","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-456e80232e60168ae8ec8ccd","recordKey":"FW-TX-TRAIGA@9b71af35f63ed5f3","sourceRowId":"ROW-f8c9614ddce80a9270ae7bd7","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":22,"locator":"'03 Framework Catalog'!22:22","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-cdd14747e36c2730b8611a3d","recordKey":"FW-OMB-M25-21@02c619879520c6e4","sourceRowId":"ROW-13f60aee9b891ed0fa920671","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":23,"locator":"'03 Framework Catalog'!23:23","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-1de208eff3e4fa25e9209de4","recordKey":"FW-OMB-M25-22@1dd0effe69b2dd83","sourceRowId":"ROW-9889e80711643a9e010639d9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":24,"locator":"'03 Framework Catalog'!24:24","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-97398a4fc04ebd9dab5adad0","recordKey":"FW-OWASP-LLM-2026@44fda67005e1638f","sourceRowId":"ROW-70c761f1fca1627b685cb5c2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":25,"locator":"'03 Framework Catalog'!25:25","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-476d5289aeaa973cccc7db58","recordKey":"FW-SOX@6b53f8d76c60deb9","sourceRowId":"ROW-698d977448eda3fa0d5899ac","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"03 Framework Catalog","row":26,"locator":"'03 Framework Catalog'!26:26","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-70f9c69fec987bbef69cba1c","recordKey":"MS-POL-POL-01@49c4c01e6c0532bb","sourceRowId":"ROW-6491eca3788e1a02d64f761b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":2,"locator":"'04 Internal Policies'!2:2","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-6dc4e4653bae9ab1cb30f361","recordKey":"MS-POL-POL-02@aa0847ee55585424","sourceRowId":"ROW-5b1bda2cc3542b5c905ad4d1","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":3,"locator":"'04 Internal Policies'!3:3","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-94af1dfe6d908aa27307ba55","recordKey":"MS-POL-POL-03@11c99e7398913f0f","sourceRowId":"ROW-1affd5855db1d50f805ce49f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":4,"locator":"'04 Internal Policies'!4:4","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-0e5f2766537f3442e1367401","recordKey":"MS-POL-POL-04@44f05efa6918df27","sourceRowId":"ROW-aa65f416409061dc11377921","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":5,"locator":"'04 Internal Policies'!5:5","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5ee14759183502bc2149d789","recordKey":"MS-POL-POL-05@9c8c386d8437959c","sourceRowId":"ROW-8a92c8d4cac24824396ba285","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":6,"locator":"'04 Internal Policies'!6:6","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b07395de1378eccc890a2909","recordKey":"MS-POL-POL-06@8603eff3ea33a61f","sourceRowId":"ROW-129fbd0997f2bbdc126537c0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":7,"locator":"'04 Internal Policies'!7:7","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-370512288ea43a569caf82d0","recordKey":"MS-POL-POL-07@a1b6f11dcbba27b5","sourceRowId":"ROW-e1b586bc597848f2689c98f9","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":8,"locator":"'04 Internal Policies'!8:8","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-03a4745686f3682143f75c75","recordKey":"MS-POL-POL-08@ee4729bdeed9ad16","sourceRowId":"ROW-008410384990db1fe08b3023","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":9,"locator":"'04 Internal Policies'!9:9","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-1e3f8a3473e53802f444fd3e","recordKey":"MS-POL-POL-09@30cd5cb249f58ae2","sourceRowId":"ROW-b6a71b0de2f50d78b21fec0b","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":10,"locator":"'04 Internal Policies'!10:10","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-df489d4609fecc8bbd5e441c","recordKey":"MS-POL-POL-10@cce53ffd6ac04512","sourceRowId":"ROW-c821d31cff2c956332d4f6ed","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":11,"locator":"'04 Internal Policies'!11:11","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-5049738c8fda0951bf32581a","recordKey":"MS-POL-POL-11@4cbd6ed56751cc97","sourceRowId":"ROW-dc6aae022c0dda931f92bee2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":12,"locator":"'04 Internal Policies'!12:12","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-43a61960fc9f6a8891bbf6b1","recordKey":"MS-POL-POL-12@2bcf920fc5a05e6b","sourceRowId":"ROW-4433a7fd429009fcb4e64045","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":13,"locator":"'04 Internal Policies'!13:13","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-b7be45af219f2764c73cac96","recordKey":"MS-POL-POL-13@e8a7e91b791104ce","sourceRowId":"ROW-9a8eab0cdb305798c72f74df","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":14,"locator":"'04 Internal Policies'!14:14","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-3dd22fbb7167374439879f34","recordKey":"MS-POL-POL-14@aa241dc1520b8ab5","sourceRowId":"ROW-6da427ab8ef28a8b5efa80e0","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":15,"locator":"'04 Internal Policies'!15:15","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-8e6e7f4102a5bd94ad48298b","recordKey":"MS-POL-POL-15@66ce06439b6303c8","sourceRowId":"ROW-2e70a9e514569b8a44427c28","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":16,"locator":"'04 Internal Policies'!16:16","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-6ecc72132254897764ad0f09","recordKey":"MS-POL-POL-16@e96f7674899ecd20","sourceRowId":"ROW-4b13a6dba181d0e74da964eb","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":17,"locator":"'04 Internal Policies'!17:17","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f03463e200d0aa60c7f40c39","recordKey":"MS-POL-POL-17@fbd2f1193b92724a","sourceRowId":"ROW-33bfebb7d3c61d478df97677","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":18,"locator":"'04 Internal Policies'!18:18","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f9b26ce7be97e28073291a3b","recordKey":"MS-POL-POL-18@97f5690fa7f7084e","sourceRowId":"ROW-8cad1d1eb5ca428342ab260e","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":19,"locator":"'04 Internal Policies'!19:19","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-0695d0235690cc346e1eab43","recordKey":"MS-POL-POL-19@d6f23b7346439395","sourceRowId":"ROW-7cc4365a2762412fcdeb3337","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":20,"locator":"'04 Internal Policies'!20:20","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-371fe7c926a9dd1da0c3bd00","recordKey":"MS-POL-POL-20@ea163decd6c07a16","sourceRowId":"ROW-7c1fd550d17c7e0b2a67f2dd","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":21,"locator":"'04 Internal Policies'!21:21","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d164b879a51f522796afa640","recordKey":"MS-POL-POL-21@9a99a10275e80192","sourceRowId":"ROW-65a8e3a5fef53f86846dbf1f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":22,"locator":"'04 Internal Policies'!22:22","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d9759b07a1d851b7cc925da9","recordKey":"MS-POL-POL-22@7864cb607001d95d","sourceRowId":"ROW-f37141b7245460bc587481fe","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":23,"locator":"'04 Internal Policies'!23:23","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-1c4cb4ac70ef5d87e2b115d9","recordKey":"MS-PROPOSED-POL-931e90fdca61e0e8@1d9be900f9903f26","sourceRowId":"ROW-576de7c130ae3131625f07ab","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":26,"locator":"'04 Internal Policies'!26:26","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d572b83a79b48a96205f1706","recordKey":"MS-PROPOSED-POL-2f6d2f60b014f568@6e778aebe316cf9f","sourceRowId":"ROW-2be506fc7bfae048f4f3d5cf","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":27,"locator":"'04 Internal Policies'!27:27","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-6e903f75bde2656cbb5d3899","recordKey":"MS-PROPOSED-POL-c6fe56d775c8c7d1@9f3567316affb3c7","sourceRowId":"ROW-b8ee90af3c059599b83ab624","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"04 Internal Policies","row":28,"locator":"'04 Internal Policies'!28:28","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-c370c33b98bc228b146cf959","recordKey":"MS-OVERLAY-CUS-01@ef016720fa4b77d5","sourceRowId":"ROW-0b52ce36c97fb00aa1327198","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":2,"locator":"'05 Custom Rules'!2:2","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-eb5b4875ea95738382ceae5b","recordKey":"MS-OVERLAY-CUS-02@2bdb2cb7097a15c7","sourceRowId":"ROW-de534a668d5b9afc7a353baf","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":3,"locator":"'05 Custom Rules'!3:3","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d2200dc8e6fcde1ee0422269","recordKey":"MS-OVERLAY-CUS-03@9e0dd72cbcd36d06","sourceRowId":"ROW-fc2719c75dfa1cf4c459b82f","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":4,"locator":"'05 Custom Rules'!4:4","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-6d85de54ba816f4c6a38f548","recordKey":"MS-OVERLAY-CUS-04@1f8a3af1c8e871ca","sourceRowId":"ROW-9a15ea95ee64873dd9c1b7ee","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":5,"locator":"'05 Custom Rules'!5:5","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-68524068cc7f5032a410aede","recordKey":"MS-OVERLAY-CUS-05@312949a220d7aa56","sourceRowId":"ROW-6199d934896405fadeeafc5c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":6,"locator":"'05 Custom Rules'!6:6","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-54c892321e5fb8a8346facc0","recordKey":"MS-OVERLAY-CUS-06@b76726eea76800fb","sourceRowId":"ROW-b9650087ae2f89219f0bdcd6","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":7,"locator":"'05 Custom Rules'!7:7","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-22d5e57e185daef7077daa82","recordKey":"MS-OVERLAY-CUS-07@e7e1902f4641a2b9","sourceRowId":"ROW-c22bf0e067e421380f42cf0a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":8,"locator":"'05 Custom Rules'!8:8","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-73dc2df1fc8bde0e70ab97d1","recordKey":"MS-OVERLAY-CUS-08@f2e9d1cd2e00bcf6","sourceRowId":"ROW-134e8181c648fa80a210777c","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":9,"locator":"'05 Custom Rules'!9:9","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-ec11cc03d90a741828502be5","recordKey":"MS-OVERLAY-CUS-09@fa0395a46d9792dd","sourceRowId":"ROW-a1238f3f910e719323a62d4d","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":10,"locator":"'05 Custom Rules'!10:10","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-bd79e8337e0538f913d45c3e","recordKey":"MS-OVERLAY-CUS-10@d2a5b80a68088779","sourceRowId":"ROW-d2569456e42c06216d188a20","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":11,"locator":"'05 Custom Rules'!11:11","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-113c04dca854f080b0fdd471","recordKey":"MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7","sourceRowId":"ROW-9c031045835ea4ae4fe0bebc","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":12,"locator":"'05 Custom Rules'!12:12","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-4f46c35122d7342cf22c99aa","recordKey":"MS-OVERLAY-CUS-12@b7241f443c6c3622","sourceRowId":"ROW-1e2e4db54c587516e09caa03","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":13,"locator":"'05 Custom Rules'!13:13","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-3bec21ab60c20099ee1801bf","recordKey":"MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7","sourceRowId":"ROW-20f564f2863722d2d8445b8a","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":14,"locator":"'05 Custom Rules'!14:14","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-f0acdd7c694ae7a16359b865","recordKey":"MS-OVERLAY-CUS-14@360b13cad7621179","sourceRowId":"ROW-2b0e28bd7bfd3e8fe80ae976","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":15,"locator":"'05 Custom Rules'!15:15","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-6ba2810fb4ba47ddd2363df7","recordKey":"MS-OVERLAY-CUS-15@bdd9abeff8cb9654","sourceRowId":"ROW-32126527062bd2b2e03d0aac","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":16,"locator":"'05 Custom Rules'!16:16","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-254aa303bc49c0a8950c881b","recordKey":"MS-OVERLAY-CUS-16@5dc4891c003c8c70","sourceRowId":"ROW-72de606b934fd25a5109e8b6","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":17,"locator":"'05 Custom Rules'!17:17","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-49b65fcae8f05780020740a8","recordKey":"MS-OVERLAY-CUS-17@3b8c3e6e3715795f","sourceRowId":"ROW-003117d4c6e30aede27dbecc","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":18,"locator":"'05 Custom Rules'!18:18","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-ade42fd1d9d6ca97e732ab01","recordKey":"MS-OVERLAY-CUS-18@d7a54daf6d4edffb","sourceRowId":"ROW-2e4a786bd0a31d444f26e8f2","sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","workbook":"missionSAFE_policy_expansion_2026-08-20.xlsx","libraryFileId":"libfile_eb3efe10f3588191a96ee9fb6fd4bcd6","sheet":"05 Custom Rules","row":19,"locator":"'05 Custom Rules'!19:19","sourceSha256":"595d3cba580f5771d5d3ee06aea1a5b5c3c72eb218102c02ab055af5192a9f9f"},{"id":"PRV-d36c5c21887e5d2a1b2d09d0","recordKey":"FW-NIST-AI-RMF@aba341d53497210b","sourceRowId":"ROW-777783df3cd9ef7062834bf5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":5,"locator":"'04 Framework Catalog'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f0e9e549705222a8eaf1913f","recordKey":"FW-NIST-AI-600-1@91e5bc3b14f2a84b","sourceRowId":"ROW-b1b626fe01bea60389a94799","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":6,"locator":"'04 Framework Catalog'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bed7316f82c1697463acb623","recordKey":"FW-NIST-CSF2@e2682aacee87a7d8","sourceRowId":"ROW-04433aba3ef3442a7dc342ea","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":7,"locator":"'04 Framework Catalog'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-84c6d572a620d752b4e2a64f","recordKey":"FW-NIST-800-53@df620e4e08f309b9","sourceRowId":"ROW-9ebae7a1c19f9d988cfefe1e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":8,"locator":"'04 Framework Catalog'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5a919d614ceb4b17f43134b8","recordKey":"FW-FEDRAMP@0431d549dd6dc7e6","sourceRowId":"ROW-b8bd9ba08111089522472a26","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":9,"locator":"'04 Framework Catalog'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-614daec725021b02db45e34e","recordKey":"FW-ISO-42001@6d004f01fd1dd6f5","sourceRowId":"ROW-b29e0e95548020af5b6ccf75","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":10,"locator":"'04 Framework Catalog'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ae6884931525e20232f6d417","recordKey":"FW-ISO-42005@b02139bf544ce4bf","sourceRowId":"ROW-d00d7796973ad8d803836eb1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":11,"locator":"'04 Framework Catalog'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d713be66ab1a0f165bf9e2a8","recordKey":"FW-ISO-23894@b87e8d19fc73b809","sourceRowId":"ROW-956707b6e9f1a1157d10e2b3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":12,"locator":"'04 Framework Catalog'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9870680e057444d0ccea0278","recordKey":"FW-ISO-38507@3a21d46272e4d98f","sourceRowId":"ROW-cad3c07500071ecb6debed6c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":13,"locator":"'04 Framework Catalog'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-788fb2e76184255f7cc46446","recordKey":"FW-ISO-5338@5384b7599ab287e8","sourceRowId":"ROW-616d2a735b78292c54f59a72","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":14,"locator":"'04 Framework Catalog'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d3d7f4c5f6bd090ff306ea2c","recordKey":"FW-ISO-24028@3d472e5cbcce5b94","sourceRowId":"ROW-3b6e80479929d9c2c44c106c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":15,"locator":"'04 Framework Catalog'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-26bfde4ac6857e0abb353539","recordKey":"FW-EU-AI-ACT@46561a486a4c008b","sourceRowId":"ROW-35056b4a4fdc12e0f5d8634d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":16,"locator":"'04 Framework Catalog'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2e0ec2f688c842efad18def9","recordKey":"FW-GDPR@ee1443d6c0919bfd","sourceRowId":"ROW-2fc3f9fc669c13e115f8440e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":17,"locator":"'04 Framework Catalog'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bc2db9e11f21ab108af00625","recordKey":"FW-HIPAA@024563eb5b7c33a6","sourceRowId":"ROW-bfa5e24cc1091a56ae6e3610","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":18,"locator":"'04 Framework Catalog'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8b9f0669a22d60d61127833a","recordKey":"FW-PCI-DSS@26b432290466d636","sourceRowId":"ROW-1034aa6318910efd3b805700","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":19,"locator":"'04 Framework Catalog'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4dde4b0ef53af72092d2fdef","recordKey":"FW-SOC2@db7c79c2dbfb20ed","sourceRowId":"ROW-70fe013b1ed861bc1f0e269a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":20,"locator":"'04 Framework Catalog'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dd68a4c9e6197188208e8fa2","recordKey":"FW-GLBA@ce5eb5a36e567a3b","sourceRowId":"ROW-7322b54de38f7bb6a4573010","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":21,"locator":"'04 Framework Catalog'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6c384d345937d6b805811dae","recordKey":"FW-FERPA@adba7da3b8b49ee6","sourceRowId":"ROW-a119e473fbc724a9f3d4a2b4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":22,"locator":"'04 Framework Catalog'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f7ee7057a737d8914ced4bc4","recordKey":"FW-CCPA-CPRA@2726437e0cff599a","sourceRowId":"ROW-f69538d02437e555efcfb185","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":23,"locator":"'04 Framework Catalog'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-489b8b29ee2dd17dd724b817","recordKey":"FW-CO-AI@dc656cacb5cb1e38","sourceRowId":"ROW-4ecff7de664a84bb7dd2852a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":24,"locator":"'04 Framework Catalog'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d1897f1cd9be8458c8cb62fd","recordKey":"FW-TX-TRAIGA@9b71af35f63ed5f3","sourceRowId":"ROW-d18d29a9d6086ffcafa78490","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":25,"locator":"'04 Framework Catalog'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-348851a0b853d2b03702fa8f","recordKey":"FW-OMB-M25-21@02c619879520c6e4","sourceRowId":"ROW-3f269d4ebd6704ea6e57097f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":26,"locator":"'04 Framework Catalog'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b2f8b1888904f04476a6abb3","recordKey":"FW-OMB-M25-22@1dd0effe69b2dd83","sourceRowId":"ROW-11e306224e302c8409f55ddd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":27,"locator":"'04 Framework Catalog'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9d561d4f44d61f7ebef09d6c","recordKey":"FW-OWASP-LLM-2026@44fda67005e1638f","sourceRowId":"ROW-938bc65cd2d8eb379c2074a1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":28,"locator":"'04 Framework Catalog'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-49c2d674f9474f6b3b7d6190","recordKey":"FW-SOX@6b53f8d76c60deb9","sourceRowId":"ROW-6dbfd1e205fc4d3834e7ff51","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":29,"locator":"'04 Framework Catalog'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f983008134460ca2b8f66189","recordKey":"FW-NIST-800-171@58ab2c70e4be447b","sourceRowId":"ROW-ad8e1243daaf62d6c9148402","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":30,"locator":"'04 Framework Catalog'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b256555e6567bbe790236026","recordKey":"FW-CMMC@ac0fcc4dbed93e96","sourceRowId":"ROW-1141d7110b74b56aad82a5b6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":31,"locator":"'04 Framework Catalog'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6e9c60a7ef081923d33de092","recordKey":"FW-CJIS-6.1@d72dc934b163c587","sourceRowId":"ROW-0481455a2206d38034e4b4ba","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":32,"locator":"'04 Framework Catalog'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-82d59a323d11f7c1848b51ac","recordKey":"FW-IRS-1075@41f4b6c6a851eb70","sourceRowId":"ROW-f7fd4420c43cadaa2e7b3001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":33,"locator":"'04 Framework Catalog'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-caafd3e7e9cc09c1ed920c43","recordKey":"FW-SECTION-508@fbc75a7a0c1d63df","sourceRowId":"ROW-4277eeeaf763ff7468b3a7b4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":34,"locator":"'04 Framework Catalog'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-71d36babf7c01bb653e72b68","recordKey":"FW-HHS-PART2@141c8543b532c1e2","sourceRowId":"ROW-d2f32be2b1b5dc9d7955495f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":35,"locator":"'04 Framework Catalog'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dbdfcc56e436901e998b270f","recordKey":"FW-ONC-HTI1@07ba2443114bf7cf","sourceRowId":"ROW-a64395257784a0f7e1d11c84","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":36,"locator":"'04 Framework Catalog'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-caac65db4b3614e35ac507bc","recordKey":"FW-FDA-AI-MD@432a62ac753198dc","sourceRowId":"ROW-7902cc3b6776f8059ad6e48d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":37,"locator":"'04 Framework Catalog'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-473c7bce3cd425cef8a5c8a8","recordKey":"FW-FRB-MRM-2026@20af5280d1d80c0c","sourceRowId":"ROW-4eebfaddfe6861574fe5260e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":38,"locator":"'04 Framework Catalog'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e91d586a8f32fb81082836d7","recordKey":"FW-NYDFS-500@67740b905bbc613b","sourceRowId":"ROW-2648fe12dd0384dfad627d02","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":39,"locator":"'04 Framework Catalog'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6a024a438bd931678ad50405","recordKey":"FW-ECOA-REG-B@ddb9963a16c2337d","sourceRowId":"ROW-48be17815700adb48f3861b0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":40,"locator":"'04 Framework Catalog'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f0d5923cf5a423485c1d3073","recordKey":"FW-NAIC-AI@06f6441bb07255a0","sourceRowId":"ROW-59d631f460f3601715cab310","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":41,"locator":"'04 Framework Catalog'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8efa64d62eb2f718cbc2455b","recordKey":"FW-COPPA@fc258ea83878e53c","sourceRowId":"ROW-c01d164deb866d8eb2726d49","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":42,"locator":"'04 Framework Catalog'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9787379745542b19537648d6","recordKey":"FW-NYC-LL144@cc7abf9e1b87f1de","sourceRowId":"ROW-dc59b939b8884195773a807e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":43,"locator":"'04 Framework Catalog'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0d154a548e902d19a59f81e3","recordKey":"FW-IL-AIVIA@57edfa6b6c2632ab","sourceRowId":"ROW-c07594d7774f422504e5f9ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":44,"locator":"'04 Framework Catalog'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c5d630d2aa0d0736145308af","recordKey":"FW-UK-DP-AI@f7644b0e61b4f5d8","sourceRowId":"ROW-6865413e70818ef9afda1cfb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":45,"locator":"'04 Framework Catalog'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-435d204fcb0535cc9788402b","recordKey":"FW-BR-LGPD@b1c212cd4f289ae8","sourceRowId":"ROW-53c17fdfdb05d320ef747afe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":46,"locator":"'04 Framework Catalog'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-92ec0597f41b4606baca81f7","recordKey":"FW-AU-PRIVACY-AI@cc7182c7d5cefeb1","sourceRowId":"ROW-da1ad5c97fa11d12ccf111a2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":47,"locator":"'04 Framework Catalog'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f3d207e115cd9c7d51e47b7a","recordKey":"FW-SG-MODEL-AI@f169da9f6ce16236","sourceRowId":"ROW-0579fb48e563f6cfc629e7cf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":48,"locator":"'04 Framework Catalog'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a7cab342aa5410e510cd71e2","recordKey":"FW-DOJ-DSP@0d9c8e0ced94016d","sourceRowId":"ROW-31876febcca5a5de95a2d423","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":49,"locator":"'04 Framework Catalog'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1135958bb366af297da05703","recordKey":"FW-EAR@0588bd07a68b0491","sourceRowId":"ROW-0d028bee6e20425b1df870f7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"04 Framework Catalog","row":50,"locator":"'04 Framework Catalog'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-58578d2da8e06704d873d29c","recordKey":"MS-RULE-DP-01@82066dbd9b9a4f14","sourceRowId":"ROW-dd7dd21a66734e7b97fcb5b0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":5,"locator":"'05 Canonical Rules'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0e1b4f6678659a6f6d859fe1","recordKey":"TEST-MS-RULE-DP-01@0bc48774d2f0f1dd","sourceRowId":"ROW-dd7dd21a66734e7b97fcb5b0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":5,"locator":"'05 Canonical Rules'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-80ab25c4e89a108c44cdaa9e","recordKey":"MS-RULE-DP-02@d20cd6810e42f858","sourceRowId":"ROW-d965a35a421e3fc6673c239f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":6,"locator":"'05 Canonical Rules'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b51e2b1aebf153ce53950ea6","recordKey":"TEST-MS-RULE-DP-02@ca4ef66ca268a10a","sourceRowId":"ROW-d965a35a421e3fc6673c239f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":6,"locator":"'05 Canonical Rules'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a0b61c1f696185f7d5834bea","recordKey":"MS-RULE-DP-03@4cbb47b109e98f4a","sourceRowId":"ROW-796761a8a9cf57da2fae3e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":7,"locator":"'05 Canonical Rules'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-596c3aed4be0b989904aab40","recordKey":"TEST-MS-RULE-DP-03@50eab23253df5cb7","sourceRowId":"ROW-796761a8a9cf57da2fae3e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":7,"locator":"'05 Canonical Rules'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3345e4f4c3c59f0636da5ef0","recordKey":"MS-RULE-DP-04@13c6ba85197d9a69","sourceRowId":"ROW-caa534e1eb5c3613fe0591c1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":8,"locator":"'05 Canonical Rules'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-71a68edd1dcb35d4cfcec99c","recordKey":"TEST-MS-RULE-DP-04@f3aef5f922894a93","sourceRowId":"ROW-caa534e1eb5c3613fe0591c1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":8,"locator":"'05 Canonical Rules'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-04a2de752d90edf883214f6f","recordKey":"MS-RULE-DP-05@30a7a6fc8d2d373f","sourceRowId":"ROW-7a175ac95401f3abfaf8290d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":9,"locator":"'05 Canonical Rules'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-93dc7fc115cd96460b4e7962","recordKey":"TEST-MS-RULE-DP-05@77349f3499851451","sourceRowId":"ROW-7a175ac95401f3abfaf8290d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":9,"locator":"'05 Canonical Rules'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6a7e601dfb67f080c81f529b","recordKey":"MS-RULE-DP-06@af062b3863346b41","sourceRowId":"ROW-b78aa7d9163467a76700c54a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":10,"locator":"'05 Canonical Rules'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3308749b026c43ccd4cb857e","recordKey":"TEST-MS-RULE-DP-06@59256ca2a153a840","sourceRowId":"ROW-b78aa7d9163467a76700c54a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":10,"locator":"'05 Canonical Rules'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3b95b552b9121c8f1fa19189","recordKey":"MS-RULE-DP-07@94c870d43e4286ab","sourceRowId":"ROW-eaf49299e5a27f3a04a39dee","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":11,"locator":"'05 Canonical Rules'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c0a86276648fccde496e6b51","recordKey":"TEST-MS-RULE-DP-07@5002f8ed22b072a4","sourceRowId":"ROW-eaf49299e5a27f3a04a39dee","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":11,"locator":"'05 Canonical Rules'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-169b6cff610884e25ff8ab01","recordKey":"MS-RULE-DP-08@f94b476097640eb3","sourceRowId":"ROW-2db24a210a103da03c6369d1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":12,"locator":"'05 Canonical Rules'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4d0edc7fd139fd2628c76f7c","recordKey":"TEST-MS-RULE-DP-08@5952c57b4ceafdbd","sourceRowId":"ROW-2db24a210a103da03c6369d1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":12,"locator":"'05 Canonical Rules'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a8c0fe0c69c0733f6feb8a54","recordKey":"MS-RULE-DP-09@e32553c4840951b3","sourceRowId":"ROW-0b229efa77ef98b17d217b94","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":13,"locator":"'05 Canonical Rules'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ea66354a994a681c20c1920b","recordKey":"TEST-MS-RULE-DP-09@c4ed5280df2d8691","sourceRowId":"ROW-0b229efa77ef98b17d217b94","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":13,"locator":"'05 Canonical Rules'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-42181901a57c0202dcf8e830","recordKey":"MS-RULE-DP-10@fc6f0a161d4f201f","sourceRowId":"ROW-2e8dd0f254a9bfc88a26ae93","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":14,"locator":"'05 Canonical Rules'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-efcf1931b981fa3659297869","recordKey":"TEST-MS-RULE-DP-10@6d512691a22458cc","sourceRowId":"ROW-2e8dd0f254a9bfc88a26ae93","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":14,"locator":"'05 Canonical Rules'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ae0e14c4a3985173c8baf1cb","recordKey":"MS-RULE-DP-11@b7d96f7e1501e4ed","sourceRowId":"ROW-a5189f5e4b5294c5256598fe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":15,"locator":"'05 Canonical Rules'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-392174a58732e8d615bd70d4","recordKey":"TEST-MS-RULE-DP-11@e6424832265654e7","sourceRowId":"ROW-a5189f5e4b5294c5256598fe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":15,"locator":"'05 Canonical Rules'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e960a0a77e05647bfb824b03","recordKey":"MS-RULE-DP-12@4ae51c2523134e28","sourceRowId":"ROW-de74c6dce98f94da3fdb5dfb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":16,"locator":"'05 Canonical Rules'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-18a73c0964a13ae6f8bb2c19","recordKey":"TEST-MS-RULE-DP-12@95d98ba0364aec85","sourceRowId":"ROW-de74c6dce98f94da3fdb5dfb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":16,"locator":"'05 Canonical Rules'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-335ae58e5e594dcc73b2edcd","recordKey":"MS-RULE-DP-13@1299bbf89c50bd1a","sourceRowId":"ROW-274105fb30057214d0562812","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":17,"locator":"'05 Canonical Rules'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1ee0e393ec1b022bbf0c46f4","recordKey":"TEST-MS-RULE-DP-13@f983ef5d4e01924d","sourceRowId":"ROW-274105fb30057214d0562812","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":17,"locator":"'05 Canonical Rules'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e947afe9d8dd79c21b1f6943","recordKey":"MS-RULE-DP-14@7b898303f53ec49b","sourceRowId":"ROW-225037eab461099efc409e5c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":18,"locator":"'05 Canonical Rules'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-53e803e4891e42fb57335d8c","recordKey":"TEST-MS-RULE-DP-14@ab80d0fa0d8db15e","sourceRowId":"ROW-225037eab461099efc409e5c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":18,"locator":"'05 Canonical Rules'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9ed68d68ff737c7fa48c6e66","recordKey":"MS-RULE-DP-15@208a0f796d79405e","sourceRowId":"ROW-7ce2bc4a6a65b5ec7ea32a1f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":19,"locator":"'05 Canonical Rules'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b4e74d563079e9889395daea","recordKey":"TEST-MS-RULE-DP-15@cea9c93668f602e0","sourceRowId":"ROW-7ce2bc4a6a65b5ec7ea32a1f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":19,"locator":"'05 Canonical Rules'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8fd00719769d6c2dd7cfb4fe","recordKey":"MS-RULE-DP-16@d0dca88853814a51","sourceRowId":"ROW-547168ebefb450617ee140e7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":20,"locator":"'05 Canonical Rules'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3af67c5a881aa5bb571658e5","recordKey":"TEST-MS-RULE-DP-16@97bda9e88e479e68","sourceRowId":"ROW-547168ebefb450617ee140e7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":20,"locator":"'05 Canonical Rules'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d43f23dc3af353f0a269b4ae","recordKey":"MS-RULE-DP-17@d1c8e0c542b0a6f6","sourceRowId":"ROW-6d330d498b040a50298e5096","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":21,"locator":"'05 Canonical Rules'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-575ce08e7034fde731a708fe","recordKey":"TEST-MS-RULE-DP-17@811ed55e191f631e","sourceRowId":"ROW-6d330d498b040a50298e5096","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":21,"locator":"'05 Canonical Rules'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1d79bae0249381001ee80834","recordKey":"MS-RULE-DP-18@082a5a202e1a48ef","sourceRowId":"ROW-7df32d39977e00db5c854d8e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":22,"locator":"'05 Canonical Rules'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a90872136771ad8f4eb38d5c","recordKey":"TEST-MS-RULE-DP-18@8a543089559677bc","sourceRowId":"ROW-7df32d39977e00db5c854d8e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":22,"locator":"'05 Canonical Rules'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d718f1d3eba9d04d41abb0d9","recordKey":"MS-RULE-AU-01@32b7d4ac14b06f7b","sourceRowId":"ROW-2be72c12f0cb01e4a2b7dcaa","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":23,"locator":"'05 Canonical Rules'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2eaa15f0f87d37ed0246d6a6","recordKey":"TEST-MS-RULE-AU-01@0084a371cf0309b9","sourceRowId":"ROW-2be72c12f0cb01e4a2b7dcaa","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":23,"locator":"'05 Canonical Rules'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ec58221787ad54c73fc20676","recordKey":"MS-RULE-AU-02@1a166eaeb8f7f1ad","sourceRowId":"ROW-a2c0d46f3e18438f105dc6d7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":24,"locator":"'05 Canonical Rules'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-99fc154221f5f4267e0582df","recordKey":"TEST-MS-RULE-AU-02@ab1063b0ed9fa8a0","sourceRowId":"ROW-a2c0d46f3e18438f105dc6d7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":24,"locator":"'05 Canonical Rules'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c782a865c87ab70e4872d73c","recordKey":"MS-RULE-AU-03@ece0c972ca2c62e1","sourceRowId":"ROW-3dc6adb58d7f098f9272c80d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":25,"locator":"'05 Canonical Rules'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-42d4aef896d836ecd1f66ea6","recordKey":"TEST-MS-RULE-AU-03@2c0164b9ceb762fe","sourceRowId":"ROW-3dc6adb58d7f098f9272c80d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":25,"locator":"'05 Canonical Rules'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ed6dabc42a35bf675349e9a1","recordKey":"MS-RULE-AU-04@d51101a040857487","sourceRowId":"ROW-fcec3fc6725ce68924123608","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":26,"locator":"'05 Canonical Rules'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-04480eeb37d4b10427a91cc5","recordKey":"TEST-MS-RULE-AU-04@d64cd4d5b62ae1d2","sourceRowId":"ROW-fcec3fc6725ce68924123608","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":26,"locator":"'05 Canonical Rules'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fd359574b64670feb6dfc4e9","recordKey":"MS-RULE-AU-05@7c58fddd6817f607","sourceRowId":"ROW-cfe116723d32ad6326ee06b3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":27,"locator":"'05 Canonical Rules'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a4c8d065ef584ee60e955150","recordKey":"TEST-MS-RULE-AU-05@0f305d8c832c7e2f","sourceRowId":"ROW-cfe116723d32ad6326ee06b3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":27,"locator":"'05 Canonical Rules'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d041200962f83da5d08fdcb8","recordKey":"MS-RULE-AU-06@e8c8f3b771054fbc","sourceRowId":"ROW-99440280e23a02ddcb319ff1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":28,"locator":"'05 Canonical Rules'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-25008db32eda56b92ded3826","recordKey":"TEST-MS-RULE-AU-06@750f23cda17c3c4b","sourceRowId":"ROW-99440280e23a02ddcb319ff1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":28,"locator":"'05 Canonical Rules'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-54407b8d14336c9886927ee7","recordKey":"MS-RULE-AU-07@989c3a6787fc6689","sourceRowId":"ROW-73b5ab67a4373cbffdf61c3c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":29,"locator":"'05 Canonical Rules'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2d66407ed1c0897970eedc13","recordKey":"TEST-MS-RULE-AU-07@5ffa142ce7218527","sourceRowId":"ROW-73b5ab67a4373cbffdf61c3c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":29,"locator":"'05 Canonical Rules'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6b20204771f55fc799f9bd63","recordKey":"MS-RULE-AU-08@4eda0a221f3ef380","sourceRowId":"ROW-70ffbddc19757b6b4bd3008f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":30,"locator":"'05 Canonical Rules'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4c56ed2a947125d9d6cb2da4","recordKey":"TEST-MS-RULE-AU-08@1572d78ad2ecacee","sourceRowId":"ROW-70ffbddc19757b6b4bd3008f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":30,"locator":"'05 Canonical Rules'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-07830c6244228314fbeaff4b","recordKey":"MS-RULE-IN-01@e4fe11be1a20f12f","sourceRowId":"ROW-33d75597df848b17c463a5ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":31,"locator":"'05 Canonical Rules'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fe0e98d0065456eb6d68a53d","recordKey":"TEST-MS-RULE-IN-01@9d4be1fbcaec2bf2","sourceRowId":"ROW-33d75597df848b17c463a5ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":31,"locator":"'05 Canonical Rules'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f039a7206e73783faf61d017","recordKey":"MS-RULE-IN-02@dbb47a84e8a96c05","sourceRowId":"ROW-f827b989613c49ac0be126bf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":32,"locator":"'05 Canonical Rules'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3ab00f3dedb6ea1929948a24","recordKey":"TEST-MS-RULE-IN-02@1d2838ae3e1a57ab","sourceRowId":"ROW-f827b989613c49ac0be126bf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":32,"locator":"'05 Canonical Rules'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f7d9a9ba765fce5306a7cd1f","recordKey":"MS-RULE-IN-03@900d1ac2806dab1c","sourceRowId":"ROW-a69372f0d658fdbe12b8fd53","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":33,"locator":"'05 Canonical Rules'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-696023a59a5a4a3af17a522c","recordKey":"TEST-MS-RULE-IN-03@900d1236d564a9d6","sourceRowId":"ROW-a69372f0d658fdbe12b8fd53","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":33,"locator":"'05 Canonical Rules'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a4ea8d9b1af7cf9cbe667f3e","recordKey":"MS-RULE-IN-04@40341d186f0bd606","sourceRowId":"ROW-1d4de9b6515e28867aabb661","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":34,"locator":"'05 Canonical Rules'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3fb76f2622c0628294b00acc","recordKey":"TEST-MS-RULE-IN-04@2643ff56cf23a729","sourceRowId":"ROW-1d4de9b6515e28867aabb661","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":34,"locator":"'05 Canonical Rules'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-77d60962be2adf696651f519","recordKey":"MS-RULE-IN-05@8dff43ab30881e3f","sourceRowId":"ROW-404738e71a852866a1f1a06b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":35,"locator":"'05 Canonical Rules'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e50d6a607882de95f151341e","recordKey":"TEST-MS-RULE-IN-05@3c95bf3267fc393c","sourceRowId":"ROW-404738e71a852866a1f1a06b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":35,"locator":"'05 Canonical Rules'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9b342856ae81ddf278f644af","recordKey":"MS-RULE-IN-06@478a04da335c1e7f","sourceRowId":"ROW-9fc4252383688ede04d786ea","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":36,"locator":"'05 Canonical Rules'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7d185a43bec089afc67f18b1","recordKey":"TEST-MS-RULE-IN-06@858400572c4c71c1","sourceRowId":"ROW-9fc4252383688ede04d786ea","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":36,"locator":"'05 Canonical Rules'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bf32863aa8acf4985260ac19","recordKey":"MS-RULE-IN-07@31e317962beaeb5b","sourceRowId":"ROW-5f5c18f25000f9c536da18d5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":37,"locator":"'05 Canonical Rules'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5f1bbed6f520df25e428b216","recordKey":"TEST-MS-RULE-IN-07@375f07965e1612f9","sourceRowId":"ROW-5f5c18f25000f9c536da18d5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":37,"locator":"'05 Canonical Rules'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4369ff75de5ec8245204a607","recordKey":"MS-RULE-IN-08@94324ccfd3a491ef","sourceRowId":"ROW-09612dabcd00cb81ad1d05ba","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":38,"locator":"'05 Canonical Rules'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b900479c497adc2b2722d9f3","recordKey":"TEST-MS-RULE-IN-08@d7fc8b0e56e8838b","sourceRowId":"ROW-09612dabcd00cb81ad1d05ba","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":38,"locator":"'05 Canonical Rules'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-139f66a1d7a6848b61c01662","recordKey":"MS-RULE-OU-01@d0805195b855c7dd","sourceRowId":"ROW-60b11c0a5a8eb1d759b90a1d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":39,"locator":"'05 Canonical Rules'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3bef8e9f814862c54581297a","recordKey":"TEST-MS-RULE-OU-01@b9fd24d42e46a0aa","sourceRowId":"ROW-60b11c0a5a8eb1d759b90a1d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":39,"locator":"'05 Canonical Rules'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-719693df6ecc1942a9f46042","recordKey":"MS-RULE-OU-02@4965655028a3d485","sourceRowId":"ROW-8f98d8e0539ec18e9717c095","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":40,"locator":"'05 Canonical Rules'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5dc11b63f5baa807a4c8f4d0","recordKey":"TEST-MS-RULE-OU-02@82b9b07bac4d235a","sourceRowId":"ROW-8f98d8e0539ec18e9717c095","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":40,"locator":"'05 Canonical Rules'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-12898c2d117d5284843d0b68","recordKey":"MS-RULE-OU-03@ce8e31e07eb4da96","sourceRowId":"ROW-05ae5b514ae5f63ada4d7746","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":41,"locator":"'05 Canonical Rules'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-81b06290fb68e62da2c2efe6","recordKey":"TEST-MS-RULE-OU-03@855aa6350f3b6faf","sourceRowId":"ROW-05ae5b514ae5f63ada4d7746","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":41,"locator":"'05 Canonical Rules'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-74db27b9182b326a75e79a1e","recordKey":"MS-RULE-OU-04@4f3b3444715b2744","sourceRowId":"ROW-93855bbbe9a302b1f1006cdc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":42,"locator":"'05 Canonical Rules'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3dadb7ff39651c0dcee8d0a3","recordKey":"TEST-MS-RULE-OU-04@b8d5604c6e6cac3b","sourceRowId":"ROW-93855bbbe9a302b1f1006cdc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":42,"locator":"'05 Canonical Rules'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dff1a797bd820fe9ec905e2b","recordKey":"MS-RULE-OU-05@cb5aeaa742fb4521","sourceRowId":"ROW-2cf11e533edb20d9d1dd9c78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":43,"locator":"'05 Canonical Rules'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9013ebe214a1d4b15732c80a","recordKey":"TEST-MS-RULE-OU-05@790ba5609481741c","sourceRowId":"ROW-2cf11e533edb20d9d1dd9c78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":43,"locator":"'05 Canonical Rules'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1ab01e43c5b3f8ff12f66cc4","recordKey":"MS-RULE-OU-06@ce0137df984ac601","sourceRowId":"ROW-f603f5e29e916e93e964aafc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":44,"locator":"'05 Canonical Rules'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a3658771782cb127f9b75a9a","recordKey":"TEST-MS-RULE-OU-06@3389a94a06402212","sourceRowId":"ROW-f603f5e29e916e93e964aafc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":44,"locator":"'05 Canonical Rules'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-37b899b1cc04ac5580141be6","recordKey":"MS-RULE-OU-07@7d5bc203e83e95c9","sourceRowId":"ROW-56e9b5df3e9b56a0997dcd8f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":45,"locator":"'05 Canonical Rules'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f6711e49ff3052645725ed1b","recordKey":"TEST-MS-RULE-OU-07@c8b8661e517fb395","sourceRowId":"ROW-56e9b5df3e9b56a0997dcd8f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":45,"locator":"'05 Canonical Rules'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c54edaa51c934bf310e3969b","recordKey":"MS-RULE-OU-08@4c7bb6dc00dfcbfd","sourceRowId":"ROW-a918b603fd3d79a9824f1e6c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":46,"locator":"'05 Canonical Rules'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3a6ac8afd752ee53974d30c7","recordKey":"TEST-MS-RULE-OU-08@2da28a7f88e05c49","sourceRowId":"ROW-a918b603fd3d79a9824f1e6c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":46,"locator":"'05 Canonical Rules'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f6b0c9312d915718708a5e2c","recordKey":"MS-RULE-OU-09@2ffb1322457172b3","sourceRowId":"ROW-b5b43ff186de61e4e9c8f991","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":47,"locator":"'05 Canonical Rules'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-63cda9a03ac1fe03f2c2d5ba","recordKey":"TEST-MS-RULE-OU-09@225611971feba396","sourceRowId":"ROW-b5b43ff186de61e4e9c8f991","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":47,"locator":"'05 Canonical Rules'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f7091082889df30a8f852b53","recordKey":"MS-RULE-OU-10@2332653b89bcd331","sourceRowId":"ROW-72e395c7218a6a4876304887","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":48,"locator":"'05 Canonical Rules'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b54c6a2a17e57d52df6e5b11","recordKey":"TEST-MS-RULE-OU-10@f6e5d3d4dc45e98f","sourceRowId":"ROW-72e395c7218a6a4876304887","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":48,"locator":"'05 Canonical Rules'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a23194e30070c6d78d2a384e","recordKey":"MS-RULE-OU-11@0710643d8a955cf6","sourceRowId":"ROW-20682fe9bafd1d0abdfa8c4b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":49,"locator":"'05 Canonical Rules'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5aacc0ca523ba67e7d9648d2","recordKey":"TEST-MS-RULE-OU-11@786090aa4216d6dd","sourceRowId":"ROW-20682fe9bafd1d0abdfa8c4b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":49,"locator":"'05 Canonical Rules'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-17ebfd576786267207950867","recordKey":"MS-RULE-OU-12@295cdecda41b8b55","sourceRowId":"ROW-bf7bf2864cb170ef25ebd30d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":50,"locator":"'05 Canonical Rules'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3224385f7bca86a41a29660d","recordKey":"TEST-MS-RULE-OU-12@249ad604ebb6fff7","sourceRowId":"ROW-bf7bf2864cb170ef25ebd30d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":50,"locator":"'05 Canonical Rules'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6449fffc3696b012127ff810","recordKey":"MS-RULE-AG-01@e6aee1767c267990","sourceRowId":"ROW-1279c5b35f2939fb1cc43247","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":51,"locator":"'05 Canonical Rules'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9b332825a41c59ed16bbd390","recordKey":"TEST-MS-RULE-AG-01@ff7a0e8e2da5d17b","sourceRowId":"ROW-1279c5b35f2939fb1cc43247","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":51,"locator":"'05 Canonical Rules'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3bc4f804ebdc3114adaea9db","recordKey":"MS-RULE-AG-02@d4d178c0433fd6d4","sourceRowId":"ROW-a3ddaf09b3a72f0c72e8964e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":52,"locator":"'05 Canonical Rules'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6bacc49993cbf1becea3e017","recordKey":"TEST-MS-RULE-AG-02@aade6035a0855241","sourceRowId":"ROW-a3ddaf09b3a72f0c72e8964e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":52,"locator":"'05 Canonical Rules'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8e108dc4fe2005fb58408f0b","recordKey":"MS-RULE-AG-03@20aa3c90fa880f0d","sourceRowId":"ROW-10aac5610f8d61a3c39451f5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":53,"locator":"'05 Canonical Rules'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e79ee7ada7fcfa1843cfd635","recordKey":"TEST-MS-RULE-AG-03@015e6c738b015bd2","sourceRowId":"ROW-10aac5610f8d61a3c39451f5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":53,"locator":"'05 Canonical Rules'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6d17a545a366128743a9f209","recordKey":"MS-RULE-AG-04@c7af717b1d68045e","sourceRowId":"ROW-53dd84f34afc376b1c406ce7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":54,"locator":"'05 Canonical Rules'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8ee5a2e5364b1cc6f6015242","recordKey":"TEST-MS-RULE-AG-04@098ca0df2ff02a79","sourceRowId":"ROW-53dd84f34afc376b1c406ce7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":54,"locator":"'05 Canonical Rules'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dea6b271946ddbbbb62a7ddd","recordKey":"MS-RULE-AG-05@8829d873310f18f9","sourceRowId":"ROW-91f4c7ef9235e9f81ce06ed3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":55,"locator":"'05 Canonical Rules'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-06edbcd864ed03ebdf5fee89","recordKey":"TEST-MS-RULE-AG-05@8edc0dd979fb9441","sourceRowId":"ROW-91f4c7ef9235e9f81ce06ed3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":55,"locator":"'05 Canonical Rules'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-15b756f01295ac3945c3602a","recordKey":"MS-RULE-AG-06@6371f819b40b0d97","sourceRowId":"ROW-adf2e90caa19e3e99d364557","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":56,"locator":"'05 Canonical Rules'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b724e97f8124bd198f27ff45","recordKey":"TEST-MS-RULE-AG-06@ee1eb5a987831137","sourceRowId":"ROW-adf2e90caa19e3e99d364557","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":56,"locator":"'05 Canonical Rules'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a4b2e82dfb519d150f84e88f","recordKey":"MS-RULE-AG-07@c2fb36c556cb8a62","sourceRowId":"ROW-68f5ef062c038e22495ed591","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":57,"locator":"'05 Canonical Rules'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ee381947eed24d34080f9c3d","recordKey":"TEST-MS-RULE-AG-07@ba65d33eee3e267b","sourceRowId":"ROW-68f5ef062c038e22495ed591","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":57,"locator":"'05 Canonical Rules'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a42e98c37f8fb1de8c52df5b","recordKey":"MS-RULE-AG-08@b98e349c6e27f319","sourceRowId":"ROW-8cbb6da23d36aa1a0f0d3d85","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":58,"locator":"'05 Canonical Rules'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a281a2b9c2c0c5d5281b4916","recordKey":"TEST-MS-RULE-AG-08@416a45e0a0b25761","sourceRowId":"ROW-8cbb6da23d36aa1a0f0d3d85","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":58,"locator":"'05 Canonical Rules'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ea5f5f3bd8c2853ba911c220","recordKey":"MS-RULE-AG-09@2bd07e82a72d4f2e","sourceRowId":"ROW-259c8693730cbe4b874ed25f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":59,"locator":"'05 Canonical Rules'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-09974b2134285bd4e1c76b0a","recordKey":"TEST-MS-RULE-AG-09@77f7bead2ff59d1f","sourceRowId":"ROW-259c8693730cbe4b874ed25f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":59,"locator":"'05 Canonical Rules'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-669ed089e40f70ad8b1fcc56","recordKey":"MS-RULE-AG-10@41b899de0bf0744b","sourceRowId":"ROW-9af6191d6f0ea49d3937a8c8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":60,"locator":"'05 Canonical Rules'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-35f14198b7cd5ce19f7f83ad","recordKey":"TEST-MS-RULE-AG-10@fcfc304af4142870","sourceRowId":"ROW-9af6191d6f0ea49d3937a8c8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":60,"locator":"'05 Canonical Rules'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e2d8641016ea355807b74cd1","recordKey":"MS-RULE-OP-01@ce84968e8045ef9e","sourceRowId":"ROW-d47b427b0a53c7bac793a47d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":61,"locator":"'05 Canonical Rules'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-68ba7f78c4439bffaef9f613","recordKey":"TEST-MS-RULE-OP-01@1650910477cab89a","sourceRowId":"ROW-d47b427b0a53c7bac793a47d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":61,"locator":"'05 Canonical Rules'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-718657f52e080e414d79f360","recordKey":"MS-RULE-OP-02@7147e78f71e89fcb","sourceRowId":"ROW-411ceb959d0e3dc42db4309f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":62,"locator":"'05 Canonical Rules'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-10061e4e7ac66e595100dcba","recordKey":"TEST-MS-RULE-OP-02@e6bebdee13a2794f","sourceRowId":"ROW-411ceb959d0e3dc42db4309f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":62,"locator":"'05 Canonical Rules'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b1ade7d1c6c8f6ca4f549060","recordKey":"MS-RULE-OP-03@410599212edc432e","sourceRowId":"ROW-0dae86644d7e0892c43f8ad6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":63,"locator":"'05 Canonical Rules'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a62d0c1f3cfc1a22ceaf4144","recordKey":"TEST-MS-RULE-OP-03@63af44dbe3b87025","sourceRowId":"ROW-0dae86644d7e0892c43f8ad6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":63,"locator":"'05 Canonical Rules'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3a1f1248e03158ed91305fe5","recordKey":"MS-RULE-OP-04@63fbf478664e5e99","sourceRowId":"ROW-ef0314c91d4454e53a93b153","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":64,"locator":"'05 Canonical Rules'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0834e99c6f4d5b24fd0ed533","recordKey":"TEST-MS-RULE-OP-04@10af1b4283fbdf52","sourceRowId":"ROW-ef0314c91d4454e53a93b153","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":64,"locator":"'05 Canonical Rules'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d8fd3a0b426218187c41c8ed","recordKey":"MS-RULE-OP-05@98df9a80a2151ad4","sourceRowId":"ROW-4d9ef81e7a1d864e0b1b7a0c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":65,"locator":"'05 Canonical Rules'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-72768e75c2d5cbea6ee6d329","recordKey":"TEST-MS-RULE-OP-05@0d20359d25737fc8","sourceRowId":"ROW-4d9ef81e7a1d864e0b1b7a0c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":65,"locator":"'05 Canonical Rules'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-79ec10cff9283145fee42724","recordKey":"MS-RULE-OP-06@6ecbeba4e14a59af","sourceRowId":"ROW-0bf81f21814b84f8d4a6120e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":66,"locator":"'05 Canonical Rules'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c029f86046daf54484361602","recordKey":"TEST-MS-RULE-OP-06@a9f506c8bff242f1","sourceRowId":"ROW-0bf81f21814b84f8d4a6120e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":66,"locator":"'05 Canonical Rules'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dea29263f1de84cb58458a80","recordKey":"MS-RULE-OP-07@f1df2cbcb724af3b","sourceRowId":"ROW-426eb58154ac5c17eeb98ae3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":67,"locator":"'05 Canonical Rules'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7d45e98d995b020957cd97b0","recordKey":"TEST-MS-RULE-OP-07@8efbac703c680b3b","sourceRowId":"ROW-426eb58154ac5c17eeb98ae3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":67,"locator":"'05 Canonical Rules'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7f797b8dd8a422c1bd333170","recordKey":"MS-RULE-OP-08@a38dff87950aa40f","sourceRowId":"ROW-6ade478d8add1c6d08ff4ac3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":68,"locator":"'05 Canonical Rules'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9aab6d2fa16c99a9c9f092c6","recordKey":"TEST-MS-RULE-OP-08@438a6f5faac23af7","sourceRowId":"ROW-6ade478d8add1c6d08ff4ac3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":68,"locator":"'05 Canonical Rules'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b9202be8b0e21124109e96b4","recordKey":"MS-RULE-OP-09@ec587343b8220a51","sourceRowId":"ROW-b044e2b74aee570af6ea9ddb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":69,"locator":"'05 Canonical Rules'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-70f038de856c5b45030c66e4","recordKey":"TEST-MS-RULE-OP-09@30152b169dd9d2ae","sourceRowId":"ROW-b044e2b74aee570af6ea9ddb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":69,"locator":"'05 Canonical Rules'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-934bc9cbc7b08ae30150eb6a","recordKey":"MS-RULE-OP-10@8c831bc5659a4340","sourceRowId":"ROW-9a3fb24f1ae7d8b47e64d741","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":70,"locator":"'05 Canonical Rules'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bab4e532e3aeda73d7384121","recordKey":"TEST-MS-RULE-OP-10@e71f274c4901fd3c","sourceRowId":"ROW-9a3fb24f1ae7d8b47e64d741","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":70,"locator":"'05 Canonical Rules'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-996482e8c8f3e59631919b5f","recordKey":"MS-RULE-OP-11@a024a5509524bfa2","sourceRowId":"ROW-0286ad5f4fefc00dbe6a41e0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":71,"locator":"'05 Canonical Rules'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e696cbde4bbbdd173de5ba4b","recordKey":"TEST-MS-RULE-OP-11@431f6754fa078c78","sourceRowId":"ROW-0286ad5f4fefc00dbe6a41e0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":71,"locator":"'05 Canonical Rules'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-726c84b5620b7e05da91d11e","recordKey":"MS-RULE-OP-12@04d0287d10225094","sourceRowId":"ROW-8b735011c40a3883395d7b14","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":72,"locator":"'05 Canonical Rules'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a0fb77247467b2e0280a8e28","recordKey":"TEST-MS-RULE-OP-12@e2e102960c613341","sourceRowId":"ROW-8b735011c40a3883395d7b14","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"05 Canonical Rules","row":72,"locator":"'05 Canonical Rules'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-90e62ffcd4f5e2874311c9cd","recordKey":"TAIM-GOVERN-1.1@35b911ad2aa6f0f1","sourceRowId":"ROW-0436fe940afc1f3caff587d4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":5,"locator":"'07 TAIM Control Map'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-794cb8833bee37cbec06af96","recordKey":"TAIM-GOVERN-1.2@ad2860a2fbdee92d","sourceRowId":"ROW-9f73993da6b03a23b7d79194","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":6,"locator":"'07 TAIM Control Map'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-06372cd8f0da0c4a5f60efb7","recordKey":"TAIM-GOVERN-1.3@6129b834f8908bde","sourceRowId":"ROW-5eb3955963184e8440a784c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":7,"locator":"'07 TAIM Control Map'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5219d5bf7b6c63d700f759b8","recordKey":"TAIM-GOVERN-1.4@2cf04928037dcfee","sourceRowId":"ROW-dc7d966c3c4146ef15596712","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":8,"locator":"'07 TAIM Control Map'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7557b0339ed1973b452d5352","recordKey":"TAIM-GOVERN-1.5@92357b32e10b5e02","sourceRowId":"ROW-ea24af928d62bd87fd41520a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":9,"locator":"'07 TAIM Control Map'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7e17a7559af204a709aa1095","recordKey":"TAIM-GOVERN-1.6@382c72c8bff29604","sourceRowId":"ROW-5feb54759bd5017430fbf9d1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":10,"locator":"'07 TAIM Control Map'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-088931863b0f816065f5edd8","recordKey":"TAIM-GOVERN-1.7@198eee5654f91ae3","sourceRowId":"ROW-b37bd5ac4beebdf5f507f46d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":11,"locator":"'07 TAIM Control Map'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1f19987303341d5045d90a38","recordKey":"TAIM-GOVERN-2.1@198893140402361c","sourceRowId":"ROW-0f962003a74b184e10086459","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":12,"locator":"'07 TAIM Control Map'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a6f79e2702215dc95a4c549b","recordKey":"TAIM-GOVERN-2.2@9b46d32788988ef2","sourceRowId":"ROW-940acef05c5ae58b41b4d7bb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":13,"locator":"'07 TAIM Control Map'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-637945b2d800e709a1068351","recordKey":"TAIM-GOVERN-2.3@e28fde83a8cc90e1","sourceRowId":"ROW-d85079a2e23f7b879098b87b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":14,"locator":"'07 TAIM Control Map'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d87d88b6f59cf99c74ccb460","recordKey":"TAIM-GOVERN-3.1@2427dcd86ebd4f7b","sourceRowId":"ROW-e429c6ba34a217c4dc797ca5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":15,"locator":"'07 TAIM Control Map'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4e74a008b67653fd35040ef2","recordKey":"TAIM-GOVERN-3.2@9c41c08d8d6c9ac6","sourceRowId":"ROW-ca06a56725a9dbb4e85e92d3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":16,"locator":"'07 TAIM Control Map'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0b1b841167fea63328fae861","recordKey":"TAIM-GOVERN-4.1@104e4747b0fad479","sourceRowId":"ROW-2bc6849411b4998161149591","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":17,"locator":"'07 TAIM Control Map'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4ce5d2eb8583d28ca377d660","recordKey":"TAIM-GOVERN-4.2@c1e4d61854eedbe8","sourceRowId":"ROW-29810b95d42030e15e397513","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":18,"locator":"'07 TAIM Control Map'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2e755de779fdf6ff70e53996","recordKey":"TAIM-GOVERN-4.3@6c63b10d0830b670","sourceRowId":"ROW-8d0d0965a44f90ae3d3cc0f1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":19,"locator":"'07 TAIM Control Map'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-13fc8880730c160bb4e7bcc8","recordKey":"TAIM-GOVERN-5.1@68f585618af89993","sourceRowId":"ROW-b60b338d8fff0d68d9595662","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":20,"locator":"'07 TAIM Control Map'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-26ed007429f96ef83b97851f","recordKey":"TAIM-GOVERN-5.2@fe8607850f8d2ca6","sourceRowId":"ROW-500750772273410954396052","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":21,"locator":"'07 TAIM Control Map'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-749f7ff7b667d78244533b65","recordKey":"TAIM-GOVERN-6.1@b8216e0b6ff98607","sourceRowId":"ROW-f2810d3df144aca110dc06bf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":22,"locator":"'07 TAIM Control Map'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-16b0efb477a6a63ae8bb1c7d","recordKey":"TAIM-GOVERN-6.2@054b3cd3c85b2f5d","sourceRowId":"ROW-91cd0e78dca275cb050bc3e4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":23,"locator":"'07 TAIM Control Map'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1b9207a2e75cbaf79961a316","recordKey":"TAIM-MAP-1.1@f7aec3e0fde77d65","sourceRowId":"ROW-ca6d60a53efb1424563b6a40","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":24,"locator":"'07 TAIM Control Map'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ffea6fb7250e5b76b1fafdd0","recordKey":"TAIM-MAP-1.2@93024a692d8324ff","sourceRowId":"ROW-3e236e8e79989911c2fd421c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":25,"locator":"'07 TAIM Control Map'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e2769a3ca03f44811570f660","recordKey":"TAIM-MAP-1.3@405b97af733bc900","sourceRowId":"ROW-2642411dbdc41cc222fca79c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":26,"locator":"'07 TAIM Control Map'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5600d4d0a0a34ec4f396554b","recordKey":"TAIM-MAP-1.4@867a4ceeddb4119d","sourceRowId":"ROW-728f022e48f96ce22c44c008","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":27,"locator":"'07 TAIM Control Map'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ed4ae8171927cc6572235ba6","recordKey":"TAIM-MAP-1.5@7b28c9d1495f3a89","sourceRowId":"ROW-228008b865cc93f7efc74508","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":28,"locator":"'07 TAIM Control Map'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9f07eedf4809370547ad1b44","recordKey":"TAIM-MAP-1.6@0ca81605dd8ee088","sourceRowId":"ROW-5bdf52fb7f0644485ccbf76e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":29,"locator":"'07 TAIM Control Map'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-73f320d1da365f310c43286e","recordKey":"TAIM-MAP-2.1@24236a0f4fe9d355","sourceRowId":"ROW-b687ed4ac9e7e0f057c79e9a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":30,"locator":"'07 TAIM Control Map'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1411f2177032afe57639a8e5","recordKey":"TAIM-MAP-2.2@c9b1594e914d9478","sourceRowId":"ROW-3457b56c6f9c22d6c58a0baf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":31,"locator":"'07 TAIM Control Map'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8df02cfefceeb09a67d19dd3","recordKey":"TAIM-MAP-2.3@98b8065b9500c2b5","sourceRowId":"ROW-8d1f0528e35d17f32d1081b0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":32,"locator":"'07 TAIM Control Map'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e5fce890563c6608ea52e40f","recordKey":"TAIM-MAP-3.1@5aadf0f832148043","sourceRowId":"ROW-7abdda5765327e2160582453","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":33,"locator":"'07 TAIM Control Map'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8e546dc65f95072e96899258","recordKey":"TAIM-MAP-3.2@68f17d5dab909a30","sourceRowId":"ROW-60e3318a68cac27c12559032","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":34,"locator":"'07 TAIM Control Map'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-faa868c9c704f365daf3dfb1","recordKey":"TAIM-MAP-3.3@2dcbe4ab43aa4492","sourceRowId":"ROW-99eb80abcd3c1d44a589d360","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":35,"locator":"'07 TAIM Control Map'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7141e90341745508b12cbcb4","recordKey":"TAIM-MAP-3.4@e310d1f6e2a1ea35","sourceRowId":"ROW-97d81ae3de38e0218032e5e3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":36,"locator":"'07 TAIM Control Map'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1f605a116df3afb74a02d21e","recordKey":"TAIM-MAP-3.5@03aad24c9f287fab","sourceRowId":"ROW-76805fc34d55894ec497dd54","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":37,"locator":"'07 TAIM Control Map'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-935e7172d3881c77f8449a99","recordKey":"TAIM-MAP-4.1@47a77b8622793a72","sourceRowId":"ROW-89cd18091d66246918ad37a6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":38,"locator":"'07 TAIM Control Map'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9f141152f6e27c2a707a457f","recordKey":"TAIM-MAP-4.2@ba7614350b99a7d0","sourceRowId":"ROW-8d92ce095c217473492c4e22","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":39,"locator":"'07 TAIM Control Map'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1722d3faf62584606078fe54","recordKey":"TAIM-MAP-5.1@4170d53e4eea6a66","sourceRowId":"ROW-f4c59e325c73d53d771eb0d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":40,"locator":"'07 TAIM Control Map'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6ad584e09a01c47d45e2dab0","recordKey":"TAIM-MAP-5.2@4fe1fea3a40c08e0","sourceRowId":"ROW-b629a2051b5c632ad1bb94f3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":41,"locator":"'07 TAIM Control Map'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4b53b44265942d62f992df98","recordKey":"TAIM-MEASURE-1.1@80d658f30e1d4e80","sourceRowId":"ROW-be066ff450282829b661b44e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":42,"locator":"'07 TAIM Control Map'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-46e46aa5fadb24635330f27a","recordKey":"TAIM-MEASURE-1.2@b5c24007b17017b3","sourceRowId":"ROW-e9675d2ee0cb25ece3b514e4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":43,"locator":"'07 TAIM Control Map'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-738027b04f9e04492b86bdbc","recordKey":"TAIM-MEASURE-1.3@438e7613521eceac","sourceRowId":"ROW-9699ec5de84fe84fb76cb9ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":44,"locator":"'07 TAIM Control Map'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-167de5be43266b6f1733b9d3","recordKey":"TAIM-MEASURE-2.1@bfec014736abe868","sourceRowId":"ROW-bbec2b17d56289a7f5c25b53","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":45,"locator":"'07 TAIM Control Map'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b53993ae45fccb88c773227f","recordKey":"TAIM-MEASURE-2.2@f1b91c01b8b926be","sourceRowId":"ROW-f2f376a1c6d3742ab5caaf24","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":46,"locator":"'07 TAIM Control Map'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d54218b859044b75a190272f","recordKey":"TAIM-MEASURE-2.3@f396bee25387e21c","sourceRowId":"ROW-cacf9d8dedfae0415462a084","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":47,"locator":"'07 TAIM Control Map'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3fff6cefa8d39030ae0947a9","recordKey":"TAIM-MEASURE-2.4@30416b6b4c6068dd","sourceRowId":"ROW-5061fcbdbff52f60847681b9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":48,"locator":"'07 TAIM Control Map'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-22d6c2b68427b8210cd5ba2b","recordKey":"TAIM-MEASURE-2.5@f17bf250e010d494","sourceRowId":"ROW-310c8c5db55e1862198e9662","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":49,"locator":"'07 TAIM Control Map'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e8502161871ea11e6a0c60aa","recordKey":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","sourceRowId":"ROW-958bacc56d9f333cc38d965e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":50,"locator":"'07 TAIM Control Map'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9234fa07828e36f9aec8770f","recordKey":"TAIM-MEASURE-2.7@4fefc7d979469953","sourceRowId":"ROW-4b791ac97fd57b8f09ff28ae","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":51,"locator":"'07 TAIM Control Map'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c8f4ef69b52dd01e62f62907","recordKey":"TAIM-MEASURE-2.8@927b0554749a76e0","sourceRowId":"ROW-1f2732a147132cb5e67eddd5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":52,"locator":"'07 TAIM Control Map'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f94c04dba26a138d8f6403bb","recordKey":"TAIM-MEASURE-2.9@3e99c99461743bec","sourceRowId":"ROW-e9009361c6e3c47a613fff2d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":53,"locator":"'07 TAIM Control Map'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f0c6f5702100171550487e92","recordKey":"TAIM-MEASURE-2.10@6df5b5c790a49492","sourceRowId":"ROW-439c4005cd304715243aab49","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":54,"locator":"'07 TAIM Control Map'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-801ed0c304a568dedaaa00ac","recordKey":"TAIM-MEASURE-2.11@69c078796341cd3b","sourceRowId":"ROW-a28b0288d9744e7ead699a22","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":55,"locator":"'07 TAIM Control Map'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ba0d70127f8d118a20c78df1","recordKey":"TAIM-MEASURE-2.12@12d74b82b770347a","sourceRowId":"ROW-d9cdbbf9522be0ec6296a202","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":56,"locator":"'07 TAIM Control Map'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1b9c00df4345f8fc9edef1d3","recordKey":"TAIM-MEASURE-2.13@12d2da14f2779af3","sourceRowId":"ROW-610433a8b0c33456d6be5839","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":57,"locator":"'07 TAIM Control Map'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ec28507a74063fcd1c68b3cd","recordKey":"TAIM-MEASURE-3.1@6a9415a16f00ace2","sourceRowId":"ROW-8a6c73181832884f50e05fb6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":58,"locator":"'07 TAIM Control Map'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d01996b9ffbd15e9f229c068","recordKey":"TAIM-MEASURE-3.2@0a3eca3853caf2e2","sourceRowId":"ROW-cd6f275cf3add1eca391fc9f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":59,"locator":"'07 TAIM Control Map'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d6c2ad65a362efe0e4a23181","recordKey":"TAIM-MEASURE-3.3@6a5560394079e008","sourceRowId":"ROW-305b90ddf698d05e612090ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":60,"locator":"'07 TAIM Control Map'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1a3e285e488d437e474255d3","recordKey":"TAIM-MEASURE-4.1@87efb87b60ce14d1","sourceRowId":"ROW-897ea52a20ce5cc7040a9541","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":61,"locator":"'07 TAIM Control Map'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c380840458a4d364e0ff9fb2","recordKey":"TAIM-MEASURE-4.2@441148e8e1148dbe","sourceRowId":"ROW-58449d955527149a0f179ec0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":62,"locator":"'07 TAIM Control Map'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e130d47a07cb365b52acac01","recordKey":"TAIM-MEASURE-4.3@759303d11da3ea95","sourceRowId":"ROW-7ef5787cde66b74accddd8ee","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":63,"locator":"'07 TAIM Control Map'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7449828f49b87f0329c28807","recordKey":"TAIM-MANAGE-1.1@8f95b18554d187df","sourceRowId":"ROW-a0ededd04da90b3308ea08a2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":64,"locator":"'07 TAIM Control Map'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-03d2bbeed96d53afd8de761d","recordKey":"TAIM-MANAGE-1.2@725fe00a61b98e10","sourceRowId":"ROW-e87514e04a71bd3f97ac3669","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":65,"locator":"'07 TAIM Control Map'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6ceac51c373353cf5695bcb4","recordKey":"TAIM-MANAGE-1.3@113dba8419d60368","sourceRowId":"ROW-5995a1802cb23a347425edfa","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":66,"locator":"'07 TAIM Control Map'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-78368fcc0af8a29781cbbe62","recordKey":"TAIM-MANAGE-1.4@706dd15eb7c4daeb","sourceRowId":"ROW-8df57b7038b2a41a57860b74","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":67,"locator":"'07 TAIM Control Map'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-02ecc4d89fc6ef28fc3a6f21","recordKey":"TAIM-MANAGE-2.1@a1ff21e73495f39c","sourceRowId":"ROW-a73cd2fac4b46ad456ff5692","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":68,"locator":"'07 TAIM Control Map'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d9b4baa1fc164ba28120655d","recordKey":"TAIM-MANAGE-2.2@f861fb2340eaa0c6","sourceRowId":"ROW-aaf6c152c12d314855752277","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":69,"locator":"'07 TAIM Control Map'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-84460f677be5c3832f910dc6","recordKey":"TAIM-MANAGE-2.3@f69713d6045063b5","sourceRowId":"ROW-197aa13b5f5bdbea22bbf129","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":70,"locator":"'07 TAIM Control Map'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9f0d5db278b5efb24fb3a89a","recordKey":"TAIM-MANAGE-2.4@4c58d159afdc4362","sourceRowId":"ROW-544e28a698bfcb54f1d58363","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":71,"locator":"'07 TAIM Control Map'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-012da35c6480074625ee1761","recordKey":"TAIM-MANAGE-3.1@fa0c648cdd610fd5","sourceRowId":"ROW-b412d5ef3e2994ceae39c8ee","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":72,"locator":"'07 TAIM Control Map'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7cb6ec17f5011a00a186748c","recordKey":"TAIM-MANAGE-3.2@72d098f451a97bfc","sourceRowId":"ROW-0663263ddaf79118d84e7fe8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":73,"locator":"'07 TAIM Control Map'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4d619e8c675307ede2c65048","recordKey":"TAIM-MANAGE-4.1@ba6d42802623e508","sourceRowId":"ROW-4e39214407569385f3678edd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":74,"locator":"'07 TAIM Control Map'!74:74","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-74de047dc578a442af8c8413","recordKey":"TAIM-MANAGE-4.2@6622b89a3cfef575","sourceRowId":"ROW-3fa4568ddb90364310f79558","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":75,"locator":"'07 TAIM Control Map'!75:75","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e6fc08d6795e7c732071d2eb","recordKey":"TAIM-MANAGE-4.3@6d72e9f28c581992","sourceRowId":"ROW-dd6c7a2621768727bb6aed5f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"07 TAIM Control Map","row":76,"locator":"'07 TAIM Control Map'!76:76","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-16f543c4dc4d46ef05349bdc","recordKey":"MS-POL-POL-01@49c4c01e6c0532bb","sourceRowId":"ROW-9901ffd8b126f69ae63350de","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":5,"locator":"'08 Internal Policies'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bff94c6e58b6baeb4b00c861","recordKey":"MS-POL-POL-02@aa0847ee55585424","sourceRowId":"ROW-9ad78af677a3b5d9759b887b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":6,"locator":"'08 Internal Policies'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-18c3b5856b7195eb8239b125","recordKey":"MS-POL-POL-03@11c99e7398913f0f","sourceRowId":"ROW-29a4b876563a7c5e5f61740b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":7,"locator":"'08 Internal Policies'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-56aebc2d829bc1d7382d40ef","recordKey":"MS-POL-POL-04@44f05efa6918df27","sourceRowId":"ROW-9bf2bc3adbab1e2dee12f515","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":8,"locator":"'08 Internal Policies'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6dd208c8ae22e1b7052e9475","recordKey":"MS-POL-POL-05@9c8c386d8437959c","sourceRowId":"ROW-6e8f3330f289fef5ba84007b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":9,"locator":"'08 Internal Policies'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-57c62f2bc4ab7b6619861f4c","recordKey":"MS-POL-POL-06@8603eff3ea33a61f","sourceRowId":"ROW-4f74fcc4966dbbe7f66ef362","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":10,"locator":"'08 Internal Policies'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8ecb995f81f53ab2d0753153","recordKey":"MS-POL-POL-07@a1b6f11dcbba27b5","sourceRowId":"ROW-06ea9c0f28a4eea7435052c8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":11,"locator":"'08 Internal Policies'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-768bdb5ab1bc0b670d84625b","recordKey":"MS-POL-POL-08@ee4729bdeed9ad16","sourceRowId":"ROW-8461d2b174b2762e1f10a709","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":12,"locator":"'08 Internal Policies'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1ebf4bcc26c0c7ae2559a2b7","recordKey":"MS-POL-POL-09@30cd5cb249f58ae2","sourceRowId":"ROW-a4fae60a4a57a31922c2a920","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":13,"locator":"'08 Internal Policies'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3a2762ac612a726fed971500","recordKey":"MS-POL-POL-10@cce53ffd6ac04512","sourceRowId":"ROW-7b50d19a31477ee41f8cb382","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":14,"locator":"'08 Internal Policies'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4cfd315b828a69f5d06c3f0d","recordKey":"MS-POL-POL-11@4cbd6ed56751cc97","sourceRowId":"ROW-88027e060a43088933d7dcb2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":15,"locator":"'08 Internal Policies'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e16101766b6ce126bf35beaa","recordKey":"MS-POL-POL-12@2bcf920fc5a05e6b","sourceRowId":"ROW-e26a3fd76ddae25c27ca89e9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":16,"locator":"'08 Internal Policies'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dcbc5dff5901bfe943f9b4ec","recordKey":"MS-POL-POL-13@e8a7e91b791104ce","sourceRowId":"ROW-32190cdcaac6e3c194494884","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":17,"locator":"'08 Internal Policies'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1e8ddde52a660f099230a51e","recordKey":"MS-POL-POL-14@aa241dc1520b8ab5","sourceRowId":"ROW-d2d29450870cc664076fa776","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":18,"locator":"'08 Internal Policies'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0b97f5b2ad74817f105278a7","recordKey":"MS-POL-POL-15@66ce06439b6303c8","sourceRowId":"ROW-696891ccaa6f91b05ddfeccf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":19,"locator":"'08 Internal Policies'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0d46084a8c7227417af90791","recordKey":"MS-POL-POL-16@e96f7674899ecd20","sourceRowId":"ROW-e6709fcf212e2ab6475067c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":20,"locator":"'08 Internal Policies'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9d734aca9251e23f85045a7f","recordKey":"MS-POL-POL-17@fbd2f1193b92724a","sourceRowId":"ROW-9510c4e7c88ba4e81c0e5afe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":21,"locator":"'08 Internal Policies'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cecd872aa4bae5398338396c","recordKey":"MS-POL-POL-18@97f5690fa7f7084e","sourceRowId":"ROW-b736746ce58ff7dff8147ef4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":22,"locator":"'08 Internal Policies'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1a14643624a43fa95c3406e7","recordKey":"MS-POL-POL-19@d6f23b7346439395","sourceRowId":"ROW-03d32467ac99155fdf032dcc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":23,"locator":"'08 Internal Policies'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6de69cf5442b43e05eac94ea","recordKey":"MS-POL-POL-20@ea163decd6c07a16","sourceRowId":"ROW-ea4881077d96488697007098","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":24,"locator":"'08 Internal Policies'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fd5b429c7c727ceee93eea6b","recordKey":"MS-POL-POL-21@9a99a10275e80192","sourceRowId":"ROW-bc50ae9819bd430da4ac55e5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":25,"locator":"'08 Internal Policies'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f18a19d8842fb232a6a051e8","recordKey":"MS-POL-POL-22@7864cb607001d95d","sourceRowId":"ROW-40ebb345161d52b7ba4b367a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":26,"locator":"'08 Internal Policies'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1892f0965bd7c80c436c9e39","recordKey":"MS-POL-POL-23@daaad9ef8b33a963","sourceRowId":"ROW-cb4466fb39da00773f5837d1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":27,"locator":"'08 Internal Policies'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b2e9bdfea6e6c632f818f31e","recordKey":"MS-POL-POL-24@3ac8bb46b53fea08","sourceRowId":"ROW-1718f0c9978bf5fc219dc0c7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":28,"locator":"'08 Internal Policies'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ce1f99d380b5df18856bc293","recordKey":"MS-POL-POL-25@cbf2a67c65532b7d","sourceRowId":"ROW-0aeece3e966f9aa9680570c7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":29,"locator":"'08 Internal Policies'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5daff54a2e7776a91b1aaf35","recordKey":"MS-POL-POL-26@306487f686bd6069","sourceRowId":"ROW-41848ba037cecf3e8d074e48","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":30,"locator":"'08 Internal Policies'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-548e8615b53fabeccf1a1a98","recordKey":"MS-POL-POL-27@24ccacabdf3df91b","sourceRowId":"ROW-3719da1cc331838f2d2a68af","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":31,"locator":"'08 Internal Policies'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a7ba4204ff8cfe37742a921c","recordKey":"MS-POL-POL-28@d850b62ebf5806ef","sourceRowId":"ROW-45aa92b9107cc8cbe91ca0f3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":32,"locator":"'08 Internal Policies'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-57b100f08b16872b51f3dbaa","recordKey":"MS-POL-POL-29@15da853e19e2751a","sourceRowId":"ROW-28b0a5c33e58b821b626ba3f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":33,"locator":"'08 Internal Policies'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-25a95b708aa44243da086091","recordKey":"MS-POL-POL-30@09fcec49716e93c1","sourceRowId":"ROW-6a4a9297afc1dff568ae4ffe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":34,"locator":"'08 Internal Policies'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-aac33b7c1c0095d3be6497c6","recordKey":"MS-POL-POL-31@1e5f7eb3de495c93","sourceRowId":"ROW-ded5b9688f80dee7b6ae0dc6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":35,"locator":"'08 Internal Policies'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-70591fdf948fa15927bcedc3","recordKey":"MS-POL-POL-32@9422d7fab14d948a","sourceRowId":"ROW-2d79421af7c52328a7ca4a2b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":36,"locator":"'08 Internal Policies'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7ec3150fd7e0ef2e8dbcf27a","recordKey":"MS-POL-POL-33@2173f98ce3d3e4e6","sourceRowId":"ROW-26f367f6054ab2f27911fdd6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":37,"locator":"'08 Internal Policies'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-03141fa39a67034244b2403b","recordKey":"MS-POL-POL-34@93db44d68b4d6aaf","sourceRowId":"ROW-507b6a8b1ea536981893e60a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"08 Internal Policies","row":38,"locator":"'08 Internal Policies'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c3b7cc6b9ebb4d0c0a969fe4","recordKey":"MS-OVERLAY-CUS-01@ef016720fa4b77d5","sourceRowId":"ROW-146862f47812b9ae26370fd0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":5,"locator":"'09 Custom Rule Backlog'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0128d2b7a98b44092aad4149","recordKey":"MS-OVERLAY-CUS-02@2bdb2cb7097a15c7","sourceRowId":"ROW-5bcf96047fa08ae2b6b65181","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":6,"locator":"'09 Custom Rule Backlog'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0d68430023c4a9b785a6ff13","recordKey":"MS-OVERLAY-CUS-03@9e0dd72cbcd36d06","sourceRowId":"ROW-e171c2189c16d39a96f2d435","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":7,"locator":"'09 Custom Rule Backlog'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1d10e4ea0df7494d674f1c1a","recordKey":"MS-OVERLAY-CUS-04@1f8a3af1c8e871ca","sourceRowId":"ROW-d0055a995dd63ecb14457966","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":8,"locator":"'09 Custom Rule Backlog'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9476c4a12f354724a3ddcacb","recordKey":"MS-OVERLAY-CUS-05@312949a220d7aa56","sourceRowId":"ROW-4b46219e8a7fdf2cc64ead8d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":9,"locator":"'09 Custom Rule Backlog'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-46e4c759ecc21bf630d630e0","recordKey":"MS-OVERLAY-CUS-06@b76726eea76800fb","sourceRowId":"ROW-f664083a9316edadae58f202","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":10,"locator":"'09 Custom Rule Backlog'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-36b1a1067a792991a27e56f8","recordKey":"MS-OVERLAY-CUS-07@e7e1902f4641a2b9","sourceRowId":"ROW-1e0906bdfeb07642f5a6383c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":11,"locator":"'09 Custom Rule Backlog'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bb90348f9e2a5896c0046e7b","recordKey":"MS-OVERLAY-CUS-08@f2e9d1cd2e00bcf6","sourceRowId":"ROW-358af18f7ff4b1f1c7f15e49","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":12,"locator":"'09 Custom Rule Backlog'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e564ed37d5b2a44e10f99b0c","recordKey":"MS-OVERLAY-CUS-09@fa0395a46d9792dd","sourceRowId":"ROW-eed4acdd05169ae1cdae0fb0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":13,"locator":"'09 Custom Rule Backlog'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dd484837d1a7e881a1d6f51b","recordKey":"MS-OVERLAY-CUS-10@d2a5b80a68088779","sourceRowId":"ROW-5a3968734969f3630d199818","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":14,"locator":"'09 Custom Rule Backlog'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b90a6e14ba9fa9133163d6e4","recordKey":"MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7","sourceRowId":"ROW-7773147c27bee4f47c98927a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":15,"locator":"'09 Custom Rule Backlog'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5f7a2e982573719477f825bf","recordKey":"MS-OVERLAY-CUS-12@b7241f443c6c3622","sourceRowId":"ROW-3b4da8214b1f36c3e923b379","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":16,"locator":"'09 Custom Rule Backlog'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-47f12d060fa3350bf4d9b672","recordKey":"MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7","sourceRowId":"ROW-486bdf06094cab5c7d69c090","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":17,"locator":"'09 Custom Rule Backlog'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-59f205adee9b198802c89bc1","recordKey":"MS-OVERLAY-CUS-14@360b13cad7621179","sourceRowId":"ROW-287d7228f241422587f79a55","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":18,"locator":"'09 Custom Rule Backlog'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f6eab996467e94b66b496268","recordKey":"MS-OVERLAY-CUS-15@bdd9abeff8cb9654","sourceRowId":"ROW-429d00686051b551dcfbf5a0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":19,"locator":"'09 Custom Rule Backlog'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-56c159504ffbd9ca197975f1","recordKey":"MS-OVERLAY-CUS-16@5dc4891c003c8c70","sourceRowId":"ROW-cc2b90de75c6c003dad3133a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":20,"locator":"'09 Custom Rule Backlog'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-11fa9539716c7fdffa43e08e","recordKey":"MS-OVERLAY-CUS-17@3b8c3e6e3715795f","sourceRowId":"ROW-d471d3023dda79c592f484ab","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":21,"locator":"'09 Custom Rule Backlog'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6dc04b4232aeb1dbcb68976e","recordKey":"MS-OVERLAY-CUS-18@d7a54daf6d4edffb","sourceRowId":"ROW-444feafe1a5e5ebbe1b862a2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"09 Custom Rule Backlog","row":22,"locator":"'09 Custom Rule Backlog'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bc397b41c1cf8d2cbe0f0b52","recordKey":"MS-HISTORICAL-GAP-01@ef333861512e5931","sourceRowId":"ROW-e89882f4eefed12da4a6a681","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":5,"locator":"'11 Implementation Gaps'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-63200e1cf911c6d4aeab449c","recordKey":"MS-HISTORICAL-GAP-02@704ee5c4492909d6","sourceRowId":"ROW-79bf705493f1a4867cbe7d1f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":6,"locator":"'11 Implementation Gaps'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-daa0f7c41b24513a5d772777","recordKey":"MS-HISTORICAL-GAP-03@a613206359c61d90","sourceRowId":"ROW-83d8fb607f22481006351f8b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":7,"locator":"'11 Implementation Gaps'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fd70fc309562e66d2bca835e","recordKey":"MS-HISTORICAL-GAP-04@a2b05c620c5f50ed","sourceRowId":"ROW-6a33478c7459f33bbf72cf77","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":8,"locator":"'11 Implementation Gaps'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1fbd506854b5d3bb9b9a23fe","recordKey":"MS-HISTORICAL-GAP-05@fd1e5fbd26653f52","sourceRowId":"ROW-9dfadb8ba2471597b45b6e88","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":9,"locator":"'11 Implementation Gaps'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f79fd3e788e112f8804711ce","recordKey":"MS-HISTORICAL-GAP-06@638e326b96b3fcf3","sourceRowId":"ROW-ba9782a79b141b74dece3f09","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":10,"locator":"'11 Implementation Gaps'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-81b39cef4edd3dee70d89184","recordKey":"MS-HISTORICAL-GAP-07@9c8fde7f6beb59a9","sourceRowId":"ROW-26401adce5181a1a07a0d722","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":11,"locator":"'11 Implementation Gaps'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3c2633363769886c6fe97bbb","recordKey":"MS-HISTORICAL-GAP-08@454bf9cdcc63df06","sourceRowId":"ROW-872a502497c8d2f6ff76c86b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":12,"locator":"'11 Implementation Gaps'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-87575640cfb422e4ba53d1d9","recordKey":"MS-HISTORICAL-GAP-09@3df71044c3ecb595","sourceRowId":"ROW-04a4c63c824966582beed548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":13,"locator":"'11 Implementation Gaps'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8bcb4dfc677c96a924d4a22e","recordKey":"MS-HISTORICAL-GAP-10@9d50c828fd6ea39b","sourceRowId":"ROW-c049d1f90cd63d56973d42f0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":14,"locator":"'11 Implementation Gaps'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c265ed4e560236f22859786b","recordKey":"MS-HISTORICAL-GAP-11@4ae486b4e3826e21","sourceRowId":"ROW-973c5b6015e711024ce42074","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":15,"locator":"'11 Implementation Gaps'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dcc81e6fdd8ce0b35cc701aa","recordKey":"MS-HISTORICAL-GAP-12@a7a5a6c9616fce50","sourceRowId":"ROW-1ec6547dac8ceabb2330aa59","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":16,"locator":"'11 Implementation Gaps'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6398102f38478dc94c027890","recordKey":"MS-HISTORICAL-GAP-13@17c770c42c111ef5","sourceRowId":"ROW-69499a990ce891a907c15b02","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":17,"locator":"'11 Implementation Gaps'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8e5cde9ed7a54ed1ef2a1298","recordKey":"MS-HISTORICAL-GAP-14@9547f69026f10453","sourceRowId":"ROW-6e526396730d34d704b91578","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":18,"locator":"'11 Implementation Gaps'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3bfa3243b3d768d0d92d36c3","recordKey":"MS-HISTORICAL-GAP-15@b99678b120eb54ee","sourceRowId":"ROW-45aed31520c3c771b367cd86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":19,"locator":"'11 Implementation Gaps'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-da39d56232266c507c393abe","recordKey":"MS-HISTORICAL-GAP-16@f32af55c238717e3","sourceRowId":"ROW-f09aed123818246514cd99f3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":20,"locator":"'11 Implementation Gaps'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1b1f69704c5234217df2ee96","recordKey":"MS-HISTORICAL-GAP-17@64b248d8f26e8ce8","sourceRowId":"ROW-f5e9250ee5fb2d2496494829","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":21,"locator":"'11 Implementation Gaps'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f5f53fba8c4b571b026ceac0","recordKey":"MS-HISTORICAL-GAP-18@f5078914a88d60e6","sourceRowId":"ROW-7760ac3c00f781c033953718","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"11 Implementation Gaps","row":22,"locator":"'11 Implementation Gaps'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-62502d935f97eeeac5e85aba","recordKey":"MS-SEED-fc49123874e83c92@1ed210287f703b82","sourceRowId":"ROW-e531517e75ff6c1ea9d2721f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":5,"locator":"'12 Code Seed Crosswalk'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2f7faf27342d38f6ef068de7","recordKey":"MS-SEED-98c36050538db5d1@65ffe1e6e8668a51","sourceRowId":"ROW-95bdf4ef8e71ed1f8da8bc9e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":6,"locator":"'12 Code Seed Crosswalk'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e73889f9ced20af0bb3736ae","recordKey":"MS-SEED-ea7497b6cbeba00e@7470eaf94aa87c41","sourceRowId":"ROW-8d0849663cd435b444347c01","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":7,"locator":"'12 Code Seed Crosswalk'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d5e8111f1135221915476c78","recordKey":"MS-SEED-ad9fe38d530f8f1e@d7fcddbdb30bd016","sourceRowId":"ROW-4c7b126ab1150cbab527e52c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":8,"locator":"'12 Code Seed Crosswalk'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-27204ad2efabc5ddbcceb9fd","recordKey":"MS-SEED-3c262146dff584d9@65146e1683c930ec","sourceRowId":"ROW-89ee5d0d815e2c04f504daf4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":9,"locator":"'12 Code Seed Crosswalk'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c523a8c80760ac3824d9a839","recordKey":"MS-SEED-71dcb43d4ab69039@2cb8ac94477f4fc1","sourceRowId":"ROW-54a0cda710cc0ac226446bb2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":10,"locator":"'12 Code Seed Crosswalk'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8e28814b20c558a18501335a","recordKey":"MS-SEED-189bbb416d04da7a@9eca359a04a266eb","sourceRowId":"ROW-3398f9b98a01b2c82243a490","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":11,"locator":"'12 Code Seed Crosswalk'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-94c2257484f687030ac787b5","recordKey":"MS-SEED-fa17b2e8b13c54ec@c3bb1f47e455b596","sourceRowId":"ROW-c38cc466e1d28fe7580bc966","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":12,"locator":"'12 Code Seed Crosswalk'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1053fb86724a3b5b63947de1","recordKey":"MS-SEED-0d5943f602c4e0c6@0b72544338892151","sourceRowId":"ROW-c064988b42aeccde475a2fbe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":13,"locator":"'12 Code Seed Crosswalk'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ca58cc19e290257b24fd2a59","recordKey":"MS-SEED-fabd8a5fa3829b34@a1173a790d6af788","sourceRowId":"ROW-d91e8e2c081aaaa400d5a26d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":14,"locator":"'12 Code Seed Crosswalk'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-048ed17c8548f202c6baff34","recordKey":"MS-SEED-18fc98793e3aa932@1b1b44969e446920","sourceRowId":"ROW-09a9c737170c0eaf9734804f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":15,"locator":"'12 Code Seed Crosswalk'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1970fc007061654328fce778","recordKey":"MS-SEED-68e6b67355afdda4@2380ad816add7da2","sourceRowId":"ROW-79f5105a5614c9263ce987a0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":16,"locator":"'12 Code Seed Crosswalk'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-31e4036ea2b70dcdb4b6209d","recordKey":"MS-SEED-1362e1ef9da30d6a@a69019f699a9743e","sourceRowId":"ROW-ec127003a0d28e1c2d007c85","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":17,"locator":"'12 Code Seed Crosswalk'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6b5b38658438ed6f713aaa2e","recordKey":"MS-SEED-fc55d1561526efc3@99d4d53f8b22179d","sourceRowId":"ROW-8d4888969b27d0e629cf009c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":18,"locator":"'12 Code Seed Crosswalk'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-daf165220e74aea196058149","recordKey":"MS-SEED-273c936c3ac5a321@609ed6ce29a693b3","sourceRowId":"ROW-b8e1564c743132220f350fa0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":19,"locator":"'12 Code Seed Crosswalk'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0f062a91f71827902fb66ba2","recordKey":"MS-SEED-38a0f0c058b76861@f7e97b882e8d03d9","sourceRowId":"ROW-b3df80072b3e1b6c3c76eb6b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":20,"locator":"'12 Code Seed Crosswalk'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9dcfa180ee4d7b8819980edb","recordKey":"MS-SEED-59116351fad45b18@cef308c28bb05b77","sourceRowId":"ROW-0fc6e47ceb3fd0833dcd0f4b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":21,"locator":"'12 Code Seed Crosswalk'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-243051d26b141aefcca1cb12","recordKey":"MS-SEED-c3235745be75933b@c2946015ae62bccb","sourceRowId":"ROW-d3b71ee6cccb14b8cab0c71b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":22,"locator":"'12 Code Seed Crosswalk'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0abd362a3d2bae8fa4cf989c","recordKey":"MS-SEED-7c38f47e89353be2@c668276dcce2c02c","sourceRowId":"ROW-78719549d6f65a288a70090d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":23,"locator":"'12 Code Seed Crosswalk'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f61c745589494a8cc1b5335c","recordKey":"MS-SEED-3545abaedc039060@41f9aeca34965328","sourceRowId":"ROW-8cefef221161f5459b7ccc99","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":24,"locator":"'12 Code Seed Crosswalk'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cc5aaa08ec055001ec23ad7c","recordKey":"MS-SEED-f14ef687ebdcf6dd@e868935a9f5522b7","sourceRowId":"ROW-ec3492acce5ebbcad4dfe3e4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":25,"locator":"'12 Code Seed Crosswalk'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0611e6ea5a4ad5780b399ce9","recordKey":"MS-SEED-72c2d3940fb2e07d@a30b48de591bab74","sourceRowId":"ROW-f18954c14a4219e9ea924d9b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":26,"locator":"'12 Code Seed Crosswalk'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3060ea5de7d1c90c1b0569fe","recordKey":"MS-SEED-f24cc8315666f56b@0b522650197658e0","sourceRowId":"ROW-9b72c07bea974cf12dc2bd30","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":27,"locator":"'12 Code Seed Crosswalk'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8e46e8ccad4a31fbe6ab8906","recordKey":"MS-SEED-af63591ae8a0d1d3@cf9fcbd0c3f96907","sourceRowId":"ROW-00d87bbfab67a923114bb38e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":28,"locator":"'12 Code Seed Crosswalk'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-daa9e0b8c724d80761ef1603","recordKey":"MS-SEED-9b9cda9c97338d12@ceb60bcac22b5550","sourceRowId":"ROW-71e8ffd025b963adcc1c4b9f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":29,"locator":"'12 Code Seed Crosswalk'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-98ddee2483691df21fdb6a4d","recordKey":"MS-SEED-45c0aa82a09ceac4@b7de303ed373dc1e","sourceRowId":"ROW-793bfcc68cb26b4abab508df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":30,"locator":"'12 Code Seed Crosswalk'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e004c1fc694ed3cf9069e7b5","recordKey":"MS-SEED-6962f396beb2c752@af6c264d193e2846","sourceRowId":"ROW-66539e6f26ec87bbe11a9bc1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":31,"locator":"'12 Code Seed Crosswalk'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a4ffa5520789b092249a7e23","recordKey":"MS-SEED-274a1827288fe0cb@596d8feb02101b0a","sourceRowId":"ROW-32df96ed3abceadd78b3abbf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":32,"locator":"'12 Code Seed Crosswalk'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f14ad58e20ba9c3d677a5788","recordKey":"MS-SEED-af6d2822af49aa78@15cfcad58c3a6910","sourceRowId":"ROW-1e6816d1ec7869f6c78a5755","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":33,"locator":"'12 Code Seed Crosswalk'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6c7d1b9e10182047c0f8702e","recordKey":"MS-SEED-773a80bd6da7f832@fbd7a85624f21c94","sourceRowId":"ROW-c596af87ddb04c45eff80f0c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":34,"locator":"'12 Code Seed Crosswalk'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e1753a3f64d3f27b5e06261a","recordKey":"MS-SEED-db227e3fca1cbc72@ad3e673390385458","sourceRowId":"ROW-838a3b36ebb7fd868602dd89","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":35,"locator":"'12 Code Seed Crosswalk'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ed462f8a3432f1a0184e049a","recordKey":"MS-SEED-3b2df0684d924bea@d76862e507e52a9e","sourceRowId":"ROW-01ec318fcaa13fa5c44171ad","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":36,"locator":"'12 Code Seed Crosswalk'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d34c05769594622b7a0d8bf1","recordKey":"MS-SEED-3a800d0a422ff4cf@bb27bd955ce6ac5b","sourceRowId":"ROW-9395f1cfac7c8957e195fd8a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":37,"locator":"'12 Code Seed Crosswalk'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c4fd276f2f18f9a5e90b808a","recordKey":"MS-SEED-e7da922c47d356c8@a8f292c00608d481","sourceRowId":"ROW-5298209f409bdc7952ce82e2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":38,"locator":"'12 Code Seed Crosswalk'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-31466e9b2eebe3fffeec4ff7","recordKey":"MS-SEED-0318ca8123595a60@ce3f096f7c803475","sourceRowId":"ROW-af4ab4dfdf0104a164195ce3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"12 Code Seed Crosswalk","row":39,"locator":"'12 Code Seed Crosswalk'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8d8eb436e54f2c1685b53b7a","recordKey":"MS-SOURCE-NOTE-NIST-AI-RMF@98431fe675258378","sourceRowId":"ROW-723c6f53d9af0c34c3c60c8d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":5,"locator":"'13 Sources'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3cc42a328efeb508815b1212","recordKey":"MS-SOURCE-NOTE-NIST-AI-600-1@9f18ca8a12bc344d","sourceRowId":"ROW-cabcf78a76fd24ca003186b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":6,"locator":"'13 Sources'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-37bce2217d84e496c8b620d2","recordKey":"MS-SOURCE-NOTE-NIST-CSF2@a272302d62ba1740","sourceRowId":"ROW-29d3486160cd65d5f0105802","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":7,"locator":"'13 Sources'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-88ab4ca76e8e643617e1082b","recordKey":"MS-SOURCE-NOTE-NIST-800-53@e121d1d1460084ec","sourceRowId":"ROW-87ade4455de5bee96da0d4d4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":8,"locator":"'13 Sources'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-35464924f0e74863841ab5d4","recordKey":"MS-SOURCE-NOTE-FEDRAMP@5e0472e4d1ffabac","sourceRowId":"ROW-bd93a6a23b73f73d1877fa7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":9,"locator":"'13 Sources'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9cb6a85b2d9295354588c304","recordKey":"MS-SOURCE-NOTE-ISO-42001@87c0a2b5412aa0e9","sourceRowId":"ROW-7deff5e867302c090b508bf9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":10,"locator":"'13 Sources'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9a0995cb2a2e9d1b2e2b273c","recordKey":"MS-SOURCE-NOTE-ISO-42005@e17e06ae157a1f98","sourceRowId":"ROW-9258166bda5ef211934003eb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":11,"locator":"'13 Sources'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-538da708e81b04bdea931ce1","recordKey":"MS-SOURCE-NOTE-ISO-23894@80e543ddeca562e5","sourceRowId":"ROW-213273a7e6825bfc832b1ac8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":12,"locator":"'13 Sources'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6100a45c8df52093524d2655","recordKey":"MS-SOURCE-NOTE-ISO-38507@770b79062960bed3","sourceRowId":"ROW-8e2b57ca38ac752211982427","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":13,"locator":"'13 Sources'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-60842eac692e0e6965e75e6f","recordKey":"MS-SOURCE-NOTE-ISO-5338@643c4b69567eef27","sourceRowId":"ROW-f630cfd300d79a80856d51e7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":14,"locator":"'13 Sources'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-807e57dda49b9b198055be6f","recordKey":"MS-SOURCE-NOTE-ISO-24028@6163ca05af07cd39","sourceRowId":"ROW-23be4b66866a98ea224800af","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":15,"locator":"'13 Sources'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bb70f378c9910841aca5035f","recordKey":"MS-SOURCE-NOTE-EU-AI-ACT@52f0bd02c9eb6511","sourceRowId":"ROW-108081788dd247a0c4103aeb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":16,"locator":"'13 Sources'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1ab88fdddcba484a9e41809b","recordKey":"MS-SOURCE-NOTE-GDPR@df5de80066779850","sourceRowId":"ROW-11c15131928a0186a899fd50","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":17,"locator":"'13 Sources'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f6e8e00d12c69fb40591ecb0","recordKey":"MS-SOURCE-NOTE-HIPAA@4a70cd2d5098a0c7","sourceRowId":"ROW-87ec29517bb6f98f620a9cb5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":18,"locator":"'13 Sources'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7d4f0ecc46ee0a09c6ca2fa2","recordKey":"MS-SOURCE-NOTE-PCI-DSS@3bf9369883365902","sourceRowId":"ROW-0878eb783e475bae84c5d1ce","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":19,"locator":"'13 Sources'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cbb0f9b3143107bd6a72d8da","recordKey":"MS-SOURCE-NOTE-SOC2@4545ab4b9080158e","sourceRowId":"ROW-d6d04c1d550ccd808ca741d7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":20,"locator":"'13 Sources'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3a66a2b5b1a57dd18e378820","recordKey":"MS-SOURCE-NOTE-GLBA@dc735550e5b449c0","sourceRowId":"ROW-ad2dda4a47909d1716f949a2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":21,"locator":"'13 Sources'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cc10fd5c145f3e91b64dd64d","recordKey":"MS-SOURCE-NOTE-FERPA@07e23ebe6259be8e","sourceRowId":"ROW-e1af5f85af93f8e5737f06e0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":22,"locator":"'13 Sources'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-41c487d673284ce0c8dc95b7","recordKey":"MS-SOURCE-NOTE-CCPA-CPRA@dfbd85b2a322fe7a","sourceRowId":"ROW-3d13b97eba5f66a7e905d84c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":23,"locator":"'13 Sources'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dfc1f3fe6f57faebe925a5f5","recordKey":"MS-SOURCE-NOTE-CO-AI@0990e7efdb70bde9","sourceRowId":"ROW-c30a780babb1867fdc0384af","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":24,"locator":"'13 Sources'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-34d6b20c528e6d3e39254bb1","recordKey":"MS-SOURCE-NOTE-TX-TRAIGA@ad2fe809b6252e8e","sourceRowId":"ROW-e2d830466ab99ccbba64ba73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":25,"locator":"'13 Sources'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3431196bfa295112a1aa6bdf","recordKey":"MS-SOURCE-NOTE-OMB-M25-21@df948b26494bab24","sourceRowId":"ROW-efb19504deecd7b81a028eca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":26,"locator":"'13 Sources'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-786ffe1a18270d6e5d53518c","recordKey":"MS-SOURCE-NOTE-OMB-M25-22@281271ae37faf796","sourceRowId":"ROW-16f1dec94349ddab3f60e58e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":27,"locator":"'13 Sources'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-47543a783b198533b7edc310","recordKey":"MS-SOURCE-NOTE-OWASP-LLM-2026@c3439a2d9e8b7618","sourceRowId":"ROW-f7e376de3df6821eec1f5565","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":28,"locator":"'13 Sources'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7be0927b30b2dbca7901a124","recordKey":"MS-SOURCE-NOTE-SOX@3765787d692c0bdd","sourceRowId":"ROW-9be8ad8e05dec59d0e046a17","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":29,"locator":"'13 Sources'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8e59ee70886c9273e1d2e1ec","recordKey":"MS-SOURCE-NOTE-EO-14110-RESCISSION@b1e1206ab8a875f8","sourceRowId":"ROW-fa5aa960671b2ed3783ad3e1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":30,"locator":"'13 Sources'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ea11ea19a4044df2a44f1697","recordKey":"MS-SOURCE-NOTE-CO-SB26-189@bc07181d7e90a278","sourceRowId":"ROW-1c3a12de44f535e4a6fddee0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":31,"locator":"'13 Sources'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8075e67494347a7812abfeef","recordKey":"MS-SOURCE-NOTE-OMB-M26-04@4394ab01566ed077","sourceRowId":"ROW-ea3b58e664c1bf890acc5229","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":32,"locator":"'13 Sources'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5945b1c3bd7aebc2e748cf8b","recordKey":"MS-SOURCE-NOTE-NIST-800-171@5a19e663a8d345c5","sourceRowId":"ROW-e74ee1c6736e72557b9d1180","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":33,"locator":"'13 Sources'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-26bcb41aff2c2891eca28cf6","recordKey":"MS-SOURCE-NOTE-CMMC@9e207924a4f419e9","sourceRowId":"ROW-7734dc8054e1aa3bb0a065d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":34,"locator":"'13 Sources'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5834f89c19330698aff55c27","recordKey":"MS-SOURCE-NOTE-CJIS-6.1@7add1fcf7e28764f","sourceRowId":"ROW-eef331643b6ffd3347d26eeb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":35,"locator":"'13 Sources'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-79e9e7d5c8dd1a70f7ec812d","recordKey":"MS-SOURCE-NOTE-IRS-1075@3e893b9fcbc81dca","sourceRowId":"ROW-d18a6606f8b36e7bb230a45d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":36,"locator":"'13 Sources'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-694c57a5f9c1b62339f1f81f","recordKey":"MS-SOURCE-NOTE-SECTION-508@d70c0efece3bbbba","sourceRowId":"ROW-5ba7c6c0bcfdef3e32230b33","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":37,"locator":"'13 Sources'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6c28e2af103f552004c85a3e","recordKey":"MS-SOURCE-NOTE-HHS-PART2@9228679fc413763e","sourceRowId":"ROW-60f380e380e028f310f349dc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":38,"locator":"'13 Sources'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-92fee52a6b3b6f49e16d9ca4","recordKey":"MS-SOURCE-NOTE-ONC-HTI1@49483b2433b19c50","sourceRowId":"ROW-98d5fe2378e545f5d99b52d4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":39,"locator":"'13 Sources'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6028703c9dce7163c0f56181","recordKey":"MS-SOURCE-NOTE-FDA-AI-MD@61f59968505b1fa6","sourceRowId":"ROW-8fa6d3355c67d7270eeba24a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":40,"locator":"'13 Sources'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ab62e4caf9ef21143887d210","recordKey":"MS-SOURCE-NOTE-FRB-MRM-2026@0acc0024ff8f2e8a","sourceRowId":"ROW-ae3d01d10e21253761a95aab","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":41,"locator":"'13 Sources'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-81d47702ca991bcac72d2a10","recordKey":"MS-SOURCE-NOTE-NYDFS-500@6374340ea3d01620","sourceRowId":"ROW-fae6056afae43fd05040754d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":42,"locator":"'13 Sources'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-be2ae1415dfa070c793d9258","recordKey":"MS-SOURCE-NOTE-ECOA-REG-B@bf7f1748f4f66630","sourceRowId":"ROW-62811e3885ce0bca184cef26","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":43,"locator":"'13 Sources'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d1ef53277baeeb501d2ae4ab","recordKey":"MS-SOURCE-NOTE-NAIC-AI@7158e975d38b48aa","sourceRowId":"ROW-d79b285e8d97b5c1a7d317bf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":44,"locator":"'13 Sources'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dbc0708ab51dc4a4d6159446","recordKey":"MS-SOURCE-NOTE-COPPA@b0ecfb53ebaea5ac","sourceRowId":"ROW-e0bdcdf9a1d21918ea492969","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":45,"locator":"'13 Sources'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-263d16c1b5dbee5e5569343f","recordKey":"MS-SOURCE-NOTE-NYC-LL144@7d6edadda20097d6","sourceRowId":"ROW-881c96aa63df52c7c1a0757b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":46,"locator":"'13 Sources'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dabb35e6d2274d8f1d2317c8","recordKey":"MS-SOURCE-NOTE-IL-AIVIA@4835e2fbf12f2c51","sourceRowId":"ROW-63e4a8237ff7fde83912a8cc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":47,"locator":"'13 Sources'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8ca02a05b0160fa3677a71d7","recordKey":"MS-SOURCE-NOTE-UK-DP-AI@477b70b509183173","sourceRowId":"ROW-500ba8c96af3728e7884db43","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":48,"locator":"'13 Sources'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8055f1dd24cf1e89a87f512e","recordKey":"MS-SOURCE-NOTE-BR-LGPD@5fcba992809b3b1e","sourceRowId":"ROW-3b5874ab31e922cea4ca7adc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":49,"locator":"'13 Sources'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c50ef3890e3fd1f7f1f0834a","recordKey":"MS-SOURCE-NOTE-AU-PRIVACY-AI@da30724b50ad5d96","sourceRowId":"ROW-d96847232d467814681317f3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":50,"locator":"'13 Sources'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-99b5019b4fc061e72635cc5f","recordKey":"MS-SOURCE-NOTE-SG-MODEL-AI@82e8e54435c86c2b","sourceRowId":"ROW-aa1b50b906f7485b2663cf61","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":51,"locator":"'13 Sources'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2c4509a2a764081f00e916c6","recordKey":"MS-SOURCE-NOTE-DOJ-DSP@033ab90c34a8ed45","sourceRowId":"ROW-ed26e563ccec20d9fb0f14ec","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":52,"locator":"'13 Sources'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-770ee7f8878111f665859d26","recordKey":"MS-SOURCE-NOTE-EAR@db7aeb13e0f74f04","sourceRowId":"ROW-8b33503d26da2c737177ca6b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"13 Sources","row":53,"locator":"'13 Sources'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-af42e9d4596c17591e6d0496","recordKey":"TAIM-GOVERN-1.1@26b8d9618cddf058","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-377632148595c5c86adfd9ef","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4086bcf58c8d0b656e3567b5","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3ca60e93ad2229ddebeec5a4","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6cba878df55e47c459566ba7","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-49bf0579422fedd621a9006a","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ff4c6c068817e9e7da5c1aa3","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b53888971cf6be526e724990","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-680236880227793f7b7cd1ac","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5811077ed6abb05e50c29ea4","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9c92646df4165fc8398b27ea","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8138229e6d1dc44e0edf779c","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0d55aff528b10d1c9d995572","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0d542cfe8e2dae697281f17d","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d77e75a00a001d48c8b7154e","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9299f655dfadbd69a0ac83c8","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c3030edddb82900c8e2c7f26","recordKey":"TAIM-GOVERN-1.2@91a9127ceb89507e","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0d76bf62ff6727df2c3b5d08","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9239d9738f91e57348154da3","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-30e4dabce9659f8f0d435915","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-210bf207d562b62d821ba93e","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c8528a055947f817aff91059","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6928a8e0b964f0ffc6376a50","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d4ae1504630f2123b4b2d8f5","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1892972b8b100329d02d3faa","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3718e8be3ff9e881ebdc0e7a","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b425b5285ab391df67260f42","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6cb88126c6f567f401e1811f","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7a363a04fc05f39761c26979","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-74c73b201e61d391d67e552a","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-197703033caaf9c6d86432b1","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7bb1960d1abb4c9fd07688a2","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-69bdac3f54c92e3428338c67","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1e62f38fc8aa2c328dbc2747","recordKey":"TAIM-GOVERN-1.3@d61a82d09de245d3","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c39ef49ef171d330a0832854","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-170c9bff59cbbfcebab2ab99","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9e9a957af1531c56d18bc262","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c751690ebc5bb7f8b8d2fe01","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a45d68ae6dd33ef9c4c2d1e8","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c19ac12ee60f082c91f39a3c","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c03f8513289cce000a8f3929","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-42931f8354edd7b1e34220d8","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e026c90cee0d5c91b102870c","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-417801f23efa1aa08b82ed56","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-80180c98d11885767f6476da","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6098e3321f3d877acc09360c","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a34620500331b23d33af0093","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b280a21a2bf2bd44e4a2c473","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ebdb73fa874c56097ea283fd","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4d79cf9d5585fb797d1fec7f","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-de20955303a814c5993a206b","recordKey":"TAIM-GOVERN-1.4@a744d71de8e42bb8","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fa9c16c6b8d302a37203564c","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a532114370d568a52355b066","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-13102bcfa7180bd1614cdebb","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-97a88b6d05bb0ce6cd5bcb9c","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3e1c229ce1902e7655d7ab5a","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-67522e306664fdbf7f1c2047","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f6cee560a21cc1c6aa3cf2c0","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0b6d68ebc2d6986b6e139e38","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e0417b580b8d74692b07902e","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5fe71985116af504adce549a","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c502ad36b7ba6a26d5d0a2e5","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-faa5b96c9dc03a28e25ec342","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5518c395f9af9208a4ddad41","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-190bd94d9d6f4d081e83dbd9","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-55f244f34c5b111223840cbf","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5aae01b4573579093a07e570","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d72923dd112ec1a5ac2c0828","recordKey":"TAIM-GOVERN-1.5@e6be6927d32f915f","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8f59f7d43752e676d3c7ed68","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-18d2d01935962260915419a6","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f912e662d73d7c4b48287521","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-be8362f19f73f740bfa17e8b","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ea077d8cfde18a65ac9e02f7","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7e5630e9c09c1e7f54f35109","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-91d47790a0f006d0f72d9f11","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-74acaa0251f37fc37ea15890","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6ee4b32b3e0edbe734229e05","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3b6eabbe770abc0c4757e752","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ad6d41e1ea70384395aafe82","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f2ca5083178925e3492e46eb","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-613d62de38c67a8dcb69e1f0","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3f01bef0fef4f38c6f28ab36","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3c955981ba6ef202fcffb90d","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7d7cab0eb98cf13c865e9d0c","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9d29f843368384caf0b0b175","recordKey":"TAIM-GOVERN-1.6@26f041bc196d2f20","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dc152d4e0e707f6a97f256c2","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1b4b56bc1f2e87aacd95e6f0","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-97893927192b6645a62afbc5","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a29a980d76798b31bf036fc8","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d19ef14f9d398c6a75849499","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-af9c5b4bde43a0bdc26de9d1","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6b4e7ca57dfea5ba493f30d4","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-943854ec727dba341fdb64de","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eee823523d8a816801a7ab18","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-64ccc56bae0a7d5fe390ced0","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3ee4e066686927128be815e8","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9c0c7a07fbd4cfaecb513455","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-805167bf281a500d3c2bffbe","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1123865b414d025babc0b194","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-908988f5412b19c64295acb4","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-07e8d304b6179031e8237942","recordKey":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","sourceRowId":"ROW-866ed5a608cb779efd53f138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a9b6de43c3bf8fb0e2df0485","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-866ed5a608cb779efd53f138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-07ce0d962dd78e86bc6969fb","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-866ed5a608cb779efd53f138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a42515dda3c0bbd02bb439c5","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-866ed5a608cb779efd53f138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e6ddd83eaeaf446184cad109","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-866ed5a608cb779efd53f138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cd9174da4d3af38a38cf9fd9","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-866ed5a608cb779efd53f138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e527c4df317395e73099af31","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-866ed5a608cb779efd53f138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4d4b41001f3925eb173a35a9","recordKey":"TAIM-GOVERN-2.1@677e9c1589774ef7","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-aa1a912db0f36dfc4b8f0916","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-88a6dc42557ab1e0e802787e","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b8e95310bcb2f14d81ab4053","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-39879b2e4bd298c3884afacf","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fa36371f1468dc50f7cc73d1","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5e588ab80fd5bb4127214d4f","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cd505c5f6b66b4ac71a25dab","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9abee3adb4ac4b57101bc037","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eabcb764ccdcaf5b9ce14cdf","recordKey":"TAIM-GOVERN-2.2@212a87832b3bc07a","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-255ae4f9148d6c3aa2a0e172","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-724479c4bf972c25e1b3de62","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3090157322edca06b0289bc7","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1feefb0489a9363afbf202c3","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-449ab30b915869e5bec23e7c","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c9b34f0f3ac4b1d5a81e1127","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b015c1f045dae45f78363b55","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a2a23385ea226a8c0fed5444","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3ac1e4b2b0711b7365670086","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-50c217fbb1bb1de09eb86e50","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c30a20886579deb4f9cb1f1d","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c94c8af87ece738f3dfb8183","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ae44bbae3e94534c124f04b0","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fbac8b34aeed4476d29ec0a8","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a9e03e3ee73136e1f5f5731b","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-811744a1044275370a97902f","recordKey":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-112ea543a17b9ba2528cd4fc","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3bb570ae990081a09a373298","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-923c02f5a951f2d0eef6988b","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d6563974e87e5080e842a8f4","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-78e927f56063459939f18031","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-955eb6acb257e6cabf3a1e49","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-342a665211377ae2d09874e1","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1994a71fcb3fa213e15687fd","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-95235b5ad4a7174a6dacc108","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-85030a768bed46e626c140be","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-be2df64aaf7321e2aa4c099b","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-995b78766acfd5f5f8081c85","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e82d64b25fed4c6dfcd5da78","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-470c12d5abe9f050680c6c67","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5e1e778119cf9b4363c4abae","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4f6c791caf8fd9ea3c087d74","recordKey":"TAIM-GOVERN-3.1@0f38f1685d8ed670","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0345e29fa4c4296f34434fc9","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fd06bf6fc70b4796910ed9c0","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0e00850c435a34635f44a51d","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-25a57b452a6fe9a614a174d9","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-48f09603dc1ef38d55f8f8c0","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-83de77bd106e6b0707676b66","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-541f70117102b45ddfcbe8a9","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-953964efec96e2dcf907e307","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-61751be1df846cc6987d92a4","recordKey":"TAIM-GOVERN-3.2@c47019573b68992a","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e692cf8923b8b2cf8ea71d89","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8e17b9f45db66a3453cb8781","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f7c72d87c7fde8a911df2c76","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d1e93a0e40a23affc0b1b67e","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-000d2ad751518ad8e5018e8d","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6d8f786658c3988e764b1843","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f83ff06801b6d2bfc6bf8e44","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b08ec2fbab3f39c18ffed89b","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7b33efd794aecb9a79973ecb","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e600d4db4159512465589e86","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ef8fa9776b01b3f0da21aac6","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9f03bd985a4231c2e2a4f3c2","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3367ca516f6cc983ed1a1933","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-009ffff5dc0e227f638d5fa1","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f5558413af1df71f0f8d0698","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-21a9441cb68ab666bf3d90fa","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-719b49bcd72f7d7d569bad30","recordKey":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-92fa137e1e8b2d9f30e512bd","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7eea2b3f4ac5abea7a8d33fc","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dfdb3b50ea099fe61baf92bf","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1f6709245bb768254477e092","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9fded4f91c3848f74db34753","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-284d89ace2ad52191458dc18","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e1ef6f8123d453d8494279d5","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c64949fea1a484a2860ea52d","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7f148a77399208d44269b37b","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5e5efca352bbdba75d7ec1e6","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c26ead7da11fd4fd5738419e","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5be102aae566d1e44a5d33c7","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2791985d2d99d34c38906f02","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2820a0ec081d6df1b93f13da","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-861121eb6ef0f9a2e2bf6272","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-29011fdeba5c24e74ddab48c","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-45084912df93358384605c34","recordKey":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e6ba7a2d2c183ba2b910fa24","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-033e3ef9e4c744843ce6e6c1","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-79dc142b4c1ef2bd880c8850","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-122ac2adcd4e3fb8c035c109","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f761803715edab617f77e3ac","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-384a18d41d32cbaac0cf1731","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-72f543737976b32938e7c541","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6a0392dea7fce0d20dabe68e","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-64f72a30796b5f73a8ebd769","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0056bbe705b6c1208300cf02","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dda6dbe14911693d5c4d8671","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-268b76f9beb510d0415e314b","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-207083e8652efe682d493420","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9bcef3acf6007ede836be4bb","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ae55679718299b151f510599","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cc737dfc0582f271913ba202","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-68b14d5119a6859fb814012f","recordKey":"TAIM-GOVERN-4.3@87ee4878e85c702a","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d7a05973b714bc3307d94cda","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6585144cb6c252f7ba1d6c09","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9dc00d1c558214a6bcb1b737","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-50cd2b53edc34337b8e10afd","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-72cf5d97ac70d7b0f1399f92","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eca638e9773963e4f428ae28","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9413a21bab2ead605c3d56d1","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3893938947644ecaf7713273","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-939ed2870d7b6d0cd6831b13","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c700dfbed554dba946550591","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8dfd24b07bfe11ebc09e81c2","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6801731f186e465ffbd7c148","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-19566927c8829a14ac7b9763","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b760b3f572014d36bacab6a8","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-935634a0db608f323eee3fc7","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1d2cfe98a0a82d7c76810005","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-92bc9ac00b6a61f25ca32b49","recordKey":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c3a59cb5d34d4c2b15053000","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d1f21eaac6d8b9ed4d106b3c","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-878d4a25070938457c44b34a","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-20f397203eea8d452b64055b","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-98ac9df632cb22a7d173f4ac","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-88ec8231c77f6c644dd23142","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-19456d1d61067464ec4838b0","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6123caeab869a380d2b339c7","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9207d5ce0632d018bf1e9f95","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f97f7cedd54987d57d324ba7","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-969e2b0f2edbafcb60a85f95","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-27055544979bb030139ac487","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e13f30545f0f24a9aa305cc6","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f395385c0cc123e55279e523","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-23eed5fc01414f49d3c680c1","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a47d88aa8b1c69afd3a74914","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2c1b6f7cef0cdd8619125a96","recordKey":"TAIM-GOVERN-5.2@0c282eb98e0d233a","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e65a23fe014e38478a06617c","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1b08cad92cfae314a9b57929","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-559c4bec79d362a00f229fc1","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-aafd7b9f826cc19a06c80db4","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d03a79063742cea231508c3c","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-954a4a5d7b6a286cd0335a51","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3e62d582699f312830cefae8","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2ff86d81aba86d20d3f1e0de","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c2d3969d3e4f1d4739e8af5f","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4c839cb38a50c2d7911a1aa1","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c670cd32498ed8b0f675bec1","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-801acab5dd756497d61518e4","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2f4fbbf5e190e6f2251418aa","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9e4196eb338a7ad90b91bce5","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c9e3f45dbe63169b7bb440f2","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-151130bedb5b22cd4782720c","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9ce2ce2482c34634dde68c86","recordKey":"TAIM-GOVERN-6.1@fc5e93781b104482","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fda1aae4cfc4fe4939d9b70f","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-05988ba9db0829b430cbab43","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d78706fe3c00baa12f6c67f3","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-71320dc67e5fbf03266c3b34","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fff14846ffd3f2feb0cedab3","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6e6e45f6492fbe789561a5fd","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-65ed94ee183c03aad9712a37","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-600867840bc917698f26e2b5","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b0785e57c1819c3b157b1168","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-84259a22570d021be3521c0d","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-99e2ca4963f794666c99b121","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4c9a9ff4a004419642881e1f","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8934a5cfe06fef0ca635e283","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-64bfb03e8f17fdd745b16fdf","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-903fc6c0b423c75ea6a165be","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-76f7d038d0d61d89ee39d768","recordKey":"TAIM-GOVERN-6.2@bfdb82176b6f4825","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7015904fcf463138ae21a235","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1c7133b79f2e53323c0c94d8","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-33e93ac69c4d7ae3a16c70f8","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bd29b68cb5f5a17d5b59b4b1","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-85edb89f7830b1f1d42b9716","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9e084bfb2f74f0d584c6a2ea","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-de96c7061812e459167f17ea","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cfc49125bb26cc9549af8cfe","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-35119dbd4d2c655362510043","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-714b2935e18d0d753fa5de32","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-32dc158542338c5d28f8a46d","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4163243088044d7158e11a87","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-50ad706aad56fc42c519829e","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fdeff61f83839ce89ed7ebc7","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b1ff3bfc54661c608ff59b7c","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c8c0d907d63d6202b19bd24c","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-616f46904e0f5823fe8c4857","recordKey":"TAIM-MAP-1.1@78b3fb055e68bb28","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3d1a2e3d8d421465f6e02f2f","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8ee7d6be163635c50d4df9f1","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c04c86fb7dd9c2a3e78b431f","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-022ed3cc4fac202885d3ceea","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e6802a5254b38fb7cfb97c54","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f2989a09f6a1c7364fcac66b","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-117dc8c1a75262169f0f29c0","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-79d1749e2b9d918e03c282d0","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-426cbe12538a2689cabbc7b6","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9676b27a890ee61c01d1273c","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-452e61c32d21dd8702c76199","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c049d3a481dcdbc2f9bc65e5","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-491c56a084a3d79c051a8655","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-befaa500c3b40aa12981f8fd","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a2ac7119b86cf8aa7b60b6d2","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1b2cb4634bd876e56e3d108f","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cb9673feb41256a908351bc1","recordKey":"TAIM-MAP-1.2@88267d6e5486e9ff","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4002236ba86eca631d8175bc","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2e4700fda9d9ec86fd208bcf","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-712e74320fbde6422a011909","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-60a87ede7b808d22bc411e67","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-33e9d4a1d6ca4828b493ecaa","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d0e6f957dc014281c5c348cb","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-56e3712f1634005d5ffaed0f","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-edf988885dbf1595fb63bd46","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f5586353f99c7d2f23f475f3","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-64937ba69732826d48a46005","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e985147bfffd5c39eaec5303","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d282f7fe6b831b72cf907097","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f85d67f2ec2383042ad94818","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f8f0fb3cc7dc58b79bdec5d1","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b6d64509a359dce3c668bb3a","recordKey":"TAIM-MAP-1.3@1e631023c1414ce6","sourceRowId":"ROW-eafc5c95da5c20fd5e339a23","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c6985c434e874b32e7c83a54","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-eafc5c95da5c20fd5e339a23","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c055cd77e1a4fef9ee090bf2","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-eafc5c95da5c20fd5e339a23","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fef9c2d46679edd080f46e2e","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-eafc5c95da5c20fd5e339a23","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e4dad2ff8206bb3eda9d3904","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-eafc5c95da5c20fd5e339a23","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1d1ba35b13bf48ea7f5b36a4","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-eafc5c95da5c20fd5e339a23","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-120846b03f398329b2a69ce6","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-eafc5c95da5c20fd5e339a23","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fbe1504020f86565a1ffee43","recordKey":"TAIM-MAP-1.4@576a9621f7b44f60","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ba01247d567dc46de5b9f1c1","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e2b7e8c2794a64ae1fbbe945","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-743e4351d948890f4e45734c","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ac57f0fdcb137f06dbff4765","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cac526667dd237f02232c155","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f5f08f63ca0f8242b1186b29","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-71eb1e89ea69016a72873d8b","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5c982d0eab57b0d7bc7adaf2","recordKey":"TAIM-MAP-1.5@076d4983d14ef5a0","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4074e0f2b8ecf7c35b0e8a57","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-325bb7037594a85d0f87d992","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ec3cf2945867a1a5115a6a37","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-421d03044bb4c90450e67b31","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2811f461364fe65ce10dcadb","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-829088faac8f88a0a7360180","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-aba6f17e693dbad9e89cff0f","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a2f0748c26d9cf6890b1fb39","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9c8b9b2b586445739841aba1","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4df861041a328add0496f44a","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bb10a601fc8f5e48f7b110c7","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0b1be1db3422bbf888442e0a","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4f478e3a3db1de0cad78d44c","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e870d22025cc2e5408f6db7e","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-70f24b8b9704a2d42dfcda36","recordKey":"TAIM-MAP-1.6@be58945d827b6db0","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-322ecbf7b38402bb7d56567a","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dab471f1796189a43f00b5fe","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e7f57580ea1c3319b0a96014","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bf88f2b10f08338184997f45","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-daebab6f5b30e315af9d7bee","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1bb1e5686cf13a15769a5900","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2f6a675d7c7a9e8d6be0d7a4","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f5973eebc237b77ae314f7df","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c7df125c08473b2c264651b2","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bac36d8b318fe5f17ae678d6","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5c4ce63e567e4aa82087f6af","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-da155297a5e4a2ec2d00d018","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3f6fb0fc6c88a6ec6a716818","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-df1acf0f6ffc386fb6df38e2","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-54902c50a47d1a6c52985144","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4ed58c15ce0a635bff024aa3","recordKey":"TAIM-MAP-2.1@4508ecde43a2dc95","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2da0b4b5bfa348b7bc1725ca","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1fde675f69030cc1c88e9a29","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-473bc30e1343ca6991caa4f0","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7cdcdd8e3256d12586140a56","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-05187268eb12b353a603e4bf","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7367fc40aaee7a2b300e4a24","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b398d80118393148a42b1b83","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7f0cf2d3c1a6b81ac49fe1a3","recordKey":"TAIM-MAP-2.2@318e6e5f8367a840","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d39aff11e6ec6c73025ddf8d","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b7f2abd9b971505c09745e7f","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ac0be3bdfafd841f3b01b3ac","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ed79a4510c96b07f9469847a","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-22aadc2da28e3ac1e904ba92","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-45503ad732e9e54fb6dd0ae7","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1e6aab4e238e349e01d947fa","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-45d28f1fff7a976031eaa8ef","recordKey":"TAIM-MAP-2.3@595fdc3a6417dcba","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cd57e0eb1f10b042b0017e5c","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-af03cee91aa509c6378df7ca","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8f4671cbfe2469995e93507a","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-98a925669083b088704f091a","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-98a00dd8c7e37a3dd55723a6","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7b66343fc7ce05f756fa1ca7","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9fb2b4f5cf595ad2a1eb1b90","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-13011fccf5e5e2cdafd1f1d2","recordKey":"TAIM-MAP-3.1@8cf079d1257ee929","sourceRowId":"ROW-723912eb26a85e142966be86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2069038ef319731f09f339c9","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-723912eb26a85e142966be86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-569db7fa9ec14743a1e5d8f4","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-723912eb26a85e142966be86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9dccd0bf294b8fd810d0dfb5","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-723912eb26a85e142966be86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cbbb3f71c8995163968f4376","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-723912eb26a85e142966be86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e8351a2764fafeab28aab3c6","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-723912eb26a85e142966be86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-11da1f3e362ceeb614979390","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-723912eb26a85e142966be86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-64b24817e10520bfa3ae420e","recordKey":"TAIM-MAP-3.2@b4079d9aebeb395d","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a40d7cad32ac2690b8357ecc","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-61e650117e43d971506ecedd","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-27c7beb8363ce5776ca1fa87","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8037bcc77b3ae2123c8cd82a","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a7ce1e11922d691432ff985f","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e7a39f6481c5d43b74ff1bb1","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-488d66d393072f20320713ec","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6e6d29dd7a7d5feba09b3a7e","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-41fe85ca917a6a2434ba79c8","recordKey":"TAIM-MAP-3.3@db54472c934e7816","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-31b65281cb08c5deab06d439","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2809125371b16ef3f309b23e","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d5df9d6f96d3cb64d17d455e","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-655f77f1216d54ac4df9d343","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-be833a14af294f3e9a0cc4c0","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-af0a63334fcddccdcc606499","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-224ff874dc4322afaedb932e","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-babe2c9644fc3967e1dbe2cb","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f0531b58541f06c82aa1367a","recordKey":"TAIM-MAP-3.4@171bc4d2aa86131b","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bc5cf8bb51687a24db1edb36","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4f686b59acf1656f927d3fee","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-980b5cf35bd78f7b69780212","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-282d89431690432ef2230728","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eea82a070c397558d7c19197","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1f19a8fc3a92593d997981a1","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-76582f2199a1076a62d7ebda","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5962fe23b5e3695a0346a59f","recordKey":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-acafea894a5749ede4d2f586","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3e73caf48cebe616f73fdac1","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c53fbd631aeccaf545b03c70","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fb2575ca2e09f3949f268533","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4a9692d81f9e2e944d27956a","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f87700720494c2f203c4f200","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a9ace033c2d3e5ad3f4e59d6","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-81ad3d25cfd053aa1dd60dda","recordKey":"TAIM-MAP-4.1@59a21bb34b454e39","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-33ebd9858539e4459bc8a15b","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-654daa20682f6888973f7104","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-41c60278ab3bc8c0760b3525","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a812c9768911762e04aac11e","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3cbe860177dfa6a603b9709c","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-afaa6c34442606ea065fad58","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f1e3cb24b68608f5dcded341","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4515535134c31b25b69acb59","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-637b9b8ecb698def9d773a29","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5464d68038192ddf04033705","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2e042229f278526b39a558e9","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-13aa4f8b1fe15a7e6e576214","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-01b1c75291f722e49a06707c","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c8fcebd80dd00caa34e338e2","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9024583cbf46818d866ff987","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-463b41179104d781af45fa22","recordKey":"TAIM-MAP-4.2@0287d8ad2ea3574d","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4565dff0a376a04d22e53d91","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2c400a04b17e4fc7ae0db638","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-91e38d87220d2344133e5b7b","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9f4e9d6005c433f88b6919b6","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ff35b4c306344cc5858a83ef","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0f24565973d56edc1a9e2cd3","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b5156ba466083c754ab7d779","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-407b3e53879e3c0ed3e6ce1e","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-74f8854be305004d5ada889c","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cbf7c6d224afc733fa21e571","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5c6dd4928b6f069d890d906d","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5d424018dfd0aeead3b30947","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a558cb9dfeb9e80e466548e7","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-be15b6fdbb7504e5ecd2b767","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b9d67ad30e55beb0dc6cb7f2","recordKey":"TAIM-MAP-5.1@eeeb1c9210779883","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3b56cc6a6161fc5963385a4a","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1c1f6e1c3160fe575da90b33","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-601d111e4613f1830285d63a","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7ffd867de6108929cd6e6e3e","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-413e8c9c0a8f76a654d1452e","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1642c8cc36a60ae41048029d","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5e7cd81da5bd1786724800e3","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9f63f4d4370b3a9dbb0b8198","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-56e35ecff1eb7ebc368664e0","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cd3b287c89878fa503e01bd5","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a0fd3aad1e08a7db0611944d","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-de465ab514d11bff3e109fb9","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7c3320c0fbd5291d86e0de7c","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-52df123415472c405c003ecb","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4ebafbf5a5b02d55584207a8","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b69e40e8e25260a4366eee97","recordKey":"TAIM-MAP-5.2@d9cbb5e90cd723ff","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5757ac48c1b282813a6fc699","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-943bf26ad98d86f7df6e013c","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0e91bdc794e7470fde498f80","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4209335bdaa57f3f805fe558","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-892b90bea2f9a2a062a97329","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ace7822036e2339e3eb5da9d","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-80eba8c3f0a17b4a415cdc7a","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3057a3a68a9d4cc8f9c0a12a","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-26ca71ecf91719c88d9564ca","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a7bd82366ab348b042801097","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dc78b8f237a1af5face987f2","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e42110913c1e29ba570e7bb5","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-82fecc4cb588ede477559ec7","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1b34a3d4fc4281f1ad4deb9e","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7a8be81ab819a9adcbf37fef","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6dd17eed3583f0849ca1b4e5","recordKey":"TAIM-MEASURE-1.1@06bafc72fb94bf95","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-20b252c84b6a3d7ce55545aa","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7830096bbf82c58754c9ce67","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-aac6493c30bd0f23c1d93905","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c103a08da1100bcb374ac334","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cfdb942896b38f361472c392","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-754c56aa018324b57fad255c","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-29e6c0c379efa4e45044dd9f","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0432894a3be88052df8a2502","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5f97f5b2cfc7c7717f2c8fef","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-80b8172a622c7131829138f3","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e84d67a78d564805eb868a83","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e87c88670c0f326fc4c01108","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b0d5182f2fff94afb943979c","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a3637431d8b9bd2f3fb41f02","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2d96e89b336e2073aa14d0f7","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0c8039c94198fb0ab28cb692","recordKey":"TAIM-MEASURE-1.2@6a15ee51fbe22034","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eacb1e3abc1054a4210ee603","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f5fa7021afd2a678e9a6d822","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d0f6dd70e53a2f305e77dc7e","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8634a834c6b4a83e041a9495","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a2d76a4b46fad197c2c02033","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f3c3b53f054aa722a366d3da","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-11b2776ff0a9b42d4c934abf","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a85f6121bba159fbf4a5610d","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c9e4e1b911b4cc91f7645708","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5030a73804a45906dd4e98da","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fcb84531a26a865f737aeff3","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cb7ce3b476eac8fe644c184b","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bffe95785c13425d34a83ad6","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-77d5a996065e5a49559ad6bb","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f3efe6cea06e67c686364376","recordKey":"TAIM-MEASURE-1.3@4da0283611f39f57","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-076200e266a5eef8a5eabd7a","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e5a3bb5a71c283197e5a5805","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3800c516a6c481e40b510b84","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-229a2d8ef34dd396591345bd","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8d66e8725d4de0b5d3f70954","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4619df8fe75858fb15bc2aeb","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e35348ade8366dc44f9e0cee","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8379dbb7d735033620ca9381","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ca7b4a06807e24999ae20270","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-81975cbbee8cfbc206882469","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c4e8f7a12062344e9d7c8f8f","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bcdbeb42ee14ef0f44888c43","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1942e210ab1eb67561f35934","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a3cdd114e443bc5ae20af34b","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-10d9fd499c5de254bc39b481","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4dbfaa23ccf724ae4cd0e04a","recordKey":"TAIM-MEASURE-2.1@e9330844656a4ab1","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7af5753388b778131065d7fe","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-889a13614ce8f4f2b58e03ae","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ec32ad7d90c0a89dcd5d33b9","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7a0e5734fc2352ecc8cf4406","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-999e32e1c84ac61df195b73d","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6249306b41086f2ca5a57642","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a7a3376823659678f516be78","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-052246a1c7819d830a794b75","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d92a5f8bdaf7ebe2f1858888","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-02ec4ddf9907c31e94c555d3","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e651ab6b1c139b926c33ed71","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c094a5654608acafa6883320","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d0ce491fb44a8be336c800fd","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b715e3541b95f021dca0dab7","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-58359b154f0143d5d663192a","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-15a65575b963f2656cb1314c","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fee06bb7b058cf02f5f50cd2","recordKey":"TAIM-MEASURE-2.2@10cd0cb098928172","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-364ea647542c5e9d316c37b5","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-14f74b3ef9eb1ac2949845be","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-48e5d7a94fc584fecbe166a5","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-24a0e527168e24cefc5582de","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fed677b50b081ca2171d34af","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e02bd517b53f312333c5420d","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9163c1595183ffae9ba25900","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5e25be07535e7c69b5b9808c","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4b38ffca4945b0cd9938ae58","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-84b09c92d41750feb6b76b57","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8866ad411d3daa5081eaeb28","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7ad61918eaaaa0f556f2df7f","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8283c8fc0366829ea9a11320","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-961c792ca0ca6f9a1e23560a","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-af61a4a3c7ccf249ba68f701","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-913d053e61a769c159a24154","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ba7efdba25b7dc7da6d2252e","recordKey":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b7b059b378db3d8d4c4d7ef1","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-97640fde6eb83242377ecaf8","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fcf640bc4b77961d4f45e39b","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c7f34eddf9b802a10c671833","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-be1811a5b4627d67964d3ea8","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-306b147fe9efb3b1bc3ba892","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-30fc6de7257252b55be776f3","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0625b33a4903444cf61499cf","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-db664ed62052bb377fb07e2f","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-42f3ac4dfdad8d1cd1a75bd2","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4b12811136abb29fd893b182","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-95dda288a57c338ba3499a8a","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3263631cc2752e97d7009bb2","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a60b0ef5a76d05f4a9fa92cf","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-99e3a615b7e6001ab22887b2","recordKey":"TAIM-MEASURE-2.4@4f759def92d244b2","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4df0e0d34abc57f0e296e2d8","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5502401cd445657edbc6ab3c","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1aa57146e60eba5c32fab372","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f82d6b9636e187e43d8f7ff3","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-46eaccb4e0114ee4205b882c","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a362766aeb2c0fdf7dfa4777","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6e8c08c1b08b5954f79370f3","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7ca2995b15b08799cb13fafd","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c5845664e10a2fb64eabe4c8","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-be1def644eab420866baf76f","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b9775d897e2d341bfade5416","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-968965ff521d6daba063eb5d","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6d98ce45bfc26dad12661407","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c4d240710ffd4ed932379b8c","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ae23c4734c222417785334a6","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d685213a0c44a894fab37434","recordKey":"TAIM-MEASURE-2.5@530446e7cdd7b14a","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b03c752dfa897009a48c6fd5","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-358837d4f6caf413b55b072b","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bda1bf3ac92eb6dcad220339","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ee81530599e5389eb6481fce","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-82c3dc1f2c67befce64d062c","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9544692b33dd74b57430df0d","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f221d682b88853801c9d6a2c","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-62b0f611c04202c370e680f5","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e9c37cf3e80eeab88fc7a29b","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8e6ef135244c10eefcf103d1","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-805542a066baca11ac165629","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8d6800ec6e3a77ebb563b940","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-66f7024ca804d2ca78a10eb1","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0d8df92f02aff93e09a10f59","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3f2e9f0e95b5b26bf12e5221","recordKey":"TAIM-MEASURE-2.6@36a069327f5d2611","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5c02427891da81845a423672","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7991305cbaee14a63c72f45f","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2af5069f6d82e192706ef2eb","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-98ff9851dce38de7bf3b4e37","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7580abed2860bfc99bbb933c","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7a5a425e2696385bf133130e","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ccd66ad7d163cbba3f8e64d5","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-08c85801be334663b8831e2c","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-96a722a111d0b8d711820ef6","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e43cf919510f01562b26c4a1","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2682597756141bf157b487f8","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6403f638d39c2896f06a1d00","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c7a389c0a272dd5fa5171bae","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-05f6d7a491f087fb43695385","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7825aa246f948bad72c26a47","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-74414db15e1d6bbdeced687c","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cb4415bf66f61a48d0a2af6f","recordKey":"TAIM-MEASURE-2.7@5b57e3e360c405ae","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2c2852845820f28db69703e1","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-92325b15cc6fb6799e0679c2","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1bc83831b3396f5f4eb87822","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d33d8b3be26f8c4e2f5969ee","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6363b260b7cdbd47805b647d","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fbd7be082d6a58f431b81738","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fca4cb72c8d3478ebffde3b2","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-21cbba421b8704ffe1434b4f","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-06235fdbc1ac2dfc5d8862ae","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b215783692803fa35e5d9b7c","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-64b4209629b47508d1e7cfc7","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ab38e96bb891f0ee4e982f69","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bf65a54defa5e5f3cc3627b8","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4932b6f8ae8e0f665638dcd7","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-71d63ce258044783b0d7518f","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a9b4b18a5d33aeaf6db9bdee","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-baafb91bd6726942fed830c3","recordKey":"TAIM-MEASURE-2.8@263030dd27d71a53","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4f52eefc83cf6bf3352c6376","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9f8a441864aee70b7647e3e7","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8ac5488872d064e4f2f32740","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fe0ff447e7738ce330a0331d","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bd0bc2d5ffbc73b4321a0d97","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5c06851399a47edf98938b83","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-09cf149e654aad9e5b6ef1e0","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0fe704d4e650b94a4e8b42d9","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3a5a34008afb04499b0fc322","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fc92d7cd5cdaca2e42401256","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7d915e0b3fc2781bcc947c7b","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eb61f4275df2d39b390b6794","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b36b663ecae9da2b470a2ffc","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-45b590c8d475305ad854f26e","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cdb7028225723118bb27c808","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-35d9823d802498561b6ca66c","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-80a48163f7ffe3bfbf4e6149","recordKey":"TAIM-MEASURE-2.9@81925d68d826c01b","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9ef853762b868526b80c8a88","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fd743abe75ccaa98bf9bdb40","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-87148e8dd0321e82c730f232","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b55868e74a11d002f02d6d25","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d9ee782765645c09c0c09701","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-036291f884347c3c90825dc2","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3c4466a7cf34d970d5dcc844","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d70890542247dba821d71fbc","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-24285bad1a222447a78913a5","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-12b59ed7ff0ea94d8a6e5922","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-599cf658d5a4955092bbd9dd","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-93a3bf909075aa76776e3c64","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b6ed5251f5fb440f128822ed","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2fccb461f1b2483df6aff467","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-787036c12ba4408d975b1aa0","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-743a95b7229623d718c1802c","recordKey":"TAIM-MEASURE-2.10@00041240562d2f6b","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bca0e1ccf80a031557764636","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3cbfa09042d9639d3f55522d","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3c1257be3f9dbb197ecc6937","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6437d56d5eec5c8f02fe764c","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d2d26b536412b58af9c21f1c","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-88948e522b6ca56b9280c32a","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fe19448adab98ea4cd7ad11f","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-acf64f117685b49c4ffe1b8d","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-40724695a6db04712680c83e","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f80d54ed95204a6360f7655b","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-75c8dce538ba11c7475f8f70","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-78aacf6822f00b2423b70e59","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cb0fcbf072421076c749f560","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b7657ea36e4b5da9ffdf4a2b","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4cc370118cb912692ba47d9a","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a842a6b7020f454e7140af54","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4704252c843b429e7f9869ab","recordKey":"TAIM-MEASURE-2.11@c547147a38410e2a","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-25b1935b09ef048edd2cb5b8","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-274e5cdf2a81dbc52e42750a","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4dde73c090c92d0eb512a0c7","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a8524f993b5f9252ef326eda","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9c93ed9857ba7a25e46427de","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-298459137ef277fbf9ce5289","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-733a5afd157e1a7a2f825e31","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ab5f3a0a310b4f1b927b00cf","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bdb45e90b61e3077f91e0ca2","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cfbedad9af170769d23805fa","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a9e1d6e100e9265f58c8551c","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-26499766a87602ca03f5bd8e","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0f55ce52f1a02b472732ce49","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9123f652477ff573cb8ab24f","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7e71612de998e819bb5a3d5e","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6ac2aa0279a39d4571607da1","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-46f43931b662fee7e5e03135","recordKey":"TAIM-MEASURE-2.12@242501cce6559442","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-087d844075a3e35b3be9766b","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-46048fa8b040ac5d450a2080","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9dbb1493f75451ddb3ad8e70","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-31b4ffd1adf4ee7694f9db90","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4529ff599e5ee6c337772246","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8dde5b251071d8403595ac47","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2862a064812bd33213bf19bf","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d4237c74079379a71059110e","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1cf8d192e0e8467f22d4b7d0","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4ab142f24010712f2f80d34a","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-75e43364c2bc4f27aadd58d3","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9b8ed0b390f2db0245216107","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b5eddab740bff529716ae870","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3288675f3c349b17bbdceb14","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-732ff5827ab48801292c41cd","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4dbfa5fd4dd0c1797bb17aba","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f174175463bd1cd7f0d8017b","recordKey":"TAIM-MEASURE-2.13@48fc4cc20ecff047","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-adaad5c2cedfc56ba1578359","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f301539ad33d3c06f82e81e8","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-653c30648247d5c7e719fe63","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0e38883efb067d17a9580d37","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0376d9b171b615ff5b0c2dc8","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9b00a9c07ea5f435ce3c89d2","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-335306ae19d7f3d6073ac9ac","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7ef54b85ac0f5e6219b39efc","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0287eb4cd55c195802921029","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-23948b30ef48d74707662454","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c28726111cc9ed14b061e4fa","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5112fc130d49a247056ba688","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a6dc97d12d73bc0d305192d1","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9c6acba254167cd9aa488cbe","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7c5de87761a18ebf401d6a5f","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a2513069ca51b9c76ae01ac7","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cbbabbc3fd491057640b9992","recordKey":"TAIM-MEASURE-3.1@1a8a34c7269bc006","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9b803f351e7f32a8786fabdb","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ac6640e28c78c019b1a8f4e7","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c6d0f82ce171d783e3c4fe77","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eb29bfa7860898d31cecaf93","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1fe789351386c3c82fd76042","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-38d3bf52d9669287c0f1fb77","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8e821231094acbe5e981b972","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f5d29ae3ee77f69020fa0ffa","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-91f958f6243f7c16fcfdaf17","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f28e813649f5e65b739b9445","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-580b5a35df3412aca545620e","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-481ea33f8de03473532b7933","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1bc83abaae090b104c44d2aa","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ffbb422dc7360b82e9cf3ca3","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c2193c5d3e7b0fa0893a58ce","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f1759b720721269e95d75afc","recordKey":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f6eaed70986267cf6debabf4","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1ca3f6638959f754faa8a6a4","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-efc5ded1e28792d151f29125","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9477a79b1fbcc291433d453b","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-763ddd91ec956d846ad25db9","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-059cf622fcab92fe09646eb0","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a67dc149a0f715611e519169","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-beca9efd2ee2704be9ac0a28","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d765d4830ffc32cb5dfc9154","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-21d5dc92690ad41b51e96978","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6e9a34e2a6c64ce7622b8749","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c058cbc72fd28d17b6777747","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9d7e02272a2a44ed1bdecc2a","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-37c5c34b9ae06359599a9a02","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-36eaa0233420104688fdd186","recordKey":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-674262bce42ea5fd6c19f8f9","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-20bf01c2166a432b4b951a86","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7945927f32f15391ac19a7eb","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9abfb130dad2c2e2055d6edc","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2947fbb7d4da672a576a0ae4","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-39ead1e50aa078af7ca30da2","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-09a9795f69d408e362735a2e","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3c40124550081bc6eac11af7","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-82907631d7a8577481ea79a4","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b96c09d485770542fd568ca1","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e4bffd16895a562b6ae90a27","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9df0711c58382fb9910d3152","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e824eeb47a8a8a249a695e86","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-88ce5b47abcee92711c409ac","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4ab6105602d0deafba94ad7a","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bd5eb2380dbe62b50d00c7fa","recordKey":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ccb85b7daea6251bd8661498","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a0a842d6de49c0d8e4b4c411","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3a05ce58d1c5c306eb4f2a39","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-506f0d23fcd30b69bd2ddd7e","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3cb5a1be6010285fb3142f9c","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6f6d5ea222977c67f488bfb0","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1e7de7524b4d404f27274356","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0a8b56a52f7e6f2ef9690c12","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-75a60347d1e764c1675f0131","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8fe0697f47f2c852e1cbce59","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-be0311e477089e78ccd40f18","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3febd8ede6b88e6367521d99","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cffc555a5ea6ea418aee1b19","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-539fde39557fa8b1d02461cb","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-07ef6d661280ec506a6c4232","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-87dc1ad5d79391c5d94c4887","recordKey":"TAIM-MEASURE-4.2@3880f07b20cefd80","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-59fa6e08eeab40a155771182","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8469e4213305a485fa994ca6","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cd5a4daa716d3a75a41a6b56","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4d68b9e6192d24b57097a887","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e2ea77dc36e241f9e2669825","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4d0fb9dd1b1b594afc1b23a7","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1f661fe1f6670ed211a5e3f8","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-435c033ec98d93473d7c8b2e","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9585577a2401e7ee8be97a02","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-583dfe36331b88849c52d4a6","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ec937961e64ebd541f937da9","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-050c146c5d37a6d250fd737e","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f57f6ed118ed4c693d73fab3","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f4175088cc2ef6e9eac7a37c","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-43f1ce5b4ebec8962eba018a","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-46c71ebc85bb4767b3656d96","recordKey":"TAIM-MEASURE-4.3@0b263792260e087e","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2492dd3cf1383b273cf30277","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f7b32a3e807ed345512890c5","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-be2f5f1ea48361dda68c354b","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fae04b2e1d74a8f26e776328","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f21f5da720ec6a13222ae18f","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-69e94446315508f4c4dbc5ad","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3deb824adee23d2a56a5784f","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-33690c5c3faa99a54d5f6002","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1d2583e5a6d8d033ef7519ba","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1dc091f0a0e5a9d0fab8c148","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-39e4bd0fe62bb7721cf34a51","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f073f0b39a71f0c7bf86d757","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c374f92255a0676518149d04","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-efeb78950011c768829f45d4","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0066a431cad1cb6e88811202","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0a59b273665ee367c3a6167f","recordKey":"TAIM-MANAGE-1.1@b474c5c19115a785","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-de736c272177e8c97ffd0ce9","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-106e792dfce5b727cbfc23f5","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e7ca9a00d1038dee41d49c55","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-327249e7a5873a2664fcd343","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-aaac934bf67128558fea9d3a","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-446c1b72bacd26d40e66a127","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5d976170a109ed4e66170cde","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b6e05693cffbe1ce7d507ed5","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-60db45d00a4f285f7aa128ab","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-407e79063bb0e67d116b4181","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-edf4078e94573fe5aa9c9efd","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b7b959cdf7ec99ae9f00319f","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-042bf31ef786317f013380f7","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a9659330c930d6fed5dc5a88","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-354f9e7ac7ecff6bbe934b58","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f63d6f41bc5380fc2c4e7d1e","recordKey":"TAIM-MANAGE-1.2@a705fc2f096d2e46","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b2accad48110fd69c39e827f","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-071f571c1f0ff8f5a932a2d6","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-958b29d8d5036904efe17fee","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3cbbac4f660135f761d90408","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e6a7f478173cb9193adb28d1","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e40145fc9119c157753c8c73","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3372622a756e32c9fb34c5f7","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-15c7f9bfbfdf5fb331430439","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-451c24274d1cfd5029624076","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-50d7186a4ec05c2d13013631","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5e8f7af1c582891b6872caaa","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4690bcaccaafaa68806d0032","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e73462329458ddb855e6e9e6","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8756ea9795e1206d42069280","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2035c3874498e558693d2a1f","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6fb9405ecd57cf8fa81434b1","recordKey":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-960415227da55ae8619f65bb","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2658c3051dbfb65b17d48747","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fe54e0f90d770711a92fb02e","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e3be706b743b5bc67da27975","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c0110ed120e01a1252541c69","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-05ee8e5b300b1607d2520655","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e4d7c47b5bfc26d5b7ee7e0f","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bdedac2ee84242375c66e529","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e553bb413ad239d99a74b132","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fc88d9d5aef0099362cd8af6","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e151242ddcac20654f824027","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b399e2032f345930bd7dd6e6","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-44a9691f4cfe513149ed4adf","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-39411c29c7828a0f630fe27f","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f8aae7781b0f4e7ccc0bcb25","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-02851641471ba62a7512622a","recordKey":"TAIM-MANAGE-1.4@614e57f0276eaccf","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7f8353a4d86d96480e6feacc","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a9d2fbeeee4ccccc797bbd26","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6d8d4b77036aa807b8d2e69a","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1c3145c7a310868106a20534","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-432c51a9da11bb4bd6b79885","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0be0b23d495c42d08cf207d1","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4f23b5e0607f349babe58111","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-179e19fde65a1b96f3c60e8b","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-08854c8a66ae14745d9fa6ba","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-55675982668731a4e2dd4a48","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-008fd9a612bac93c2f6d4497","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3972127c6c70cfcbdba4112a","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-03058ee4c26da796edaffe52","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f373b0009596da086aa3f5dd","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5b4c76682174dcb63dfa2cbd","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-90b93c99b56cc299ee3a6e70","recordKey":"TAIM-MANAGE-2.1@aa163cc990ffc547","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-59550c06e5c13688d1c665e5","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fbd489090421b26cb46b62bb","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0ff11cee8c278518326b7644","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a2411f29ad0370066403dbda","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-324f841d5090dee6a88c0b61","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-49e43153037c75de0473ace0","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-365c0b84883ad5152b971c94","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-93b391c9e4c8f70d36b595ea","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d2fc5b99f2c0f79db8747256","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0edcda0a2e6b523b85dbc814","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-004bbc3dcc247c2f53c9089e","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0c8fca77c51f7f229958b068","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a3b926cca3b28ef6273edbde","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-46514ffdcf80446efdaa2b38","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0e73165f6dc1705f10366928","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9ba0a962dedf25b129c54068","recordKey":"TAIM-MANAGE-2.2@14538be506abb510","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e6312e1d158015cc7dd54104","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a891d26f6adf9e1f338f847f","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-767ca7817cccd689edb66cc8","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7487b6aa30ae06549c791f51","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-63b9530ed2087ef8ea891ffc","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-da07c5067d4cd9c885e89a67","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b2d7e4710c7e1d20ab2a6066","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6ce36740e87806f633fac420","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c5c76cf1392f08e9bb8a50eb","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-94001327bd1b3ed143c3bcda","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-44a0c576112887b3a7895f82","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3ebc477a0a2a6ced0d231cf0","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-baea571a56ef6b3a2bbf3f14","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f4ccf745963427c54280681e","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-933fd4f17280a6c1c88b7fb8","recordKey":"TAIM-MANAGE-2.3@438a1a9f5069b57c","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-06af55d7da8a78dd55303b70","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c10d3eea668c407ada692928","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-279df1f93992faeffb765637","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ef10f536f3573dddd99d07b2","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-44bc6636126a258f511c61ca","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-82a0b6787e6276d84f339f22","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cb6cba4635853b63c7be8fe7","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-823f69d5bdea2b04e7cb1015","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6550c7ca3ccd0b6206a200ca","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-196d741eadcf9aacb392abc6","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ed68857ce81860fecd9f9bb7","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e868b05792c2b1f6a8cbe28e","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c45dde2d9a91e1653e4dd0b6","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d82fc96d2320af1f56b08a03","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-27319a6e77a2664dfd95e3f8","recordKey":"TAIM-MANAGE-2.4@7716c58006958476","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-44a5b8009721f979a2ccdec0","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-03be1cbb59362f61de3979c1","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-39202741bbef3c46a754fda8","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8a60d1e4309faa2a3075212b","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2b7f457dee6fded44ea6173b","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3f9500275532c131f6df499b","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9c77c83fb4933cd6f6111b12","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6035febe0cdb3b2922853d5a","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1ea85ddfa71d447e1df970d6","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-01b89c7f9436e4dbb0980af0","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6197a2f5a81a394f211e02bc","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-88cfffafc29af18994ee452d","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-afc9c9b8bb9f911373fe91de","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eb3457a62c2216dd199682df","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-828481c6d78580a8ccb8c527","recordKey":"TAIM-MANAGE-3.1@019b36616e569086","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-92812077f9f8728ea22bbce0","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-651ff1e8e3f2f6043dc584e5","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5d8924834e577886e5bbd548","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a45ea3a5fdbcdb1f2806c24b","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-263bdbde4b35b5404cc6a284","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2a62a0cf3f522965a73b3b3d","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3c55f26fa9251832875c9a0a","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d07f95268471ce29a04a4208","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-64c7eb073e91a9dbbe04ca9c","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-813bd0356058c3b95b5ef005","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-96d1b57c7e18f45286c53c01","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1648d5709c5851d844a5de5e","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-89e7838f99e30acd9e7570f8","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-58259411d921122e69c8677f","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bc2470c2ca0d45f05e5839ab","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f577c8ecde138828d1b35f35","recordKey":"TAIM-MANAGE-3.2@3a8b74098cc691a2","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-621a5932a4630fb67dfcb4fd","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d6407e2dd6496250728510d6","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4145d83c27fb891bf9d80ed1","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-37542de18887e14caa96b781","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c8e57d647b8128e018f80057","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e00908909fb2350afc22f104","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2444e4b56f799e9b0b6874e0","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4790f11783bd204a463b7072","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8c02eba41b07dea5e08ac943","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-320caec260046b1b47996d04","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5bd10cc2306383cd2686f7ca","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dc4fbf75bd2ded6217fd5423","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-18fa551da837195e89dcbced","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-92fe9b8f25967addf479ed9e","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c00cca02e50543e67a404b09","recordKey":"TAIM-MANAGE-4.1@46658ac358537223","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-52c7700e6c2752945f00738b","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e0c19837f1a18ff8aa614458","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b4b97d0cc4b72cd6ffa9033b","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1baf67831dadbea683ec92e9","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1a4f2a3b65492ea15caed639","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bdf95bbc1779058b9abec435","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-04624f43b684d7ef8782973b","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7646fbdd38b655765c7d6730","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4abf316e3b3b90252f29f24f","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-86f4ab5005a1bb1a22f581fa","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9c7772757c221538750631ec","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-42556bc42795f43902fc364e","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2bfaf3a9af368ee7a61e0f55","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-773a38d81e2b121b5afb745d","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7fab593848ffb0fa6e7514c1","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1a33dcf8424d8bd7c10fe008","recordKey":"TAIM-MANAGE-4.2@c85453fdd5b795d2","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-98b70b685437194904936632","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1f5c9bc76d15de1fe20ca0de","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2dd5a69a667281bf4be007af","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0ca93569e180d3b935f5eff0","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ded64291c064d1da466aaae4","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2ecb07d3203b6198e12cde1f","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e55b6fecbc18e3a53ef0d4d8","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7d69b110e2e5ddab4a1ece97","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a42615d3df73b746a0ae9f75","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1bdc7ac42ba77f6f85fd8a7f","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f8c1b2f11fc07cb8427cc0ab","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-846de4706399c8c39ca5bcf0","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-edc3ead683004317430fde64","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-40f78679625fb590249f35a7","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c0e2487c6eafa96e5e5c4c6b","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c11bbd66f86bb6f8662f75fd","recordKey":"TAIM-MANAGE-4.3@86067afb96e12a89","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-564a6f1ebd13db6f8a035260","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-02e23715a1be6748a5b43328","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8e37f46888a7b18b23f23bf4","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7b6f20af75612dfa4dcd2df9","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b3ba9184d25682d45303338b","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7afdeba52a8fa54e0faf5533","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0352c3ad09353317737cc523","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a5c5079641beab61d1999941","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a7824bf497d48bb991e94bce","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b49515284d15c60f9c8c95a1","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6896245a8c584c7cc16c7a71","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ef61afb7e331118bb05dc3ea","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e5b842e26d7a41cf0ab9361a","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5142d3d51519d2a950a3f42f","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-926f8bc6b40924b9caaae294","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-64f4189a9ac9baef927e8d16","recordKey":"MS-POL-POL-01@c04293698c8a9261","sourceRowId":"ROW-96a38ebab06ea9cb3a65a994","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":5,"locator":"'17 Expanded Policies'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a8af2199088cef5b29976ced","recordKey":"MS-POL-POL-02@1d53076e8a906a49","sourceRowId":"ROW-9ca2c025b0be78c5fa53efc4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":6,"locator":"'17 Expanded Policies'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-35cb4867523c1bfbcce16ba0","recordKey":"MS-POL-POL-03@3cb30c5e249da778","sourceRowId":"ROW-1883b9fcaf40536aa40f98d7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":7,"locator":"'17 Expanded Policies'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3a66ce7bb647defb2d122be0","recordKey":"MS-POL-POL-04@879f79e7b7ac1d86","sourceRowId":"ROW-64cf0ed804f6f5363102ae87","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":8,"locator":"'17 Expanded Policies'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c60fafe1264d8a74daa53a50","recordKey":"MS-POL-POL-05@50ff2ba2fff0e774","sourceRowId":"ROW-ceaf917e903e8907ab081b0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":9,"locator":"'17 Expanded Policies'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d8773777ab8237e1c0b0922a","recordKey":"MS-POL-POL-06@3e3864614f0da24e","sourceRowId":"ROW-220b71b05d69c729b91f6c15","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":10,"locator":"'17 Expanded Policies'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c63a6191e4b07106ce1760dc","recordKey":"MS-POL-POL-07@a95261fb9bd47400","sourceRowId":"ROW-77ec1167bfad52f3f9c58084","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":11,"locator":"'17 Expanded Policies'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4aa1025ff91be1da3a898043","recordKey":"MS-POL-POL-08@6b73225de437a7ac","sourceRowId":"ROW-c3a4023c8ece1262261f76ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":12,"locator":"'17 Expanded Policies'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4506304f18b6903e7e38a8b4","recordKey":"MS-POL-POL-09@8c04be5259127986","sourceRowId":"ROW-f10db7a3fc71cd58d20f9b9a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":13,"locator":"'17 Expanded Policies'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a6e80f473256223fdb166e24","recordKey":"MS-POL-POL-10@85ee73762e51641d","sourceRowId":"ROW-f57ae840ce101882a829a7b6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":14,"locator":"'17 Expanded Policies'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9868e1da08346c6399cb58cd","recordKey":"MS-POL-POL-11@2c947637536e9be0","sourceRowId":"ROW-7220351995c84a97eb742df1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":15,"locator":"'17 Expanded Policies'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f56a190d4c66562222422331","recordKey":"MS-POL-POL-12@d890555e2ad21089","sourceRowId":"ROW-4fd103fa040bc68a148e5205","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":16,"locator":"'17 Expanded Policies'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c2c148962e51b92ac5b70616","recordKey":"MS-POL-POL-13@05690649552c9bb9","sourceRowId":"ROW-05d4495743694292dd58efc5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":17,"locator":"'17 Expanded Policies'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2df1ec87cba7d153391f2580","recordKey":"MS-POL-POL-14@2a83e30bc6f88f8a","sourceRowId":"ROW-55413a8273bc58566f8b0c7d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":18,"locator":"'17 Expanded Policies'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e8dd07f87f60bcb83b4547b1","recordKey":"MS-POL-POL-15@92db373c77f25877","sourceRowId":"ROW-ac9757141b31b29e4a097326","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":19,"locator":"'17 Expanded Policies'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-358e0edf06c7d25e3f273bad","recordKey":"MS-POL-POL-16@ee0f7d2e98b800e9","sourceRowId":"ROW-3fe25bf3408d412c42601d11","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":20,"locator":"'17 Expanded Policies'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-12170719a4c3498c9eb5da40","recordKey":"MS-POL-POL-17@ec7601a706961f3f","sourceRowId":"ROW-96ddd6557299ae7b26f47285","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":21,"locator":"'17 Expanded Policies'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3f78dccc42baf363c03360da","recordKey":"MS-POL-POL-18@ee2264a9b561bd1a","sourceRowId":"ROW-a4efbc2c172662e109cef298","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":22,"locator":"'17 Expanded Policies'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9ef71462a6bb12ef060a79df","recordKey":"MS-POL-POL-19@aed1a48acd06ccbe","sourceRowId":"ROW-94a4333985fd902c69308e09","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":23,"locator":"'17 Expanded Policies'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-70d345184427550e68d62eac","recordKey":"MS-POL-POL-20@c9a396428183869a","sourceRowId":"ROW-1ebb42d047010ea3d1abe124","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":24,"locator":"'17 Expanded Policies'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3706c0a7310d8203d059a9e0","recordKey":"MS-POL-POL-21@20a70c7870aa9b0a","sourceRowId":"ROW-279c9f0d0cd7ab461ddd5e51","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":25,"locator":"'17 Expanded Policies'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c42fbc4de752e9030836bf64","recordKey":"MS-POL-POL-22@e64fee0922267d4e","sourceRowId":"ROW-e3679e05b5d9735c093f4df4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":26,"locator":"'17 Expanded Policies'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1cdd64131a327ab076ecc659","recordKey":"MS-POL-POL-23@f183914bbbf48a36","sourceRowId":"ROW-d2ae9e51445e85e9a5838004","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":27,"locator":"'17 Expanded Policies'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-384650b03a05e0a8d8ccd0b9","recordKey":"MS-POL-POL-24@1d7f4f0e0bd28468","sourceRowId":"ROW-364f293c73297acd9ad6f2b0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":28,"locator":"'17 Expanded Policies'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2f6ab98cf9917387cbf413d9","recordKey":"MS-POL-POL-25@597e30d9cfdaf3d4","sourceRowId":"ROW-7c7208cfbd6be32aee6cc43d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":29,"locator":"'17 Expanded Policies'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-66fce17adb2aeafa34654ecc","recordKey":"MS-POL-POL-26@d4fc522de78b75ea","sourceRowId":"ROW-ff6bed5cb4999e2c64ed126f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":30,"locator":"'17 Expanded Policies'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9835db7acfcab37de7578337","recordKey":"MS-POL-POL-27@68833138d9c86a50","sourceRowId":"ROW-f17ad0b8f8631254ac307260","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":31,"locator":"'17 Expanded Policies'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-beb134bc387041515c59362a","recordKey":"MS-POL-POL-28@0647c4283f3dd806","sourceRowId":"ROW-d7be2e212ffe99f49066c043","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":32,"locator":"'17 Expanded Policies'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1b98c900029c7078db477ac0","recordKey":"MS-POL-POL-29@0ed02484ce9e6aaa","sourceRowId":"ROW-d83f848af5d7b43eed8895e4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":33,"locator":"'17 Expanded Policies'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ac839b57de308cbc100c8ad8","recordKey":"MS-POL-POL-30@83f7dac5a0008a83","sourceRowId":"ROW-683d9e80f269c2b0122d1f21","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":34,"locator":"'17 Expanded Policies'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-84af1d4790a853f365fce2b4","recordKey":"MS-POL-POL-31@0c25dadb14d3c446","sourceRowId":"ROW-ea283be9b23ef77d1ea41b7b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":35,"locator":"'17 Expanded Policies'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8b2348b533bf44a0c415c152","recordKey":"MS-POL-POL-32@04591876ceb8b167","sourceRowId":"ROW-6a98ed4ee6db3f3a8b90dd1a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":36,"locator":"'17 Expanded Policies'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-53d9e7edd5b53f41e0f9e542","recordKey":"MS-POL-POL-33@2a0117a70af5164b","sourceRowId":"ROW-408a190a4b93808cc6c3d0c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":37,"locator":"'17 Expanded Policies'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f86353a391d4732021b12b9c","recordKey":"MS-POL-POL-34@262ec774eaab089e","sourceRowId":"ROW-c6b71e5305881f1f5a5956bd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"17 Expanded Policies","row":38,"locator":"'17 Expanded Policies'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1c73db56c141c570a0ffc9d5","recordKey":"MS-CTRL-POL-01-C01@b766250ab3daedc9","sourceRowId":"ROW-597ca0bc93ff7503f1d4f3b3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":5,"locator":"'18 Policy Rule Lineage'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-25888587f1944eab642a899a","recordKey":"MS-CTRL-POL-02-C01@40fc29d45c4457f1","sourceRowId":"ROW-bedde3dbc5180d0eadf9f86b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":9,"locator":"'18 Policy Rule Lineage'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-32008f31099fb867067e86a8","recordKey":"MS-CTRL-POL-03-C01@dbe46d341001eeb6","sourceRowId":"ROW-2959b8d807f47f3dfa234a64","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":13,"locator":"'18 Policy Rule Lineage'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-77f3507b2527ea7533b7d6a4","recordKey":"MS-CTRL-POL-04-C01@386e3fe2d1f5246f","sourceRowId":"ROW-61f5de8cd7f0791b5a3d7b8b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":17,"locator":"'18 Policy Rule Lineage'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bdf9379937c6927b98b2078c","recordKey":"MS-CTRL-POL-05-C01@ffefbbfc6f719437","sourceRowId":"ROW-899fb0ad39a0a9d36f86c53c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":38,"locator":"'18 Policy Rule Lineage'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-36ea0b3b1722021df46ca89c","recordKey":"MS-CTRL-POL-06-C01@7107ad18568fb35c","sourceRowId":"ROW-fbf09e1837957a999acb3d56","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":51,"locator":"'18 Policy Rule Lineage'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-792bc5e579505e2aa9b7faf9","recordKey":"MS-CTRL-POL-07-C01@92eeb3b18fd14237","sourceRowId":"ROW-03ce43e426703e875ebe88a6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":60,"locator":"'18 Policy Rule Lineage'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1d4990bfe2e27dde8efb5ddc","recordKey":"MS-CTRL-POL-08-C01@9bdb77bb21f1278a","sourceRowId":"ROW-8f4d73b156a9e22a6f860177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":67,"locator":"'18 Policy Rule Lineage'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-babd119c7ad75d61c68464cf","recordKey":"MS-CTRL-POL-09-C01@28bd04439eeb643f","sourceRowId":"ROW-6288afa17e01f971a94dd449","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":73,"locator":"'18 Policy Rule Lineage'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-903824d9be25872a8ee65309","recordKey":"MS-CTRL-POL-10-C01@d6a7308768b38dd6","sourceRowId":"ROW-1e23d360e89c1062cb69a0aa","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":77,"locator":"'18 Policy Rule Lineage'!77:77","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8dc0e9d37d068e206c7af30f","recordKey":"MS-CTRL-POL-11-C01@ba8f0f69896dbda0","sourceRowId":"ROW-2f20b20c9af57fd935635e4b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":80,"locator":"'18 Policy Rule Lineage'!80:80","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5cfd6519693ed8e2eae72675","recordKey":"MS-CTRL-POL-12-C01@328267f10538458f","sourceRowId":"ROW-9dc5e6b16b05a7499a88af03","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":84,"locator":"'18 Policy Rule Lineage'!84:84","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cbe3d58bf8cd5234fe7f72cb","recordKey":"MS-CTRL-POL-13-C01@aa73ec05d68f5778","sourceRowId":"ROW-10f898dcd48405d3f2d17587","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":87,"locator":"'18 Policy Rule Lineage'!87:87","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8fd1f342e65b1b6bdc242d1b","recordKey":"MS-CTRL-POL-14-C01@d4d8e5f978ff6018","sourceRowId":"ROW-948256b154e3a3184c37e4c3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":91,"locator":"'18 Policy Rule Lineage'!91:91","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5617b372e7ea2e0ea0f2560e","recordKey":"MS-CTRL-POL-15-C01@bae38b8ddca62d09","sourceRowId":"ROW-6038ba62eb95f6a745d8985f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":102,"locator":"'18 Policy Rule Lineage'!102:102","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e04bcec10fb3c9e0ba7d3403","recordKey":"MS-CTRL-POL-16-C01@4385dd308009dd40","sourceRowId":"ROW-91676a6ed461ccc5b613a7b2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":107,"locator":"'18 Policy Rule Lineage'!107:107","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c8bb21a2ad09dba300549bc4","recordKey":"MS-CTRL-POL-17-C01@a589870290e36ebc","sourceRowId":"ROW-ab37f01cac1d33c794f6a189","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":109,"locator":"'18 Policy Rule Lineage'!109:109","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c9ee07593edfa1d80ca4a98a","recordKey":"MS-CTRL-POL-18-C01@353022021876b69f","sourceRowId":"ROW-723871d2f34954cba70298c9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":113,"locator":"'18 Policy Rule Lineage'!113:113","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-77ffb82ec55bac9e5a3b89e5","recordKey":"MS-CTRL-POL-19-C01@8b80f45de84ee486","sourceRowId":"ROW-82c755ed78b6023ed1c742ae","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":119,"locator":"'18 Policy Rule Lineage'!119:119","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cb6df07c6ca1f69fda1abc66","recordKey":"MS-CTRL-POL-20-C01@f431b58ee095a892","sourceRowId":"ROW-ba68a24115344b264aff3b77","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":188,"locator":"'18 Policy Rule Lineage'!188:188","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0108d9912a15635c77343ce3","recordKey":"MS-CTRL-POL-21-C01@8b5135c5fa6c4d80","sourceRowId":"ROW-971ad6a5ea6eca36c040f8d4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":191,"locator":"'18 Policy Rule Lineage'!191:191","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-356fafd609b2374579e21a39","recordKey":"MS-CTRL-POL-22-C01@0008bb9b0a6ec78a","sourceRowId":"ROW-3e39c91e7192c375260741bd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":193,"locator":"'18 Policy Rule Lineage'!193:193","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-28eede96d9dee16985b82a7f","recordKey":"MS-CTRL-POL-23-C01@8177afebde7da07a","sourceRowId":"ROW-b660e156aee27955c0564f9f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":197,"locator":"'18 Policy Rule Lineage'!197:197","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-709fccff9980ac766a242432","recordKey":"MS-CTRL-POL-23-C02@1bd8482b6b9bad6c","sourceRowId":"ROW-4349a56a85220a7e22902e5e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":198,"locator":"'18 Policy Rule Lineage'!198:198","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c4e5ccfb2008a121c45adf71","recordKey":"MS-CTRL-POL-23-C03@1678ca94f02e1cbc","sourceRowId":"ROW-b5c77a28ee8f204248c0cf53","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":199,"locator":"'18 Policy Rule Lineage'!199:199","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-caa9a14168e56586e46dc465","recordKey":"MS-CTRL-POL-24-C01@d5e684dfef1b2e9c","sourceRowId":"ROW-bd68e135dd3dc591bbad92d7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":206,"locator":"'18 Policy Rule Lineage'!206:206","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-78bfc966ca8dc98d2ceea6ab","recordKey":"MS-CTRL-POL-24-C02@d918e2b22e350918","sourceRowId":"ROW-48d7266963f51e7e07bf6a49","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":207,"locator":"'18 Policy Rule Lineage'!207:207","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b99b93df6ac7f3dccba068f3","recordKey":"MS-CTRL-POL-24-C03@dbbd781e2afd0ee6","sourceRowId":"ROW-a154e81f2366fbde55071873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":208,"locator":"'18 Policy Rule Lineage'!208:208","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-461661deadb1f705cafeec8f","recordKey":"MS-CTRL-POL-25-C01@f1c5ef468cf35b54","sourceRowId":"ROW-9dfd7e849d8d1c9642c36f1f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":214,"locator":"'18 Policy Rule Lineage'!214:214","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-75743e12a5c140b82fa6d071","recordKey":"MS-CTRL-POL-25-C02@65df3c955cab3391","sourceRowId":"ROW-c6d3e12cf0651a8c4bede3c8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":215,"locator":"'18 Policy Rule Lineage'!215:215","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0bac078de1a10aeab3c02e60","recordKey":"MS-CTRL-POL-25-C03@4b08a537f8b2697c","sourceRowId":"ROW-9550de0296df063d63803859","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":216,"locator":"'18 Policy Rule Lineage'!216:216","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3569256fc9929034e01be696","recordKey":"MS-CTRL-POL-26-C01@d2d8820db6d6a87e","sourceRowId":"ROW-92c1f546bfb6de4054c33821","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":227,"locator":"'18 Policy Rule Lineage'!227:227","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e2ee4d6a6376f20db9549b03","recordKey":"MS-CTRL-POL-26-C02@e82d80b0d844beb1","sourceRowId":"ROW-48ad15e4b2c7db6eca771777","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":228,"locator":"'18 Policy Rule Lineage'!228:228","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d2dcdace8261fbb298fb8e51","recordKey":"MS-CTRL-POL-26-C03@e63178b9cd783908","sourceRowId":"ROW-18f97f08a5872325214eaa2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":229,"locator":"'18 Policy Rule Lineage'!229:229","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5fbf6e91c407d9daa178829c","recordKey":"MS-CTRL-POL-27-C01@f3fafd4f1eb871cc","sourceRowId":"ROW-b16f769c94eb751c9254bc77","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":239,"locator":"'18 Policy Rule Lineage'!239:239","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6404ab573cf70517677ebe00","recordKey":"MS-CTRL-POL-27-C02@95768538c03b23cf","sourceRowId":"ROW-c07473ec7c89817e50a86d9b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":240,"locator":"'18 Policy Rule Lineage'!240:240","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-346be413d02e7a7d3ec00fee","recordKey":"MS-CTRL-POL-27-C03@51941690c4ccdbbc","sourceRowId":"ROW-2afc8979fe0f0865098c4138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":241,"locator":"'18 Policy Rule Lineage'!241:241","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-da4182bfd1cdd5bec4e1318b","recordKey":"MS-CTRL-POL-28-C01@95cebd36e96c97aa","sourceRowId":"ROW-d95fc88d64ce4e8747127416","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":251,"locator":"'18 Policy Rule Lineage'!251:251","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-365e78e07d43fb1fcd5631b7","recordKey":"MS-CTRL-POL-28-C02@75a42ce5eb954451","sourceRowId":"ROW-13df7ddb0e903396c050d9e6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":252,"locator":"'18 Policy Rule Lineage'!252:252","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-93ad9bb182875e9d27f72da1","recordKey":"MS-CTRL-POL-28-C03@00038d1a54adc49c","sourceRowId":"ROW-b9f171bb55a90e9eae81c39f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":253,"locator":"'18 Policy Rule Lineage'!253:253","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2b5d276a7407800e73b3121c","recordKey":"MS-CTRL-POL-29-C01@2a636b88495545f2","sourceRowId":"ROW-4d27ab3f5918435455585bb4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":264,"locator":"'18 Policy Rule Lineage'!264:264","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c1e2f1f3aa20bd8e48e99e08","recordKey":"MS-CTRL-POL-29-C02@454e63540191c754","sourceRowId":"ROW-a92aba8f46217633c0fba0b2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":265,"locator":"'18 Policy Rule Lineage'!265:265","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1add8c470c91d9c01df421c4","recordKey":"MS-CTRL-POL-29-C03@9e8988e83061cf94","sourceRowId":"ROW-24c9208eba2e169b1f50d5d2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":266,"locator":"'18 Policy Rule Lineage'!266:266","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e2c1340a081be8a0237edec1","recordKey":"MS-CTRL-POL-30-C01@8d15ee1e0bb3ebf4","sourceRowId":"ROW-6f2ce89095e627c56f05dffe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":278,"locator":"'18 Policy Rule Lineage'!278:278","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4a9fe175a9c966e99a6a6d65","recordKey":"MS-CTRL-POL-30-C02@2dd54d58131ceade","sourceRowId":"ROW-3ec37b706115b72a056d3ccd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":279,"locator":"'18 Policy Rule Lineage'!279:279","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0441bb05cbc7e814968c4d29","recordKey":"MS-CTRL-POL-30-C03@ea04ae8a27c7247b","sourceRowId":"ROW-6b20d82cb7deb5073aa7f80b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":280,"locator":"'18 Policy Rule Lineage'!280:280","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a15d5c93093e7dfc397bb352","recordKey":"MS-CTRL-POL-31-C01@8ca08935ea227608","sourceRowId":"ROW-ae39945e9dca8fcae07dfc99","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":290,"locator":"'18 Policy Rule Lineage'!290:290","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f23a03d9be0d3eeecd821155","recordKey":"MS-CTRL-POL-31-C02@85c34fafa98fabaf","sourceRowId":"ROW-ae5907835ecddd942a3d8e01","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":291,"locator":"'18 Policy Rule Lineage'!291:291","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-857892616769c4c34ef7a715","recordKey":"MS-CTRL-POL-31-C03@a6ef23abf5c5e42b","sourceRowId":"ROW-a720ec7ed772e31748155f5b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":292,"locator":"'18 Policy Rule Lineage'!292:292","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-56f30d46c7acd6e4758740e0","recordKey":"MS-CTRL-POL-32-C01@3fdcc01a28b621fa","sourceRowId":"ROW-122b607d7b07be41aeff4057","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":299,"locator":"'18 Policy Rule Lineage'!299:299","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e9d531f5735c257b968d70f8","recordKey":"MS-CTRL-POL-32-C02@ddde04a8d8ca4082","sourceRowId":"ROW-35502741aa7590781fd8f4e9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":300,"locator":"'18 Policy Rule Lineage'!300:300","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9f8992639abcfcf4673f44e0","recordKey":"MS-CTRL-POL-32-C03@1de5a35b8a8c8fd0","sourceRowId":"ROW-64bfc6528dc38316d939add4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":301,"locator":"'18 Policy Rule Lineage'!301:301","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ec148f8497caec3419898986","recordKey":"MS-CTRL-POL-33-C01@e5ead432ece32c95","sourceRowId":"ROW-fa3e011dd0bba2c808289eb2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":309,"locator":"'18 Policy Rule Lineage'!309:309","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2e474b5c469a71377a2cadcc","recordKey":"MS-CTRL-POL-33-C02@3921a2759f04839d","sourceRowId":"ROW-1ef294b209ba6792c36c1a47","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":310,"locator":"'18 Policy Rule Lineage'!310:310","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-98a04dec8f2e133ad532e098","recordKey":"MS-CTRL-POL-33-C03@8666fa9d9d46f7fb","sourceRowId":"ROW-3a9f3a84ccce1fd53cd82d90","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":311,"locator":"'18 Policy Rule Lineage'!311:311","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d8dbe539bd05db4d2f7702aa","recordKey":"MS-CTRL-POL-34-C01@848d6f9bfc0f9229","sourceRowId":"ROW-471a5982079f9dbe85af9a7a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":316,"locator":"'18 Policy Rule Lineage'!316:316","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c491b3bcd16349661e11f066","recordKey":"MS-CTRL-POL-34-C02@818c4b275dcc2acd","sourceRowId":"ROW-b902e9ba3501ba900ac1863b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":317,"locator":"'18 Policy Rule Lineage'!317:317","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8148bc9b0ff0d7ce6ca73539","recordKey":"MS-CTRL-POL-34-C03@6de53a060d4995dc","sourceRowId":"ROW-b63f57bc66539e58bd083b8d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"18 Policy Rule Lineage","row":318,"locator":"'18 Policy Rule Lineage'!318:318","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-34db073f181624216221e689","recordKey":"MS-RULE-DP-19@40fb41ffda35d9a3","sourceRowId":"ROW-15b95804fbe20e27a83cf2e4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"19 Canonical Expansion","row":5,"locator":"'19 Canonical Expansion'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e9c53d95b7d88214c8bfe8de","recordKey":"MS-RULE-AU-09@204573caad930259","sourceRowId":"ROW-2a8137ca0825e1a9dfeb17a0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"19 Canonical Expansion","row":6,"locator":"'19 Canonical Expansion'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e845f356dc978444e70d19d9","recordKey":"MS-RULE-AU-10@7f425f52b685ce44","sourceRowId":"ROW-9e2bc5d6883eb4cd6dd4365e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"19 Canonical Expansion","row":7,"locator":"'19 Canonical Expansion'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-53e1a5a15131a38fe090e279","recordKey":"MS-RULE-OU-13@1eb7cb01e3cf473f","sourceRowId":"ROW-4540717a2d2e6debabd64e61","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"19 Canonical Expansion","row":8,"locator":"'19 Canonical Expansion'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-191568812e5b2267b8dff641","recordKey":"MS-RULE-OU-14@ae9d5f3f618c9838","sourceRowId":"ROW-c0fe41ce0bc2c88a46398a9d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"19 Canonical Expansion","row":9,"locator":"'19 Canonical Expansion'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b322a2140a03bb2520cbd263","recordKey":"MS-RULE-OU-15@17dad38dad581076","sourceRowId":"ROW-90b23577a2eb05531f8e3261","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"19 Canonical Expansion","row":10,"locator":"'19 Canonical Expansion'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-941864c1ef1e4a64875c3ddd","recordKey":"MS-RULE-OP-13@d9a7b8a98719c7c2","sourceRowId":"ROW-f0dbc6d7fe91002217172a97","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"19 Canonical Expansion","row":11,"locator":"'19 Canonical Expansion'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b235d67e576375d66092adb1","recordKey":"MS-RULE-OP-14@b102df5650885781","sourceRowId":"ROW-d4924fc54b366323d675248d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"19 Canonical Expansion","row":12,"locator":"'19 Canonical Expansion'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b979e32c39224073bbf68fc7","recordKey":"MS-RULE-OP-15@bab74c0be8fc582d","sourceRowId":"ROW-bcb632ce4ca7dbd0b0a9bcec","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"19 Canonical Expansion","row":13,"locator":"'19 Canonical Expansion'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b2a9839cb5820d482b9ec13f","recordKey":"MS-RULE-OP-16@277159bc0f54c27c","sourceRowId":"ROW-9333c0f20d9760d550b04d90","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"19 Canonical Expansion","row":14,"locator":"'19 Canonical Expansion'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-00767c838b3a2fef840a811c","recordKey":"MS-RULE-OP-17@6b311b898e8dc850","sourceRowId":"ROW-22a687f6e6dbd28f0335faeb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"19 Canonical Expansion","row":15,"locator":"'19 Canonical Expansion'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b3ecbe92e629051bd98d93f6","recordKey":"MS-RULE-OP-18@1df03547863d8288","sourceRowId":"ROW-94bbfb10610f2fb3dfc40fa6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"19 Canonical Expansion","row":16,"locator":"'19 Canonical Expansion'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6eb46def3395918418e132dd","recordKey":"MS-RULE-OP-19@744dc9983a3098ac","sourceRowId":"ROW-eae77152a76c10a3841754bc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"19 Canonical Expansion","row":17,"locator":"'19 Canonical Expansion'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e1f35e99b30c3743729d774f","recordKey":"MS-RULE-AG-11@f9288b5977523607","sourceRowId":"ROW-90e42764c49f2e96fd5a394b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2.xlsx","libraryFileId":"libfile_7e8b0d19bc788191b2c6843a3f734338","sheet":"19 Canonical Expansion","row":18,"locator":"'19 Canonical Expansion'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-11fc281cc4920322ad1a38a6","recordKey":"FW-NIST-AI-RMF@aba341d53497210b","sourceRowId":"ROW-777783df3cd9ef7062834bf5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":5,"locator":"'04 Framework Catalog'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-50adbcd776e2a0d81ecebb7c","recordKey":"FW-NIST-AI-600-1@91e5bc3b14f2a84b","sourceRowId":"ROW-b1b626fe01bea60389a94799","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":6,"locator":"'04 Framework Catalog'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-25c0f20624d08710638a6d6d","recordKey":"FW-NIST-CSF2@e2682aacee87a7d8","sourceRowId":"ROW-04433aba3ef3442a7dc342ea","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":7,"locator":"'04 Framework Catalog'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c1c53539913f5ecdf752f791","recordKey":"FW-NIST-800-53@df620e4e08f309b9","sourceRowId":"ROW-9ebae7a1c19f9d988cfefe1e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":8,"locator":"'04 Framework Catalog'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7b6df6341fe08ecdef1d69be","recordKey":"FW-FEDRAMP@0431d549dd6dc7e6","sourceRowId":"ROW-b8bd9ba08111089522472a26","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":9,"locator":"'04 Framework Catalog'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e38fd422d12358f36ae35c6f","recordKey":"FW-ISO-42001@6d004f01fd1dd6f5","sourceRowId":"ROW-b29e0e95548020af5b6ccf75","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":10,"locator":"'04 Framework Catalog'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d28e9ac1cec18dfe4dd68ce0","recordKey":"FW-ISO-42005@b02139bf544ce4bf","sourceRowId":"ROW-d00d7796973ad8d803836eb1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":11,"locator":"'04 Framework Catalog'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e157a6b0f23e3895e4d6695c","recordKey":"FW-ISO-23894@b87e8d19fc73b809","sourceRowId":"ROW-956707b6e9f1a1157d10e2b3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":12,"locator":"'04 Framework Catalog'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ab2ebcd40998ad9f8c070d39","recordKey":"FW-ISO-38507@3a21d46272e4d98f","sourceRowId":"ROW-cad3c07500071ecb6debed6c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":13,"locator":"'04 Framework Catalog'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3e302790529872fe64ccb7be","recordKey":"FW-ISO-5338@5384b7599ab287e8","sourceRowId":"ROW-616d2a735b78292c54f59a72","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":14,"locator":"'04 Framework Catalog'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a2127051ab4c2b2eb3230b69","recordKey":"FW-ISO-24028@3d472e5cbcce5b94","sourceRowId":"ROW-3b6e80479929d9c2c44c106c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":15,"locator":"'04 Framework Catalog'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-625bb551a1bca7ebee57b176","recordKey":"FW-EU-AI-ACT@46561a486a4c008b","sourceRowId":"ROW-35056b4a4fdc12e0f5d8634d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":16,"locator":"'04 Framework Catalog'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f82d6618d21721008125e316","recordKey":"FW-GDPR@ee1443d6c0919bfd","sourceRowId":"ROW-2fc3f9fc669c13e115f8440e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":17,"locator":"'04 Framework Catalog'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b1d281e79e96bb5d557650cc","recordKey":"FW-HIPAA@024563eb5b7c33a6","sourceRowId":"ROW-bfa5e24cc1091a56ae6e3610","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":18,"locator":"'04 Framework Catalog'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-226f4e01999e095e44f89c29","recordKey":"FW-PCI-DSS@26b432290466d636","sourceRowId":"ROW-1034aa6318910efd3b805700","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":19,"locator":"'04 Framework Catalog'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d70eceae0076db82cd016a35","recordKey":"FW-SOC2@db7c79c2dbfb20ed","sourceRowId":"ROW-70fe013b1ed861bc1f0e269a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":20,"locator":"'04 Framework Catalog'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-359e5c1dac4b5303c1e03d15","recordKey":"FW-GLBA@ce5eb5a36e567a3b","sourceRowId":"ROW-7322b54de38f7bb6a4573010","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":21,"locator":"'04 Framework Catalog'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-22f41ac97ad3c5f24a887c1a","recordKey":"FW-FERPA@adba7da3b8b49ee6","sourceRowId":"ROW-a119e473fbc724a9f3d4a2b4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":22,"locator":"'04 Framework Catalog'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d728c896101b895f0b1f6484","recordKey":"FW-CCPA-CPRA@2726437e0cff599a","sourceRowId":"ROW-f69538d02437e555efcfb185","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":23,"locator":"'04 Framework Catalog'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-32f7e2dda801e57ec4f12ce3","recordKey":"FW-CO-AI@dc656cacb5cb1e38","sourceRowId":"ROW-4ecff7de664a84bb7dd2852a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":24,"locator":"'04 Framework Catalog'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3b3ce36431cedc8c7eb6a9f0","recordKey":"FW-TX-TRAIGA@9b71af35f63ed5f3","sourceRowId":"ROW-d18d29a9d6086ffcafa78490","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":25,"locator":"'04 Framework Catalog'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3cbf6c7d8de9d10db5f9784b","recordKey":"FW-OMB-M25-21@02c619879520c6e4","sourceRowId":"ROW-3f269d4ebd6704ea6e57097f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":26,"locator":"'04 Framework Catalog'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1baf0a1bb3a3dbeebcfbe9e8","recordKey":"FW-OMB-M25-22@1dd0effe69b2dd83","sourceRowId":"ROW-11e306224e302c8409f55ddd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":27,"locator":"'04 Framework Catalog'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f4724e3f1c29f42d53189a1e","recordKey":"FW-OWASP-LLM-2026@44fda67005e1638f","sourceRowId":"ROW-938bc65cd2d8eb379c2074a1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":28,"locator":"'04 Framework Catalog'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-649fe533c241a1c1a4912433","recordKey":"FW-SOX@6b53f8d76c60deb9","sourceRowId":"ROW-6dbfd1e205fc4d3834e7ff51","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":29,"locator":"'04 Framework Catalog'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d36fcf190ac771910baae9c0","recordKey":"FW-NIST-800-171@58ab2c70e4be447b","sourceRowId":"ROW-ad8e1243daaf62d6c9148402","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":30,"locator":"'04 Framework Catalog'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f235a84f43334d9335617a09","recordKey":"FW-CMMC@ac0fcc4dbed93e96","sourceRowId":"ROW-1141d7110b74b56aad82a5b6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":31,"locator":"'04 Framework Catalog'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b4a34ada7cda826a44250e9f","recordKey":"FW-CJIS-6.1@d72dc934b163c587","sourceRowId":"ROW-0481455a2206d38034e4b4ba","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":32,"locator":"'04 Framework Catalog'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d6b749b4acad44ca10538c7f","recordKey":"FW-IRS-1075@41f4b6c6a851eb70","sourceRowId":"ROW-f7fd4420c43cadaa2e7b3001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":33,"locator":"'04 Framework Catalog'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7422ad9c1eb56c2a7561a03b","recordKey":"FW-SECTION-508@fbc75a7a0c1d63df","sourceRowId":"ROW-4277eeeaf763ff7468b3a7b4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":34,"locator":"'04 Framework Catalog'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d6087a9439c64e846f02ce79","recordKey":"FW-HHS-PART2@141c8543b532c1e2","sourceRowId":"ROW-d2f32be2b1b5dc9d7955495f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":35,"locator":"'04 Framework Catalog'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d728661439cc1328b3d0f679","recordKey":"FW-ONC-HTI1@07ba2443114bf7cf","sourceRowId":"ROW-a64395257784a0f7e1d11c84","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":36,"locator":"'04 Framework Catalog'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dbeb9e75277a92da8dfdd0d2","recordKey":"FW-FDA-AI-MD@432a62ac753198dc","sourceRowId":"ROW-7902cc3b6776f8059ad6e48d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":37,"locator":"'04 Framework Catalog'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e482d21670a15317f26f778d","recordKey":"FW-FRB-MRM-2026@20af5280d1d80c0c","sourceRowId":"ROW-4eebfaddfe6861574fe5260e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":38,"locator":"'04 Framework Catalog'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7b32e0df9a9c10858aaf921d","recordKey":"FW-NYDFS-500@67740b905bbc613b","sourceRowId":"ROW-2648fe12dd0384dfad627d02","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":39,"locator":"'04 Framework Catalog'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0f17f16b7a521891c3a395c0","recordKey":"FW-ECOA-REG-B@ddb9963a16c2337d","sourceRowId":"ROW-48be17815700adb48f3861b0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":40,"locator":"'04 Framework Catalog'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f672681aeab37344d74605a6","recordKey":"FW-NAIC-AI@06f6441bb07255a0","sourceRowId":"ROW-59d631f460f3601715cab310","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":41,"locator":"'04 Framework Catalog'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-03f2f86af68fa86ccf49d033","recordKey":"FW-COPPA@fc258ea83878e53c","sourceRowId":"ROW-c01d164deb866d8eb2726d49","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":42,"locator":"'04 Framework Catalog'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-812bc3d13b336434df2cb4fa","recordKey":"FW-NYC-LL144@cc7abf9e1b87f1de","sourceRowId":"ROW-dc59b939b8884195773a807e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":43,"locator":"'04 Framework Catalog'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f5a8864775ab4c391e9cea6e","recordKey":"FW-IL-AIVIA@57edfa6b6c2632ab","sourceRowId":"ROW-c07594d7774f422504e5f9ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":44,"locator":"'04 Framework Catalog'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2bf147dad5a5c470c6008b02","recordKey":"FW-UK-DP-AI@f7644b0e61b4f5d8","sourceRowId":"ROW-6865413e70818ef9afda1cfb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":45,"locator":"'04 Framework Catalog'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5e7bf2fa7129382265d6e5f3","recordKey":"FW-BR-LGPD@b1c212cd4f289ae8","sourceRowId":"ROW-53c17fdfdb05d320ef747afe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":46,"locator":"'04 Framework Catalog'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c811432d43fdac9db07433b2","recordKey":"FW-AU-PRIVACY-AI@cc7182c7d5cefeb1","sourceRowId":"ROW-da1ad5c97fa11d12ccf111a2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":47,"locator":"'04 Framework Catalog'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3c938d88ff20ef05d68ec87a","recordKey":"FW-SG-MODEL-AI@f169da9f6ce16236","sourceRowId":"ROW-0579fb48e563f6cfc629e7cf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":48,"locator":"'04 Framework Catalog'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b6981e7f827ea7406fbfccc1","recordKey":"FW-DOJ-DSP@0d9c8e0ced94016d","sourceRowId":"ROW-31876febcca5a5de95a2d423","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":49,"locator":"'04 Framework Catalog'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-74ee2af5587f55a5ac10b484","recordKey":"FW-EAR@0588bd07a68b0491","sourceRowId":"ROW-0d028bee6e20425b1df870f7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"04 Framework Catalog","row":50,"locator":"'04 Framework Catalog'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-13781a3388955f6425949475","recordKey":"MS-RULE-DP-01@82066dbd9b9a4f14","sourceRowId":"ROW-dd7dd21a66734e7b97fcb5b0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":5,"locator":"'05 Canonical Rules'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-68135a14e8b81baf5cc6e7a1","recordKey":"TEST-MS-RULE-DP-01@0bc48774d2f0f1dd","sourceRowId":"ROW-dd7dd21a66734e7b97fcb5b0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":5,"locator":"'05 Canonical Rules'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9f48bd61087ce18aac0147ba","recordKey":"MS-RULE-DP-02@d20cd6810e42f858","sourceRowId":"ROW-d965a35a421e3fc6673c239f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":6,"locator":"'05 Canonical Rules'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-66b0863f879913505f693b80","recordKey":"TEST-MS-RULE-DP-02@ca4ef66ca268a10a","sourceRowId":"ROW-d965a35a421e3fc6673c239f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":6,"locator":"'05 Canonical Rules'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-09f78bc427616570af7731f7","recordKey":"MS-RULE-DP-03@4cbb47b109e98f4a","sourceRowId":"ROW-796761a8a9cf57da2fae3e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":7,"locator":"'05 Canonical Rules'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-aa05114092aea4f6fc0de077","recordKey":"TEST-MS-RULE-DP-03@50eab23253df5cb7","sourceRowId":"ROW-796761a8a9cf57da2fae3e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":7,"locator":"'05 Canonical Rules'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f577b153e06f7763fdc316ca","recordKey":"MS-RULE-DP-04@13c6ba85197d9a69","sourceRowId":"ROW-caa534e1eb5c3613fe0591c1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":8,"locator":"'05 Canonical Rules'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-aa29b56366bec32b192f60c9","recordKey":"TEST-MS-RULE-DP-04@f3aef5f922894a93","sourceRowId":"ROW-caa534e1eb5c3613fe0591c1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":8,"locator":"'05 Canonical Rules'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9a76e6109bbe76a6cf152da0","recordKey":"MS-RULE-DP-05@30a7a6fc8d2d373f","sourceRowId":"ROW-7a175ac95401f3abfaf8290d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":9,"locator":"'05 Canonical Rules'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7d17161f421bf34201e1562e","recordKey":"TEST-MS-RULE-DP-05@77349f3499851451","sourceRowId":"ROW-7a175ac95401f3abfaf8290d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":9,"locator":"'05 Canonical Rules'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ad479d267036b0cc7e81107c","recordKey":"MS-RULE-DP-06@af062b3863346b41","sourceRowId":"ROW-b78aa7d9163467a76700c54a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":10,"locator":"'05 Canonical Rules'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-de29a2c3ea0f103bbee574ce","recordKey":"TEST-MS-RULE-DP-06@59256ca2a153a840","sourceRowId":"ROW-b78aa7d9163467a76700c54a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":10,"locator":"'05 Canonical Rules'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9061838023c01193c5825a9e","recordKey":"MS-RULE-DP-07@94c870d43e4286ab","sourceRowId":"ROW-eaf49299e5a27f3a04a39dee","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":11,"locator":"'05 Canonical Rules'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c1080f27ef3880ee2c7f5952","recordKey":"TEST-MS-RULE-DP-07@5002f8ed22b072a4","sourceRowId":"ROW-eaf49299e5a27f3a04a39dee","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":11,"locator":"'05 Canonical Rules'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c00539bf9f74c2fbe4175fdf","recordKey":"MS-RULE-DP-08@f94b476097640eb3","sourceRowId":"ROW-2db24a210a103da03c6369d1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":12,"locator":"'05 Canonical Rules'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c16de660c2862bb409b7742d","recordKey":"TEST-MS-RULE-DP-08@5952c57b4ceafdbd","sourceRowId":"ROW-2db24a210a103da03c6369d1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":12,"locator":"'05 Canonical Rules'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dc813fb133295e7609d8272d","recordKey":"MS-RULE-DP-09@e32553c4840951b3","sourceRowId":"ROW-0b229efa77ef98b17d217b94","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":13,"locator":"'05 Canonical Rules'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-92c5dce970e81bddbe0f5eb6","recordKey":"TEST-MS-RULE-DP-09@c4ed5280df2d8691","sourceRowId":"ROW-0b229efa77ef98b17d217b94","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":13,"locator":"'05 Canonical Rules'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8a492d12d74ed514ec136e5f","recordKey":"MS-RULE-DP-10@fc6f0a161d4f201f","sourceRowId":"ROW-2e8dd0f254a9bfc88a26ae93","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":14,"locator":"'05 Canonical Rules'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-381ce40f53c2a68b39f5cad6","recordKey":"TEST-MS-RULE-DP-10@6d512691a22458cc","sourceRowId":"ROW-2e8dd0f254a9bfc88a26ae93","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":14,"locator":"'05 Canonical Rules'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bd6b51067d506de135d2b019","recordKey":"MS-RULE-DP-11@b7d96f7e1501e4ed","sourceRowId":"ROW-a5189f5e4b5294c5256598fe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":15,"locator":"'05 Canonical Rules'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2b643f5caedfe086c3b2b78c","recordKey":"TEST-MS-RULE-DP-11@e6424832265654e7","sourceRowId":"ROW-a5189f5e4b5294c5256598fe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":15,"locator":"'05 Canonical Rules'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9d5b65b0ab0ff31d5ce05457","recordKey":"MS-RULE-DP-12@4ae51c2523134e28","sourceRowId":"ROW-de74c6dce98f94da3fdb5dfb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":16,"locator":"'05 Canonical Rules'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c479b49c812d2612f0ce5c7d","recordKey":"TEST-MS-RULE-DP-12@95d98ba0364aec85","sourceRowId":"ROW-de74c6dce98f94da3fdb5dfb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":16,"locator":"'05 Canonical Rules'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-574288a77f2b56c423b47a64","recordKey":"MS-RULE-DP-13@1299bbf89c50bd1a","sourceRowId":"ROW-274105fb30057214d0562812","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":17,"locator":"'05 Canonical Rules'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-777a661265b7220d50554587","recordKey":"TEST-MS-RULE-DP-13@f983ef5d4e01924d","sourceRowId":"ROW-274105fb30057214d0562812","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":17,"locator":"'05 Canonical Rules'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-90c9db2a2cf2da24a254e7b6","recordKey":"MS-RULE-DP-14@7b898303f53ec49b","sourceRowId":"ROW-225037eab461099efc409e5c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":18,"locator":"'05 Canonical Rules'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6ec4dddf0673134956a8b862","recordKey":"TEST-MS-RULE-DP-14@ab80d0fa0d8db15e","sourceRowId":"ROW-225037eab461099efc409e5c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":18,"locator":"'05 Canonical Rules'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5b3034f0db1b8f1b33e1613e","recordKey":"MS-RULE-DP-15@208a0f796d79405e","sourceRowId":"ROW-7ce2bc4a6a65b5ec7ea32a1f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":19,"locator":"'05 Canonical Rules'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5fdee3fa1ed9f3a788cbaa50","recordKey":"TEST-MS-RULE-DP-15@cea9c93668f602e0","sourceRowId":"ROW-7ce2bc4a6a65b5ec7ea32a1f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":19,"locator":"'05 Canonical Rules'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e09e5f03e10fd0b22677ccf4","recordKey":"MS-RULE-DP-16@d0dca88853814a51","sourceRowId":"ROW-547168ebefb450617ee140e7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":20,"locator":"'05 Canonical Rules'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-aae93915e0b5189f2ea990a8","recordKey":"TEST-MS-RULE-DP-16@97bda9e88e479e68","sourceRowId":"ROW-547168ebefb450617ee140e7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":20,"locator":"'05 Canonical Rules'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-31046c89a9b9aa400266247a","recordKey":"MS-RULE-DP-17@d1c8e0c542b0a6f6","sourceRowId":"ROW-6d330d498b040a50298e5096","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":21,"locator":"'05 Canonical Rules'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-86813630210f23a84e2535d7","recordKey":"TEST-MS-RULE-DP-17@811ed55e191f631e","sourceRowId":"ROW-6d330d498b040a50298e5096","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":21,"locator":"'05 Canonical Rules'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0a11b0af6096c3c153566919","recordKey":"MS-RULE-DP-18@082a5a202e1a48ef","sourceRowId":"ROW-7df32d39977e00db5c854d8e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":22,"locator":"'05 Canonical Rules'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bc75190e447eda0f6f26953f","recordKey":"TEST-MS-RULE-DP-18@8a543089559677bc","sourceRowId":"ROW-7df32d39977e00db5c854d8e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":22,"locator":"'05 Canonical Rules'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-822527e7c6572680036ad651","recordKey":"MS-RULE-AU-01@32b7d4ac14b06f7b","sourceRowId":"ROW-2be72c12f0cb01e4a2b7dcaa","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":23,"locator":"'05 Canonical Rules'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d53b4441cb25765bb05332e1","recordKey":"TEST-MS-RULE-AU-01@0084a371cf0309b9","sourceRowId":"ROW-2be72c12f0cb01e4a2b7dcaa","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":23,"locator":"'05 Canonical Rules'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5b36a6be865e7e7fe42b6136","recordKey":"MS-RULE-AU-02@1a166eaeb8f7f1ad","sourceRowId":"ROW-a2c0d46f3e18438f105dc6d7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":24,"locator":"'05 Canonical Rules'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8ad8d416baf402423c34d824","recordKey":"TEST-MS-RULE-AU-02@ab1063b0ed9fa8a0","sourceRowId":"ROW-a2c0d46f3e18438f105dc6d7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":24,"locator":"'05 Canonical Rules'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7d76e0ece011d87de6cacb8e","recordKey":"MS-RULE-AU-03@ece0c972ca2c62e1","sourceRowId":"ROW-3dc6adb58d7f098f9272c80d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":25,"locator":"'05 Canonical Rules'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3e58cd2feefa136e21a21490","recordKey":"TEST-MS-RULE-AU-03@2c0164b9ceb762fe","sourceRowId":"ROW-3dc6adb58d7f098f9272c80d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":25,"locator":"'05 Canonical Rules'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-62870f679b36c940204ebcfe","recordKey":"MS-RULE-AU-04@d51101a040857487","sourceRowId":"ROW-fcec3fc6725ce68924123608","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":26,"locator":"'05 Canonical Rules'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-147e074e52ed60081bd23041","recordKey":"TEST-MS-RULE-AU-04@d64cd4d5b62ae1d2","sourceRowId":"ROW-fcec3fc6725ce68924123608","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":26,"locator":"'05 Canonical Rules'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-abcc5fb2cde477fa297b10d1","recordKey":"MS-RULE-AU-05@7c58fddd6817f607","sourceRowId":"ROW-cfe116723d32ad6326ee06b3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":27,"locator":"'05 Canonical Rules'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-419ffb262fbbd8c2ead5b836","recordKey":"TEST-MS-RULE-AU-05@0f305d8c832c7e2f","sourceRowId":"ROW-cfe116723d32ad6326ee06b3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":27,"locator":"'05 Canonical Rules'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e3126f9f8d5b08a2d9b73741","recordKey":"MS-RULE-AU-06@e8c8f3b771054fbc","sourceRowId":"ROW-99440280e23a02ddcb319ff1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":28,"locator":"'05 Canonical Rules'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e47ae6bd45e939f85d398b49","recordKey":"TEST-MS-RULE-AU-06@750f23cda17c3c4b","sourceRowId":"ROW-99440280e23a02ddcb319ff1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":28,"locator":"'05 Canonical Rules'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f12410224924cd117ef114df","recordKey":"MS-RULE-AU-07@989c3a6787fc6689","sourceRowId":"ROW-73b5ab67a4373cbffdf61c3c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":29,"locator":"'05 Canonical Rules'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-85e28ab8419a997eb9f46a84","recordKey":"TEST-MS-RULE-AU-07@5ffa142ce7218527","sourceRowId":"ROW-73b5ab67a4373cbffdf61c3c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":29,"locator":"'05 Canonical Rules'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1e4b28abbb4a0601a71ca013","recordKey":"MS-RULE-AU-08@4eda0a221f3ef380","sourceRowId":"ROW-70ffbddc19757b6b4bd3008f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":30,"locator":"'05 Canonical Rules'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3813e105aca3c945a72a5d94","recordKey":"TEST-MS-RULE-AU-08@1572d78ad2ecacee","sourceRowId":"ROW-70ffbddc19757b6b4bd3008f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":30,"locator":"'05 Canonical Rules'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c418ba7b479dda90d42c0928","recordKey":"MS-RULE-IN-01@e4fe11be1a20f12f","sourceRowId":"ROW-33d75597df848b17c463a5ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":31,"locator":"'05 Canonical Rules'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-17d815c911eb2a9b49d7e97f","recordKey":"TEST-MS-RULE-IN-01@9d4be1fbcaec2bf2","sourceRowId":"ROW-33d75597df848b17c463a5ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":31,"locator":"'05 Canonical Rules'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ffe1fbbf91ced18e1a940ef6","recordKey":"MS-RULE-IN-02@dbb47a84e8a96c05","sourceRowId":"ROW-f827b989613c49ac0be126bf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":32,"locator":"'05 Canonical Rules'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f397ba683717ae573c67aba1","recordKey":"TEST-MS-RULE-IN-02@1d2838ae3e1a57ab","sourceRowId":"ROW-f827b989613c49ac0be126bf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":32,"locator":"'05 Canonical Rules'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-749787e06d3fc2b0b3445df6","recordKey":"MS-RULE-IN-03@900d1ac2806dab1c","sourceRowId":"ROW-a69372f0d658fdbe12b8fd53","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":33,"locator":"'05 Canonical Rules'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f6fb9dc5f522c6afe90b0511","recordKey":"TEST-MS-RULE-IN-03@900d1236d564a9d6","sourceRowId":"ROW-a69372f0d658fdbe12b8fd53","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":33,"locator":"'05 Canonical Rules'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ac615c077e3a585acd29c440","recordKey":"MS-RULE-IN-04@40341d186f0bd606","sourceRowId":"ROW-1d4de9b6515e28867aabb661","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":34,"locator":"'05 Canonical Rules'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cdbbaaada6093a3116ef3535","recordKey":"TEST-MS-RULE-IN-04@2643ff56cf23a729","sourceRowId":"ROW-1d4de9b6515e28867aabb661","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":34,"locator":"'05 Canonical Rules'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fb27e32784982eedbc9a983f","recordKey":"MS-RULE-IN-05@8dff43ab30881e3f","sourceRowId":"ROW-404738e71a852866a1f1a06b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":35,"locator":"'05 Canonical Rules'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e97e9332eb14a45aacbd8524","recordKey":"TEST-MS-RULE-IN-05@3c95bf3267fc393c","sourceRowId":"ROW-404738e71a852866a1f1a06b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":35,"locator":"'05 Canonical Rules'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7b7d19b0113edc12e8df27a6","recordKey":"MS-RULE-IN-06@478a04da335c1e7f","sourceRowId":"ROW-9fc4252383688ede04d786ea","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":36,"locator":"'05 Canonical Rules'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f2751beb496391d19ce7ee20","recordKey":"TEST-MS-RULE-IN-06@858400572c4c71c1","sourceRowId":"ROW-9fc4252383688ede04d786ea","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":36,"locator":"'05 Canonical Rules'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3886595aea117b2555a24525","recordKey":"MS-RULE-IN-07@31e317962beaeb5b","sourceRowId":"ROW-5f5c18f25000f9c536da18d5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":37,"locator":"'05 Canonical Rules'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dcf28df941dbbbf7e1514d61","recordKey":"TEST-MS-RULE-IN-07@375f07965e1612f9","sourceRowId":"ROW-5f5c18f25000f9c536da18d5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":37,"locator":"'05 Canonical Rules'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-99fb34a2bec6d6abd7ac2ea4","recordKey":"MS-RULE-IN-08@94324ccfd3a491ef","sourceRowId":"ROW-09612dabcd00cb81ad1d05ba","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":38,"locator":"'05 Canonical Rules'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8b4d7ec8d4df18bc7c71549c","recordKey":"TEST-MS-RULE-IN-08@d7fc8b0e56e8838b","sourceRowId":"ROW-09612dabcd00cb81ad1d05ba","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":38,"locator":"'05 Canonical Rules'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c72e58214435197a504d0085","recordKey":"MS-RULE-OU-01@d0805195b855c7dd","sourceRowId":"ROW-60b11c0a5a8eb1d759b90a1d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":39,"locator":"'05 Canonical Rules'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-76c5114e66a0fe1ce8f68a28","recordKey":"TEST-MS-RULE-OU-01@b9fd24d42e46a0aa","sourceRowId":"ROW-60b11c0a5a8eb1d759b90a1d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":39,"locator":"'05 Canonical Rules'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b0b52fef3463ea0cbff30d53","recordKey":"MS-RULE-OU-02@4965655028a3d485","sourceRowId":"ROW-8f98d8e0539ec18e9717c095","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":40,"locator":"'05 Canonical Rules'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-00e38fa9e965e98641d238ad","recordKey":"TEST-MS-RULE-OU-02@82b9b07bac4d235a","sourceRowId":"ROW-8f98d8e0539ec18e9717c095","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":40,"locator":"'05 Canonical Rules'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b48370a922d58185ef18afb3","recordKey":"MS-RULE-OU-03@ce8e31e07eb4da96","sourceRowId":"ROW-05ae5b514ae5f63ada4d7746","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":41,"locator":"'05 Canonical Rules'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7cc2063f596a680b2eb4bb8a","recordKey":"TEST-MS-RULE-OU-03@855aa6350f3b6faf","sourceRowId":"ROW-05ae5b514ae5f63ada4d7746","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":41,"locator":"'05 Canonical Rules'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ab1f195a55efd69b8766d7d8","recordKey":"MS-RULE-OU-04@4f3b3444715b2744","sourceRowId":"ROW-93855bbbe9a302b1f1006cdc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":42,"locator":"'05 Canonical Rules'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-39c65024f1e873f5393ac587","recordKey":"TEST-MS-RULE-OU-04@b8d5604c6e6cac3b","sourceRowId":"ROW-93855bbbe9a302b1f1006cdc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":42,"locator":"'05 Canonical Rules'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dc3f1bf2e28937d4b853b435","recordKey":"MS-RULE-OU-05@cb5aeaa742fb4521","sourceRowId":"ROW-2cf11e533edb20d9d1dd9c78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":43,"locator":"'05 Canonical Rules'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7fa87b37dac98fdb5e482f29","recordKey":"TEST-MS-RULE-OU-05@790ba5609481741c","sourceRowId":"ROW-2cf11e533edb20d9d1dd9c78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":43,"locator":"'05 Canonical Rules'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c334d51b897f0a8a8253fc41","recordKey":"MS-RULE-OU-06@ce0137df984ac601","sourceRowId":"ROW-f603f5e29e916e93e964aafc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":44,"locator":"'05 Canonical Rules'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-adbea9c98be4fad5e2e7a84f","recordKey":"TEST-MS-RULE-OU-06@3389a94a06402212","sourceRowId":"ROW-f603f5e29e916e93e964aafc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":44,"locator":"'05 Canonical Rules'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0cf9f09250cf0d0a7c3b97b7","recordKey":"MS-RULE-OU-07@7d5bc203e83e95c9","sourceRowId":"ROW-56e9b5df3e9b56a0997dcd8f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":45,"locator":"'05 Canonical Rules'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c05bc0b4e9f03afada627143","recordKey":"TEST-MS-RULE-OU-07@c8b8661e517fb395","sourceRowId":"ROW-56e9b5df3e9b56a0997dcd8f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":45,"locator":"'05 Canonical Rules'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-58db82bb87e6e6ca2c23579d","recordKey":"MS-RULE-OU-08@4c7bb6dc00dfcbfd","sourceRowId":"ROW-a918b603fd3d79a9824f1e6c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":46,"locator":"'05 Canonical Rules'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-92413052e4eff627f58e357c","recordKey":"TEST-MS-RULE-OU-08@2da28a7f88e05c49","sourceRowId":"ROW-a918b603fd3d79a9824f1e6c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":46,"locator":"'05 Canonical Rules'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-10a048c37c8618552dd62d7e","recordKey":"MS-RULE-OU-09@2ffb1322457172b3","sourceRowId":"ROW-b5b43ff186de61e4e9c8f991","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":47,"locator":"'05 Canonical Rules'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2c8a6048873f0cf40d19414a","recordKey":"TEST-MS-RULE-OU-09@225611971feba396","sourceRowId":"ROW-b5b43ff186de61e4e9c8f991","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":47,"locator":"'05 Canonical Rules'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c9b6f5daa1845f96b1852053","recordKey":"MS-RULE-OU-10@2332653b89bcd331","sourceRowId":"ROW-72e395c7218a6a4876304887","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":48,"locator":"'05 Canonical Rules'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-853bef5dbd08018fe41cfd30","recordKey":"TEST-MS-RULE-OU-10@f6e5d3d4dc45e98f","sourceRowId":"ROW-72e395c7218a6a4876304887","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":48,"locator":"'05 Canonical Rules'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-424a2ddeb1b1cc386bfc3af4","recordKey":"MS-RULE-OU-11@0710643d8a955cf6","sourceRowId":"ROW-20682fe9bafd1d0abdfa8c4b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":49,"locator":"'05 Canonical Rules'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c20b09f2d2b0f611e3e08b10","recordKey":"TEST-MS-RULE-OU-11@786090aa4216d6dd","sourceRowId":"ROW-20682fe9bafd1d0abdfa8c4b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":49,"locator":"'05 Canonical Rules'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a464912297986260dd3323ab","recordKey":"MS-RULE-OU-12@295cdecda41b8b55","sourceRowId":"ROW-bf7bf2864cb170ef25ebd30d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":50,"locator":"'05 Canonical Rules'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d717f22e1c5adb4393621bf4","recordKey":"TEST-MS-RULE-OU-12@249ad604ebb6fff7","sourceRowId":"ROW-bf7bf2864cb170ef25ebd30d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":50,"locator":"'05 Canonical Rules'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-441ec531201cb8ac99c03f13","recordKey":"MS-RULE-AG-01@e6aee1767c267990","sourceRowId":"ROW-1279c5b35f2939fb1cc43247","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":51,"locator":"'05 Canonical Rules'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bdcaa22327304ec00d88f29a","recordKey":"TEST-MS-RULE-AG-01@ff7a0e8e2da5d17b","sourceRowId":"ROW-1279c5b35f2939fb1cc43247","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":51,"locator":"'05 Canonical Rules'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-09e4f02a520f469da0f0ae95","recordKey":"MS-RULE-AG-02@d4d178c0433fd6d4","sourceRowId":"ROW-a3ddaf09b3a72f0c72e8964e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":52,"locator":"'05 Canonical Rules'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6687873e298650be401273b1","recordKey":"TEST-MS-RULE-AG-02@aade6035a0855241","sourceRowId":"ROW-a3ddaf09b3a72f0c72e8964e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":52,"locator":"'05 Canonical Rules'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a5f9eeca3fc5148ed097a7d3","recordKey":"MS-RULE-AG-03@20aa3c90fa880f0d","sourceRowId":"ROW-10aac5610f8d61a3c39451f5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":53,"locator":"'05 Canonical Rules'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e7cb5aaef8c6b9170695671c","recordKey":"TEST-MS-RULE-AG-03@015e6c738b015bd2","sourceRowId":"ROW-10aac5610f8d61a3c39451f5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":53,"locator":"'05 Canonical Rules'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-549ede4f1193f595724a69c7","recordKey":"MS-RULE-AG-04@c7af717b1d68045e","sourceRowId":"ROW-53dd84f34afc376b1c406ce7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":54,"locator":"'05 Canonical Rules'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-242c6354887ca10518cd5718","recordKey":"TEST-MS-RULE-AG-04@098ca0df2ff02a79","sourceRowId":"ROW-53dd84f34afc376b1c406ce7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":54,"locator":"'05 Canonical Rules'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2ee441c23871883f39b894c6","recordKey":"MS-RULE-AG-05@8829d873310f18f9","sourceRowId":"ROW-91f4c7ef9235e9f81ce06ed3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":55,"locator":"'05 Canonical Rules'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a786d882224e2341365b5196","recordKey":"TEST-MS-RULE-AG-05@8edc0dd979fb9441","sourceRowId":"ROW-91f4c7ef9235e9f81ce06ed3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":55,"locator":"'05 Canonical Rules'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-719a28e30668ff02f6f21970","recordKey":"MS-RULE-AG-06@6371f819b40b0d97","sourceRowId":"ROW-adf2e90caa19e3e99d364557","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":56,"locator":"'05 Canonical Rules'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6d0ce449ba33aa37d068366c","recordKey":"TEST-MS-RULE-AG-06@ee1eb5a987831137","sourceRowId":"ROW-adf2e90caa19e3e99d364557","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":56,"locator":"'05 Canonical Rules'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cfcdcb92090abac3ce97e9c8","recordKey":"MS-RULE-AG-07@c2fb36c556cb8a62","sourceRowId":"ROW-68f5ef062c038e22495ed591","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":57,"locator":"'05 Canonical Rules'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8bed886e7c0bcba2d6ed1ca1","recordKey":"TEST-MS-RULE-AG-07@ba65d33eee3e267b","sourceRowId":"ROW-68f5ef062c038e22495ed591","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":57,"locator":"'05 Canonical Rules'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4db1bd6416bb45fdca8e809b","recordKey":"MS-RULE-AG-08@b98e349c6e27f319","sourceRowId":"ROW-8cbb6da23d36aa1a0f0d3d85","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":58,"locator":"'05 Canonical Rules'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ddc67e2cff9df23b63c4dade","recordKey":"TEST-MS-RULE-AG-08@416a45e0a0b25761","sourceRowId":"ROW-8cbb6da23d36aa1a0f0d3d85","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":58,"locator":"'05 Canonical Rules'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-03db00cf4ce3298446a5765d","recordKey":"MS-RULE-AG-09@2bd07e82a72d4f2e","sourceRowId":"ROW-259c8693730cbe4b874ed25f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":59,"locator":"'05 Canonical Rules'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-04701b53cfad3023ad72f340","recordKey":"TEST-MS-RULE-AG-09@77f7bead2ff59d1f","sourceRowId":"ROW-259c8693730cbe4b874ed25f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":59,"locator":"'05 Canonical Rules'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6bcc716a4465f1f3ae0bc6a5","recordKey":"MS-RULE-AG-10@41b899de0bf0744b","sourceRowId":"ROW-9af6191d6f0ea49d3937a8c8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":60,"locator":"'05 Canonical Rules'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-16b72710e4b1f09e7ba9f144","recordKey":"TEST-MS-RULE-AG-10@fcfc304af4142870","sourceRowId":"ROW-9af6191d6f0ea49d3937a8c8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":60,"locator":"'05 Canonical Rules'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-43ba346ef8fc158d0e7489af","recordKey":"MS-RULE-OP-01@ce84968e8045ef9e","sourceRowId":"ROW-d47b427b0a53c7bac793a47d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":61,"locator":"'05 Canonical Rules'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ceba0ec2ee08ed874ed07b31","recordKey":"TEST-MS-RULE-OP-01@1650910477cab89a","sourceRowId":"ROW-d47b427b0a53c7bac793a47d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":61,"locator":"'05 Canonical Rules'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2512ff1967e4c5aebc4e5912","recordKey":"MS-RULE-OP-02@7147e78f71e89fcb","sourceRowId":"ROW-411ceb959d0e3dc42db4309f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":62,"locator":"'05 Canonical Rules'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-322fc59abb23b6df72ed592f","recordKey":"TEST-MS-RULE-OP-02@e6bebdee13a2794f","sourceRowId":"ROW-411ceb959d0e3dc42db4309f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":62,"locator":"'05 Canonical Rules'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7768a3e2069f3f8ae9cc5a3c","recordKey":"MS-RULE-OP-03@410599212edc432e","sourceRowId":"ROW-0dae86644d7e0892c43f8ad6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":63,"locator":"'05 Canonical Rules'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dfc532027e0f045dc365b00b","recordKey":"TEST-MS-RULE-OP-03@63af44dbe3b87025","sourceRowId":"ROW-0dae86644d7e0892c43f8ad6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":63,"locator":"'05 Canonical Rules'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ed78ed274ffc51ad54e3c10f","recordKey":"MS-RULE-OP-04@63fbf478664e5e99","sourceRowId":"ROW-ef0314c91d4454e53a93b153","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":64,"locator":"'05 Canonical Rules'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fa73945cb8da9c4c2f46123a","recordKey":"TEST-MS-RULE-OP-04@10af1b4283fbdf52","sourceRowId":"ROW-ef0314c91d4454e53a93b153","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":64,"locator":"'05 Canonical Rules'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2ef0e1aeb6e85a961c31e4e6","recordKey":"MS-RULE-OP-05@98df9a80a2151ad4","sourceRowId":"ROW-4d9ef81e7a1d864e0b1b7a0c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":65,"locator":"'05 Canonical Rules'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0a9b6bebcdd4718c5a5bd34c","recordKey":"TEST-MS-RULE-OP-05@0d20359d25737fc8","sourceRowId":"ROW-4d9ef81e7a1d864e0b1b7a0c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":65,"locator":"'05 Canonical Rules'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-21d3e041f0ef338221c1d73a","recordKey":"MS-RULE-OP-06@6ecbeba4e14a59af","sourceRowId":"ROW-0bf81f21814b84f8d4a6120e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":66,"locator":"'05 Canonical Rules'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-751225b1509fd01415eabe1a","recordKey":"TEST-MS-RULE-OP-06@a9f506c8bff242f1","sourceRowId":"ROW-0bf81f21814b84f8d4a6120e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":66,"locator":"'05 Canonical Rules'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-029860f6abfb8972a1341f33","recordKey":"MS-RULE-OP-07@f1df2cbcb724af3b","sourceRowId":"ROW-426eb58154ac5c17eeb98ae3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":67,"locator":"'05 Canonical Rules'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cbd6bcd17ff357a0aa8f6119","recordKey":"TEST-MS-RULE-OP-07@8efbac703c680b3b","sourceRowId":"ROW-426eb58154ac5c17eeb98ae3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":67,"locator":"'05 Canonical Rules'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d366c5ec44496a15ba01c6dd","recordKey":"MS-RULE-OP-08@a38dff87950aa40f","sourceRowId":"ROW-6ade478d8add1c6d08ff4ac3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":68,"locator":"'05 Canonical Rules'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a9ed0ab25a693542a79706e7","recordKey":"TEST-MS-RULE-OP-08@438a6f5faac23af7","sourceRowId":"ROW-6ade478d8add1c6d08ff4ac3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":68,"locator":"'05 Canonical Rules'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5d35d2e4428d993206c2c942","recordKey":"MS-RULE-OP-09@ec587343b8220a51","sourceRowId":"ROW-b044e2b74aee570af6ea9ddb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":69,"locator":"'05 Canonical Rules'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-79f776cb67d18b44f437c478","recordKey":"TEST-MS-RULE-OP-09@30152b169dd9d2ae","sourceRowId":"ROW-b044e2b74aee570af6ea9ddb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":69,"locator":"'05 Canonical Rules'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7988589b15f5ea166badedfe","recordKey":"MS-RULE-OP-10@8c831bc5659a4340","sourceRowId":"ROW-9a3fb24f1ae7d8b47e64d741","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":70,"locator":"'05 Canonical Rules'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3e79780ff4cb81e850360a6d","recordKey":"TEST-MS-RULE-OP-10@e71f274c4901fd3c","sourceRowId":"ROW-9a3fb24f1ae7d8b47e64d741","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":70,"locator":"'05 Canonical Rules'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-de52e63b059b8943c0b589de","recordKey":"MS-RULE-OP-11@a024a5509524bfa2","sourceRowId":"ROW-0286ad5f4fefc00dbe6a41e0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":71,"locator":"'05 Canonical Rules'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d26bc4ab7a2c84886a340b3a","recordKey":"TEST-MS-RULE-OP-11@431f6754fa078c78","sourceRowId":"ROW-0286ad5f4fefc00dbe6a41e0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":71,"locator":"'05 Canonical Rules'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-35ae893ba688c3a9b3e32d51","recordKey":"MS-RULE-OP-12@04d0287d10225094","sourceRowId":"ROW-8b735011c40a3883395d7b14","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":72,"locator":"'05 Canonical Rules'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4e74fdb038bdc5480bbf0578","recordKey":"TEST-MS-RULE-OP-12@e2e102960c613341","sourceRowId":"ROW-8b735011c40a3883395d7b14","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"05 Canonical Rules","row":72,"locator":"'05 Canonical Rules'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-12970b633fe6913bcaed41bb","recordKey":"TAIM-GOVERN-1.1@35b911ad2aa6f0f1","sourceRowId":"ROW-0436fe940afc1f3caff587d4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":5,"locator":"'07 TAIM Control Map'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ae6c9af2cf7d1daabad0203a","recordKey":"TAIM-GOVERN-1.2@ad2860a2fbdee92d","sourceRowId":"ROW-9f73993da6b03a23b7d79194","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":6,"locator":"'07 TAIM Control Map'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-daa2a089c440880e3c01a1f6","recordKey":"TAIM-GOVERN-1.3@6129b834f8908bde","sourceRowId":"ROW-5eb3955963184e8440a784c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":7,"locator":"'07 TAIM Control Map'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-234f27f53fb2863d0b13424a","recordKey":"TAIM-GOVERN-1.4@2cf04928037dcfee","sourceRowId":"ROW-dc7d966c3c4146ef15596712","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":8,"locator":"'07 TAIM Control Map'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-24ed4fd827a0d14854d22a32","recordKey":"TAIM-GOVERN-1.5@92357b32e10b5e02","sourceRowId":"ROW-ea24af928d62bd87fd41520a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":9,"locator":"'07 TAIM Control Map'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1dccb13b38f8d27016123a95","recordKey":"TAIM-GOVERN-1.6@382c72c8bff29604","sourceRowId":"ROW-5feb54759bd5017430fbf9d1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":10,"locator":"'07 TAIM Control Map'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-316b95722c8193c8db1e4dcf","recordKey":"TAIM-GOVERN-1.7@198eee5654f91ae3","sourceRowId":"ROW-b37bd5ac4beebdf5f507f46d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":11,"locator":"'07 TAIM Control Map'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b35374915d2a08b088e28619","recordKey":"TAIM-GOVERN-2.1@198893140402361c","sourceRowId":"ROW-0f962003a74b184e10086459","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":12,"locator":"'07 TAIM Control Map'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-09bffa3b42d744f17281f8d8","recordKey":"TAIM-GOVERN-2.2@9b46d32788988ef2","sourceRowId":"ROW-940acef05c5ae58b41b4d7bb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":13,"locator":"'07 TAIM Control Map'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-382598f693f133a5ec598e3d","recordKey":"TAIM-GOVERN-2.3@e28fde83a8cc90e1","sourceRowId":"ROW-d85079a2e23f7b879098b87b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":14,"locator":"'07 TAIM Control Map'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-87dd5427df149ab02cc95b73","recordKey":"TAIM-GOVERN-3.1@2427dcd86ebd4f7b","sourceRowId":"ROW-e429c6ba34a217c4dc797ca5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":15,"locator":"'07 TAIM Control Map'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b124c5b87f514c9121683f1a","recordKey":"TAIM-GOVERN-3.2@9c41c08d8d6c9ac6","sourceRowId":"ROW-ca06a56725a9dbb4e85e92d3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":16,"locator":"'07 TAIM Control Map'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9dee2187e80da5c4ab4c1237","recordKey":"TAIM-GOVERN-4.1@104e4747b0fad479","sourceRowId":"ROW-2bc6849411b4998161149591","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":17,"locator":"'07 TAIM Control Map'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1fb3c9b8816b143da02be00e","recordKey":"TAIM-GOVERN-4.2@c1e4d61854eedbe8","sourceRowId":"ROW-29810b95d42030e15e397513","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":18,"locator":"'07 TAIM Control Map'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-db2494d008ef9152a66f359f","recordKey":"TAIM-GOVERN-4.3@6c63b10d0830b670","sourceRowId":"ROW-8d0d0965a44f90ae3d3cc0f1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":19,"locator":"'07 TAIM Control Map'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c46f13f3636106b5f37f5fc0","recordKey":"TAIM-GOVERN-5.1@68f585618af89993","sourceRowId":"ROW-b60b338d8fff0d68d9595662","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":20,"locator":"'07 TAIM Control Map'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f9306c92bff7623dca7fac82","recordKey":"TAIM-GOVERN-5.2@fe8607850f8d2ca6","sourceRowId":"ROW-500750772273410954396052","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":21,"locator":"'07 TAIM Control Map'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0ce00ccc69e6158c5054262c","recordKey":"TAIM-GOVERN-6.1@b8216e0b6ff98607","sourceRowId":"ROW-f2810d3df144aca110dc06bf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":22,"locator":"'07 TAIM Control Map'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bcfb6bf44771383da0921a5a","recordKey":"TAIM-GOVERN-6.2@054b3cd3c85b2f5d","sourceRowId":"ROW-91cd0e78dca275cb050bc3e4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":23,"locator":"'07 TAIM Control Map'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-03e7e5f01f4f6348116dd03c","recordKey":"TAIM-MAP-1.1@f7aec3e0fde77d65","sourceRowId":"ROW-ca6d60a53efb1424563b6a40","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":24,"locator":"'07 TAIM Control Map'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4b41e0a05397026ab461bae8","recordKey":"TAIM-MAP-1.2@93024a692d8324ff","sourceRowId":"ROW-3e236e8e79989911c2fd421c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":25,"locator":"'07 TAIM Control Map'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8a38d9c42e5543df9e7a721d","recordKey":"TAIM-MAP-1.3@405b97af733bc900","sourceRowId":"ROW-2642411dbdc41cc222fca79c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":26,"locator":"'07 TAIM Control Map'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-694eeed621ed191519ed8208","recordKey":"TAIM-MAP-1.4@867a4ceeddb4119d","sourceRowId":"ROW-728f022e48f96ce22c44c008","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":27,"locator":"'07 TAIM Control Map'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c600b1574b4b47d19a918d0b","recordKey":"TAIM-MAP-1.5@7b28c9d1495f3a89","sourceRowId":"ROW-228008b865cc93f7efc74508","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":28,"locator":"'07 TAIM Control Map'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-134a8f08be775a4c270d9480","recordKey":"TAIM-MAP-1.6@0ca81605dd8ee088","sourceRowId":"ROW-5bdf52fb7f0644485ccbf76e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":29,"locator":"'07 TAIM Control Map'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3df4187708d9aea1568e869d","recordKey":"TAIM-MAP-2.1@24236a0f4fe9d355","sourceRowId":"ROW-b687ed4ac9e7e0f057c79e9a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":30,"locator":"'07 TAIM Control Map'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-69be82d5b4128d8beefd6956","recordKey":"TAIM-MAP-2.2@c9b1594e914d9478","sourceRowId":"ROW-3457b56c6f9c22d6c58a0baf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":31,"locator":"'07 TAIM Control Map'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3e9b60ded390f5b3111dcc87","recordKey":"TAIM-MAP-2.3@98b8065b9500c2b5","sourceRowId":"ROW-8d1f0528e35d17f32d1081b0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":32,"locator":"'07 TAIM Control Map'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7401723a3b22ea497ffaf985","recordKey":"TAIM-MAP-3.1@5aadf0f832148043","sourceRowId":"ROW-7abdda5765327e2160582453","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":33,"locator":"'07 TAIM Control Map'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-86cbbf29d2426fba3efb2a9e","recordKey":"TAIM-MAP-3.2@68f17d5dab909a30","sourceRowId":"ROW-60e3318a68cac27c12559032","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":34,"locator":"'07 TAIM Control Map'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-74c5052427fd59a489685792","recordKey":"TAIM-MAP-3.3@2dcbe4ab43aa4492","sourceRowId":"ROW-99eb80abcd3c1d44a589d360","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":35,"locator":"'07 TAIM Control Map'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-057a6950bd1ccade72cd6d02","recordKey":"TAIM-MAP-3.4@e310d1f6e2a1ea35","sourceRowId":"ROW-97d81ae3de38e0218032e5e3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":36,"locator":"'07 TAIM Control Map'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6565dcd687b3bd47489e631c","recordKey":"TAIM-MAP-3.5@03aad24c9f287fab","sourceRowId":"ROW-76805fc34d55894ec497dd54","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":37,"locator":"'07 TAIM Control Map'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-348d973c4167114e2f75c45e","recordKey":"TAIM-MAP-4.1@47a77b8622793a72","sourceRowId":"ROW-89cd18091d66246918ad37a6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":38,"locator":"'07 TAIM Control Map'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5c985a4b29049a7b77290959","recordKey":"TAIM-MAP-4.2@ba7614350b99a7d0","sourceRowId":"ROW-8d92ce095c217473492c4e22","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":39,"locator":"'07 TAIM Control Map'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-67c85c81e9cc13623dbaddaa","recordKey":"TAIM-MAP-5.1@4170d53e4eea6a66","sourceRowId":"ROW-f4c59e325c73d53d771eb0d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":40,"locator":"'07 TAIM Control Map'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-00ecf1c8e404c13fc4590bf5","recordKey":"TAIM-MAP-5.2@4fe1fea3a40c08e0","sourceRowId":"ROW-b629a2051b5c632ad1bb94f3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":41,"locator":"'07 TAIM Control Map'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b8ec44a981c417337a638d75","recordKey":"TAIM-MEASURE-1.1@80d658f30e1d4e80","sourceRowId":"ROW-be066ff450282829b661b44e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":42,"locator":"'07 TAIM Control Map'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-71804f2e6111bb1b268face9","recordKey":"TAIM-MEASURE-1.2@b5c24007b17017b3","sourceRowId":"ROW-e9675d2ee0cb25ece3b514e4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":43,"locator":"'07 TAIM Control Map'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-84a5a2201da19090c189fffe","recordKey":"TAIM-MEASURE-1.3@438e7613521eceac","sourceRowId":"ROW-9699ec5de84fe84fb76cb9ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":44,"locator":"'07 TAIM Control Map'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b29d73bf8894f5de85b900f4","recordKey":"TAIM-MEASURE-2.1@bfec014736abe868","sourceRowId":"ROW-bbec2b17d56289a7f5c25b53","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":45,"locator":"'07 TAIM Control Map'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e67d638b3d923e2d0a80c9b1","recordKey":"TAIM-MEASURE-2.2@f1b91c01b8b926be","sourceRowId":"ROW-f2f376a1c6d3742ab5caaf24","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":46,"locator":"'07 TAIM Control Map'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b098dd71e886bee24981b627","recordKey":"TAIM-MEASURE-2.3@f396bee25387e21c","sourceRowId":"ROW-cacf9d8dedfae0415462a084","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":47,"locator":"'07 TAIM Control Map'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f6a6571f059e69f5a1d0acc4","recordKey":"TAIM-MEASURE-2.4@30416b6b4c6068dd","sourceRowId":"ROW-5061fcbdbff52f60847681b9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":48,"locator":"'07 TAIM Control Map'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c69a995d50f4834919859186","recordKey":"TAIM-MEASURE-2.5@f17bf250e010d494","sourceRowId":"ROW-310c8c5db55e1862198e9662","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":49,"locator":"'07 TAIM Control Map'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ab8203861d2aedece3103b79","recordKey":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","sourceRowId":"ROW-958bacc56d9f333cc38d965e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":50,"locator":"'07 TAIM Control Map'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-25d80e4b2dfebc7f754d9c0a","recordKey":"TAIM-MEASURE-2.7@4fefc7d979469953","sourceRowId":"ROW-4b791ac97fd57b8f09ff28ae","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":51,"locator":"'07 TAIM Control Map'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f8835191daba3e4458abcc6d","recordKey":"TAIM-MEASURE-2.8@927b0554749a76e0","sourceRowId":"ROW-1f2732a147132cb5e67eddd5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":52,"locator":"'07 TAIM Control Map'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e24571b5833659ed0c7efa33","recordKey":"TAIM-MEASURE-2.9@3e99c99461743bec","sourceRowId":"ROW-e9009361c6e3c47a613fff2d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":53,"locator":"'07 TAIM Control Map'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ca0bd9b4b1a1496cdf1760b0","recordKey":"TAIM-MEASURE-2.10@6df5b5c790a49492","sourceRowId":"ROW-439c4005cd304715243aab49","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":54,"locator":"'07 TAIM Control Map'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8dc7c892eb2352d5ff2c4983","recordKey":"TAIM-MEASURE-2.11@69c078796341cd3b","sourceRowId":"ROW-a28b0288d9744e7ead699a22","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":55,"locator":"'07 TAIM Control Map'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b5260c7f2ed289fbca4af69f","recordKey":"TAIM-MEASURE-2.12@12d74b82b770347a","sourceRowId":"ROW-d9cdbbf9522be0ec6296a202","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":56,"locator":"'07 TAIM Control Map'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a180a0ae51c970eac183240c","recordKey":"TAIM-MEASURE-2.13@12d2da14f2779af3","sourceRowId":"ROW-610433a8b0c33456d6be5839","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":57,"locator":"'07 TAIM Control Map'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4471894e894a3a7c2853d9ff","recordKey":"TAIM-MEASURE-3.1@6a9415a16f00ace2","sourceRowId":"ROW-8a6c73181832884f50e05fb6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":58,"locator":"'07 TAIM Control Map'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-546688dbc1441f54db5502a0","recordKey":"TAIM-MEASURE-3.2@0a3eca3853caf2e2","sourceRowId":"ROW-cd6f275cf3add1eca391fc9f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":59,"locator":"'07 TAIM Control Map'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ba58a729f583f6ac73574aad","recordKey":"TAIM-MEASURE-3.3@6a5560394079e008","sourceRowId":"ROW-305b90ddf698d05e612090ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":60,"locator":"'07 TAIM Control Map'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9398d6eece9c12bdbb276d44","recordKey":"TAIM-MEASURE-4.1@87efb87b60ce14d1","sourceRowId":"ROW-897ea52a20ce5cc7040a9541","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":61,"locator":"'07 TAIM Control Map'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-92ddebf017f21e17c3bddc70","recordKey":"TAIM-MEASURE-4.2@441148e8e1148dbe","sourceRowId":"ROW-58449d955527149a0f179ec0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":62,"locator":"'07 TAIM Control Map'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-af740a195796a46be6a45b4a","recordKey":"TAIM-MEASURE-4.3@759303d11da3ea95","sourceRowId":"ROW-7ef5787cde66b74accddd8ee","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":63,"locator":"'07 TAIM Control Map'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-855070702e362faa777c556f","recordKey":"TAIM-MANAGE-1.1@8f95b18554d187df","sourceRowId":"ROW-a0ededd04da90b3308ea08a2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":64,"locator":"'07 TAIM Control Map'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9076d74dd6912669212ea1ee","recordKey":"TAIM-MANAGE-1.2@725fe00a61b98e10","sourceRowId":"ROW-e87514e04a71bd3f97ac3669","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":65,"locator":"'07 TAIM Control Map'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a743423ba3a2040a7f89af8d","recordKey":"TAIM-MANAGE-1.3@113dba8419d60368","sourceRowId":"ROW-5995a1802cb23a347425edfa","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":66,"locator":"'07 TAIM Control Map'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-96114bc1b97ea7aee541bd9b","recordKey":"TAIM-MANAGE-1.4@706dd15eb7c4daeb","sourceRowId":"ROW-8df57b7038b2a41a57860b74","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":67,"locator":"'07 TAIM Control Map'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-edafa2737be981d0ccffa9ef","recordKey":"TAIM-MANAGE-2.1@a1ff21e73495f39c","sourceRowId":"ROW-a73cd2fac4b46ad456ff5692","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":68,"locator":"'07 TAIM Control Map'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-16f8c810bc66976713241697","recordKey":"TAIM-MANAGE-2.2@f861fb2340eaa0c6","sourceRowId":"ROW-aaf6c152c12d314855752277","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":69,"locator":"'07 TAIM Control Map'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5bcd0ec4f0c0d08f113a5efc","recordKey":"TAIM-MANAGE-2.3@f69713d6045063b5","sourceRowId":"ROW-197aa13b5f5bdbea22bbf129","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":70,"locator":"'07 TAIM Control Map'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8a6bfa97a039439a541e2ec6","recordKey":"TAIM-MANAGE-2.4@4c58d159afdc4362","sourceRowId":"ROW-544e28a698bfcb54f1d58363","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":71,"locator":"'07 TAIM Control Map'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2a9d7a11b9e6e616f88aa03a","recordKey":"TAIM-MANAGE-3.1@fa0c648cdd610fd5","sourceRowId":"ROW-b412d5ef3e2994ceae39c8ee","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":72,"locator":"'07 TAIM Control Map'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-09faf60a34c221f4d3b4dcc7","recordKey":"TAIM-MANAGE-3.2@72d098f451a97bfc","sourceRowId":"ROW-0663263ddaf79118d84e7fe8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":73,"locator":"'07 TAIM Control Map'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0b8a49094185d866515598b9","recordKey":"TAIM-MANAGE-4.1@ba6d42802623e508","sourceRowId":"ROW-4e39214407569385f3678edd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":74,"locator":"'07 TAIM Control Map'!74:74","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b43e5840146cd1dc39a7714c","recordKey":"TAIM-MANAGE-4.2@6622b89a3cfef575","sourceRowId":"ROW-3fa4568ddb90364310f79558","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":75,"locator":"'07 TAIM Control Map'!75:75","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2d75f87ebb3c23e91c35ff1b","recordKey":"TAIM-MANAGE-4.3@6d72e9f28c581992","sourceRowId":"ROW-dd6c7a2621768727bb6aed5f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"07 TAIM Control Map","row":76,"locator":"'07 TAIM Control Map'!76:76","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bda859f5c3c13f72912976b7","recordKey":"MS-POL-POL-01@49c4c01e6c0532bb","sourceRowId":"ROW-9901ffd8b126f69ae63350de","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":5,"locator":"'08 Internal Policies'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d9868df7d06df94d93d00dcb","recordKey":"MS-POL-POL-02@aa0847ee55585424","sourceRowId":"ROW-9ad78af677a3b5d9759b887b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":6,"locator":"'08 Internal Policies'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-37fce84f3057319ccd11fb33","recordKey":"MS-POL-POL-03@11c99e7398913f0f","sourceRowId":"ROW-29a4b876563a7c5e5f61740b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":7,"locator":"'08 Internal Policies'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-519f740e1d8001dacac0dba0","recordKey":"MS-POL-POL-04@44f05efa6918df27","sourceRowId":"ROW-9bf2bc3adbab1e2dee12f515","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":8,"locator":"'08 Internal Policies'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0e1c4f2b5c7efaa4405ccbfc","recordKey":"MS-POL-POL-05@9c8c386d8437959c","sourceRowId":"ROW-6e8f3330f289fef5ba84007b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":9,"locator":"'08 Internal Policies'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8b6674966f186025ed33f02f","recordKey":"MS-POL-POL-06@8603eff3ea33a61f","sourceRowId":"ROW-4f74fcc4966dbbe7f66ef362","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":10,"locator":"'08 Internal Policies'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6ebc4fec89ad08d4c8d0e600","recordKey":"MS-POL-POL-07@a1b6f11dcbba27b5","sourceRowId":"ROW-06ea9c0f28a4eea7435052c8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":11,"locator":"'08 Internal Policies'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b551888a68e389d34915d482","recordKey":"MS-POL-POL-08@ee4729bdeed9ad16","sourceRowId":"ROW-8461d2b174b2762e1f10a709","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":12,"locator":"'08 Internal Policies'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f457200118f1a2e22bf2200c","recordKey":"MS-POL-POL-09@30cd5cb249f58ae2","sourceRowId":"ROW-a4fae60a4a57a31922c2a920","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":13,"locator":"'08 Internal Policies'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-47778533629f1dabeb75b0a7","recordKey":"MS-POL-POL-10@cce53ffd6ac04512","sourceRowId":"ROW-7b50d19a31477ee41f8cb382","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":14,"locator":"'08 Internal Policies'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fb0737dfd6a43134e3f791b3","recordKey":"MS-POL-POL-11@4cbd6ed56751cc97","sourceRowId":"ROW-88027e060a43088933d7dcb2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":15,"locator":"'08 Internal Policies'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ebfc9b7526886792fa1f384c","recordKey":"MS-POL-POL-12@2bcf920fc5a05e6b","sourceRowId":"ROW-e26a3fd76ddae25c27ca89e9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":16,"locator":"'08 Internal Policies'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6dbe0d6ff3cb35f48fb5ae00","recordKey":"MS-POL-POL-13@e8a7e91b791104ce","sourceRowId":"ROW-32190cdcaac6e3c194494884","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":17,"locator":"'08 Internal Policies'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a632b16a89795daecff00886","recordKey":"MS-POL-POL-14@aa241dc1520b8ab5","sourceRowId":"ROW-d2d29450870cc664076fa776","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":18,"locator":"'08 Internal Policies'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1b28e2ad9c0cede2017b17ce","recordKey":"MS-POL-POL-15@66ce06439b6303c8","sourceRowId":"ROW-696891ccaa6f91b05ddfeccf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":19,"locator":"'08 Internal Policies'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f1bca75501793dd0ac4db238","recordKey":"MS-POL-POL-16@e96f7674899ecd20","sourceRowId":"ROW-e6709fcf212e2ab6475067c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":20,"locator":"'08 Internal Policies'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dfb8053b2b1bc00e96cf33d2","recordKey":"MS-POL-POL-17@fbd2f1193b92724a","sourceRowId":"ROW-9510c4e7c88ba4e81c0e5afe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":21,"locator":"'08 Internal Policies'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8846b2e1c2080e0b5205528f","recordKey":"MS-POL-POL-18@97f5690fa7f7084e","sourceRowId":"ROW-b736746ce58ff7dff8147ef4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":22,"locator":"'08 Internal Policies'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dc9898d9d026f9783d3b2b36","recordKey":"MS-POL-POL-19@d6f23b7346439395","sourceRowId":"ROW-03d32467ac99155fdf032dcc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":23,"locator":"'08 Internal Policies'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dadb8b2b1f4bc29556cbe865","recordKey":"MS-POL-POL-20@ea163decd6c07a16","sourceRowId":"ROW-ea4881077d96488697007098","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":24,"locator":"'08 Internal Policies'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cfc45ccb38a4a301c87e39a0","recordKey":"MS-POL-POL-21@9a99a10275e80192","sourceRowId":"ROW-bc50ae9819bd430da4ac55e5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":25,"locator":"'08 Internal Policies'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f315efbec68e2ff3ea29dc37","recordKey":"MS-POL-POL-22@7864cb607001d95d","sourceRowId":"ROW-40ebb345161d52b7ba4b367a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":26,"locator":"'08 Internal Policies'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-da143f29c9dbe18f784d7f36","recordKey":"MS-POL-POL-23@daaad9ef8b33a963","sourceRowId":"ROW-cb4466fb39da00773f5837d1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":27,"locator":"'08 Internal Policies'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-de8259ce899ed696bd1aa690","recordKey":"MS-POL-POL-24@3ac8bb46b53fea08","sourceRowId":"ROW-1718f0c9978bf5fc219dc0c7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":28,"locator":"'08 Internal Policies'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-52cfda79733b475f95a4e59d","recordKey":"MS-POL-POL-25@cbf2a67c65532b7d","sourceRowId":"ROW-0aeece3e966f9aa9680570c7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":29,"locator":"'08 Internal Policies'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-46da261ac4666577e29b5b48","recordKey":"MS-POL-POL-26@306487f686bd6069","sourceRowId":"ROW-41848ba037cecf3e8d074e48","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":30,"locator":"'08 Internal Policies'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-721127ba990f07fcb7679d88","recordKey":"MS-POL-POL-27@24ccacabdf3df91b","sourceRowId":"ROW-3719da1cc331838f2d2a68af","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":31,"locator":"'08 Internal Policies'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ae0ffa61ed6adc93a1158748","recordKey":"MS-POL-POL-28@d850b62ebf5806ef","sourceRowId":"ROW-45aa92b9107cc8cbe91ca0f3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":32,"locator":"'08 Internal Policies'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-090f1fc1ede354441cf3b5ce","recordKey":"MS-POL-POL-29@15da853e19e2751a","sourceRowId":"ROW-28b0a5c33e58b821b626ba3f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":33,"locator":"'08 Internal Policies'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-19d43b70e2239416e4f66e31","recordKey":"MS-POL-POL-30@09fcec49716e93c1","sourceRowId":"ROW-6a4a9297afc1dff568ae4ffe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":34,"locator":"'08 Internal Policies'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-65413a6c0a37a850581905e1","recordKey":"MS-POL-POL-31@1e5f7eb3de495c93","sourceRowId":"ROW-ded5b9688f80dee7b6ae0dc6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":35,"locator":"'08 Internal Policies'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-190376dded7ef4b14dc9b76d","recordKey":"MS-POL-POL-32@9422d7fab14d948a","sourceRowId":"ROW-2d79421af7c52328a7ca4a2b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":36,"locator":"'08 Internal Policies'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a0ee9c2b94b7c60698f38347","recordKey":"MS-POL-POL-33@2173f98ce3d3e4e6","sourceRowId":"ROW-26f367f6054ab2f27911fdd6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":37,"locator":"'08 Internal Policies'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5a02237ad74004dce66189e6","recordKey":"MS-POL-POL-34@93db44d68b4d6aaf","sourceRowId":"ROW-507b6a8b1ea536981893e60a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"08 Internal Policies","row":38,"locator":"'08 Internal Policies'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1421f7203e71902d11cb29fb","recordKey":"MS-OVERLAY-CUS-01@ef016720fa4b77d5","sourceRowId":"ROW-146862f47812b9ae26370fd0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":5,"locator":"'09 Custom Rule Backlog'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-887bc5f2b518966c46872842","recordKey":"MS-OVERLAY-CUS-02@2bdb2cb7097a15c7","sourceRowId":"ROW-5bcf96047fa08ae2b6b65181","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":6,"locator":"'09 Custom Rule Backlog'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-397e60c0abf6b812abb8d746","recordKey":"MS-OVERLAY-CUS-03@9e0dd72cbcd36d06","sourceRowId":"ROW-e171c2189c16d39a96f2d435","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":7,"locator":"'09 Custom Rule Backlog'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fa0f25beef587f0b61509fe1","recordKey":"MS-OVERLAY-CUS-04@1f8a3af1c8e871ca","sourceRowId":"ROW-d0055a995dd63ecb14457966","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":8,"locator":"'09 Custom Rule Backlog'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-60a16bd70b2d8207c4371620","recordKey":"MS-OVERLAY-CUS-05@312949a220d7aa56","sourceRowId":"ROW-4b46219e8a7fdf2cc64ead8d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":9,"locator":"'09 Custom Rule Backlog'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-60271643658ccb2076ea9833","recordKey":"MS-OVERLAY-CUS-06@b76726eea76800fb","sourceRowId":"ROW-f664083a9316edadae58f202","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":10,"locator":"'09 Custom Rule Backlog'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4ed41b6986b41815741aa95d","recordKey":"MS-OVERLAY-CUS-07@e7e1902f4641a2b9","sourceRowId":"ROW-1e0906bdfeb07642f5a6383c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":11,"locator":"'09 Custom Rule Backlog'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-47fcef81d1c7f5acc0956b8a","recordKey":"MS-OVERLAY-CUS-08@f2e9d1cd2e00bcf6","sourceRowId":"ROW-358af18f7ff4b1f1c7f15e49","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":12,"locator":"'09 Custom Rule Backlog'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-80907ae3b22cbb29c1f2e6f2","recordKey":"MS-OVERLAY-CUS-09@fa0395a46d9792dd","sourceRowId":"ROW-eed4acdd05169ae1cdae0fb0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":13,"locator":"'09 Custom Rule Backlog'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-879a0d17087baa39da118fa7","recordKey":"MS-OVERLAY-CUS-10@d2a5b80a68088779","sourceRowId":"ROW-5a3968734969f3630d199818","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":14,"locator":"'09 Custom Rule Backlog'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bad6c5dd475d60489e61558d","recordKey":"MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7","sourceRowId":"ROW-7773147c27bee4f47c98927a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":15,"locator":"'09 Custom Rule Backlog'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-371eafa84328dc7e7e0f510f","recordKey":"MS-OVERLAY-CUS-12@b7241f443c6c3622","sourceRowId":"ROW-3b4da8214b1f36c3e923b379","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":16,"locator":"'09 Custom Rule Backlog'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bd44773c0406c36be939e1bb","recordKey":"MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7","sourceRowId":"ROW-486bdf06094cab5c7d69c090","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":17,"locator":"'09 Custom Rule Backlog'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2f50d4f14e84f033caf84bfd","recordKey":"MS-OVERLAY-CUS-14@360b13cad7621179","sourceRowId":"ROW-287d7228f241422587f79a55","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":18,"locator":"'09 Custom Rule Backlog'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-00bb65d42f5f415d7723de26","recordKey":"MS-OVERLAY-CUS-15@bdd9abeff8cb9654","sourceRowId":"ROW-429d00686051b551dcfbf5a0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":19,"locator":"'09 Custom Rule Backlog'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ff77a340c25631068c7095ea","recordKey":"MS-OVERLAY-CUS-16@5dc4891c003c8c70","sourceRowId":"ROW-cc2b90de75c6c003dad3133a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":20,"locator":"'09 Custom Rule Backlog'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-72e60063557caf258f015d6b","recordKey":"MS-OVERLAY-CUS-17@3b8c3e6e3715795f","sourceRowId":"ROW-d471d3023dda79c592f484ab","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":21,"locator":"'09 Custom Rule Backlog'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-870e1cfc3b419c1f9b77512e","recordKey":"MS-OVERLAY-CUS-18@d7a54daf6d4edffb","sourceRowId":"ROW-444feafe1a5e5ebbe1b862a2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"09 Custom Rule Backlog","row":22,"locator":"'09 Custom Rule Backlog'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-caec40f923eacc59890ee03f","recordKey":"MS-HISTORICAL-GAP-01@ef333861512e5931","sourceRowId":"ROW-e89882f4eefed12da4a6a681","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":5,"locator":"'11 Implementation Gaps'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0a4b2a7ee50d23dfed8d9907","recordKey":"MS-HISTORICAL-GAP-02@704ee5c4492909d6","sourceRowId":"ROW-79bf705493f1a4867cbe7d1f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":6,"locator":"'11 Implementation Gaps'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-361832fb2771a4ea6b0da50a","recordKey":"MS-HISTORICAL-GAP-03@a613206359c61d90","sourceRowId":"ROW-83d8fb607f22481006351f8b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":7,"locator":"'11 Implementation Gaps'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-03f09b780279ebe6dee2a330","recordKey":"MS-HISTORICAL-GAP-04@a2b05c620c5f50ed","sourceRowId":"ROW-6a33478c7459f33bbf72cf77","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":8,"locator":"'11 Implementation Gaps'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-82ad0aa1e3b2200b45ee6cd5","recordKey":"MS-HISTORICAL-GAP-05@fd1e5fbd26653f52","sourceRowId":"ROW-9dfadb8ba2471597b45b6e88","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":9,"locator":"'11 Implementation Gaps'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9e1d6b739e5378483e0ae80d","recordKey":"MS-HISTORICAL-GAP-06@638e326b96b3fcf3","sourceRowId":"ROW-ba9782a79b141b74dece3f09","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":10,"locator":"'11 Implementation Gaps'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f6b153d550c0ef1c5f9293b8","recordKey":"MS-HISTORICAL-GAP-07@9c8fde7f6beb59a9","sourceRowId":"ROW-26401adce5181a1a07a0d722","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":11,"locator":"'11 Implementation Gaps'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0f73b62a9eb80c5bf6eaaedb","recordKey":"MS-HISTORICAL-GAP-08@454bf9cdcc63df06","sourceRowId":"ROW-872a502497c8d2f6ff76c86b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":12,"locator":"'11 Implementation Gaps'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-20bfff8fcd55aa309497b3f3","recordKey":"MS-HISTORICAL-GAP-09@3df71044c3ecb595","sourceRowId":"ROW-04a4c63c824966582beed548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":13,"locator":"'11 Implementation Gaps'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b575a2884bbcd3bf8957cece","recordKey":"MS-HISTORICAL-GAP-10@9d50c828fd6ea39b","sourceRowId":"ROW-c049d1f90cd63d56973d42f0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":14,"locator":"'11 Implementation Gaps'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ad4c01917f964224b9d16cfe","recordKey":"MS-HISTORICAL-GAP-11@4ae486b4e3826e21","sourceRowId":"ROW-973c5b6015e711024ce42074","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":15,"locator":"'11 Implementation Gaps'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eb9f243fb9c38aee5060407d","recordKey":"MS-HISTORICAL-GAP-12@a7a5a6c9616fce50","sourceRowId":"ROW-1ec6547dac8ceabb2330aa59","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":16,"locator":"'11 Implementation Gaps'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d64ee40d0a0dcc8c392f71de","recordKey":"MS-HISTORICAL-GAP-13@17c770c42c111ef5","sourceRowId":"ROW-69499a990ce891a907c15b02","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":17,"locator":"'11 Implementation Gaps'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-70db3d10c3c5e9fda8fbf48c","recordKey":"MS-HISTORICAL-GAP-14@9547f69026f10453","sourceRowId":"ROW-6e526396730d34d704b91578","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":18,"locator":"'11 Implementation Gaps'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-88882e7a5f19c879047ecf7f","recordKey":"MS-HISTORICAL-GAP-15@b99678b120eb54ee","sourceRowId":"ROW-45aed31520c3c771b367cd86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":19,"locator":"'11 Implementation Gaps'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f96f9efcb74e6b7b07c29e21","recordKey":"MS-HISTORICAL-GAP-16@f32af55c238717e3","sourceRowId":"ROW-f09aed123818246514cd99f3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":20,"locator":"'11 Implementation Gaps'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b57dc3f43389db7a325e63c7","recordKey":"MS-HISTORICAL-GAP-17@64b248d8f26e8ce8","sourceRowId":"ROW-f5e9250ee5fb2d2496494829","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":21,"locator":"'11 Implementation Gaps'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e20b11a600987dddc1ef7c37","recordKey":"MS-HISTORICAL-GAP-18@f5078914a88d60e6","sourceRowId":"ROW-7760ac3c00f781c033953718","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"11 Implementation Gaps","row":22,"locator":"'11 Implementation Gaps'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3a3af9a0a18bb098fad81c9c","recordKey":"MS-SEED-fc49123874e83c92@1ed210287f703b82","sourceRowId":"ROW-e531517e75ff6c1ea9d2721f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":5,"locator":"'12 Code Seed Crosswalk'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-02e61834ff595f28e06c6b89","recordKey":"MS-SEED-98c36050538db5d1@65ffe1e6e8668a51","sourceRowId":"ROW-95bdf4ef8e71ed1f8da8bc9e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":6,"locator":"'12 Code Seed Crosswalk'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2282218144bc7e590df5caef","recordKey":"MS-SEED-ea7497b6cbeba00e@7470eaf94aa87c41","sourceRowId":"ROW-8d0849663cd435b444347c01","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":7,"locator":"'12 Code Seed Crosswalk'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d17c88e8144044a077694158","recordKey":"MS-SEED-ad9fe38d530f8f1e@d7fcddbdb30bd016","sourceRowId":"ROW-4c7b126ab1150cbab527e52c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":8,"locator":"'12 Code Seed Crosswalk'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d8f3c16357fdfa949458d73f","recordKey":"MS-SEED-3c262146dff584d9@65146e1683c930ec","sourceRowId":"ROW-89ee5d0d815e2c04f504daf4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":9,"locator":"'12 Code Seed Crosswalk'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b00651f1476c16e74df17cb6","recordKey":"MS-SEED-71dcb43d4ab69039@2cb8ac94477f4fc1","sourceRowId":"ROW-54a0cda710cc0ac226446bb2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":10,"locator":"'12 Code Seed Crosswalk'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7d6bb48afc436db8c651d770","recordKey":"MS-SEED-189bbb416d04da7a@9eca359a04a266eb","sourceRowId":"ROW-3398f9b98a01b2c82243a490","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":11,"locator":"'12 Code Seed Crosswalk'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6b170ba3a7603cbfaf21faae","recordKey":"MS-SEED-fa17b2e8b13c54ec@c3bb1f47e455b596","sourceRowId":"ROW-c38cc466e1d28fe7580bc966","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":12,"locator":"'12 Code Seed Crosswalk'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6e1a127382fc85b5863a3ba4","recordKey":"MS-SEED-0d5943f602c4e0c6@0b72544338892151","sourceRowId":"ROW-c064988b42aeccde475a2fbe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":13,"locator":"'12 Code Seed Crosswalk'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-de45746582c16a0bc41aaaef","recordKey":"MS-SEED-fabd8a5fa3829b34@a1173a790d6af788","sourceRowId":"ROW-d91e8e2c081aaaa400d5a26d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":14,"locator":"'12 Code Seed Crosswalk'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ffffcaa44673405972ff708b","recordKey":"MS-SEED-18fc98793e3aa932@1b1b44969e446920","sourceRowId":"ROW-09a9c737170c0eaf9734804f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":15,"locator":"'12 Code Seed Crosswalk'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fdb9a6141ddfb5b51be0441e","recordKey":"MS-SEED-68e6b67355afdda4@2380ad816add7da2","sourceRowId":"ROW-79f5105a5614c9263ce987a0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":16,"locator":"'12 Code Seed Crosswalk'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-49d4e5c6efba979dbdfec533","recordKey":"MS-SEED-1362e1ef9da30d6a@a69019f699a9743e","sourceRowId":"ROW-ec127003a0d28e1c2d007c85","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":17,"locator":"'12 Code Seed Crosswalk'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2e404226456cd5f0bea9669c","recordKey":"MS-SEED-fc55d1561526efc3@99d4d53f8b22179d","sourceRowId":"ROW-8d4888969b27d0e629cf009c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":18,"locator":"'12 Code Seed Crosswalk'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3c4869ed60a4bd74bf74ad23","recordKey":"MS-SEED-273c936c3ac5a321@609ed6ce29a693b3","sourceRowId":"ROW-b8e1564c743132220f350fa0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":19,"locator":"'12 Code Seed Crosswalk'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a5664f8cd087b4c6df3f2bc5","recordKey":"MS-SEED-38a0f0c058b76861@f7e97b882e8d03d9","sourceRowId":"ROW-b3df80072b3e1b6c3c76eb6b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":20,"locator":"'12 Code Seed Crosswalk'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-20ed53d276fbf63f2d7fda81","recordKey":"MS-SEED-59116351fad45b18@cef308c28bb05b77","sourceRowId":"ROW-0fc6e47ceb3fd0833dcd0f4b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":21,"locator":"'12 Code Seed Crosswalk'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0124079f9e9b18b82c332f2e","recordKey":"MS-SEED-c3235745be75933b@c2946015ae62bccb","sourceRowId":"ROW-d3b71ee6cccb14b8cab0c71b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":22,"locator":"'12 Code Seed Crosswalk'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-075381f9440c537f390e5eb3","recordKey":"MS-SEED-7c38f47e89353be2@c668276dcce2c02c","sourceRowId":"ROW-78719549d6f65a288a70090d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":23,"locator":"'12 Code Seed Crosswalk'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f3e7060f347b8fe38cb47873","recordKey":"MS-SEED-3545abaedc039060@41f9aeca34965328","sourceRowId":"ROW-8cefef221161f5459b7ccc99","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":24,"locator":"'12 Code Seed Crosswalk'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-41bf5f7d443b93747bec4c66","recordKey":"MS-SEED-f14ef687ebdcf6dd@e868935a9f5522b7","sourceRowId":"ROW-ec3492acce5ebbcad4dfe3e4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":25,"locator":"'12 Code Seed Crosswalk'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-36cbd402af9e429544e7e637","recordKey":"MS-SEED-72c2d3940fb2e07d@a30b48de591bab74","sourceRowId":"ROW-f18954c14a4219e9ea924d9b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":26,"locator":"'12 Code Seed Crosswalk'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6dc66f919c156549ee725b80","recordKey":"MS-SEED-f24cc8315666f56b@0b522650197658e0","sourceRowId":"ROW-9b72c07bea974cf12dc2bd30","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":27,"locator":"'12 Code Seed Crosswalk'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-55b6716574a6ac3b4466d237","recordKey":"MS-SEED-af63591ae8a0d1d3@cf9fcbd0c3f96907","sourceRowId":"ROW-00d87bbfab67a923114bb38e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":28,"locator":"'12 Code Seed Crosswalk'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ab3f9932c47d0e542642a396","recordKey":"MS-SEED-9b9cda9c97338d12@ceb60bcac22b5550","sourceRowId":"ROW-71e8ffd025b963adcc1c4b9f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":29,"locator":"'12 Code Seed Crosswalk'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-df4bcd5cd0b1bef5c195b961","recordKey":"MS-SEED-45c0aa82a09ceac4@b7de303ed373dc1e","sourceRowId":"ROW-793bfcc68cb26b4abab508df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":30,"locator":"'12 Code Seed Crosswalk'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f1ef4326aaf73871a41cc477","recordKey":"MS-SEED-6962f396beb2c752@af6c264d193e2846","sourceRowId":"ROW-66539e6f26ec87bbe11a9bc1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":31,"locator":"'12 Code Seed Crosswalk'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f46e9fd6b8b642880096d6e8","recordKey":"MS-SEED-274a1827288fe0cb@596d8feb02101b0a","sourceRowId":"ROW-32df96ed3abceadd78b3abbf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":32,"locator":"'12 Code Seed Crosswalk'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fcd2a0b6e2f1ad6e5716d44d","recordKey":"MS-SEED-af6d2822af49aa78@15cfcad58c3a6910","sourceRowId":"ROW-1e6816d1ec7869f6c78a5755","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":33,"locator":"'12 Code Seed Crosswalk'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f12860ce85e41a388349a849","recordKey":"MS-SEED-773a80bd6da7f832@fbd7a85624f21c94","sourceRowId":"ROW-c596af87ddb04c45eff80f0c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":34,"locator":"'12 Code Seed Crosswalk'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1701db79a3c24a9c1105efce","recordKey":"MS-SEED-db227e3fca1cbc72@ad3e673390385458","sourceRowId":"ROW-838a3b36ebb7fd868602dd89","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":35,"locator":"'12 Code Seed Crosswalk'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6821fb5a351a3f87c3f9f74c","recordKey":"MS-SEED-3b2df0684d924bea@d76862e507e52a9e","sourceRowId":"ROW-01ec318fcaa13fa5c44171ad","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":36,"locator":"'12 Code Seed Crosswalk'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5db75917f77102b4e091fe3e","recordKey":"MS-SEED-3a800d0a422ff4cf@bb27bd955ce6ac5b","sourceRowId":"ROW-9395f1cfac7c8957e195fd8a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":37,"locator":"'12 Code Seed Crosswalk'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-29252f59f57ebb568935c03e","recordKey":"MS-SEED-e7da922c47d356c8@a8f292c00608d481","sourceRowId":"ROW-5298209f409bdc7952ce82e2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":38,"locator":"'12 Code Seed Crosswalk'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bded1230dd49b2bea9a60fb8","recordKey":"MS-SEED-0318ca8123595a60@ce3f096f7c803475","sourceRowId":"ROW-af4ab4dfdf0104a164195ce3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"12 Code Seed Crosswalk","row":39,"locator":"'12 Code Seed Crosswalk'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9523c6b685d1ef20dfed7fcc","recordKey":"MS-SOURCE-NOTE-NIST-AI-RMF@98431fe675258378","sourceRowId":"ROW-723c6f53d9af0c34c3c60c8d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":5,"locator":"'13 Sources'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1b01a13659810ada298ae017","recordKey":"MS-SOURCE-NOTE-NIST-AI-600-1@9f18ca8a12bc344d","sourceRowId":"ROW-cabcf78a76fd24ca003186b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":6,"locator":"'13 Sources'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4c6b6935056bc2104bd463af","recordKey":"MS-SOURCE-NOTE-NIST-CSF2@a272302d62ba1740","sourceRowId":"ROW-29d3486160cd65d5f0105802","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":7,"locator":"'13 Sources'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5fe90daa41837424e18ed987","recordKey":"MS-SOURCE-NOTE-NIST-800-53@e121d1d1460084ec","sourceRowId":"ROW-87ade4455de5bee96da0d4d4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":8,"locator":"'13 Sources'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-11933d36fa18ee2686b40a10","recordKey":"MS-SOURCE-NOTE-FEDRAMP@5e0472e4d1ffabac","sourceRowId":"ROW-bd93a6a23b73f73d1877fa7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":9,"locator":"'13 Sources'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d3d8e41ff8be934a3d876778","recordKey":"MS-SOURCE-NOTE-ISO-42001@87c0a2b5412aa0e9","sourceRowId":"ROW-7deff5e867302c090b508bf9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":10,"locator":"'13 Sources'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-be9b590d8c8bc8932bb0b9ab","recordKey":"MS-SOURCE-NOTE-ISO-42005@e17e06ae157a1f98","sourceRowId":"ROW-9258166bda5ef211934003eb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":11,"locator":"'13 Sources'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a99fcf49ddfee0a2881b9825","recordKey":"MS-SOURCE-NOTE-ISO-23894@80e543ddeca562e5","sourceRowId":"ROW-213273a7e6825bfc832b1ac8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":12,"locator":"'13 Sources'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-78dd7904d18b0a0cf2bff4d5","recordKey":"MS-SOURCE-NOTE-ISO-38507@770b79062960bed3","sourceRowId":"ROW-8e2b57ca38ac752211982427","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":13,"locator":"'13 Sources'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a30d21772a9e7407a1d50cd4","recordKey":"MS-SOURCE-NOTE-ISO-5338@643c4b69567eef27","sourceRowId":"ROW-f630cfd300d79a80856d51e7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":14,"locator":"'13 Sources'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-79d98a5af4c1d156e693ea79","recordKey":"MS-SOURCE-NOTE-ISO-24028@6163ca05af07cd39","sourceRowId":"ROW-23be4b66866a98ea224800af","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":15,"locator":"'13 Sources'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-911106cefe1c179446e073bf","recordKey":"MS-SOURCE-NOTE-EU-AI-ACT@52f0bd02c9eb6511","sourceRowId":"ROW-108081788dd247a0c4103aeb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":16,"locator":"'13 Sources'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-03cbd57c8cca84675049e27f","recordKey":"MS-SOURCE-NOTE-GDPR@df5de80066779850","sourceRowId":"ROW-11c15131928a0186a899fd50","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":17,"locator":"'13 Sources'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7eaa01078afd004c1b466ccb","recordKey":"MS-SOURCE-NOTE-HIPAA@4a70cd2d5098a0c7","sourceRowId":"ROW-87ec29517bb6f98f620a9cb5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":18,"locator":"'13 Sources'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-acb97f102c772e6203279035","recordKey":"MS-SOURCE-NOTE-PCI-DSS@3bf9369883365902","sourceRowId":"ROW-0878eb783e475bae84c5d1ce","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":19,"locator":"'13 Sources'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-49f9273d6d4c3a182a12b09c","recordKey":"MS-SOURCE-NOTE-SOC2@4545ab4b9080158e","sourceRowId":"ROW-d6d04c1d550ccd808ca741d7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":20,"locator":"'13 Sources'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-84ecce8014637927e35b382b","recordKey":"MS-SOURCE-NOTE-GLBA@dc735550e5b449c0","sourceRowId":"ROW-ad2dda4a47909d1716f949a2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":21,"locator":"'13 Sources'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a329a3e9156d9410675e5f73","recordKey":"MS-SOURCE-NOTE-FERPA@07e23ebe6259be8e","sourceRowId":"ROW-e1af5f85af93f8e5737f06e0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":22,"locator":"'13 Sources'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d9ea8a4a166644b3e5d50ad9","recordKey":"MS-SOURCE-NOTE-CCPA-CPRA@dfbd85b2a322fe7a","sourceRowId":"ROW-3d13b97eba5f66a7e905d84c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":23,"locator":"'13 Sources'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-757a231b3aebb3b6c6aa268e","recordKey":"MS-SOURCE-NOTE-CO-AI@0990e7efdb70bde9","sourceRowId":"ROW-c30a780babb1867fdc0384af","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":24,"locator":"'13 Sources'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eb7fc5383dfee6738efb900f","recordKey":"MS-SOURCE-NOTE-TX-TRAIGA@ad2fe809b6252e8e","sourceRowId":"ROW-e2d830466ab99ccbba64ba73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":25,"locator":"'13 Sources'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e694d291f76b393e78604f40","recordKey":"MS-SOURCE-NOTE-OMB-M25-21@df948b26494bab24","sourceRowId":"ROW-efb19504deecd7b81a028eca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":26,"locator":"'13 Sources'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-12e490d114786324ac033eda","recordKey":"MS-SOURCE-NOTE-OMB-M25-22@281271ae37faf796","sourceRowId":"ROW-16f1dec94349ddab3f60e58e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":27,"locator":"'13 Sources'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fb6242d216d217923dfb8880","recordKey":"MS-SOURCE-NOTE-OWASP-LLM-2026@c3439a2d9e8b7618","sourceRowId":"ROW-f7e376de3df6821eec1f5565","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":28,"locator":"'13 Sources'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cd468b626e68ac18afe15c6f","recordKey":"MS-SOURCE-NOTE-SOX@3765787d692c0bdd","sourceRowId":"ROW-9be8ad8e05dec59d0e046a17","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":29,"locator":"'13 Sources'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e3317019b30e21588439045f","recordKey":"MS-SOURCE-NOTE-EO-14110-RESCISSION@b1e1206ab8a875f8","sourceRowId":"ROW-fa5aa960671b2ed3783ad3e1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":30,"locator":"'13 Sources'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b17912e533d7f74db2a400ee","recordKey":"MS-SOURCE-NOTE-CO-SB26-189@bc07181d7e90a278","sourceRowId":"ROW-1c3a12de44f535e4a6fddee0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":31,"locator":"'13 Sources'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-45967f6d6fb1ecc1ac51ff69","recordKey":"MS-SOURCE-NOTE-OMB-M26-04@4394ab01566ed077","sourceRowId":"ROW-ea3b58e664c1bf890acc5229","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":32,"locator":"'13 Sources'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-124725b28ecc1ac7a69c6611","recordKey":"MS-SOURCE-NOTE-NIST-800-171@5a19e663a8d345c5","sourceRowId":"ROW-e74ee1c6736e72557b9d1180","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":33,"locator":"'13 Sources'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-49e3efc036edc8942d26317d","recordKey":"MS-SOURCE-NOTE-CMMC@9e207924a4f419e9","sourceRowId":"ROW-7734dc8054e1aa3bb0a065d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":34,"locator":"'13 Sources'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0e163899ea0a038b1a053f66","recordKey":"MS-SOURCE-NOTE-CJIS-6.1@7add1fcf7e28764f","sourceRowId":"ROW-eef331643b6ffd3347d26eeb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":35,"locator":"'13 Sources'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ed97d056a860dd5a8d55600c","recordKey":"MS-SOURCE-NOTE-IRS-1075@3e893b9fcbc81dca","sourceRowId":"ROW-d18a6606f8b36e7bb230a45d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":36,"locator":"'13 Sources'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4fc604e13c0a3ce4042f0eda","recordKey":"MS-SOURCE-NOTE-SECTION-508@d70c0efece3bbbba","sourceRowId":"ROW-5ba7c6c0bcfdef3e32230b33","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":37,"locator":"'13 Sources'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9a2f00490f320f805bf92291","recordKey":"MS-SOURCE-NOTE-HHS-PART2@9228679fc413763e","sourceRowId":"ROW-60f380e380e028f310f349dc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":38,"locator":"'13 Sources'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f33939e303475fc188854979","recordKey":"MS-SOURCE-NOTE-ONC-HTI1@49483b2433b19c50","sourceRowId":"ROW-98d5fe2378e545f5d99b52d4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":39,"locator":"'13 Sources'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b36afa673f30fc3a23a6f708","recordKey":"MS-SOURCE-NOTE-FDA-AI-MD@61f59968505b1fa6","sourceRowId":"ROW-8fa6d3355c67d7270eeba24a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":40,"locator":"'13 Sources'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3a29cd1bea44d00ca6515961","recordKey":"MS-SOURCE-NOTE-FRB-MRM-2026@0acc0024ff8f2e8a","sourceRowId":"ROW-ae3d01d10e21253761a95aab","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":41,"locator":"'13 Sources'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-622bb0abd0cf859d2c0f4876","recordKey":"MS-SOURCE-NOTE-NYDFS-500@6374340ea3d01620","sourceRowId":"ROW-fae6056afae43fd05040754d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":42,"locator":"'13 Sources'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bc9dce299ba07f4665e68282","recordKey":"MS-SOURCE-NOTE-ECOA-REG-B@bf7f1748f4f66630","sourceRowId":"ROW-62811e3885ce0bca184cef26","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":43,"locator":"'13 Sources'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3c491a761f2c977d8803f970","recordKey":"MS-SOURCE-NOTE-NAIC-AI@7158e975d38b48aa","sourceRowId":"ROW-d79b285e8d97b5c1a7d317bf","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":44,"locator":"'13 Sources'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a91cb91dfe45c5821c48e5c3","recordKey":"MS-SOURCE-NOTE-COPPA@b0ecfb53ebaea5ac","sourceRowId":"ROW-e0bdcdf9a1d21918ea492969","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":45,"locator":"'13 Sources'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a2283fabe5f0ca030c913a53","recordKey":"MS-SOURCE-NOTE-NYC-LL144@7d6edadda20097d6","sourceRowId":"ROW-881c96aa63df52c7c1a0757b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":46,"locator":"'13 Sources'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b0eabe16ef0f80d1bbbe9c45","recordKey":"MS-SOURCE-NOTE-IL-AIVIA@4835e2fbf12f2c51","sourceRowId":"ROW-63e4a8237ff7fde83912a8cc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":47,"locator":"'13 Sources'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8898028970ee40935e645311","recordKey":"MS-SOURCE-NOTE-UK-DP-AI@477b70b509183173","sourceRowId":"ROW-500ba8c96af3728e7884db43","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":48,"locator":"'13 Sources'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e8c7f79bba783d07f65a1d9f","recordKey":"MS-SOURCE-NOTE-BR-LGPD@5fcba992809b3b1e","sourceRowId":"ROW-3b5874ab31e922cea4ca7adc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":49,"locator":"'13 Sources'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9588a7f5b2c66711ca0e55da","recordKey":"MS-SOURCE-NOTE-AU-PRIVACY-AI@da30724b50ad5d96","sourceRowId":"ROW-d96847232d467814681317f3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":50,"locator":"'13 Sources'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-365e498849836fb1248fd878","recordKey":"MS-SOURCE-NOTE-SG-MODEL-AI@82e8e54435c86c2b","sourceRowId":"ROW-aa1b50b906f7485b2663cf61","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":51,"locator":"'13 Sources'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-663d672cd5eb6c725c754a50","recordKey":"MS-SOURCE-NOTE-DOJ-DSP@033ab90c34a8ed45","sourceRowId":"ROW-ed26e563ccec20d9fb0f14ec","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":52,"locator":"'13 Sources'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9c71556ec14d8543a2d27451","recordKey":"MS-SOURCE-NOTE-EAR@db7aeb13e0f74f04","sourceRowId":"ROW-8b33503d26da2c737177ca6b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"13 Sources","row":53,"locator":"'13 Sources'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9df37865b07cf86ba28fe67c","recordKey":"TAIM-GOVERN-1.1@26b8d9618cddf058","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6e02b26a737e88ad624fd633","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5983b530f2c3192e50483178","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0752d3a5f7b93a56832ccebd","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-09bdaba316442c6d92021f52","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-50aad441030c1826ea62d2c5","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8230585714bf342ca8bee465","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8fbe2484f706f111e17e0f02","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-54eacac0114fd10cdb3d94cd","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-159e8ad940b95ccf07c0f6c8","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6d5eb4734c4b12241d19d5ee","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e6bd1e95b45eef1148c68383","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-35be6548d63bfb387384d411","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-57e15373a395ce1fbe263138","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e6487b01c02dfc65796fd594","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c7427bb3eb9c1e36bd214c41","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-69c99bc9ca0d5f8253256414","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":2,"locator":"'99 TAIM Source'!2:2","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1bb23cb0f1545cd4175bee1d","recordKey":"TAIM-GOVERN-1.2@91a9127ceb89507e","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6bc0c1a5ebd44e8d440b64a7","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5679ac6b4295bb4e2de1af4d","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-73a08ae78931bc03bf976e23","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5927f6f477453d31a6ecc00d","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fd0a65cc64c8d50030c759e8","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6c732a23945b9033cc583ebd","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-169042b23eb5607e147f922e","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c8f86dd786ffc614af4ece23","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b2973fc1f0f2bb42ece8b1d0","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cfc4e38d0a2b1e378cff2bc8","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9ec6c3dc09fd756eb53d3e8c","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8f3d3a8b866f6a57bb48975a","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-88686cbe552ba97e55833e40","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a5e18a9aec792e95c99cdab8","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-64d7a590e7f76bbf736c1a21","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9c09ebd50f9a9f7d5ba9b497","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-006f24745eade51dd22a7926","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":3,"locator":"'99 TAIM Source'!3:3","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e792385160dee2d4dd6cd778","recordKey":"TAIM-GOVERN-1.3@d61a82d09de245d3","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eab5b94ddfb7e6ef3ab48e82","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-54091aaaa04da20d5c3586dd","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d9864d745a632d99c75c0b32","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e34a892ec3ee5745ff644f6c","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-398f9e00845fee65aae3f0ad","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-36536286a8620925661f34fd","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e6a1f6a5c5f79833548b823f","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-817d4a8752d0d06673383649","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3f3b1ba8a6716904c5e6dbfb","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f440caae4d6754e0d73d6393","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8d238b3e1f960bb3e1420e16","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cdd0eb20fba0be33784c19d9","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dc5e54201d724152272ccf22","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2ed0c1baacb59a8bf25f9437","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a6bef0688b2541ad4247b2a6","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cd522c64cc2719a39df6fa62","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ec8749abc5cd237ebc689788","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":4,"locator":"'99 TAIM Source'!4:4","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-009d3a497765441a6bf349cd","recordKey":"TAIM-GOVERN-1.4@a744d71de8e42bb8","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9efd089603133c82eedd9886","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a56fd5b38507cc9457b7945d","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-65d7de901dcea3a260b192b0","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6a25267c232d942aaeb585d0","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f534c7bdbdcc378eace9e88d","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-efb5807c49226f69fd475ed0","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-220252481f94d955fd02e264","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5719b441856a3eb02cc00d30","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6ef3ff7adae9cfb38d5ff56f","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fd9b1619a2a7e2c52ad2b719","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-35e1084a4c171b632eae5a76","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5ec2a45d798097c354f5cd0d","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-71a176cb4e5ac3044cd162d6","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b7022fb8ec7fcbb65f55abee","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6a23d703850a8ae9a4418267","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bc1b984e2f4ef02e92815d61","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-24e73b51af734a21b156464a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":5,"locator":"'99 TAIM Source'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-59a9462e2d7b56af0df4fe16","recordKey":"TAIM-GOVERN-1.5@e6be6927d32f915f","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3c40d8183386ce0b71744646","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5a866e15d1067d739ba7f471","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bbaa5ff239f53daff2dc8e7c","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-40cf7a0491ee23cfb598af24","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0975b9d57707b59b6858baa8","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3138c33dc36dd2e9e44e3027","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d6b2c9053c572e301f9a3328","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-133cc6dad15beca3bc7661ee","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-28c0ae7606346dff61bbd953","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e78225f4f5701f2d6955dde5","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-17b9e3412d5afc65d39d96d1","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8a8855a93ce8b503e2dc4d9b","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f8ddab44fffab93a3482e978","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c7a7b90c109f18171d154149","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-40104296e36966e032d877d3","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-80b0f9292ba8b3965f786810","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-abf3c030701d3952652184d6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":6,"locator":"'99 TAIM Source'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-71c3f372ad9091ed8aef22e1","recordKey":"TAIM-GOVERN-1.6@26f041bc196d2f20","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-59657d039778054a917e6dfd","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-32eb1d8ad9305dea02480198","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1fb3468972cb70055aecf307","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-059b228f81e083b4e6b4fd70","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cec4180a4a1bf2523e4a2e68","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4e1cb3a82c0cdfde15f8cc38","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-90d731fbfb378f312fc39373","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0894172b61ed5bf51888c275","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-50672ff012a1a5631b89d9e4","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-091495d05a5715b325a59827","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-821eb185578ca122c7459a13","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-249aab2d0deefcb1f1f3d00e","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-287c23f04848438f569e71dc","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d86d2991ba35f7038adff6d0","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-272b613be2250710c7563dd6","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ddc9da1634882720736d3fed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":7,"locator":"'99 TAIM Source'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-12d394fcec11149083b8d554","recordKey":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","sourceRowId":"ROW-866ed5a608cb779efd53f138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-edf7dd6de63cea06dd0c711d","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-866ed5a608cb779efd53f138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f6525bb1472ac51190c07230","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-866ed5a608cb779efd53f138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7f97d6dd7f5dd92979bf75e2","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-866ed5a608cb779efd53f138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ee1950ad6571007599951b76","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-866ed5a608cb779efd53f138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-976fec8a4401ec4f834ceb45","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-866ed5a608cb779efd53f138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8112406c2178b0f627c0388d","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-866ed5a608cb779efd53f138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":8,"locator":"'99 TAIM Source'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fb6045ed4494111d62077268","recordKey":"TAIM-GOVERN-2.1@677e9c1589774ef7","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6bb8057349a644047acb4ee1","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a73a61ac580b7d9088027549","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f0ebcd379352c1e7fe52c7be","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-18a03e728e114cccc13114d6","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a5e6939b9c24fc78ee826b59","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ca134ab35cff28c859dbff75","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eb058d3d9bb68e2b60a4a954","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5be979486664694b9d04aae4","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-8042e5c7ef35e197cfd3245a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":9,"locator":"'99 TAIM Source'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1cf89f324a9f4fd6d6738569","recordKey":"TAIM-GOVERN-2.2@212a87832b3bc07a","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-85873d291f80c419f5a399b0","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2ee22cffab7f2f131bf2f39e","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c37e67c1887235436a4cabdb","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d5c680a6ce69c542e5cb4179","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-712dbe02154c811db442e9ab","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e046f6c34700e398b12b64ce","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ab94c215d29019c02933d804","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4c2fb156dc6113d2e3a32185","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8038c25f5e4f353a15f45b45","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-647bad6205cb19bd5b9fe517","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-951573f660706b555b01f707","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-678b37db321a51d725144dcc","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-21b4a494a3999e43e7b9f51c","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a6bad529ea692276e3684dd0","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4aac10a9bac676c5363e3969","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-faece65fa2fb525d68412e0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":10,"locator":"'99 TAIM Source'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-16fae025aa42da88f8bc83ca","recordKey":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ce4e2d848f1949208e89b70c","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8f726db54be8aa41fb5ed74b","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-892c908084d26a093be0f2a4","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9982d88548ea5d7629f0a018","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bbab8cd696db680b224b22f9","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1329d135d5f0b40cb0143dff","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-716bf6677b218cbaee2008eb","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-87086e73cd3e53fe7f1a734c","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4afb096931413904ac42c9ce","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eb4ff61483ea2a62e3ce1487","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7353490173c2ae24a92762a8","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3c9c0cc33d7700632e71e30c","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4196e107407564cdb6d1f201","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-af4cc1e35a7654d18e89680f","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e0c31834b277be75e829cdb9","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ab651762c65682d5e2235548","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":11,"locator":"'99 TAIM Source'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-49a66f8a63c2c554837ed08b","recordKey":"TAIM-GOVERN-3.1@0f38f1685d8ed670","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-60c863f20bded6d8796c4306","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-992ffa498336c2f51662a143","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-98eea395395286676698fd1e","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-381c82498a3f02811f61f2a1","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b5bde226af717d3a83801177","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2726a3cfaf0a7bfceb0b21e2","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-032b1b8b824522fb98f36f48","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-18606ebaddd1582a81652ba3","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-d217f40341fc0d18d7d422ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":12,"locator":"'99 TAIM Source'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c9810bc8830a1175eca9932f","recordKey":"TAIM-GOVERN-3.2@c47019573b68992a","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7422aae192c956fc5fe7973f","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-974f1cde400d9e877f1016d4","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f147b6ddfdbbfa3f7bed364d","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a107a48cd698b4a901460d5f","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8224f86bc52944a0b5792088","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6a7b481a01733424dac3785e","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-05135d568f6acc514c546226","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-01f68446e34e77ecc6a4321b","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3a76cb9c87d956906421b839","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1fdbd1b3c1f33cc92cc100f9","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-36bdfbfdb3874466a0a5503e","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7bc8e429a5646b1954586990","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-da7c843d3c9154627cc3a98b","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a367e737d86b4816e032ecdb","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-97591fdc26d6e23f705a268b","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b6c766bf3a708d904c67c705","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-0caf005df47ba87dbec6235d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":13,"locator":"'99 TAIM Source'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6d3eee53c27ecd492ae8206c","recordKey":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2bbbda9e770acb7b265ade43","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b242369a0192b3ac28d33a1e","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bc233942cd4056868cca3d42","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1f78be4b1be7f4799f797036","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5f30af21f17e52ea70b409e4","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9f339a87538f7d9054957775","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ff6f8505682fbe9d253d80f0","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a26add81da2af7678dfea9c6","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4f060d9478cd3def413cfd29","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1c08d764cc966fea778f28b2","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-53ba6f76a4581a367dde0eea","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-00ecfd82a2969b1fb5fc0764","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8101ce300ceb53a7c6c28d54","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9591be56f88784427517eada","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3e6bcc4e482ccbbdb5097588","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e1cfeadf920ad3e96dabea92","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-4dda1eeab539b394fafc8127","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":14,"locator":"'99 TAIM Source'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5a87f247234c98905c2d8be6","recordKey":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-954eda7e26e7beb4054e68ae","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cec46ed363415ec3cd6c61bb","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ba5f3d4ff14c2bbc49c125db","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a5c910f57e4b1f10a417f2ef","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d491b8e8a10e955980368542","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8f96d5aa639a8ae8c20ea245","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-22b4c87ae55b31adff919ae5","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dca2661391129a2c9a0a6311","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-beb6468e0af494af660ef9a9","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-66dba4946e96d210b5b6ae61","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5ffbb051b10024e5025c4e4a","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3ffd4dd7def60729c3e6cf27","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dd82541d1947d79995b80643","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5377714060a8fefb380385e7","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-56c402ed655500b93ca99a7f","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bd838f5eb2ab52feaa797da3","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-34c1a5e1e54f6514cb439bf1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":15,"locator":"'99 TAIM Source'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4d1b6fba1a80738af8169b49","recordKey":"TAIM-GOVERN-4.3@87ee4878e85c702a","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6263a9b13902a5e563a3dfcd","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ad50ea8796a0a33904b5e017","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-896320a12d0244ff859922ca","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a1b14bd5626f43c4494a3872","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-961ce5ac3627c20eee0ae5fb","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8781c209611fe5da0ef4f4eb","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b54c2a6cd8fa8d60dd60845f","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e256c0bf1f3ea66854656fd2","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9a80683d21c1ee6d9f434b5a","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a07c8b47d33c4c49ac819bac","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-292693ee3b7c8c1ee8c48f22","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eeb819c3bb53b0210dbc4f61","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9af28aa028bb3fa79900d570","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cc6d5c0739723d118445cbba","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-55e0b2a4ad2583b514ca2cea","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1dc5339950b72bb5cd153223","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-a271195e2f0dd5ebcad4c092","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":16,"locator":"'99 TAIM Source'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dbec9fdab77ac19da88b5d09","recordKey":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b504c3e9f670a4bf49f1eace","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b1ae39ef6126b1db0b47a9e4","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-db34e1f5ca0e124737022586","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2f400e18c3fa15821613c21c","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cfde5bb54e83f70886444262","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-98b61811c770ee5f3ff5ea2a","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-327087554795e6a6e51bbddd","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-513f86c7459a997f43b76333","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8c7d4f08dcc9f441467fcade","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9c790d96be70cac560e88082","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bee460d1fe33b43c133c99c4","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-54ab6f3ae6c14976a33b91d1","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d495f298a4670d589ff57c9c","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-27e19f83f8de6a7b641a2b40","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-59531815c65c107159f5e1b0","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1eb0662ebdf374db08a0c84d","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-54bd0d82f9a9102fc00b95db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":17,"locator":"'99 TAIM Source'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-110a54430f391a18096650d5","recordKey":"TAIM-GOVERN-5.2@0c282eb98e0d233a","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6261408dc134bb6b9fe3a0e5","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8fac8177e2bc7ac3f9dda70e","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-052c0064fed4cef3e20999c3","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-043d9f67206560f31968c38a","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5299f7ae224541b1d367309a","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-11ba1669fe84000d18cc0448","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-375a31ce133f7447884a405b","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eebd09d47c7d672f3bf12cec","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1011800c0182aa3dd5eccf05","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b4b2883c51b2921cd8271f25","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1f4494ec94207ec3a661a86a","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3296713e2a94bb0af3e1d6f2","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2df1c723ccd35c2dac495c9a","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-48d851cb1eca88b467f40432","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7e638d12b78190ebb6748b3e","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-62bc4ed10661143ad4940144","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-965c7ecf305f3fb88aa0b843","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":18,"locator":"'99 TAIM Source'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-00a23f18d470a280d811ec83","recordKey":"TAIM-GOVERN-6.1@fc5e93781b104482","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4fb016bba3c96c98ba70490f","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a3a0345c1e6cf408fbd875c0","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b2c05fdbde5dbdba02e578e9","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cfd8fce8fad922166c7cdf6a","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-de6239103a0c3a69866b51f6","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8edca9f4b13d5ec0bf195d90","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ec392bf6ca43ebaf6eb10601","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-362fa6b23636d11e998567d2","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7f01aaf23135e73f5996ef62","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4e091f51fea9196056e5122e","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a6fbf569395738019f626ea4","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3a5668834dc800900780330f","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7d7536321d51fbbc0ab13caa","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-af998dfb9c7aa157588a39f7","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-178d1d576ae0f6b92e483c0a","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-7268fbd634553d4a4624ee25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":19,"locator":"'99 TAIM Source'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-600943f9f74513dec0bba2ba","recordKey":"TAIM-GOVERN-6.2@bfdb82176b6f4825","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c8a2f010511db0dd59bb5847","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bcfa3e412e3b1c5aa37a1f8e","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-be87a9e2e6867dfb207f4917","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6fc3ec0d8dc1e255fe669f78","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dc0b63d0b84fbc45d42f1d0d","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5944accad3217be29885004d","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e2d3b20ae3363a82bb2c0c46","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bba54be8de45800cb78ac36e","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-444e43b614af805d88188e0e","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-12d8acd5b20075ae5c5f82ba","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4da9fa2e457c3cd727688b01","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-07420eb18c70c53927e2aa96","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7f5238f2007a916066943d05","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dfdf1c1a3710b8f329a4a6ae","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-35f657b6e7cb245de306eeb5","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b5b59f80100bceb465263564","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-0efb7d76c4efbfa485f02001","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":20,"locator":"'99 TAIM Source'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d33d04fbcdaadff423dc2d12","recordKey":"TAIM-MAP-1.1@78b3fb055e68bb28","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-be47dd574286c1032cbeb3a2","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dc668a807dc585484b1662bf","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4a16642818b330576147c074","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b9e5d28e6f7f6f46f5f94b0a","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-39f323ad285cb2afbd855bd8","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d1d433b1a13ce4ad93841f8a","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-daf1561b0ed493e6b2badd98","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-df3e16fdee7b7d994cba2903","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-38eacd3f389ab03142f8fc3a","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d2c16397edb5eaadb426daf8","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3d444c515901d8266a15662f","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b9045d8b039ee2873426c380","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-19f0d91e8035f256ab2b85f1","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2a7bd932839583c4ac40ab34","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-013656b0e83d105c557b32d2","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-493adb2edeaada14573fe41c","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-23d3074070f7495c0a308228","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":21,"locator":"'99 TAIM Source'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6584f2ad15bae265d6e7ef2c","recordKey":"TAIM-MAP-1.2@88267d6e5486e9ff","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-905220625e4a1fc3dc5d096c","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5f13344780defcaffd371c91","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cf79a93837bddac2b8c5c17e","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5af5cab2ae8fae481ff8028c","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1f6a6f8c2a4bf3f3c2af6b95","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7c3b42e51fab8504fc483718","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5b58ef7c28362de49be5ee4a","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f7c643f72b26a78a61475c83","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4fa4dec57c13cd0bff924fd7","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c690771afa7707a6f13eec2d","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7d9f1d75f72ee29b4af1b739","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e518c1931874404d26448d23","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b5adfee45b40a9d9cf20dec9","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fe56c0f27cb26fec399c8924","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-f36ef4111791b8d7f20f2408","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":22,"locator":"'99 TAIM Source'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-46efab7dc820ab91b5ddc445","recordKey":"TAIM-MAP-1.3@1e631023c1414ce6","sourceRowId":"ROW-eafc5c95da5c20fd5e339a23","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7deb71585aca98caf8543fb0","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-eafc5c95da5c20fd5e339a23","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a41958258fcd53c769680b12","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-eafc5c95da5c20fd5e339a23","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-acf2242e021784ad42bb27eb","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-eafc5c95da5c20fd5e339a23","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-92d4b3bdb940a12ebd7e567a","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-eafc5c95da5c20fd5e339a23","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a9dd18a636b48a248d32bbd4","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-eafc5c95da5c20fd5e339a23","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-10e351a570c4607f4d3a936e","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-eafc5c95da5c20fd5e339a23","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":23,"locator":"'99 TAIM Source'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dc63fd710b0891174191b56e","recordKey":"TAIM-MAP-1.4@576a9621f7b44f60","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c27ffeba629ccb0759190967","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8c1c6f6a57c8cfd5a6a88b26","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d420288321ec8d4d6838099e","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dc0892f64a105910c78a8c1b","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ab0e85ccf311815bc37e5338","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bf91646e66cb772ff12efef7","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-29b60407ac2b500a02bda467","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-4298c58891ec01cff2812177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":24,"locator":"'99 TAIM Source'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dd6fe50f0c6e187bcc4b3ed6","recordKey":"TAIM-MAP-1.5@076d4983d14ef5a0","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9eb67bfb83fd99270125f0f9","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-46abaf50c0987badbff97e70","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-934678a66f18ca6c3a931ce0","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-44566247170f93c75fe599bb","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0eb3256a1cf2b84ea08146d9","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d9e38f8318efce2528870d7b","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-26914d86b3623b7e176a1085","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cbc218d6eb19a1ea372bc64d","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bfe52a620649e0824092dc46","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-78396b5623c02faa4de49b04","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cde210a1911ade55054576e9","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b33cb9d277b8416d1e5112f2","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e89704ea3cf7765a65b2897c","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-166ec6211735c504296478bd","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-6839e7728c72933ded8c9e38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":25,"locator":"'99 TAIM Source'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6b87f6dabafa1841ebeef343","recordKey":"TAIM-MAP-1.6@be58945d827b6db0","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-08353635e0f4406d6fec5448","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fb3cfb5cc805cb779b57b8cd","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f7ea5d3e227cea1482d453f2","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-18fe822798140dc151187e3c","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bf7e0189ce561e428d09ad25","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-970bf6baead9f507427d5c62","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-58029b7cc944257143f01b7f","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-341581ec5550349273ef3092","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1292b9ae31b2a53b634ee833","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0595c9f6bce55660434274f7","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f0777e2951887b52c7ea0572","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d5fff9d20cffedd5b27bf9c6","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dfad89637cf21391980f7c07","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9508205f80fc3b04c8d1d527","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5781df0cb60be7b31dfd1d1f","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-9192e7c3d785cec72abcb981","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":26,"locator":"'99 TAIM Source'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dafc91de77526d896502a178","recordKey":"TAIM-MAP-2.1@4508ecde43a2dc95","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-aa21f8be87779737d7b95c05","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fb17fd35c853720b5857d749","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ae377d72a680a7f7fb5d6e12","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4eba6a42dce3ed9dcf69dce8","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4367812a5956c00daba7bf7b","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d33e04a048697a95e3549df2","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7da38a8109b9e96e3380756f","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ff3403f90c2f5579fc740f0f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":27,"locator":"'99 TAIM Source'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a5cb229885f0fb220a94f2cc","recordKey":"TAIM-MAP-2.2@318e6e5f8367a840","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0a9602fbdae4339f831bf8db","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d61dd71d4c3187c78cc9d283","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-53bfecb9732f096228964350","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-aade397d003c63055455c838","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-52899c6a0620bb31706fcbb9","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-028b7525aca239ee69afdb30","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-de2c16f455971a3ff28cf282","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-cf1292c3ef018079d628408c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":28,"locator":"'99 TAIM Source'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4d89c8de3e29668795bca21c","recordKey":"TAIM-MAP-2.3@595fdc3a6417dcba","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fd634010b765484c62e38b93","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-06e52d5fd63acd83221101f8","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2af95aa436e91e35d54064d4","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-01aa397ef99988c260594cb4","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-14f618b7ecd4f640648a8283","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4208109a775dd3cae704d037","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-db3e50dd66898b99534065a0","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-0067ca5f0b27dd73af2e26be","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":29,"locator":"'99 TAIM Source'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fa7680a6bba0986da6d10533","recordKey":"TAIM-MAP-3.1@8cf079d1257ee929","sourceRowId":"ROW-723912eb26a85e142966be86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d044dff220e4b76a36493c85","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-723912eb26a85e142966be86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bc06819a4a4c03e65def0404","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-723912eb26a85e142966be86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dcfeeb750d42a449a7614e80","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-723912eb26a85e142966be86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f1a685cea0208ddcf373092b","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-723912eb26a85e142966be86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0bbfe627853c3fb42ed70139","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-723912eb26a85e142966be86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1688996ffa41c0b243f86ebc","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-723912eb26a85e142966be86","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":30,"locator":"'99 TAIM Source'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6580f032b4d9d105d6270778","recordKey":"TAIM-MAP-3.2@b4079d9aebeb395d","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-affb16e618c4d97fdf93b17f","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-19afba689e0e71bd5bfe9a6e","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a63c068f04b85a313750fbbe","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c3cc5c8158428f32e4cb4927","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f300f571ba5f78110b0b2599","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2f2f222c4e4bd7f303420fa9","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9e8e68ddea58cf9459c61143","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-370d4ad051bacae26aa365a3","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-9190d1a152c3046eac8c62b1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":31,"locator":"'99 TAIM Source'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-efa0a8e85489c51afb6e9b5e","recordKey":"TAIM-MAP-3.3@db54472c934e7816","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e3ef5ffb9961ad35a6011c33","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b1b604767220d60dce977f36","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-322f059528f32d70c7726683","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0be5f8a790b81502bf78d96b","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-de09aa9bf7e21f2cd4cf844e","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-038ae5b03f21aec816cae026","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bd3a8f31c121ab469623512c","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-573423169833732c16cc15dc","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-d1b715c5541416f7dcb9a66b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":32,"locator":"'99 TAIM Source'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7b224d28a9dfd6ab832798de","recordKey":"TAIM-MAP-3.4@171bc4d2aa86131b","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-19e09d44d2e71aae07e58774","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-844ae70589378c9386027317","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b638cb15e0976b0793c8323d","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-affe99d530c0c053ab2fbeb8","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-48c0fd6e97ce4c8ad42f249e","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e8d0d317d9a2c82ecb0b5577","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-04a6cf3a2eb4195f8cc95b0a","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-2616e9d999e3d178520929c5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":33,"locator":"'99 TAIM Source'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-03ca8c57c4b4c7df3d49c5a5","recordKey":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d0997b1b0c724a92176471c4","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7ca2ebbfd878d2ca86f6fdb1","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8cfa5de401898acaf5824aea","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c3243009d63b450a584c53b2","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2a15dbf510c180923b5b9473","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-07b182585fd5a43bf5d62652","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ae89f161a889b848080d174f","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ec6d732b74ee411ff5d1647a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":34,"locator":"'99 TAIM Source'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b69389c8eef42222a315eeea","recordKey":"TAIM-MAP-4.1@59a21bb34b454e39","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d705bd7dd18a8df5119de748","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-202c48218be07f9168554454","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ad6854882f603cade109d013","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8ddd580f2c0b1d097cc7f60d","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-23586acec86dbf5e3f929b66","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-948e650f3b7345c70534176a","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-216dda3ba01542966cd8297f","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-babc7245f1ca84fc2880a863","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f17d6a1315715cffd3e372a5","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f0ac482579ce0f8dc7e15479","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a16bff74b150ea017421d120","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c499ea38f2762fcbd85df585","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3230f3505a691c5aea1c6ee0","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f49383717de25af50a94076a","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-343892692769ba233c7d0e44","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-d1a56b4ea8e659779440507b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":35,"locator":"'99 TAIM Source'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-113b968c117546a9ecee985d","recordKey":"TAIM-MAP-4.2@0287d8ad2ea3574d","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-eb689e4be18d092aca4358e1","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-332c6fc61285cb7750af88ce","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dabaf9b1d32a610fced156d0","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fb4d1ab33ee9d0c03e180217","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3cf1ae3a5a20c12cf46f3582","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d56659a757c8bb61d9516f2c","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7cfdcf30fffefa477b59dfac","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7c9a2af2398818a2ea42eec9","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4e324a8bc7b185b54f17faa0","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e6ed88ef51b574fdb18ae144","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2abaa1230a94c4471ef439e4","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fb25d8fe5a796bc1d5cfcf16","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f0b8ae2685369efd5ec240a0","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-59f8ded38ae5859c61963f35","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-66aa8ea5a587bd54f4137b7f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":36,"locator":"'99 TAIM Source'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5b16bc2194bb33e5bfe0f7d9","recordKey":"TAIM-MAP-5.1@eeeb1c9210779883","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a478061b27845bd6ef034f14","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7d2a3450cffba53ffb2faad3","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-730a5a13ae6f5e3e1aa46c3a","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b4b05d689cbce1f6924d5e07","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-65f30ca6c86c7ba5f9809aa0","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f5656f4d0c02363524bac544","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a32c91b7497335e5402ee654","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b4f86cd4ac8506751dcf2a4c","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5f45e5c38e2b42e20524b93d","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-27fc1b0a6ce666b4aee44f14","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2cd895f7601a15d1ad28c9a7","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-937aa3680450f232d747d242","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-226c734ae574a81824bd16a3","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-01400470d0c5e3fbc6e5a91a","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cfa7208303ad9de84eef67e1","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-fdddc9dcf0cab97bbc06ef2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":37,"locator":"'99 TAIM Source'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-80a896a02cd702daeeb33aa3","recordKey":"TAIM-MAP-5.2@d9cbb5e90cd723ff","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-708aaa342765481881f26703","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6ddbc9fff55083e3a0e1ad25","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b6819457e9cbc75ae154c006","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-303275cad7c810ca9cda7bb1","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ad7c9f1c22ef5a864b028156","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e0514fde7dc6f39d001be7a9","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-31504f76bb7c2d706481cf91","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-86073892144ae88cc932e459","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6c1bc6dac38b92c2a8cdb773","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f9e49fc02da64ef07da30d50","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7d08ed2556e784323837bd37","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a44641277700ed0ae5c1373b","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-25caccea084fd229bd9ac939","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b37eed70bfabb81a3a7c10f4","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2d5b02faed9cb00462faee07","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-a3ef5d6a1101466c52c4ed73","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":38,"locator":"'99 TAIM Source'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c0eeb027d30c3c81bca5f12c","recordKey":"TAIM-MEASURE-1.1@06bafc72fb94bf95","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-46ca3ebb9cab2cbbe6b8ef9d","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a29fedc48b004cc712b723c2","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f60ca371d73176cf3c3003b5","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ee3edcb17a08693a6b060bee","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2620eca5d0e37dfb921d4e30","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cfad7ba540f23e225a18bf92","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-add0c6bdc13a65942c22bedd","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f97de2ca337ec6b7da56b48e","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-707dff595286d5019e84d165","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e2264edeb95468e5f0e2090a","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-beea484c4b92e088aab4184e","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a359e89e95159b7296288491","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a2b8869a2617e757ded519ff","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4a1405d1abe9377026e24980","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a1ea6af7eb4625111d1b73d7","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-9c17f29270131b62ecea33db","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":39,"locator":"'99 TAIM Source'!39:39","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fa9771a41d4688c4f6c54d56","recordKey":"TAIM-MEASURE-1.2@6a15ee51fbe22034","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f8b875ffaf7cfe98d0b68a47","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f6ed215c368231fd1f5ea1d1","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-34cfdceb10cbb4ee8be29b4c","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-966002d2381cdfdd8c3e63b3","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d5914dd151c8526b14108e63","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5cc8783b6c1ac8bbfad4872c","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2a63d0164c41fa4b351ca5bc","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-329e606786ae126889fb87fd","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7f1304bfafafdae5566f08b0","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-aaa307fd0bcdc7c1bed927b8","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2fed86a404b62d6124c82f17","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ea839dbb8ab360270ef6d46b","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fd098aa35194a2e0d4a12b0a","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-99fab7145390ddbf220f01dd","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-24b2fff384f36fa457a3630a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":40,"locator":"'99 TAIM Source'!40:40","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-84976aab9d7d3abf7a5a6ebe","recordKey":"TAIM-MEASURE-1.3@4da0283611f39f57","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a4ce48c7782558609df03380","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b683835b09864040d4c474d3","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c9f079ea872b85f2afe303a3","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9cc6b25585604c1163b38263","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bbd36f1b8f04f82e9e1fb57c","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-88e0664f63cdfaeb7623c7bd","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a50be61cda704d42c0518f98","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a2cb660e8b3b422c54f3c7c1","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a907c593e235c511f9a8a0e6","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-66827c0dd7db9a373dfdea4d","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a85c28ca92dc4e63696026f6","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-269c3f03a54b499ebee82508","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0c9b4e3a12dd9b5e91507542","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f9341d2fd52089c803279e10","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-12ba89d08dbad8ad7c57af81","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-372e768ce67373a7401d8359","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":41,"locator":"'99 TAIM Source'!41:41","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ec85003d822368e56ee03ae8","recordKey":"TAIM-MEASURE-2.1@e9330844656a4ab1","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-10987258b3b0a4e352ff5f5a","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-779da0cc3e423c528dc25375","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-895d0269e439c5924c5d8b8b","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-548c0a5f9d103fe3e63db00d","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ae3b6a5946af0442f8e1e65d","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b62eaa4e7f31d4fcafce4f79","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-96ff5520134f30005fb2d08a","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ea9ab3648b66176209450c13","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fd385efd122e8ae68915a916","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-25915d5ac9885282c16492a1","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-27ebe1cc087c025c44ad4205","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9cbf5a75b1cfc83408296359","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6cf67566d0d58fa34fb55dd2","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7114666e92b1d53958a1a365","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-473417dc4b94c0e7ac53f761","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4573148c09c36916bd474c1c","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-58b158c842ba5bf2dcc854a4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":42,"locator":"'99 TAIM Source'!42:42","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f85f4a8fe4fe46e274c45014","recordKey":"TAIM-MEASURE-2.2@10cd0cb098928172","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-05401688d3afcb4ef6e257df","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-34ab6dd8d8c0efe86927e0ab","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7cbaae0ff1ef023feccb9558","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b8c42d706f4f4eeb8139d70e","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ec77d1c40eb165f4ae66009c","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1d6fc760c910216b8b1df47e","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e1eeadcc5aed1bdde2d63094","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-49b8e05643a0981551b45cd2","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-44654b77fd8a608f1b1f1165","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6e5d91093f7d00c3ed42eb4a","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e732ddad3ba8e7c41c225150","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-22a5525383f836b09b9ddc44","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-79e620e804f0383bae1b585c","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a67b193fdde73021602f506d","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fe3db852a2fd7473e8914477","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b0f4a30285d28f2f38b49022","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ebf541a8252b895189710873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":43,"locator":"'99 TAIM Source'!43:43","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-01213a543830e8280d5d6ac7","recordKey":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-73dd0968b5191489fd52f54b","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ab14b4327d297fd8d8632bb8","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-840722d1d85314c88d995aa7","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9711c6f0c011db3f1496cafa","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-35785647140d1910744386ce","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-038a04a3c38fb19c8ac84aa9","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1772757f2984b878a3113b26","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a7bc3f6775adead7f419d428","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0532e39f7ac32b9136410dec","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6cf9e3ca9c44a57702018914","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-293d68a071e938a2ae5951a2","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-416a2b71ab1164dc0370e3cb","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0ee2caeca8da502260fdf008","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-628ec67bab7ad58619b24990","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-0edb41ce2de4a91f5af76107","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":44,"locator":"'99 TAIM Source'!44:44","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e49ae909c4c6e3efbac3204b","recordKey":"TAIM-MEASURE-2.4@4f759def92d244b2","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0459845553da566c1d630d3f","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d7ca8113464bd99bf322c443","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5a7bf08699e6796d1a99bae2","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ee23426f0787df53afec692a","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-93f0655511db334fc9e18162","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-117cd75fa0e93e7649439bff","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ec10615301d5a50a94eaf514","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a40a24c804f580654603e096","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-08d82d1d56718d77516ab25b","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bfbf6f606076961936bde8e7","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4c2599d9f1779e6879ec2712","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-820cf0bbe5c19c6ffabdccdb","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-01ead137fe5c02f86722374c","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bd37c42444e081a2e50c19b3","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2523eb2dfbe747767bbb7a49","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ec92d82ab31b8654734f83ef","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":45,"locator":"'99 TAIM Source'!45:45","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-60a0b497380769808afefe5d","recordKey":"TAIM-MEASURE-2.5@530446e7cdd7b14a","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ac4d60d874d94ae44692a56a","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cb44fe4a8971595cf996878f","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1809cfe7551d60a5d52dc25a","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-35da14c22ae96d9fe00ae67c","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c76a484b270311282230f960","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-36141ab75b5b91b3ccd4b68b","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-27190382508217920c2f1bf4","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-82f0df59028206844246436f","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-36cede90ee115c7e1bc5c9fc","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0adc22da147cf10fbb9016f8","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-436aca9214f2fb699f8bccce","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e9bf55e3b211ca81d5c2dcd6","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-761fb470a63d471d23216bb3","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a9e03d7f1a91a1da7ebfbc92","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-8e0a15502a88a114b20917df","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":46,"locator":"'99 TAIM Source'!46:46","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bbf24ae84882a7e7d493b113","recordKey":"TAIM-MEASURE-2.6@36a069327f5d2611","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b0dff991fda2c75de25d9d18","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c0ac7743ac0a17d7a0292319","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ba02d98169a85b702413dc1a","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-477a4e61350377ed54550ec7","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-84ce953d8ddd3b0ce3220131","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b7a2df117e89628dfda45969","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-01487cd173b325fc3f68985a","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c84bb78142d0094e80ea4d9a","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cb0a6866817da1bbb82ef146","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a83176c7be674079dd95a164","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2423a2310da6119af38c9ee0","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1256a9f5e43f86eb4cee89cd","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-142370d7ea410c529877d315","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-67414e601fa30bd9c6811f57","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3fa0063c13dc984db702fe82","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f8e7ab5ca0368c22333bde20","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-bede077ea979069247d116e8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":47,"locator":"'99 TAIM Source'!47:47","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-718efad760db76b403ac41fc","recordKey":"TAIM-MEASURE-2.7@5b57e3e360c405ae","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9f48b71393ecf2ed6e219c48","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c1305082d632be8e52e43b30","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-58ad8dba1d18b871c3aef202","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-75aefcd360f5461872bd5bff","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3f437ea27a96bbeec2ea2744","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-291bf058aa3bc7184264869a","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bebab459aeaa283c57411b59","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-41e6511a3faaef3e31796f32","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4e054685be4bacbd28976a5f","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-66626bf3492711b77a3c0169","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ea261805f721b45c20016a52","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5e19216b042171aed05cd512","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ebedb5393bcc26d6aaaffe80","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-15d985c22a30c92c42250763","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5cc47aa17f2670c3f961171e","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-41b2c175475cf5db0734879a","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-06da8597efa3b7a7aaaa7b6d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":48,"locator":"'99 TAIM Source'!48:48","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ee77e7edaf323bbd79585a25","recordKey":"TAIM-MEASURE-2.8@263030dd27d71a53","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-54c75883a4c2af87dbb11ba7","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e81944983bb86261cbe10eff","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5041956fd1eaf2f4517a48dc","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c8eed9fea39c75bcdb6b030e","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3f105e5b233e14e835e42eed","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-52b30c2d7538dc478268096d","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-310f5b9b2426c9a66c2e249b","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-01ba5b295a7820c237956f20","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0c89c9499107b27ea514d5e0","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-473bd6a5dff24039e63f00ea","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-08df5cb0ae4b74427525c58b","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-979b5cf80a33db90249977ba","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ff6af4fd1427c67be68911ba","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b6aef49a1ad8f50e0b914aa9","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ca5c27cc38dbfa0da094c179","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4f24ee4eeb467fa83a958a1b","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-f934d4e7779c1865efbca53d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":49,"locator":"'99 TAIM Source'!49:49","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7ba1124e9ed3f4b684a389dd","recordKey":"TAIM-MEASURE-2.9@81925d68d826c01b","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-29f133dc3dd8cbb2c27250d0","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a8a4e6de5df86a2e4e235339","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-69854c45ac83b518aedab70f","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-40d0423b7850f2c498070d20","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5734adc2512cb8ba44126420","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-281617102c9eb07278ded3bf","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-451047e8b713d894e995286b","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e9d88544bd6bded448f807e4","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1554258e885afc5643bd3956","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-387e57d89b7903165a5d4d30","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-730238de48b35b758299137e","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e228f72ec7481a903901d17f","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5a267b6c35e4154918f8dd1e","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c90b02d679ab419666ea1432","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d68739f91dc06b768b03fa8c","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-c61f8dcb905ce5b3ed4adba8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":50,"locator":"'99 TAIM Source'!50:50","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2a454dfa9182d9c475aa3993","recordKey":"TAIM-MEASURE-2.10@00041240562d2f6b","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e0381daf93a9e05b8941b2f7","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bb3672b387d5268fd6074f13","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d95a747f4810b4b4ae5ddbe4","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9f783fbfe684234c85a0b78c","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-187bdc2bc673791ca82a9837","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c73188b1a8b9678db1112abc","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0cbd31dad42c7ccdc92b1eb4","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5ce4b47fadf3752e47927f8c","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-61cf781cae0de7a8c15cff72","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2d9f48d2c4a4559053227eac","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-884bcb4191ba2b15c1a0d2c0","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-44442abfee5789ffadc188b3","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4bb771f91dabc27143b6bb92","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a01430d309d1d7398d27a328","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c9d130fc4e599244c7f30033","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c05e57d0ca4b27c235f11309","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-d36f949fab780098727e0fd1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":51,"locator":"'99 TAIM Source'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5bf7bab98dc874dfe0570460","recordKey":"TAIM-MEASURE-2.11@c547147a38410e2a","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3d5e7f544b12a793da0d0b0b","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-334de24b5365347e8376834a","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-72370a5fd9131a56e907f9be","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7e56aad718b8a602ee42a43c","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d4d68e42a7e8b56fb21007f5","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2fde266038ba831d732e3906","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8ae6e6487f44d450d39ab525","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a2c5d873ae6c589dfc24721d","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b0ad19f5a221f3b535d55d29","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a3206569ba26b351855d8171","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-372487ec141972c4d726ead1","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e3eeef464953084f6fd66ec8","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0e1d6f85d909d8abb622b7c7","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-381b59620dc27f41684da8f9","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1a982c86dc13e7e6688ea293","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b55c811bf0ff11aa51c8f3b1","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-ee25216a12998041d07b0fa4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":52,"locator":"'99 TAIM Source'!52:52","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4cbfd8473dc1cf0c5cea415a","recordKey":"TAIM-MEASURE-2.12@242501cce6559442","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-04401576c92f12097656c57c","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c4ce1e2f70f4751b624eb00d","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-137a2a172c0c6f33e6e7f224","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-325a1f3bb2db16fc32ff47e1","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cd3a7ebdbde030c1af575e64","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bce3bb31250b289b23028d1b","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-140fcefbdf9682e30cd6df55","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6ff8388b966d339ef3cc9714","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-95fd53da2969ec73602bd105","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6e4a25626efbc4ad354cdc0f","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f30357028919bb5babb6adc1","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f8b2c9ccf39e3478f9a5aaac","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e91456d835086c6667f44c7e","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1b01b2eba4749151aff7201c","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-795037c2a181f69d62d79528","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9b018fa86ae81d2679125f55","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-1d5369a5d9a4e65fffb9bf78","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":53,"locator":"'99 TAIM Source'!53:53","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-637923563fe52ed90c072278","recordKey":"TAIM-MEASURE-2.13@48fc4cc20ecff047","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-63e351fd87498096e36823d8","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-89cc39a682a0c72286d435ce","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-37b2b271589773c22f74d1fb","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2e4b6dc4032a69be97c66c94","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3435fde21ccbd56d170a0c80","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dca20189b28015dad93e972a","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-00298cb25fb452fbef257574","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d7b1927555a10f55a7124acd","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-601d26a97b1e3276f010397d","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-86c424f2fe0edb156f8e30fc","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7ea3210084012d4dd90c4883","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-839c6b7180138cba586093d0","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-442aa4d872b36d32d8a21675","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-09222312f8f5bd9a9eafad6f","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3daa6dd7837fb3d0858dbc23","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ad46c79bdfa560f86ac9deb3","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-5bd8f9294992bd7d217ce8ac","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":54,"locator":"'99 TAIM Source'!54:54","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-63296b45f7ece2a8a65ac82e","recordKey":"TAIM-MEASURE-3.1@1a8a34c7269bc006","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-de43ef4f0b47f95de4ff54f2","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-89a61aa97132fb0c6efe6328","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0defc6dde5e5d756e5273553","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7c4838f0e8ab412c5c3d357f","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f7ce65189721a1663ced2456","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0bfe58eef283f362440ecded","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2544a0bb4b7fb888d0686141","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3ab5e8a5305e558d6a3869ab","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8c55b4822ee3497e5378cf11","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4cb359bb3a3a8d2b8ffc52a9","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-37ecd5b484f134b51c85127c","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3c7399d8329529103bae37b4","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2af1bf0bc0d8cdc029516eca","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8718a1fd6710572b24792e2a","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d06204ca9e29fc10a21494e7","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-89f29150237de9d50a891fdd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":55,"locator":"'99 TAIM Source'!55:55","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7eebe8127d6becf5e5dc93da","recordKey":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1a4c57042f1e96a56cee9610","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-22d0673f4cb1cb94eeac4ded","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bcdda2672373cd5897fe15ff","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9499ce8b6b9eee16eb4fe91d","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d552b9f0b98dcffcda777d25","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-38f396e3ff2340a83a10548c","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3bc262d598def7c61cbfde53","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-43a2ecc47e1af718c7b878d5","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ebc9fda4d83e32405c0ca031","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b064016ff1045e29e262e043","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-660a613204feb85285f3a0d5","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-92cdd8a2be9c8853ac397c1b","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e2561b3a1ffd2735153a0014","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b111cb8e2ef1d8255ae47b69","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-aed5942c1be00089502af735","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":56,"locator":"'99 TAIM Source'!56:56","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6a4218ca14f28ca435d0319c","recordKey":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b2aa4850f06a97c08370f9b1","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8ff10073ac615cd5ca6924ec","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-38dc058210f106dc1d70b281","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-13f6b6c5bd267de55a5ae3f8","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1be18a73119e29335b61ea8e","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3327136c12c5c9f7bca98786","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5debe6d6514d565e51f1f61d","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2fef087a8b746c5c051ae386","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-831127aad04cb35e7ec2aeec","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-aebef0049ee4b56bf703636f","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4034e0c9cb91248c60bf7f14","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5f31777819eee4ea1f7977f1","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-499cbbf180b0a8446c732cbc","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2953882dc9ee45af8de70800","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f1aeab4d8b3e0894c3619fcb","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-deac53aedf87c33f05c85413","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":57,"locator":"'99 TAIM Source'!57:57","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c8524fb7b00913b7ef355a59","recordKey":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-af734dae880d6eaf4d4da00d","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-312d689298ab0f7a958d5693","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-95cf047e5b0bf88fc5c5e6c5","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3812cd9f3be90d52ce5d8ad3","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-10071f9babad26859b8f5c3e","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bcc73980d04d5e91c3f211f3","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c00cb65445ef325bde7f7c30","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ebb63c19f77b01f8b7f3605d","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6934c21edb73f40187f03e12","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-800dddffab2798034ca06129","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6f3edde8ddec898a8795df1c","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cb48b47e297afa49d17eacad","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2de07dc525e5b2a75362ba10","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-47ec327a894fffdd64cd581f","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-12c9f03c4b4eb3e031fb39f8","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-0242f2b5b3a94bbb5889a935","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":58,"locator":"'99 TAIM Source'!58:58","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b30881b6ec6a3e8c6934c47c","recordKey":"TAIM-MEASURE-4.2@3880f07b20cefd80","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c79e3641b8727ca261e9321c","recordKey":"FW-ISO-24028@8789b0ac6ed19775","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-70921efa9dfc25ce76b6db15","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6c94571f3cca92647934c264","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f76c80889ba6757c224b7b32","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-99a616218c658eecced95546","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-afc730d89d0fe1febe225659","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3307e362bdf37dd39fe41e87","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d6ec6a154315c23872cc6152","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dda1f06edc1918c2e4140740","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-05c73e0a6ca65ba3c19ff8f3","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a00b8563038cadca2dfe484e","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-490c3daf3d298ff81de20ae4","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bfe9c6f9e8bbd68fa413f415","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2cd1852e391aee25d4f68898","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1f64abdfc09f640d98d326ee","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-3d5f2809dbac01cf1a88b69b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":59,"locator":"'99 TAIM Source'!59:59","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0793738ab4c23ccb41055983","recordKey":"TAIM-MEASURE-4.3@0b263792260e087e","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-17dbda9fa2382b962f2ccc2e","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-55cdaae5393941716c28a3df","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-80e036a5288e070606cc6eed","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1539baeabc7e43f43a86a94c","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-16f0f6458c98c501b895c26c","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-27addb79c12bd35ea852928c","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d12ac292b698d9f7799d6c08","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-48def9502eea451cd3440004","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-38479068a1f944aaee1902a9","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fde97f40e8c15008cb8caa00","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5e0f8a4bdd7f96e638fec0be","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-06eb17fa7bb407e06d3c7083","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e06979d1b54f10c4dff93dab","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4dd325f0fe257eb25846d682","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-573f4781632f9dd95f045508","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-b3d2e6824bf51d4389822378","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":60,"locator":"'99 TAIM Source'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2637efc7ac905d0d87bc9465","recordKey":"TAIM-MANAGE-1.1@b474c5c19115a785","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d7a98bd9570b3908e470a61c","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-72658b29db34e38dfc9f1d47","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bde9aea8fbd93690f2bee219","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1b29148ccd0c925b3cf6e4e7","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9d307e215d9d0257c7614c57","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-be60eb7834e372e2bd54762e","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-73dc598b4c475b9da5ebb900","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c0c068b2797c0220ed234b07","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-643b80b24689c39be5694b78","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2bad68cd34551c79eb60fb1f","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-924e3b3971b51ecb98db50b7","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9800f8ab216494622437b5e4","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5dbea13fa2a03979625e5edc","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-62058e0530ffed78be011e5b","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-925f54b2c244630194a2e444","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-d7f7540dbc67b65837d35621","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":61,"locator":"'99 TAIM Source'!61:61","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3810b1ac64c37fbf4569619f","recordKey":"TAIM-MANAGE-1.2@a705fc2f096d2e46","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5828633a5570f1d96623c675","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0ae85c866cb34403a8e75619","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8d3787d4a51ffef006aa243d","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b12568e817ea2237e649b32d","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-90d3ed0c57e0d9d1464b9271","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-40992cde9b324b4eddd3c63b","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8a51f42b9b46640af9523b40","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3e8b744ccae68b7ef11cfd7d","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c1b85896d9987301f3504b5b","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5f083c0c44779a7527c8ccfe","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-13e50635419f188a226a8d43","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4570b898c84518425ac9a50f","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1d7f458b1f14ee6241956c13","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4d53e12c2b07c56dce7b7e61","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1a2dfc456b216901db3a988b","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-fdf6d2028bcb93e0097ac680","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":62,"locator":"'99 TAIM Source'!62:62","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1fcad515cc1c56c10b054550","recordKey":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6bb1b8c1d09b7b6d6ce0ce21","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6c156e189568bf6ea320d9b3","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c8fb3c06beb0d65412015f22","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-292054bb436566995e5e3ba4","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d230e7a0459ad0ed6aea5805","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-37091f0d71842eaa7120fe06","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8bc535ee740ed7f66707ca9e","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-20ccb0c1a7d7d8d0e1e449df","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-85b88203b65f0680346daa48","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a90406e06a5bad66464c39f1","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-32e6d4140c0364ffd6a18457","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-38b735149cb865ae5cf0eef7","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a1374288e8968fe6e1c569cc","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6139dd91504a8169a372e254","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9677ca5004c3e3e0ca5ba667","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-aa6235acc687074089a940c6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":63,"locator":"'99 TAIM Source'!63:63","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-86c8cc0a7cba3d1b737ea63e","recordKey":"TAIM-MANAGE-1.4@614e57f0276eaccf","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3dfd1ef1dbcfdad2310dc671","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c06149cb2f1401378dd6c0c6","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a918845eb49e16a36984a396","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-55585f09de232175a1704fe5","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4f7f181a1ce425eae0f730d4","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c420a86aa326b14c4075eda0","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4d37e28e2ead9086e74293e6","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b9eb855efd9e04e8fb157461","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1abb4fa86e321c7e00dd1884","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-618628144e2bbf8b298ea422","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1e314255f02210d365331d31","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-07fb17dead1afe23555cf0ea","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bd5f6f6ca86a68c7957fd791","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e484bb357a783b93949d5f4f","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d4a2b344101cfe4536827710","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-029e40a682261c6f21e9ac38","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":64,"locator":"'99 TAIM Source'!64:64","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-58f14e87fc955dcbbd600e1c","recordKey":"TAIM-MANAGE-2.1@aa163cc990ffc547","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3d75aab8229eca3a504967ba","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6bc3eb03cc221abf2ea78a95","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-63babdf627f7aeaef486a84b","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e18b0d83832a574c1ffe364f","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-62bda0f2b6025174af730827","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ba737b1d15ea7f2d6df906d4","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-22d53bc2d4fc4e4a75127a5c","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6bd44de1c07cbfdb921e171b","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-55def4febf3b8ed4ef802051","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-43efe1a24c8b0732a95a78f5","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-744c31933818bac145dc96cd","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-66910c7195f84d05c38eb215","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-90c4cb843108342a6dc80a7a","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-89dbbb36d854f957d2df1cdd","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e59b7d814c18d08390853fc0","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-fca1aae3a3f877bb5342e7a8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":65,"locator":"'99 TAIM Source'!65:65","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-501242467d87df8b2117dedb","recordKey":"TAIM-MANAGE-2.2@14538be506abb510","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4150d79b08ff0211a7ae7e7a","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a4275ab7cadb06600860e7de","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-97ecc002eef91835e1b22091","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0d95fb6ba22bd129bbb32542","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-328b931a1ed15f1d04cb35c0","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-00cfa3c6d3058e13f9d94d3d","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4246b8359e136abe97f7bee5","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ea9beedf3d71d19e295d22c8","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e28d7040ea290253d352a75c","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b9124ac33e44f09f310040ac","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4e5812ab5e06eb198774697c","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-30011659e7f55acc265d3d91","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-395b86cf63b222a61782deb7","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a5299456937590e73d12aa8a","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-3761c5d033113ce5768f3be2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":66,"locator":"'99 TAIM Source'!66:66","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4d6f99e4c62a3e1181d4b2c4","recordKey":"TAIM-MANAGE-2.3@438a1a9f5069b57c","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-82f84a6c92eda9af8539bf1a","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c7d83c2a7287a8bb91477f3e","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-deec1be29e6d87360b83d62a","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-76c0f313eafe3f3fae227c02","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a071ca59b8f7bd7a69ca6e61","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b76a74c2023a5c7935e79aed","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4721942ccc9b568af69f5596","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ff062c6850bb10c47d9353e7","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6de97899bf7e1ad50dbe0b3a","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f65b2dc8676dca2e466d887f","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5bc631cd73c181883696a650","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6bf6276bf85075094a6c9f9b","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-27eb8dba9c14556e5458208a","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8093fd58262e2e840eec833b","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-4ff2bbd158e353596e95cc18","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":67,"locator":"'99 TAIM Source'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-add1c066a84f02392ffaae15","recordKey":"TAIM-MANAGE-2.4@7716c58006958476","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8eb8d8d51f83d702059c8652","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-45b6a6eb2b391b1501a8504d","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9a3cf3c3f39df18dfb8c9a3b","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bbce53ee9e02e7c1b3a77c1e","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1914e94650f294b2febaf556","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c97461f49396ec43b08c704a","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-41d18d76bf6bd2bdd3befe97","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1eb21b2ffa12173dffaac135","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7febd2c465a0eaa53ff0a78e","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-18e44832a8f565596e6f6e80","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-48b9bc850a5245476d2a444c","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-77f1bda2341cc70db8c2d63e","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c375effe2270a492da7ec825","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-178f3d715a4927e036d2e923","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-04a87b26205c83cfa5ef63d8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":68,"locator":"'99 TAIM Source'!68:68","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4eb7fde77d45de16776e2064","recordKey":"TAIM-MANAGE-3.1@019b36616e569086","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-691c57349b979f08777493a1","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-57cb00a47763e937265939e6","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2a3635ec79db6c0c225aa813","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-dec17325f145ae919fb00651","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-55b4c292a9635b33505c3d93","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f392816e3f50ea7788702548","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ea02196d00992805f33f3915","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2d654fba100431aad9a7c8ae","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3460374a9d9bf95e6f7a1afa","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d20ba68104513cd8795da23b","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f978a9c18bb757ba9143251d","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d5db1bbe6364f64912beb304","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-46f83f41cd810ce3ce1954e8","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b0dcc9b5dfba222fe5e0c852","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3a87f00a8ef4fff2f4f3447f","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-8e363c24408c5effa15563ca","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":69,"locator":"'99 TAIM Source'!69:69","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bbfb4d3bd42a8c4e7bfd4fc7","recordKey":"TAIM-MANAGE-3.2@3a8b74098cc691a2","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-29b217268a4450e88132ec61","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b0a3b0f03611ff06a46f6784","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d371a26dd0d4f169e05e8a86","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f65b8de819410b19e239562a","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2d23755dcad8df86eab89738","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f02a4d34ca629e71f0d2fd8f","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fd9464ac3da8c0d80a4fd74e","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1f54457f251eb87018909e9f","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e3b9d6b664ebafcae7141cd0","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e86446a4fc669c3b78e3b4ce","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c9e7d289fcb0c5114362a88c","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-46d797e71183178fa9ab3ab7","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-00350fda197a9b6ee996519e","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8d1d5f4a2d72cb40805c51c9","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-f1118937bbdc9b589be55da9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":70,"locator":"'99 TAIM Source'!70:70","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a460291cee3e28aca0a822da","recordKey":"TAIM-MANAGE-4.1@46658ac358537223","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5e027d2ca50c4ebd8efff6d3","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8b29e0cce3d617cf0d221792","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-40b173b3c884a512d4e14177","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ef9fd3983ea127af061ffe6c","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-aee5d830b8e9bcd902811571","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e7e8ccf77526dd49a49c1dac","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d381cbf01de5da6dd2209f7d","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4db81477eef0fb73586c4918","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c80f31f437998a396b69dbd7","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3367d3c26ae23dfb69445c06","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a3d501b7ceee160702266c3f","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1bed1da103f7ef3089e815f9","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ef93b31f267e2a2eacbb4c91","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5254715881d83687c21e0b93","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f57b7dffde4e07f8524514f2","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-12b9133f2fde35c94188b3c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":71,"locator":"'99 TAIM Source'!71:71","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c83ad60ba2adca2a7b2ae8e2","recordKey":"TAIM-MANAGE-4.2@c85453fdd5b795d2","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-36780898c25a4353ed564740","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1b895bc717824cb45e65fff6","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0dceefcf2d13ab1ec4833fce","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-60a532e99654723902e8fc3b","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-935527b479c8b3c78760eb7e","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d65ef403d6d21fcd1d46702f","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ac2404c8b5ecd1bb96ddce2a","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f0a14fb18ff42f9de4f94ebd","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-347a74406e72585586269d47","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-afc36f935b66f1a60f53d43f","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-26746b221ccf27b631dbfb7e","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-296aa5738ab53ddfff3cc665","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e94a957c146ea1d575e961af","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1d01bb4c047530e80169e228","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f8c54b4f3e686e687a3464b4","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-2271bf8b01357b62e829283f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":72,"locator":"'99 TAIM Source'!72:72","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ff34a1af8304ce69f128e6fe","recordKey":"TAIM-MANAGE-4.3@86067afb96e12a89","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e25d1cd923c45eb4b847b80b","recordKey":"FW-ISO-23053@55bd3074feb4a00f","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d393047489cdbee09c0efded","recordKey":"FW-ISO-23894@cfadc45875112d5b","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-00c19dacc29f55eec633be86","recordKey":"FW-ISO-5338@041ffb26c5d19cfa","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0fbcdc16bc445736f2151df8","recordKey":"FW-ISO-38507@7d77415d1c7cfe00","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-03aa64eaec1f6ed62f105ea5","recordKey":"FW-ISO-22989@678e19f13815b3fc","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4126ee5195443c15f5b19ed5","recordKey":"FW-NIST-CSF2@467eb7f201efb93e","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0e90b56d6416928645fad303","recordKey":"FW-COBIT5@be354b207a896f92","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fa08932439f46b283395b471","recordKey":"FW-HIPAA@81492e1b5dcc743c","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b1ec0320c8743b34b55858eb","recordKey":"FW-PCI-DSS@77dc262ffef86dba","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f79d7c2926b1348e8238c79c","recordKey":"FW-SOC2@bb1d3d369e5113d6","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b8b6b3078f8315e7cf827a23","recordKey":"FW-EU-AI-ACT@b2877d95cb0be331","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b3839a86246de3169547a190","recordKey":"FW-GDPR@620518a1daa19c81","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-196c2c8975371b5da70ff512","recordKey":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-838e083e1a197d637f2cb811","recordKey":"FW-ISO-42001@b588d95ea18aa2f8","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d753bfd3dda238042beb3d57","recordKey":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","sourceRowId":"ROW-48c98532b374f72e1bf7f1c0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"99 TAIM Source","row":73,"locator":"'99 TAIM Source'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4a52ca657da05c6434d652e4","recordKey":"MS-POL-POL-01@c04293698c8a9261","sourceRowId":"ROW-96a38ebab06ea9cb3a65a994","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":5,"locator":"'17 Expanded Policies'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7d4a3ad552fbe5a93065b695","recordKey":"MS-POL-POL-02@1d53076e8a906a49","sourceRowId":"ROW-9ca2c025b0be78c5fa53efc4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":6,"locator":"'17 Expanded Policies'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1ef50b60504b5c84de5b603b","recordKey":"MS-POL-POL-03@3cb30c5e249da778","sourceRowId":"ROW-1883b9fcaf40536aa40f98d7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":7,"locator":"'17 Expanded Policies'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-541445c21ae90916316ef299","recordKey":"MS-POL-POL-04@879f79e7b7ac1d86","sourceRowId":"ROW-64cf0ed804f6f5363102ae87","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":8,"locator":"'17 Expanded Policies'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-efa853fc32231393113da3c9","recordKey":"MS-POL-POL-05@50ff2ba2fff0e774","sourceRowId":"ROW-ceaf917e903e8907ab081b0d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":9,"locator":"'17 Expanded Policies'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d97127a318d4855aff7d72e5","recordKey":"MS-POL-POL-06@3e3864614f0da24e","sourceRowId":"ROW-220b71b05d69c729b91f6c15","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":10,"locator":"'17 Expanded Policies'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7a22e35a0b4947ea59b86349","recordKey":"MS-POL-POL-07@a95261fb9bd47400","sourceRowId":"ROW-77ec1167bfad52f3f9c58084","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":11,"locator":"'17 Expanded Policies'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-031083e50ee48b96dfec6587","recordKey":"MS-POL-POL-08@6b73225de437a7ac","sourceRowId":"ROW-c3a4023c8ece1262261f76ed","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":12,"locator":"'17 Expanded Policies'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cdeb5e0a7e0d1d0587b7c07e","recordKey":"MS-POL-POL-09@8c04be5259127986","sourceRowId":"ROW-f10db7a3fc71cd58d20f9b9a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":13,"locator":"'17 Expanded Policies'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-afe67b5fd696673a3bbdf87f","recordKey":"MS-POL-POL-10@85ee73762e51641d","sourceRowId":"ROW-f57ae840ce101882a829a7b6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":14,"locator":"'17 Expanded Policies'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-09be1d54743b46a8058981ce","recordKey":"MS-POL-POL-11@2c947637536e9be0","sourceRowId":"ROW-7220351995c84a97eb742df1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":15,"locator":"'17 Expanded Policies'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-57b64862818700f063732d0c","recordKey":"MS-POL-POL-12@d890555e2ad21089","sourceRowId":"ROW-4fd103fa040bc68a148e5205","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":16,"locator":"'17 Expanded Policies'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e6e6442c88a3498a9b26eb22","recordKey":"MS-POL-POL-13@05690649552c9bb9","sourceRowId":"ROW-05d4495743694292dd58efc5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":17,"locator":"'17 Expanded Policies'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fe5a06499b2bbfd06100a851","recordKey":"MS-POL-POL-14@2a83e30bc6f88f8a","sourceRowId":"ROW-55413a8273bc58566f8b0c7d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":18,"locator":"'17 Expanded Policies'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d73934e4dde933f7306ad35b","recordKey":"MS-POL-POL-15@92db373c77f25877","sourceRowId":"ROW-ac9757141b31b29e4a097326","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":19,"locator":"'17 Expanded Policies'!19:19","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e4a2d4c39c66446a291fe49f","recordKey":"MS-POL-POL-16@ee0f7d2e98b800e9","sourceRowId":"ROW-3fe25bf3408d412c42601d11","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":20,"locator":"'17 Expanded Policies'!20:20","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c3ffe69095abbb076b517ee3","recordKey":"MS-POL-POL-17@ec7601a706961f3f","sourceRowId":"ROW-96ddd6557299ae7b26f47285","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":21,"locator":"'17 Expanded Policies'!21:21","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-69023e8c7b12f356a89672c7","recordKey":"MS-POL-POL-18@ee2264a9b561bd1a","sourceRowId":"ROW-a4efbc2c172662e109cef298","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":22,"locator":"'17 Expanded Policies'!22:22","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-94a20c8da71d96cc143cf1c5","recordKey":"MS-POL-POL-19@aed1a48acd06ccbe","sourceRowId":"ROW-94a4333985fd902c69308e09","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":23,"locator":"'17 Expanded Policies'!23:23","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4fcb0d267408043bdcd1d96f","recordKey":"MS-POL-POL-20@c9a396428183869a","sourceRowId":"ROW-1ebb42d047010ea3d1abe124","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":24,"locator":"'17 Expanded Policies'!24:24","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0cccc8458ab1657748718276","recordKey":"MS-POL-POL-21@20a70c7870aa9b0a","sourceRowId":"ROW-279c9f0d0cd7ab461ddd5e51","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":25,"locator":"'17 Expanded Policies'!25:25","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8a5de32fa9fc647c5d02a016","recordKey":"MS-POL-POL-22@e64fee0922267d4e","sourceRowId":"ROW-e3679e05b5d9735c093f4df4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":26,"locator":"'17 Expanded Policies'!26:26","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1bc66d25a65e4f4072a96086","recordKey":"MS-POL-POL-23@f183914bbbf48a36","sourceRowId":"ROW-d2ae9e51445e85e9a5838004","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":27,"locator":"'17 Expanded Policies'!27:27","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-df442ab879e9705d3e4d6979","recordKey":"MS-POL-POL-24@1d7f4f0e0bd28468","sourceRowId":"ROW-364f293c73297acd9ad6f2b0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":28,"locator":"'17 Expanded Policies'!28:28","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-680400ab00f9b9b1f515b8eb","recordKey":"MS-POL-POL-25@597e30d9cfdaf3d4","sourceRowId":"ROW-7c7208cfbd6be32aee6cc43d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":29,"locator":"'17 Expanded Policies'!29:29","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3dd8267f39c625e1e20998ed","recordKey":"MS-POL-POL-26@d4fc522de78b75ea","sourceRowId":"ROW-ff6bed5cb4999e2c64ed126f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":30,"locator":"'17 Expanded Policies'!30:30","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9f2954b27cc50bb34159fe6d","recordKey":"MS-POL-POL-27@68833138d9c86a50","sourceRowId":"ROW-f17ad0b8f8631254ac307260","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":31,"locator":"'17 Expanded Policies'!31:31","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d48750726d10a734e3d22295","recordKey":"MS-POL-POL-28@0647c4283f3dd806","sourceRowId":"ROW-d7be2e212ffe99f49066c043","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":32,"locator":"'17 Expanded Policies'!32:32","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4796ab3e58e998d22216d8cd","recordKey":"MS-POL-POL-29@0ed02484ce9e6aaa","sourceRowId":"ROW-d83f848af5d7b43eed8895e4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":33,"locator":"'17 Expanded Policies'!33:33","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-87186bcda534a810b51c70b6","recordKey":"MS-POL-POL-30@83f7dac5a0008a83","sourceRowId":"ROW-683d9e80f269c2b0122d1f21","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":34,"locator":"'17 Expanded Policies'!34:34","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9445099529229c6aaa0fe4c6","recordKey":"MS-POL-POL-31@0c25dadb14d3c446","sourceRowId":"ROW-ea283be9b23ef77d1ea41b7b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":35,"locator":"'17 Expanded Policies'!35:35","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-008aaf32af0af81218ea0955","recordKey":"MS-POL-POL-32@04591876ceb8b167","sourceRowId":"ROW-6a98ed4ee6db3f3a8b90dd1a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":36,"locator":"'17 Expanded Policies'!36:36","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1df93b26f664a0aa477a3125","recordKey":"MS-POL-POL-33@2a0117a70af5164b","sourceRowId":"ROW-408a190a4b93808cc6c3d0c4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":37,"locator":"'17 Expanded Policies'!37:37","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8be0ad5e68a85dc267b32d62","recordKey":"MS-POL-POL-34@262ec774eaab089e","sourceRowId":"ROW-c6b71e5305881f1f5a5956bd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"17 Expanded Policies","row":38,"locator":"'17 Expanded Policies'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ef545212459283ee500285fa","recordKey":"MS-CTRL-POL-01-C01@b766250ab3daedc9","sourceRowId":"ROW-597ca0bc93ff7503f1d4f3b3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":5,"locator":"'18 Policy Rule Lineage'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2a0a6d682a45a622635972b7","recordKey":"MS-CTRL-POL-02-C01@40fc29d45c4457f1","sourceRowId":"ROW-bedde3dbc5180d0eadf9f86b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":9,"locator":"'18 Policy Rule Lineage'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-bfc689aeffd0ce4634ebb495","recordKey":"MS-CTRL-POL-03-C01@dbe46d341001eeb6","sourceRowId":"ROW-2959b8d807f47f3dfa234a64","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":13,"locator":"'18 Policy Rule Lineage'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6a22ef237add4dfaae8a8c9c","recordKey":"MS-CTRL-POL-04-C01@386e3fe2d1f5246f","sourceRowId":"ROW-61f5de8cd7f0791b5a3d7b8b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":17,"locator":"'18 Policy Rule Lineage'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-89fcf7a18e33b91f6e860385","recordKey":"MS-CTRL-POL-05-C01@ffefbbfc6f719437","sourceRowId":"ROW-899fb0ad39a0a9d36f86c53c","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":38,"locator":"'18 Policy Rule Lineage'!38:38","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8703a2fb8d54af5de397961a","recordKey":"MS-CTRL-POL-06-C01@7107ad18568fb35c","sourceRowId":"ROW-fbf09e1837957a999acb3d56","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":51,"locator":"'18 Policy Rule Lineage'!51:51","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-ff62b25f8e012787b51e8d9d","recordKey":"MS-CTRL-POL-07-C01@92eeb3b18fd14237","sourceRowId":"ROW-03ce43e426703e875ebe88a6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":60,"locator":"'18 Policy Rule Lineage'!60:60","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cccb2abf16979f8c7830b799","recordKey":"MS-CTRL-POL-08-C01@9bdb77bb21f1278a","sourceRowId":"ROW-8f4d73b156a9e22a6f860177","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":67,"locator":"'18 Policy Rule Lineage'!67:67","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a84432de4dae5445c020a822","recordKey":"MS-CTRL-POL-09-C01@28bd04439eeb643f","sourceRowId":"ROW-6288afa17e01f971a94dd449","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":73,"locator":"'18 Policy Rule Lineage'!73:73","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-5c39e3bc97ec2e82e6397c9c","recordKey":"MS-CTRL-POL-10-C01@d6a7308768b38dd6","sourceRowId":"ROW-1e23d360e89c1062cb69a0aa","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":77,"locator":"'18 Policy Rule Lineage'!77:77","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-7e41ae967f63fdd19dc4e97c","recordKey":"MS-CTRL-POL-11-C01@ba8f0f69896dbda0","sourceRowId":"ROW-2f20b20c9af57fd935635e4b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":80,"locator":"'18 Policy Rule Lineage'!80:80","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d7e0d41a448345f32624ebff","recordKey":"MS-CTRL-POL-12-C01@328267f10538458f","sourceRowId":"ROW-9dc5e6b16b05a7499a88af03","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":84,"locator":"'18 Policy Rule Lineage'!84:84","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-45fb636d42861d094627cffc","recordKey":"MS-CTRL-POL-13-C01@aa73ec05d68f5778","sourceRowId":"ROW-10f898dcd48405d3f2d17587","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":87,"locator":"'18 Policy Rule Lineage'!87:87","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8b7d77ed7dff940348e45e2d","recordKey":"MS-CTRL-POL-14-C01@d4d8e5f978ff6018","sourceRowId":"ROW-948256b154e3a3184c37e4c3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":91,"locator":"'18 Policy Rule Lineage'!91:91","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-69386499a7eae19e00e4ad43","recordKey":"MS-CTRL-POL-15-C01@bae38b8ddca62d09","sourceRowId":"ROW-6038ba62eb95f6a745d8985f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":102,"locator":"'18 Policy Rule Lineage'!102:102","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4ef2947faa4a1e46b3e74f8d","recordKey":"MS-CTRL-POL-16-C01@4385dd308009dd40","sourceRowId":"ROW-91676a6ed461ccc5b613a7b2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":107,"locator":"'18 Policy Rule Lineage'!107:107","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0a38c8c8b720d92a6368e126","recordKey":"MS-CTRL-POL-17-C01@a589870290e36ebc","sourceRowId":"ROW-ab37f01cac1d33c794f6a189","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":109,"locator":"'18 Policy Rule Lineage'!109:109","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3f6411fc531fa710d93c7c1a","recordKey":"MS-CTRL-POL-18-C01@353022021876b69f","sourceRowId":"ROW-723871d2f34954cba70298c9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":113,"locator":"'18 Policy Rule Lineage'!113:113","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d727ee36d00e1976fa042006","recordKey":"MS-CTRL-POL-19-C01@8b80f45de84ee486","sourceRowId":"ROW-82c755ed78b6023ed1c742ae","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":119,"locator":"'18 Policy Rule Lineage'!119:119","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-315a03ef1cff2d33cd1bd9c6","recordKey":"MS-CTRL-POL-20-C01@f431b58ee095a892","sourceRowId":"ROW-ba68a24115344b264aff3b77","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":188,"locator":"'18 Policy Rule Lineage'!188:188","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d0817947e8f8bd2c80f7d198","recordKey":"MS-CTRL-POL-21-C01@8b5135c5fa6c4d80","sourceRowId":"ROW-971ad6a5ea6eca36c040f8d4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":191,"locator":"'18 Policy Rule Lineage'!191:191","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e5d11a480a5010308721a8d3","recordKey":"MS-CTRL-POL-22-C01@0008bb9b0a6ec78a","sourceRowId":"ROW-3e39c91e7192c375260741bd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":193,"locator":"'18 Policy Rule Lineage'!193:193","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b33d170bd9c9dbd992745508","recordKey":"MS-CTRL-POL-23-C01@8177afebde7da07a","sourceRowId":"ROW-b660e156aee27955c0564f9f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":197,"locator":"'18 Policy Rule Lineage'!197:197","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c393ee108c6895c33148c82f","recordKey":"MS-CTRL-POL-23-C02@1bd8482b6b9bad6c","sourceRowId":"ROW-4349a56a85220a7e22902e5e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":198,"locator":"'18 Policy Rule Lineage'!198:198","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d8c31989d8ab628f366b50b6","recordKey":"MS-CTRL-POL-23-C03@1678ca94f02e1cbc","sourceRowId":"ROW-b5c77a28ee8f204248c0cf53","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":199,"locator":"'18 Policy Rule Lineage'!199:199","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-fedd5978190c1885e51ab476","recordKey":"MS-CTRL-POL-24-C01@d5e684dfef1b2e9c","sourceRowId":"ROW-bd68e135dd3dc591bbad92d7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":206,"locator":"'18 Policy Rule Lineage'!206:206","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c751c20446f91c62a341ffd4","recordKey":"MS-CTRL-POL-24-C02@d918e2b22e350918","sourceRowId":"ROW-48d7266963f51e7e07bf6a49","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":207,"locator":"'18 Policy Rule Lineage'!207:207","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4e444153e2d96a1ee7ce3ab5","recordKey":"MS-CTRL-POL-24-C03@dbbd781e2afd0ee6","sourceRowId":"ROW-a154e81f2366fbde55071873","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":208,"locator":"'18 Policy Rule Lineage'!208:208","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-568eca996c3920c25c63f69c","recordKey":"MS-CTRL-POL-25-C01@f1c5ef468cf35b54","sourceRowId":"ROW-9dfd7e849d8d1c9642c36f1f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":214,"locator":"'18 Policy Rule Lineage'!214:214","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a6bc8de81c9a5f38a0ed1c1c","recordKey":"MS-CTRL-POL-25-C02@65df3c955cab3391","sourceRowId":"ROW-c6d3e12cf0651a8c4bede3c8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":215,"locator":"'18 Policy Rule Lineage'!215:215","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9dd716d18dc46a03665dd764","recordKey":"MS-CTRL-POL-25-C03@4b08a537f8b2697c","sourceRowId":"ROW-9550de0296df063d63803859","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":216,"locator":"'18 Policy Rule Lineage'!216:216","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-8f7e461b17f23bf552936b02","recordKey":"MS-CTRL-POL-26-C01@d2d8820db6d6a87e","sourceRowId":"ROW-92c1f546bfb6de4054c33821","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":227,"locator":"'18 Policy Rule Lineage'!227:227","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-90988c3cc40c160cd9f338b2","recordKey":"MS-CTRL-POL-26-C02@e82d80b0d844beb1","sourceRowId":"ROW-48ad15e4b2c7db6eca771777","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":228,"locator":"'18 Policy Rule Lineage'!228:228","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-52768a103d148282801636a0","recordKey":"MS-CTRL-POL-26-C03@e63178b9cd783908","sourceRowId":"ROW-18f97f08a5872325214eaa2e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":229,"locator":"'18 Policy Rule Lineage'!229:229","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c495599fe8acb5dc3c12ce5f","recordKey":"MS-CTRL-POL-27-C01@f3fafd4f1eb871cc","sourceRowId":"ROW-b16f769c94eb751c9254bc77","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":239,"locator":"'18 Policy Rule Lineage'!239:239","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-743984b74dfcc30853205fb3","recordKey":"MS-CTRL-POL-27-C02@95768538c03b23cf","sourceRowId":"ROW-c07473ec7c89817e50a86d9b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":240,"locator":"'18 Policy Rule Lineage'!240:240","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-3c07d27255c30feb8ea62de7","recordKey":"MS-CTRL-POL-27-C03@51941690c4ccdbbc","sourceRowId":"ROW-2afc8979fe0f0865098c4138","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":241,"locator":"'18 Policy Rule Lineage'!241:241","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-011c119cae0c1ff31c186318","recordKey":"MS-CTRL-POL-28-C01@95cebd36e96c97aa","sourceRowId":"ROW-d95fc88d64ce4e8747127416","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":251,"locator":"'18 Policy Rule Lineage'!251:251","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a47bf1374ac671dec39a22ef","recordKey":"MS-CTRL-POL-28-C02@75a42ce5eb954451","sourceRowId":"ROW-13df7ddb0e903396c050d9e6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":252,"locator":"'18 Policy Rule Lineage'!252:252","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f17fb378f74967b30a5e46bf","recordKey":"MS-CTRL-POL-28-C03@00038d1a54adc49c","sourceRowId":"ROW-b9f171bb55a90e9eae81c39f","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":253,"locator":"'18 Policy Rule Lineage'!253:253","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9b4a10fee0507c4400a56148","recordKey":"MS-CTRL-POL-29-C01@2a636b88495545f2","sourceRowId":"ROW-4d27ab3f5918435455585bb4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":264,"locator":"'18 Policy Rule Lineage'!264:264","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0a0cef5db3f52044a052a040","recordKey":"MS-CTRL-POL-29-C02@454e63540191c754","sourceRowId":"ROW-a92aba8f46217633c0fba0b2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":265,"locator":"'18 Policy Rule Lineage'!265:265","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-47f3e7f6666320300f82371c","recordKey":"MS-CTRL-POL-29-C03@9e8988e83061cf94","sourceRowId":"ROW-24c9208eba2e169b1f50d5d2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":266,"locator":"'18 Policy Rule Lineage'!266:266","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-d215b02c38691cf68873418e","recordKey":"MS-CTRL-POL-30-C01@8d15ee1e0bb3ebf4","sourceRowId":"ROW-6f2ce89095e627c56f05dffe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":278,"locator":"'18 Policy Rule Lineage'!278:278","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cea3b7a07d8d19dd177da707","recordKey":"MS-CTRL-POL-30-C02@2dd54d58131ceade","sourceRowId":"ROW-3ec37b706115b72a056d3ccd","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":279,"locator":"'18 Policy Rule Lineage'!279:279","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-2532d9a761ab15e96deb4d42","recordKey":"MS-CTRL-POL-30-C03@ea04ae8a27c7247b","sourceRowId":"ROW-6b20d82cb7deb5073aa7f80b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":280,"locator":"'18 Policy Rule Lineage'!280:280","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9557286da74cc7f6ba72cd81","recordKey":"MS-CTRL-POL-31-C01@8ca08935ea227608","sourceRowId":"ROW-ae39945e9dca8fcae07dfc99","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":290,"locator":"'18 Policy Rule Lineage'!290:290","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f54ceab0b0cc44784cade732","recordKey":"MS-CTRL-POL-31-C02@85c34fafa98fabaf","sourceRowId":"ROW-ae5907835ecddd942a3d8e01","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":291,"locator":"'18 Policy Rule Lineage'!291:291","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-b0348480e3fdb8970fd42da5","recordKey":"MS-CTRL-POL-31-C03@a6ef23abf5c5e42b","sourceRowId":"ROW-a720ec7ed772e31748155f5b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":292,"locator":"'18 Policy Rule Lineage'!292:292","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-4773f35ac1a49fa2fe5350e3","recordKey":"MS-CTRL-POL-32-C01@3fdcc01a28b621fa","sourceRowId":"ROW-122b607d7b07be41aeff4057","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":299,"locator":"'18 Policy Rule Lineage'!299:299","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a1c9a256d84a92f67ba92154","recordKey":"MS-CTRL-POL-32-C02@ddde04a8d8ca4082","sourceRowId":"ROW-35502741aa7590781fd8f4e9","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":300,"locator":"'18 Policy Rule Lineage'!300:300","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-308185054b48545edec8f8af","recordKey":"MS-CTRL-POL-32-C03@1de5a35b8a8c8fd0","sourceRowId":"ROW-64bfc6528dc38316d939add4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":301,"locator":"'18 Policy Rule Lineage'!301:301","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f54707abca20cc9c31fde3bf","recordKey":"MS-CTRL-POL-33-C01@e5ead432ece32c95","sourceRowId":"ROW-fa3e011dd0bba2c808289eb2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":309,"locator":"'18 Policy Rule Lineage'!309:309","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9683a23788f6207076139cdc","recordKey":"MS-CTRL-POL-33-C02@3921a2759f04839d","sourceRowId":"ROW-1ef294b209ba6792c36c1a47","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":310,"locator":"'18 Policy Rule Lineage'!310:310","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-133534b84f953b9d77d411a7","recordKey":"MS-CTRL-POL-33-C03@8666fa9d9d46f7fb","sourceRowId":"ROW-3a9f3a84ccce1fd53cd82d90","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":311,"locator":"'18 Policy Rule Lineage'!311:311","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0b946db6a87aa597f0263692","recordKey":"MS-CTRL-POL-34-C01@848d6f9bfc0f9229","sourceRowId":"ROW-471a5982079f9dbe85af9a7a","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":316,"locator":"'18 Policy Rule Lineage'!316:316","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1429cbc725fd1e4587c43b72","recordKey":"MS-CTRL-POL-34-C02@818c4b275dcc2acd","sourceRowId":"ROW-b902e9ba3501ba900ac1863b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":317,"locator":"'18 Policy Rule Lineage'!317:317","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-0e1bff603f4f340bb62366a7","recordKey":"MS-CTRL-POL-34-C03@6de53a060d4995dc","sourceRowId":"ROW-b63f57bc66539e58bd083b8d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"18 Policy Rule Lineage","row":318,"locator":"'18 Policy Rule Lineage'!318:318","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f54250aec22838bc59f6f450","recordKey":"MS-RULE-DP-19@40fb41ffda35d9a3","sourceRowId":"ROW-15b95804fbe20e27a83cf2e4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"19 Canonical Expansion","row":5,"locator":"'19 Canonical Expansion'!5:5","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-c401ed127133af83673cec68","recordKey":"MS-RULE-AU-09@204573caad930259","sourceRowId":"ROW-2a8137ca0825e1a9dfeb17a0","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"19 Canonical Expansion","row":6,"locator":"'19 Canonical Expansion'!6:6","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f73d5226b929885615324719","recordKey":"MS-RULE-AU-10@7f425f52b685ce44","sourceRowId":"ROW-9e2bc5d6883eb4cd6dd4365e","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"19 Canonical Expansion","row":7,"locator":"'19 Canonical Expansion'!7:7","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-e3052fdbb03a7a6e09702570","recordKey":"MS-RULE-OU-13@1eb7cb01e3cf473f","sourceRowId":"ROW-4540717a2d2e6debabd64e61","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"19 Canonical Expansion","row":8,"locator":"'19 Canonical Expansion'!8:8","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-673e6c01c67021ada9fbb486","recordKey":"MS-RULE-OU-14@ae9d5f3f618c9838","sourceRowId":"ROW-c0fe41ce0bc2c88a46398a9d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"19 Canonical Expansion","row":9,"locator":"'19 Canonical Expansion'!9:9","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-47ae06cbfb2ebb99cb316cbe","recordKey":"MS-RULE-OU-15@17dad38dad581076","sourceRowId":"ROW-90b23577a2eb05531f8e3261","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"19 Canonical Expansion","row":10,"locator":"'19 Canonical Expansion'!10:10","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-1800b394d55c727a04b137e2","recordKey":"MS-RULE-OP-13@d9a7b8a98719c7c2","sourceRowId":"ROW-f0dbc6d7fe91002217172a97","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"19 Canonical Expansion","row":11,"locator":"'19 Canonical Expansion'!11:11","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-f44cfe35108cdcd163fc3e7d","recordKey":"MS-RULE-OP-14@b102df5650885781","sourceRowId":"ROW-d4924fc54b366323d675248d","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"19 Canonical Expansion","row":12,"locator":"'19 Canonical Expansion'!12:12","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-6a72e986573706faeb88d297","recordKey":"MS-RULE-OP-15@bab74c0be8fc582d","sourceRowId":"ROW-bcb632ce4ca7dbd0b0a9bcec","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"19 Canonical Expansion","row":13,"locator":"'19 Canonical Expansion'!13:13","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-50491787b98b9a01c34c9c8c","recordKey":"MS-RULE-OP-16@277159bc0f54c27c","sourceRowId":"ROW-9333c0f20d9760d550b04d90","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"19 Canonical Expansion","row":14,"locator":"'19 Canonical Expansion'!14:14","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-9e52ef8230274360ef8c18d7","recordKey":"MS-RULE-OP-17@6b311b898e8dc850","sourceRowId":"ROW-22a687f6e6dbd28f0335faeb","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"19 Canonical Expansion","row":15,"locator":"'19 Canonical Expansion'!15:15","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-86cfec0ef7193f03c6fe583e","recordKey":"MS-RULE-OP-18@1df03547863d8288","sourceRowId":"ROW-94bbfb10610f2fb3dfc40fa6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"19 Canonical Expansion","row":16,"locator":"'19 Canonical Expansion'!16:16","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-cf89cd8287c1dc291184282c","recordKey":"MS-RULE-OP-19@744dc9983a3098ac","sourceRowId":"ROW-eae77152a76c10a3841754bc","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"19 Canonical Expansion","row":17,"locator":"'19 Canonical Expansion'!17:17","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-a40fc632d678ea8d8fb7248c","recordKey":"MS-RULE-AG-11@f9288b5977523607","sourceRowId":"ROW-90e42764c49f2e96fd5a394b","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","workbook":"missionSAFE_AI_Control_Enforcement_Baseline_v2 (1).xlsx","libraryFileId":"libfile_102bb94c8928819191041a305c6c62ce","sheet":"19 Canonical Expansion","row":18,"locator":"'19 Canonical Expansion'!18:18","sourceSha256":"90529719e3e3b5bc9139acf566b436283677490e3d361d7b9c04a93c45c0a992"},{"id":"PRV-MD-b4c81874b972a450db72","recordKey":"FW-TAIMSCORE@70982b04fb51f0d0","sourceRowId":"ROW-MD-3ea5aca0efd5aba3f77b","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":1,"lineEnd":10,"locator":"POLICY.md:lines 1–10","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-369173cc8e32630a86c4","recordKey":"GUIDE-TAIMSCORE-7373e9ecec96@54237a430c639ac1","sourceRowId":"ROW-MD-b761613efc4ffafe745d","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":10,"lineEnd":24,"locator":"POLICY.md:lines 10–24","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-d483ebc52cbbf96e3a3c","recordKey":"GUIDE-TAIMSCORE-2c232da2adbd@2bba1850a1b6b745","sourceRowId":"ROW-MD-f0080fd475deff4c13ce","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":25,"lineEnd":35,"locator":"POLICY.md:lines 25–35","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-57e4819636ce5c2b8924","recordKey":"GUIDE-TAIMSCORE-5fcf17139776@97ae24c6b37d1df6","sourceRowId":"ROW-MD-878ea00c342bb4a0c8bd","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":36,"lineEnd":174,"locator":"POLICY.md:lines 36–174","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-1a07e03e916b42d6e18f","recordKey":"GUIDE-TAIMSCORE-2fb801c9fc14@8e1b366d53700130","sourceRowId":"ROW-MD-2b026bea0a42cc99a15f","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":40,"lineEnd":78,"locator":"POLICY.md:lines 40–78","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-d56f6e5b13e9d9d330b1","recordKey":"GUIDE-TAIMSCORE-8ac247cb874b@084933159965f0d5","sourceRowId":"ROW-MD-3441a62cc7f57fa0610f","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":79,"lineEnd":99,"locator":"POLICY.md:lines 79–99","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-4dcd0787b1b057f57123","recordKey":"GUIDE-TAIMSCORE-6879b220016e@456cd412309ec481","sourceRowId":"ROW-MD-a195ad5a2b50e6ad5997","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":100,"lineEnd":122,"locator":"POLICY.md:lines 100–122","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-915c81b36ad5df2b255d","recordKey":"GUIDE-TAIMSCORE-80ed04b7deed@8370d2982cfae971","sourceRowId":"ROW-MD-5fa067a7fb762fbbd16f","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":123,"lineEnd":140,"locator":"POLICY.md:lines 123–140","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-c67f931d214879b189dc","recordKey":"GUIDE-TAIMSCORE-2130b0d37ddb@c1549abbbeccd969","sourceRowId":"ROW-MD-18020d0781a1d8ff2173","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":141,"lineEnd":157,"locator":"POLICY.md:lines 141–157","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-ef69e476bbab95dea0a0","recordKey":"GUIDE-TAIMSCORE-b403499ddae8@55ea6367216eb219","sourceRowId":"ROW-MD-0fcfbe96d8f2fa430301","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":158,"lineEnd":174,"locator":"POLICY.md:lines 158–174","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-e490afa5b29edd47f14a","recordKey":"GUIDE-TAIMSCORE-f8a4f7493775@a881da89dbaa2337","sourceRowId":"ROW-MD-04b3708e53d5745a9577","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":175,"lineEnd":300,"locator":"POLICY.md:lines 175–300","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-34a9ac017b09b4b7b493","recordKey":"GUIDE-TAIMSCORE-38782814f6d4@62b6df5ed655a7d4","sourceRowId":"ROW-MD-28d77104e1d39d95e320","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":179,"lineEnd":212,"locator":"POLICY.md:lines 179–212","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-9bb002c2e4dd181e6cfb","recordKey":"GUIDE-TAIMSCORE-e7b8b8990fe3@3f324f97a6010437","sourceRowId":"ROW-MD-6e960a66bc0b01f735e4","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":213,"lineEnd":234,"locator":"POLICY.md:lines 213–234","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-e78d707f9de7e2cd790b","recordKey":"GUIDE-TAIMSCORE-7819380f4108@b0b30c9338575829","sourceRowId":"ROW-MD-5be48949371a23fb4816","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":235,"lineEnd":256,"locator":"POLICY.md:lines 235–256","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-5e85bae43b45e30e2026","recordKey":"GUIDE-TAIMSCORE-249dc0c1e2d0@8172d54f33e1ad1c","sourceRowId":"ROW-MD-22f6346688d90fc79fcc","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":257,"lineEnd":272,"locator":"POLICY.md:lines 257–272","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-450071dbbbfe9842d096","recordKey":"GUIDE-TAIMSCORE-0eff381f83ef@51ed2a746c92b9e0","sourceRowId":"ROW-MD-add3b3dcb44ceb1fceca","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":273,"lineEnd":300,"locator":"POLICY.md:lines 273–300","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-6d89357e6e66ddd5bd5e","recordKey":"GUIDE-TAIMSCORE-72386903860b@e0f6769dbaf0778a","sourceRowId":"ROW-MD-a9b0bd16d859386b93aa","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":301,"lineEnd":396,"locator":"POLICY.md:lines 301–396","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-39fcf205916d7d5ed0d4","recordKey":"GUIDE-TAIMSCORE-45605fb5fe93@708cc67ec8a01c3b","sourceRowId":"ROW-MD-17d41324d49a9e7718dd","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":305,"lineEnd":324,"locator":"POLICY.md:lines 305–324","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-816395975173d17bd692","recordKey":"GUIDE-TAIMSCORE-88782766250f@07d9fe9c36eed563","sourceRowId":"ROW-MD-e29ddcc706de765dbde9","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":325,"lineEnd":356,"locator":"POLICY.md:lines 325–356","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-7f818e8569113248eed5","recordKey":"GUIDE-TAIMSCORE-5a4de5f38b1b@1d8df7b6391324bb","sourceRowId":"ROW-MD-49e94a6ec28417ee9c6c","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":357,"lineEnd":380,"locator":"POLICY.md:lines 357–380","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-e984005c8e81a0fab6b8","recordKey":"GUIDE-TAIMSCORE-ee606d117560@6af48156e0d04548","sourceRowId":"ROW-MD-7f050a0df7012015fb10","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":381,"lineEnd":396,"locator":"POLICY.md:lines 381–396","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-7bc02c692ae57f0c3977","recordKey":"GUIDE-TAIMSCORE-eb6cc3ec525c@559936d9d7d0351e","sourceRowId":"ROW-MD-e2329858845ecb787f68","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":397,"lineEnd":493,"locator":"POLICY.md:lines 397–493","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-4920186e831da4cca9c8","recordKey":"GUIDE-TAIMSCORE-cd0ce40680a4@b7f780cfda3b881d","sourceRowId":"ROW-MD-e871d5e7eb80c4ad00cb","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":401,"lineEnd":421,"locator":"POLICY.md:lines 401–421","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-162ae294e2750862693a","recordKey":"GUIDE-TAIMSCORE-d60b914f6dd6@c6c63571fab7605d","sourceRowId":"ROW-MD-ee37016a6565ffd88843","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":422,"lineEnd":445,"locator":"POLICY.md:lines 422–445","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-81fff9c488f8d6cf48f5","recordKey":"GUIDE-TAIMSCORE-2d7ec48f3fae@3a5adbc1cbd68835","sourceRowId":"ROW-MD-bec92b82abec84bcc1e2","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":446,"lineEnd":469,"locator":"POLICY.md:lines 446–469","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-e14ead404707feccfe48","recordKey":"GUIDE-TAIMSCORE-aa6d2eda81a0@30691f48ee9e09ba","sourceRowId":"ROW-MD-942fd275780b6f127eac","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":470,"lineEnd":493,"locator":"POLICY.md:lines 470–493","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-ff90bc0b820f4697eb10","recordKey":"GUIDE-TAIMSCORE-9f18b171a0c0@d05bb0e1866b5200","sourceRowId":"ROW-MD-2af11eba998f86b9487a","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":494,"lineEnd":537,"locator":"POLICY.md:lines 494–537","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-3da8f3f998c4df5d783e","recordKey":"GUIDE-TAIMSCORE-17ed47d69bd5@74597176329b3a92","sourceRowId":"ROW-MD-f7f688eefa4819b834c8","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":496,"lineEnd":507,"locator":"POLICY.md:lines 496–507","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-2e4111cd760225ca680e","recordKey":"GUIDE-TAIMSCORE-7c6f8ef8a701@8e28bd3d24809b08","sourceRowId":"ROW-MD-23df0e9e3bb14ba8e746","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":508,"lineEnd":511,"locator":"POLICY.md:lines 508–511","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-5084e3a15cc611773e72","recordKey":"GUIDE-TAIMSCORE-ea449fed7451@540ba647e7400001","sourceRowId":"ROW-MD-943d1e56cb12c08bab56","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":512,"lineEnd":523,"locator":"POLICY.md:lines 512–523","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-dfff1f4beee609cbd172","recordKey":"GUIDE-TAIMSCORE-8fe44c472096@eee14394e87f714b","sourceRowId":"ROW-MD-b2d42d55e250f4f81b9d","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":524,"lineEnd":537,"locator":"POLICY.md:lines 524–537","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-5ed0c59198e4dfc52a0d","recordKey":"GUIDE-TAIMSCORE-256e9d391809@2fa12dd681854989","sourceRowId":"ROW-MD-b1b80defe50a900080ed","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":538,"lineEnd":558,"locator":"POLICY.md:lines 538–558","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-bd4f60e8a0250ce31c72","recordKey":"GUIDE-TAIMSCORE-e76ce119f90c@f66687dbfe6679aa","sourceRowId":"ROW-MD-0f91acabb211522c9cfa","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":559,"lineEnd":590,"locator":"POLICY.md:lines 559–590","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-b99c8a74e3d590b80085","recordKey":"GUIDE-TAIMSCORE-3be8f011f4f8@fe3bbd42f3960f1a","sourceRowId":"ROW-MD-c59a626624c5c09cd240","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":591,"lineEnd":637,"locator":"POLICY.md:lines 591–637","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-17d1fae1b6f72458f7e3","recordKey":"GUIDE-TAIMSCORE-12c4f1c01329@963980a8509e0f3c","sourceRowId":"ROW-MD-1dbd8121fa6d6c2fd58c","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":593,"lineEnd":596,"locator":"POLICY.md:lines 593–596","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-c4ab27468df00ddb3693","recordKey":"GUIDE-TAIMSCORE-0ce93a3ddbe4@5efb25b53db84c35","sourceRowId":"ROW-MD-f5c2d38554f433f55b04","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":597,"lineEnd":608,"locator":"POLICY.md:lines 597–608","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-94d8b4e0901f307964c3","recordKey":"GUIDE-TAIMSCORE-e5a52228ee60@3bdbf30b9ef74343","sourceRowId":"ROW-MD-ce7304a0d1b1e59c3f80","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":609,"lineEnd":622,"locator":"POLICY.md:lines 609–622","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-5a13b29c3b81ad4c6a08","recordKey":"GUIDE-TAIMSCORE-4ceafb318fc8@b3ff6accd8ac717f","sourceRowId":"ROW-MD-e2494dd454564de5cd08","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":623,"lineEnd":637,"locator":"POLICY.md:lines 623–637","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-87f07004268084f71caf","recordKey":"GUIDE-TAIMSCORE-c24d6381bc21@26ce2491fe9416f6","sourceRowId":"ROW-MD-1e8e973e282893865a19","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":638,"lineEnd":651,"locator":"POLICY.md:lines 638–651","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-0fe3d4ca886ef7e5d0bc","recordKey":"MD-CTRL-TAIMSCORE-GV-1.1@6e663e1f167b8156","sourceRowId":"ROW-MD-f47ba0f1748fe4acb379","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":46,"lineEnd":51,"locator":"POLICY.md:lines 46–51","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-3c108d4dc1d6f50c4d11","recordKey":"MD-CTRL-TAIMSCORE-GV-1.2@0d5ccdb59c43f67c","sourceRowId":"ROW-MD-29daa05d79d0e84d036f","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":52,"lineEnd":56,"locator":"POLICY.md:lines 52–56","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-24a6929d75cfa87f271b","recordKey":"MD-CTRL-TAIMSCORE-GV-1.3@a27b166c02aaa4c8","sourceRowId":"ROW-MD-48119cfc2ddb686a424b","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":57,"lineEnd":61,"locator":"POLICY.md:lines 57–61","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-603a44cd39e56715e978","recordKey":"MD-CTRL-TAIMSCORE-GV-1.4@488e5873c755f8ab","sourceRowId":"ROW-MD-7b83630fa12527ad0c64","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":62,"lineEnd":66,"locator":"POLICY.md:lines 62–66","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-9678d4915adb77156add","recordKey":"MD-CTRL-TAIMSCORE-GV-1.5@ff95c40e6e8afd0a","sourceRowId":"ROW-MD-56733b53af16d042cc1b","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":67,"lineEnd":71,"locator":"POLICY.md:lines 67–71","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-f8c1695fef68ecd079e9","recordKey":"MD-CTRL-TAIMSCORE-GV-1.6@e3506b0dd4dcada0","sourceRowId":"ROW-MD-75a898c95907c5161beb","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":72,"lineEnd":78,"locator":"POLICY.md:lines 72–78","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-b0ef4c7c5846eb3d82fc","recordKey":"MD-CTRL-TAIMSCORE-GV-2.1@9aac291827958bcc","sourceRowId":"ROW-MD-bfb242a28df3df81dea6","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":85,"lineEnd":89,"locator":"POLICY.md:lines 85–89","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-7c59aa65182dcb3ada3a","recordKey":"MD-CTRL-TAIMSCORE-GV-2.2@f6568a2a29410b49","sourceRowId":"ROW-MD-e29fbd55e1f6ea84a1d3","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":90,"lineEnd":93,"locator":"POLICY.md:lines 90–93","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-6f9ec71dbdf1b7adc41f","recordKey":"MD-CTRL-TAIMSCORE-GV-2.3@0a20efca2d26ce0b","sourceRowId":"ROW-MD-6c4dd8c7a39a67a1f518","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":94,"lineEnd":99,"locator":"POLICY.md:lines 94–99","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-ca9e597a5d0eaf2304d7","recordKey":"MD-CTRL-TAIMSCORE-GV-3.1@b037ccbc754dd889","sourceRowId":"ROW-MD-e17e61d7a929780bb939","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":106,"lineEnd":110,"locator":"POLICY.md:lines 106–110","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-8094fb16508d8989d1f0","recordKey":"MD-CTRL-TAIMSCORE-GV-3.2@d334db8c2a02abc6","sourceRowId":"ROW-MD-958cb8d08f92fe3d3546","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":111,"lineEnd":115,"locator":"POLICY.md:lines 111–115","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-ac6ca857f794e80f726a","recordKey":"MD-CTRL-TAIMSCORE-GV-3.3@61a4b460a66a359d","sourceRowId":"ROW-MD-5b1c6ed95f6c367e6182","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":116,"lineEnd":122,"locator":"POLICY.md:lines 116–122","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-eb908a125809b24d20e1","recordKey":"MD-CTRL-TAIMSCORE-GV-4.1@d2118a7c50a2b41f","sourceRowId":"ROW-MD-d242f5c94d77e11a9ec6","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":129,"lineEnd":133,"locator":"POLICY.md:lines 129–133","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-8f18d3b4495153d833ed","recordKey":"MD-CTRL-TAIMSCORE-GV-4.2@b8a13ffd5ef872bb","sourceRowId":"ROW-MD-e13767fda27fdc16189f","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":134,"lineEnd":140,"locator":"POLICY.md:lines 134–140","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-063d1b0ea9dc3e313c49","recordKey":"MD-CTRL-TAIMSCORE-GV-5.1@4341729d33eff527","sourceRowId":"ROW-MD-3b887ec7000c89278c2b","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":147,"lineEnd":150,"locator":"POLICY.md:lines 147–150","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-008c08bed414aaf19f0c","recordKey":"MD-CTRL-TAIMSCORE-GV-5.2@8048f6100c5be955","sourceRowId":"ROW-MD-bed9ab1a10c677fc9d41","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":151,"lineEnd":157,"locator":"POLICY.md:lines 151–157","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-eef09ece607a6bd0ef6c","recordKey":"MD-CTRL-TAIMSCORE-GV-6.1@77b1a7bf47c9101a","sourceRowId":"ROW-MD-fe3db67f17e7d8e98149","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":164,"lineEnd":168,"locator":"POLICY.md:lines 164–168","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-a3a469cce467070295d4","recordKey":"MD-CTRL-TAIMSCORE-GV-6.2@3baccaf3d3356bf8","sourceRowId":"ROW-MD-b97169400c4e43567aa2","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":169,"lineEnd":174,"locator":"POLICY.md:lines 169–174","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-f1f72a925d94dcc787dd","recordKey":"MD-CTRL-TAIMSCORE-MP-1.1@548c2c820b927f90","sourceRowId":"ROW-MD-770a56a7f40620a3f76b","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":185,"lineEnd":189,"locator":"POLICY.md:lines 185–189","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-bfbc328774899f3cbc26","recordKey":"MD-CTRL-TAIMSCORE-MP-1.2@f754d023d01e821f","sourceRowId":"ROW-MD-0d47ef55c6d252ef95a0","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":190,"lineEnd":193,"locator":"POLICY.md:lines 190–193","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-fde50c7171f3ad0f8808","recordKey":"MD-CTRL-TAIMSCORE-MP-1.3@62501b520f91f1be","sourceRowId":"ROW-MD-610be50efdaabb92a994","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":194,"lineEnd":197,"locator":"POLICY.md:lines 194–197","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-228cfc681b34ca628053","recordKey":"MD-CTRL-TAIMSCORE-MP-1.4@62d7db49c4279f76","sourceRowId":"ROW-MD-0e97a607a82aeea014e8","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":198,"lineEnd":202,"locator":"POLICY.md:lines 198–202","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-f691edc7ad02ca4b5fbe","recordKey":"MD-CTRL-TAIMSCORE-MP-1.5@4f2a419cd373ffa7","sourceRowId":"ROW-MD-1b1216cec2355311c9e6","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":203,"lineEnd":206,"locator":"POLICY.md:lines 203–206","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-68546fb2a7a8014347bb","recordKey":"MD-CTRL-TAIMSCORE-MP-1.6@ae953741bf4624c4","sourceRowId":"ROW-MD-3c80f8a7d4d83a3637d2","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":207,"lineEnd":212,"locator":"POLICY.md:lines 207–212","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-892d682400bc651968d1","recordKey":"MD-CTRL-TAIMSCORE-MP-2.1@c7b548f567e35589","sourceRowId":"ROW-MD-5ec73574f222bdf6ead4","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":219,"lineEnd":223,"locator":"POLICY.md:lines 219–223","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-6e9262ee3399c701ba66","recordKey":"MD-CTRL-TAIMSCORE-MP-2.2@6ba31f1d90581063","sourceRowId":"ROW-MD-59ad2906b7f904a8b32d","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":224,"lineEnd":228,"locator":"POLICY.md:lines 224–228","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-9de4913c39700cbf0ce2","recordKey":"MD-CTRL-TAIMSCORE-MP-2.3@0e315ec0e8de8b8f","sourceRowId":"ROW-MD-65beb287fea17650ebc6","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":229,"lineEnd":234,"locator":"POLICY.md:lines 229–234","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-fbeae55b299e50f7a67b","recordKey":"MD-CTRL-TAIMSCORE-MP-3.1@f5151dd4ddfa4905","sourceRowId":"ROW-MD-b32a5c7429c08f54f402","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":241,"lineEnd":245,"locator":"POLICY.md:lines 241–245","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-8ba5832e0284b3e0f9df","recordKey":"MD-CTRL-TAIMSCORE-MP-3.2@f6a9aead25c9a878","sourceRowId":"ROW-MD-be8f3d9935c717e4f04c","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":246,"lineEnd":249,"locator":"POLICY.md:lines 246–249","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-deee987a7a13d3354eff","recordKey":"MD-CTRL-TAIMSCORE-MP-3.3@e71a5f5b8757a1bb","sourceRowId":"ROW-MD-b36653c31421add2ec46","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":250,"lineEnd":256,"locator":"POLICY.md:lines 250–256","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-0d849ffe72c669ca1129","recordKey":"MD-CTRL-TAIMSCORE-MP-4.1@7650a9eae1489b67","sourceRowId":"ROW-MD-5f76a33c11e13a4c9b00","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":263,"lineEnd":266,"locator":"POLICY.md:lines 263–266","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-5c398a63801ee763cc5e","recordKey":"MD-CTRL-TAIMSCORE-MP-4.2@5e7e554a9d14d4f0","sourceRowId":"ROW-MD-16fdb8132e5bc475ca24","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":267,"lineEnd":272,"locator":"POLICY.md:lines 267–272","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-23c0aeb7b5f2c6271818","recordKey":"MD-CTRL-TAIMSCORE-MP-5.1@21750de9cac00ac4","sourceRowId":"ROW-MD-877d33928dd1b4795399","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":279,"lineEnd":282,"locator":"POLICY.md:lines 279–282","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-e20b0bc192ca46d2a8af","recordKey":"MD-CTRL-TAIMSCORE-MP-5.2@aae6d3aca3cefd9d","sourceRowId":"ROW-MD-4f622f9bc6c00151827c","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":283,"lineEnd":286,"locator":"POLICY.md:lines 283–286","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-85132c9790561bdff207","recordKey":"MD-CTRL-TAIMSCORE-MP-5.3@d9ade20423d9fae1","sourceRowId":"ROW-MD-0bcf8a076a59892ac0fa","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":287,"lineEnd":290,"locator":"POLICY.md:lines 287–290","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-4289c964b1a3c937e0f7","recordKey":"MD-CTRL-TAIMSCORE-MP-5.4@0f39b85d04a28ae5","sourceRowId":"ROW-MD-6b1678bd73cce80bc1c9","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":291,"lineEnd":294,"locator":"POLICY.md:lines 291–294","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-96769dd1a43dda7262ef","recordKey":"MD-CTRL-TAIMSCORE-MP-5.5@390a727740c13759","sourceRowId":"ROW-MD-a42ca919c29521e0abf3","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":295,"lineEnd":300,"locator":"POLICY.md:lines 295–300","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-c9c65f62ff70c1e84ebf","recordKey":"MD-CTRL-TAIMSCORE-MS-1.1@8e4962befa85bc7b","sourceRowId":"ROW-MD-6a42791c08e97b32cc89","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":311,"lineEnd":314,"locator":"POLICY.md:lines 311–314","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-e9e1adb204e8ed102d65","recordKey":"MD-CTRL-TAIMSCORE-MS-1.2@e5f7bc6811d1f568","sourceRowId":"ROW-MD-923644fa22da41d91d38","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":315,"lineEnd":318,"locator":"POLICY.md:lines 315–318","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-c807bcdc46a4b1d8e210","recordKey":"MD-CTRL-TAIMSCORE-MS-1.3@e0049f5a7a82e999","sourceRowId":"ROW-MD-8a5e4d6fffb804b2c691","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":319,"lineEnd":324,"locator":"POLICY.md:lines 319–324","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-10fd2da1af35c7bf037d","recordKey":"MD-CTRL-TAIMSCORE-MS-2.1@129fa1e62d197c7b","sourceRowId":"ROW-MD-ff1b4b93cceffd520231","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":331,"lineEnd":334,"locator":"POLICY.md:lines 331–334","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-f3ded3d314492903c9c8","recordKey":"MD-CTRL-TAIMSCORE-MS-2.2@2437e8f60490ee90","sourceRowId":"ROW-MD-c101c6a993d166e441e2","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":335,"lineEnd":338,"locator":"POLICY.md:lines 335–338","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-bbc0a16b3c7392c8888e","recordKey":"MD-CTRL-TAIMSCORE-MS-2.3@c2d234e5d46c6f5b","sourceRowId":"ROW-MD-43f65e74eb68e375831b","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":339,"lineEnd":342,"locator":"POLICY.md:lines 339–342","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-6e645b85dfc887bf2c6e","recordKey":"MD-CTRL-TAIMSCORE-MS-2.4@455d8d7db1bd8cf6","sourceRowId":"ROW-MD-337c26dd4028ac03f64d","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":343,"lineEnd":346,"locator":"POLICY.md:lines 343–346","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-da9688203fe06440cbdc","recordKey":"MD-CTRL-TAIMSCORE-MS-2.5@9d6eb82ed7386a1e","sourceRowId":"ROW-MD-f76f0e1a3081b6b07b0f","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":347,"lineEnd":350,"locator":"POLICY.md:lines 347–350","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-89f2209f4714b37fac95","recordKey":"MD-CTRL-TAIMSCORE-MS-2.6@7161e37074ac4ae3","sourceRowId":"ROW-MD-23ebf314208e696e03f0","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":351,"lineEnd":356,"locator":"POLICY.md:lines 351–356","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-350e1eadd71c1395e3f8","recordKey":"MD-CTRL-TAIMSCORE-MS-3.1@5ad421ae77227683","sourceRowId":"ROW-MD-44274f158f33f7bf043c","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":363,"lineEnd":366,"locator":"POLICY.md:lines 363–366","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-ec30c83b414cb7193302","recordKey":"MD-CTRL-TAIMSCORE-MS-3.2@db15d30d4ea169b5","sourceRowId":"ROW-MD-bfd415d61615e3cf9fb8","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":367,"lineEnd":370,"locator":"POLICY.md:lines 367–370","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-846022e94e020f00e93e","recordKey":"MD-CTRL-TAIMSCORE-MS-3.3@21c5310a7329281b","sourceRowId":"ROW-MD-73cb5f04251885e1be6c","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":371,"lineEnd":374,"locator":"POLICY.md:lines 371–374","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-cc500d787f25694d6c2e","recordKey":"MD-CTRL-TAIMSCORE-MS-3.4@1e808b6be39d30e1","sourceRowId":"ROW-MD-b986140f4856011fcc45","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":375,"lineEnd":380,"locator":"POLICY.md:lines 375–380","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-24407681ebe58963100d","recordKey":"MD-CTRL-TAIMSCORE-MS-4.1@0d2eebf4c3c3c07c","sourceRowId":"ROW-MD-ff58e93e8bdde7e169b7","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":387,"lineEnd":390,"locator":"POLICY.md:lines 387–390","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-7997abeea02ca66b5314","recordKey":"MD-CTRL-TAIMSCORE-MS-4.2@4d7bb36b38d271d5","sourceRowId":"ROW-MD-cc4ced92c644a95ca305","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":391,"lineEnd":396,"locator":"POLICY.md:lines 391–396","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-b0c878a770add9c2668a","recordKey":"MD-CTRL-TAIMSCORE-MG-1.1@7e4f4e39ffc8450b","sourceRowId":"ROW-MD-8c18d0316a1e6055999f","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":407,"lineEnd":411,"locator":"POLICY.md:lines 407–411","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-02b8a2b10d5ecb998e00","recordKey":"MD-CTRL-TAIMSCORE-MG-1.2@af82e47ced042dcc","sourceRowId":"ROW-MD-8b5c3357f63952276cb0","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":412,"lineEnd":415,"locator":"POLICY.md:lines 412–415","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-0f6df2fcb4c2f5cfc58f","recordKey":"MD-CTRL-TAIMSCORE-MG-1.3@57168fb27b39fa28","sourceRowId":"ROW-MD-d7923c6fb5260716d1e2","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":416,"lineEnd":421,"locator":"POLICY.md:lines 416–421","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-96369c075ec51e7d990f","recordKey":"MD-CTRL-TAIMSCORE-MG-2.1@2e45b4a7ab5058a3","sourceRowId":"ROW-MD-286a4c8c596b00439564","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":428,"lineEnd":431,"locator":"POLICY.md:lines 428–431","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-353a63420a3bfa688766","recordKey":"MD-CTRL-TAIMSCORE-MG-2.2@8dd199083f138cef","sourceRowId":"ROW-MD-12aa14d11ff6a000fcdd","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":432,"lineEnd":435,"locator":"POLICY.md:lines 432–435","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-3405173321e7641e40a8","recordKey":"MD-CTRL-TAIMSCORE-MG-2.3@386189a1c978c0cc","sourceRowId":"ROW-MD-520362eb8325a4cd66f5","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":436,"lineEnd":439,"locator":"POLICY.md:lines 436–439","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-32f33c94082f6179f357","recordKey":"MD-CTRL-TAIMSCORE-MG-2.4@4a39848a5d9ce83e","sourceRowId":"ROW-MD-6456424b57cbb0b1806d","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":440,"lineEnd":445,"locator":"POLICY.md:lines 440–445","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-48107b13ed373f4fda0c","recordKey":"MD-CTRL-TAIMSCORE-MG-3.1@a0afe931057f15cf","sourceRowId":"ROW-MD-47719f37a858deea18cc","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":452,"lineEnd":455,"locator":"POLICY.md:lines 452–455","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-da384038d97d7452c2f1","recordKey":"MD-CTRL-TAIMSCORE-MG-3.2@22aa2ad79e1a0bff","sourceRowId":"ROW-MD-411f8aa8620c2564be73","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":456,"lineEnd":459,"locator":"POLICY.md:lines 456–459","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-635f631d0a4ab7144fec","recordKey":"MD-CTRL-TAIMSCORE-MG-3.3@9720978dbac2bef4","sourceRowId":"ROW-MD-26ccafc4bf4e31e057a9","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":460,"lineEnd":463,"locator":"POLICY.md:lines 460–463","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-7c59fcea2899d57c2965","recordKey":"MD-CTRL-TAIMSCORE-MG-3.4@0813742729474653","sourceRowId":"ROW-MD-b0e9ace4d989ce5a8959","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":464,"lineEnd":469,"locator":"POLICY.md:lines 464–469","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-e4d65ff71cd85092a9f9","recordKey":"MD-CTRL-TAIMSCORE-MG-4.1@22bb5db4ed410c0e","sourceRowId":"ROW-MD-60e38bc208b3fb6ef457","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":476,"lineEnd":479,"locator":"POLICY.md:lines 476–479","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-ddd165f85f4f42a45cd2","recordKey":"MD-CTRL-TAIMSCORE-MG-4.2@c4d7d793290763bc","sourceRowId":"ROW-MD-aabb633fd4b38389cdec","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":480,"lineEnd":483,"locator":"POLICY.md:lines 480–483","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-118149e12f9e33180757","recordKey":"MD-CTRL-TAIMSCORE-MG-4.3@6f56070482b2b60a","sourceRowId":"ROW-MD-c5f764b27214c7752af1","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":484,"lineEnd":487,"locator":"POLICY.md:lines 484–487","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-0dd8635a1bbb043908ba","recordKey":"MD-CTRL-TAIMSCORE-MG-4.4@29a66fbbec9145a2","sourceRowId":"ROW-MD-fcebb176e5f47dd2ea7c","sourceKey":"policy-guide-taimscore@e8334126d25759e0","workbook":"POLICY.md","sheet":"POLICY.md","row":488,"lineEnd":493,"locator":"POLICY.md:lines 488–493","sourceSha256":"e8334126d25759e058d08f458c206d02d37a4b4dc4c2e43d0af75bb10d4ab9ea"},{"id":"PRV-MD-fcf58bf6c342e2cd020e","recordKey":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","sourceRowId":"ROW-MD-1509ba40111b35924fa8","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":1,"lineEnd":10,"locator":"POLICY(1).md:lines 1–10","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-29bcc2414f773b4c224a","recordKey":"GUIDE-CHIRALITY-MATURITY-d4b1ea5708dd@0be56b6a3a8027cb","sourceRowId":"ROW-MD-16a14557f359fbafb1eb","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":9,"lineEnd":16,"locator":"POLICY(1).md:lines 9–16","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-d9b6ea82ef199c593b09","recordKey":"GUIDE-CHIRALITY-MATURITY-abdb5c7bfe9b@6e66767c34e7897b","sourceRowId":"ROW-MD-6edc28368ea22027eb8c","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":17,"lineEnd":151,"locator":"POLICY(1).md:lines 17–151","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-5ad78db1c0aa055229f6","recordKey":"GUIDE-CHIRALITY-MATURITY-cf07da813dc1@4427570cbc2ff37c","sourceRowId":"ROW-MD-736551e00a42d79b847b","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":19,"lineEnd":44,"locator":"POLICY(1).md:lines 19–44","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-d51366b167fc261243dc","recordKey":"GUIDE-CHIRALITY-MATURITY-cafe81f5497d@69dacf7fcfb9dd06","sourceRowId":"ROW-MD-a2108ba2ea5a87031f1e","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":45,"lineEnd":71,"locator":"POLICY(1).md:lines 45–71","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-6ecf26eda7baeae92a24","recordKey":"GUIDE-CHIRALITY-MATURITY-b93219b67473@b112a497aaaa8808","sourceRowId":"ROW-MD-6904db03d557265fd62f","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":72,"lineEnd":99,"locator":"POLICY(1).md:lines 72–99","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-40c23015db2a33dda032","recordKey":"GUIDE-CHIRALITY-MATURITY-d48f0279614e@64f11469a84dc970","sourceRowId":"ROW-MD-5f9c66e3a81e6c94e1e7","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":100,"lineEnd":128,"locator":"POLICY(1).md:lines 100–128","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-6d2e8aa128d44f64d4c1","recordKey":"GUIDE-CHIRALITY-MATURITY-895a2cd07615@f5083bc7de73592c","sourceRowId":"ROW-MD-f49efc6b82e3049e2c9a","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":129,"lineEnd":151,"locator":"POLICY(1).md:lines 129–151","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-3f3f35cbd0b2509f4b17","recordKey":"GUIDE-CHIRALITY-MATURITY-ba5a0b96e58f@0d78e3c4f1b21a2f","sourceRowId":"ROW-MD-6dd53857950fc295080e","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":152,"lineEnd":165,"locator":"POLICY(1).md:lines 152–165","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-d86bbb787ddbae316a2b","recordKey":"GUIDE-CHIRALITY-MATURITY-f1f90001419d@1f59a3bb902004a5","sourceRowId":"ROW-MD-5913d5c6cde4bc680f26","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":166,"lineEnd":191,"locator":"POLICY(1).md:lines 166–191","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-5ba020036d5b7626cb23","recordKey":"GUIDE-CHIRALITY-MATURITY-f87f7452181f@71729a9bf4aaca9c","sourceRowId":"ROW-MD-97a7c1d7a6cc31b244d8","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":170,"lineEnd":174,"locator":"POLICY(1).md:lines 170–174","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-70cdff81f6f5bbf171f7","recordKey":"GUIDE-CHIRALITY-MATURITY-961bd0656a28@d22b2b16c1f9cff7","sourceRowId":"ROW-MD-52d81b5077bb9be704b4","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":175,"lineEnd":179,"locator":"POLICY(1).md:lines 175–179","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-991dc56b68699073b379","recordKey":"GUIDE-CHIRALITY-MATURITY-2dd1a154ecf8@e1bfaca3d3b7c44b","sourceRowId":"ROW-MD-7d8657cfaf76707b58c2","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":180,"lineEnd":184,"locator":"POLICY(1).md:lines 180–184","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-bb02c6bd6d2412f6f491","recordKey":"GUIDE-CHIRALITY-MATURITY-bd015120ee25@a6a0b44a60dccf23","sourceRowId":"ROW-MD-1cc0d99de1e849c82def","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":185,"lineEnd":191,"locator":"POLICY(1).md:lines 185–191","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-6c5ff4721544d4189a3a","recordKey":"GUIDE-CHIRALITY-MATURITY-c7a76d91e0cf@7ede0ada71f780c5","sourceRowId":"ROW-MD-74d9142f588ef2f5a402","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":192,"lineEnd":260,"locator":"POLICY(1).md:lines 192–260","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-b732a95659b8e8a94dea","recordKey":"GUIDE-CHIRALITY-MATURITY-f9e1250d6a89@5f84c6f50d3370f0","sourceRowId":"ROW-MD-060ec7acda1b84d39547","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":194,"lineEnd":210,"locator":"POLICY(1).md:lines 194–210","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-33ffd1ffde6c4e807de0","recordKey":"GUIDE-CHIRALITY-MATURITY-4371a48a5b8c@d5a88dec1626858a","sourceRowId":"ROW-MD-8bbee31901bf126d8825","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":211,"lineEnd":225,"locator":"POLICY(1).md:lines 211–225","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-a3ee5e8dc7332b4a87ff","recordKey":"GUIDE-CHIRALITY-MATURITY-acf51a8695dd@df15c458ec8f3ab3","sourceRowId":"ROW-MD-39a6920a11979f8bb443","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":226,"lineEnd":260,"locator":"POLICY(1).md:lines 226–260","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-1ff5c2f6acb5ac66d7cf","recordKey":"GUIDE-CHIRALITY-MATURITY-8ba0fa05d98b@0e6382cf8e05c03c","sourceRowId":"ROW-MD-3abeb965e138037b6fa9","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":261,"lineEnd":281,"locator":"POLICY(1).md:lines 261–281","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-a3e9b8074d912bed36ed","recordKey":"GUIDE-CHIRALITY-MATURITY-cdf9ea9d2bc7@77e225c5ad7873dd","sourceRowId":"ROW-MD-29fbb9c5169894278abd","sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","workbook":"POLICY(1).md","sheet":"POLICY(1).md","row":282,"lineEnd":297,"locator":"POLICY(1).md:lines 282–297","sourceSha256":"9134743a099f1dc9504df14d0caa2d77c774e20c8f0badd5d6d431f1e6e92ed6"},{"id":"PRV-MD-d490fba507416a759177","recordKey":"FW-CMMC@e968caf002b9348f","sourceRowId":"ROW-MD-f4e115f36f0c920075e3","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":1,"lineEnd":10,"locator":"POLICY(2).md:lines 1–10","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-b98dad6cf454a6df51d4","recordKey":"GUIDE-CMMC-d4b1ea5708dd@d3dfadb497795c66","sourceRowId":"ROW-MD-241051c6b80c131e775d","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":10,"lineEnd":17,"locator":"POLICY(2).md:lines 10–17","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-a86b7522632202f7ab63","recordKey":"GUIDE-CMMC-33d9b34511c8@aff2acd402b3d285","sourceRowId":"ROW-MD-7f15e6d4913d2c612574","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":18,"lineEnd":43,"locator":"POLICY(2).md:lines 18–43","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-d78254daff007a232efe","recordKey":"GUIDE-CMMC-c6687532e15e@674b4b2ae352bd8e","sourceRowId":"ROW-MD-41cd8afeaf83b62e21c1","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":20,"lineEnd":43,"locator":"POLICY(2).md:lines 20–43","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-428145d446705c10d92e","recordKey":"GUIDE-CMMC-b83ed29f205c@e559b351bf18297c","sourceRowId":"ROW-MD-7af2d30bdef7d6e3bd9f","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":44,"lineEnd":64,"locator":"POLICY(2).md:lines 44–64","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-017278e5b6f661c9621b","recordKey":"GUIDE-CMMC-ada412eeb3b1@0dd2eecf6a6a956e","sourceRowId":"ROW-MD-56b1f5ff8a18a4a9e6d9","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":65,"lineEnd":154,"locator":"POLICY(2).md:lines 65–154","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-88da870b94f8a515432e","recordKey":"GUIDE-CMMC-4bd9687b3cff@cabdd6c26874911b","sourceRowId":"ROW-MD-28ed13733840e528acf2","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":67,"lineEnd":80,"locator":"POLICY(2).md:lines 67–80","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-896f75348994495bcde2","recordKey":"GUIDE-CMMC-ad0f054d92b4@81ffa31e2fb287de","sourceRowId":"ROW-MD-ff752690c9956a027ff4","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":81,"lineEnd":94,"locator":"POLICY(2).md:lines 81–94","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-32f6b19496640f406fb0","recordKey":"GUIDE-CMMC-0c831209db16@bb87dee97482f573","sourceRowId":"ROW-MD-fea4f579524cedec644d","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":95,"lineEnd":108,"locator":"POLICY(2).md:lines 95–108","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-e6d1fd6867ee7c7cb86b","recordKey":"GUIDE-CMMC-cc60a43f21c0@956063ee44d9a070","sourceRowId":"ROW-MD-b9594975f24d0b764b5f","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":109,"lineEnd":116,"locator":"POLICY(2).md:lines 109–116","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-3abb7678e030984f8898","recordKey":"GUIDE-CMMC-2f8c723e0c37@e9a785003736fa38","sourceRowId":"ROW-MD-5114b271770149bdf02e","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":117,"lineEnd":130,"locator":"POLICY(2).md:lines 117–130","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-ccba5f7f365cd93f5565","recordKey":"GUIDE-CMMC-1391326987ed@dff889e5cb9c4047","sourceRowId":"ROW-MD-9417e1e8849693054ac8","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":131,"lineEnd":144,"locator":"POLICY(2).md:lines 131–144","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-94a5a8c64cd1ad3b5491","recordKey":"GUIDE-CMMC-3e211c704f63@61261076a2ba7e99","sourceRowId":"ROW-MD-65445b3409946e3e8d56","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":145,"lineEnd":154,"locator":"POLICY(2).md:lines 145–154","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-88d4b9abf9b7869edeb4","recordKey":"GUIDE-CMMC-718b8b70b5ca@581f8dcf597f942c","sourceRowId":"ROW-MD-2b713738c32b012b7417","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":155,"lineEnd":173,"locator":"POLICY(2).md:lines 155–173","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-1ab06035e347b2120447","recordKey":"GUIDE-CMMC-459cae2d094b@186772e1a2d6e19a","sourceRowId":"ROW-MD-831ce1e4add23b51e93f","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":157,"lineEnd":162,"locator":"POLICY(2).md:lines 157–162","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-dae4aa682032df873d97","recordKey":"GUIDE-CMMC-b82159a081aa@93605ce3bba5a4f2","sourceRowId":"ROW-MD-3bc65b384c06c1bc4bf7","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":163,"lineEnd":168,"locator":"POLICY(2).md:lines 163–168","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-3e521a0e405932fa6945","recordKey":"GUIDE-CMMC-7f85880eb6fb@fb2395f08f67e2c1","sourceRowId":"ROW-MD-0c89d8a80d4429e4dcb5","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":169,"lineEnd":173,"locator":"POLICY(2).md:lines 169–173","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-26ab740651fd8371ce57","recordKey":"GUIDE-CMMC-087615ecff08@33a56759bc286adb","sourceRowId":"ROW-MD-50ae6012bf7ff74dc12a","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":174,"lineEnd":202,"locator":"POLICY(2).md:lines 174–202","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-a337bdf9b834aeb36283","recordKey":"GUIDE-CMMC-c1d741699694@4da6cf1269e31fd5","sourceRowId":"ROW-MD-c3142092ca01d5a65d09","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":176,"lineEnd":178,"locator":"POLICY(2).md:lines 176–178","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-54aea4d42aa529162560","recordKey":"GUIDE-CMMC-034391293cf6@b34e7d3ebbfe04a1","sourceRowId":"ROW-MD-e825fc1e34e3fa51754d","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":179,"lineEnd":181,"locator":"POLICY(2).md:lines 179–181","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-20a3b8a88983f96401d9","recordKey":"GUIDE-CMMC-99f48be3dbef@604b8c446900c8d9","sourceRowId":"ROW-MD-e89e3e276fa49c3b0442","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":182,"lineEnd":189,"locator":"POLICY(2).md:lines 182–189","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-ef92bf8970bb9d0cc3a2","recordKey":"GUIDE-CMMC-e598890dbfd3@6cec6b707028e400","sourceRowId":"ROW-MD-138b806900e582131efb","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":190,"lineEnd":197,"locator":"POLICY(2).md:lines 190–197","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-9bed609fdb6b51dda80b","recordKey":"GUIDE-CMMC-1387f8a40572@893d01436728a543","sourceRowId":"ROW-MD-7f0b300b4b15341aa52b","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":198,"lineEnd":202,"locator":"POLICY(2).md:lines 198–202","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-616163d5d8edeb4c1dae","recordKey":"GUIDE-CMMC-c19e439ec559@6c77d26a45310237","sourceRowId":"ROW-MD-87d6f80a2da1b2d7c507","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":203,"lineEnd":238,"locator":"POLICY(2).md:lines 203–238","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-25b2bd3840d7ba109921","recordKey":"GUIDE-CMMC-69824d3b0e70@90f188fe81572ddd","sourceRowId":"ROW-MD-db47323c6e61353a4279","sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","workbook":"POLICY(2).md","sheet":"POLICY(2).md","row":239,"lineEnd":246,"locator":"POLICY(2).md:lines 239–246","sourceSha256":"41d1e97d020a97ab1207da3846558578afdfe59c5f9ccec2b13aa272e8b8dcca"},{"id":"PRV-MD-01eb1e57266735158df1","recordKey":"FW-DOD-AI-ETHICS@dce13385a4d1628e","sourceRowId":"ROW-MD-de878171e09afa18bd9c","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":1,"lineEnd":10,"locator":"POLICY(3).md:lines 1–10","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-4d8bf588613a1a16f986","recordKey":"GUIDE-DOD-AI-ETHICS-d4b1ea5708dd@e697741088d4aa35","sourceRowId":"ROW-MD-cb87034c7b1d034aa7c3","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":10,"lineEnd":17,"locator":"POLICY(3).md:lines 10–17","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-9a450ae203034d1c3a89","recordKey":"GUIDE-DOD-AI-ETHICS-67738471d132@3bcc1bfe47146a3e","sourceRowId":"ROW-MD-d8d2400cd6cab89d7e6a","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":18,"lineEnd":176,"locator":"POLICY(3).md:lines 18–176","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-805aae27d26a1e8b38a0","recordKey":"GUIDE-DOD-AI-ETHICS-0a63fa35e0d7@d7b2494e16327226","sourceRowId":"ROW-MD-a94d14e29d91c48af36b","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":20,"lineEnd":49,"locator":"POLICY(3).md:lines 20–49","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-52ae903eb5aad540926e","recordKey":"GUIDE-DOD-AI-ETHICS-d91817ba2d50@2e8500aaa7d00a7f","sourceRowId":"ROW-MD-161ee0df6abbf42aaea8","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":50,"lineEnd":79,"locator":"POLICY(3).md:lines 50–79","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-7578317e14c085c6768b","recordKey":"GUIDE-DOD-AI-ETHICS-c0bd973d970a@7c8168964cc9244a","sourceRowId":"ROW-MD-09132fe6bd1acd70fa6a","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":80,"lineEnd":110,"locator":"POLICY(3).md:lines 80–110","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-b2d480db3ea3035169e3","recordKey":"GUIDE-DOD-AI-ETHICS-002d8967b767@7398b22ba2f1fe62","sourceRowId":"ROW-MD-a2cd210b555a31a06759","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":111,"lineEnd":143,"locator":"POLICY(3).md:lines 111–143","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-8a9a79fca2d872e32902","recordKey":"GUIDE-DOD-AI-ETHICS-ebad561d600c@c61890205c444dcd","sourceRowId":"ROW-MD-74d779f1b1163f1cb431","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":144,"lineEnd":176,"locator":"POLICY(3).md:lines 144–176","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-f67d93557f71e02ac9ed","recordKey":"GUIDE-DOD-AI-ETHICS-5f31df376b61@eaac205009152159","sourceRowId":"ROW-MD-0be65c67e7ceeb2d8111","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":177,"lineEnd":193,"locator":"POLICY(3).md:lines 177–193","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-d01bb47f1284dc20da8f","recordKey":"GUIDE-DOD-AI-ETHICS-cbd5081a5641@675c2a91b174bcdf","sourceRowId":"ROW-MD-57c9214e7a432ef93b13","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":179,"lineEnd":181,"locator":"POLICY(3).md:lines 179–181","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-163a394a785e3d60b998","recordKey":"GUIDE-DOD-AI-ETHICS-7d04a470c378@786b8655ec41dd12","sourceRowId":"ROW-MD-6b6a8d029b0b4fe33faf","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":182,"lineEnd":188,"locator":"POLICY(3).md:lines 182–188","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-496993b38652b929bd78","recordKey":"GUIDE-DOD-AI-ETHICS-abde8473193e@6d4b5df5befaa819","sourceRowId":"ROW-MD-36cfd248adcedd03d762","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":189,"lineEnd":193,"locator":"POLICY(3).md:lines 189–193","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-49e8c2d1307eb596fc9f","recordKey":"GUIDE-DOD-AI-ETHICS-24b61af8c83d@c5dc309caff3a0aa","sourceRowId":"ROW-MD-f95a97d64a91e7d3176c","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":194,"lineEnd":210,"locator":"POLICY(3).md:lines 194–210","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-850d24a8b5115bc719a8","recordKey":"GUIDE-DOD-AI-ETHICS-d322e01cdda7@225ed7b0a68d990a","sourceRowId":"ROW-MD-4cbdbf66492fb1b1dc23","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":196,"lineEnd":201,"locator":"POLICY(3).md:lines 196–201","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-2fc7ebf5f7921278a77f","recordKey":"GUIDE-DOD-AI-ETHICS-fa36254d0296@a337bf5877252774","sourceRowId":"ROW-MD-aadd83ea0561ad4de11c","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":202,"lineEnd":210,"locator":"POLICY(3).md:lines 202–210","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-c9a9f3d04b82b7d535da","recordKey":"GUIDE-DOD-AI-ETHICS-a5e5db74c2c9@e24bf6ceafa4ee12","sourceRowId":"ROW-MD-cb3b927c956d5341f0fb","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":211,"lineEnd":263,"locator":"POLICY(3).md:lines 211–263","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-91517b2eda1bcbb75dba","recordKey":"GUIDE-DOD-AI-ETHICS-e33f725b85e2@933b87edf14e4bc4","sourceRowId":"ROW-MD-f17eae3c7d1ede552d5d","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":213,"lineEnd":263,"locator":"POLICY(3).md:lines 213–263","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-89afc04d15b6bc73176c","recordKey":"GUIDE-DOD-AI-ETHICS-69824d3b0e70@e883e8a0e46db5f1","sourceRowId":"ROW-MD-d079320ba6d07eb4c242","sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","workbook":"POLICY(3).md","sheet":"POLICY(3).md","row":264,"lineEnd":272,"locator":"POLICY(3).md:lines 264–272","sourceSha256":"cea5aa820a0b3f1d18f9da7d6192ad10563e515d3ed4508a69653e918f9d24a0"},{"id":"PRV-MD-df35fc2a5c249698736b","recordKey":"FW-EO-14110@dfd56eb497a8628f","sourceRowId":"ROW-MD-8dee660e603fe31d011f","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":1,"lineEnd":10,"locator":"POLICY(4).md:lines 1–10","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-ecb5e7c44e44940777ed","recordKey":"GUIDE-EO-14110-7c6db84cd8c4@2e466342c9db5e04","sourceRowId":"ROW-MD-bae4194b6c8316c8ea8e","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":11,"lineEnd":25,"locator":"POLICY(4).md:lines 11–25","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-8c47e595d9016344ff28","recordKey":"GUIDE-EO-14110-62c3b372adb4@a848449af68e5d32","sourceRowId":"ROW-MD-4e39ef29cc48148a66da","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":26,"lineEnd":48,"locator":"POLICY(4).md:lines 26–48","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-93210ab3797596c9ea59","recordKey":"GUIDE-EO-14110-79d9626b044a@0d34707b3713dbcc","sourceRowId":"ROW-MD-bf43d7a0502830f7acd1","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":49,"lineEnd":65,"locator":"POLICY(4).md:lines 49–65","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-0d6e5281caf19021af46","recordKey":"GUIDE-EO-14110-5855cab863a5@b2750bc8370a9a1a","sourceRowId":"ROW-MD-ea027ca613759d5a889e","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":66,"lineEnd":102,"locator":"POLICY(4).md:lines 66–102","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-d395160abf134e99cfd8","recordKey":"GUIDE-EO-14110-6f3cb5e780de@b5cac6b8b48c8167","sourceRowId":"ROW-MD-759a4ee7310c1e323643","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":103,"lineEnd":148,"locator":"POLICY(4).md:lines 103–148","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-8720fde37c96bf0d648f","recordKey":"GUIDE-EO-14110-33e3ff3a6b96@319f7474b70540a5","sourceRowId":"ROW-MD-1026c0dac14f4fbcede6","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":149,"lineEnd":179,"locator":"POLICY(4).md:lines 149–179","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-e7e209ed3f3efc55ef16","recordKey":"GUIDE-EO-14110-5d591f9926b9@60a7582becf3d823","sourceRowId":"ROW-MD-5e482db267aa00685dc6","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":180,"lineEnd":212,"locator":"POLICY(4).md:lines 180–212","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-650239e393a04aae50c5","recordKey":"GUIDE-EO-14110-04aecd8c33d5@87e34774782dbd75","sourceRowId":"ROW-MD-82a2d2f95d958f91005d","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":213,"lineEnd":242,"locator":"POLICY(4).md:lines 213–242","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-991fc3d6a5cd2f7cb933","recordKey":"GUIDE-EO-14110-218eb1a5550c@c74532fb822fa4e6","sourceRowId":"ROW-MD-1ff6a5447554dfe26434","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":243,"lineEnd":373,"locator":"POLICY(4).md:lines 243–373","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-77ce7552bf997c325dbb","recordKey":"GUIDE-EO-14110-2346c2f7aafa@54eaf61ecf770d0a","sourceRowId":"ROW-MD-d4c3a4ca94baff0ec85e","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":245,"lineEnd":273,"locator":"POLICY(4).md:lines 245–273","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-2ddd8276fe37c9fcc19f","recordKey":"GUIDE-EO-14110-b13eec9c47c3@21fee62d2e198d62","sourceRowId":"ROW-MD-d77441ce2100fcbeda6c","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":274,"lineEnd":289,"locator":"POLICY(4).md:lines 274–289","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-1bd7f50e09091168fd9d","recordKey":"GUIDE-EO-14110-c130536e7d31@0992aee256490558","sourceRowId":"ROW-MD-36e56864a7348e2e369b","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":290,"lineEnd":298,"locator":"POLICY(4).md:lines 290–298","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-93619d50ecc8fd54950a","recordKey":"GUIDE-EO-14110-34dcbc154365@4820ed3b3e2f177a","sourceRowId":"ROW-MD-9b0befbf16ce87cbcd56","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":299,"lineEnd":307,"locator":"POLICY(4).md:lines 299–307","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-2e0d93616fa9b4550f52","recordKey":"GUIDE-EO-14110-1112914dfbb4@e1794a8f9ac6eaf8","sourceRowId":"ROW-MD-b3bd796f61c2c3863a5f","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":308,"lineEnd":328,"locator":"POLICY(4).md:lines 308–328","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-c6c8c5bb2c6892e411a9","recordKey":"GUIDE-EO-14110-238ec1b1ea58@9dc39353c8c35513","sourceRowId":"ROW-MD-90022cccac51b64d2ddc","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":329,"lineEnd":338,"locator":"POLICY(4).md:lines 329–338","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-72d6c19ac65aaacad0d6","recordKey":"GUIDE-EO-14110-3b1e0132f5f0@df52392fa0f4489f","sourceRowId":"ROW-MD-b027949cf22a26bc6310","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":339,"lineEnd":364,"locator":"POLICY(4).md:lines 339–364","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-88a0bd2b7a2752434aea","recordKey":"GUIDE-EO-14110-b3dcf85c3daa@9ca589583155671b","sourceRowId":"ROW-MD-62e98b39d1c8e908bd75","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":365,"lineEnd":373,"locator":"POLICY(4).md:lines 365–373","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-fee3a13364b210e511a0","recordKey":"GUIDE-EO-14110-4dfdbc9caab6@00dea9ed7860b271","sourceRowId":"ROW-MD-8836487556b02ce7a2a2","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":374,"lineEnd":416,"locator":"POLICY(4).md:lines 374–416","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-b969b27569679c22780b","recordKey":"GUIDE-EO-14110-c0b3ac29a78d@6538ae22c8da03d1","sourceRowId":"ROW-MD-855246a283fca38d621f","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":417,"lineEnd":438,"locator":"POLICY(4).md:lines 417–438","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-64384ed638afa9265616","recordKey":"GUIDE-EO-14110-2aac512f087b@3646aa4cca032d89","sourceRowId":"ROW-MD-93c4e5b7ee857647a7cf","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":439,"lineEnd":463,"locator":"POLICY(4).md:lines 439–463","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-3a53d4c920fb8c727862","recordKey":"GUIDE-EO-14110-e1c5c4d65e56@edfaacd64e9b3c2f","sourceRowId":"ROW-MD-dd2a002318acbbd7573b","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":464,"lineEnd":477,"locator":"POLICY(4).md:lines 464–477","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-48f3a77416d77e8c35c2","recordKey":"GUIDE-EO-14110-4b99227c823f@0b1e5df222956658","sourceRowId":"ROW-MD-2886a364dead41e77b00","sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","workbook":"POLICY(4).md","sheet":"POLICY(4).md","row":478,"lineEnd":490,"locator":"POLICY(4).md:lines 478–490","sourceSha256":"88d519cc9c305e1a3694d2861baa354c68f7b520a2a23d18179d172218f45da5"},{"id":"PRV-MD-1c715196649086e344f7","recordKey":"FW-EU-AI-ACT@881f89c9d4bd5d35","sourceRowId":"ROW-MD-7abd597fee234362d6e5","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":1,"lineEnd":10,"locator":"POLICY(5).md:lines 1–10","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-6a1d681cb05eb8b4ee0b","recordKey":"GUIDE-EU-AI-ACT-7c6db84cd8c4@3c8523cabd28a251","sourceRowId":"ROW-MD-4d426d9fa861ef1fe81c","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":9,"lineEnd":18,"locator":"POLICY(5).md:lines 9–18","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-4e9f74658eece7be9373","recordKey":"GUIDE-EU-AI-ACT-6033ed1cc88a@187d945afdc6aa35","sourceRowId":"ROW-MD-4c09eb6231fa7f0538f0","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":19,"lineEnd":32,"locator":"POLICY(5).md:lines 19–32","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-49ce8d59e74320470ebb","recordKey":"GUIDE-EU-AI-ACT-8511d8d9ace9@baf7916daa66fbff","sourceRowId":"ROW-MD-2a0df1a6421946adb3ac","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":33,"lineEnd":81,"locator":"POLICY(5).md:lines 33–81","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-4a565014f0cb15527ee9","recordKey":"GUIDE-EU-AI-ACT-993a9445e7d4@d3611d629b800c5c","sourceRowId":"ROW-MD-0c5458e39440b66d4ce6","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":35,"lineEnd":51,"locator":"POLICY(5).md:lines 35–51","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-8ae2bfe9c4c5a50a62aa","recordKey":"GUIDE-EU-AI-ACT-5540efc926b0@59be080686028180","sourceRowId":"ROW-MD-bf667721c9bc5d880a79","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":52,"lineEnd":60,"locator":"POLICY(5).md:lines 52–60","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-c6de3beb316247eb1029","recordKey":"GUIDE-EU-AI-ACT-2244be543a17@6ba1ccc09baa6090","sourceRowId":"ROW-MD-1a09607b3acf067a4acd","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":61,"lineEnd":71,"locator":"POLICY(5).md:lines 61–71","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-3afc4a79857457bf3d9b","recordKey":"GUIDE-EU-AI-ACT-5150f5e2c204@d0d521be281a52cb","sourceRowId":"ROW-MD-b2c99d0f3a947fc30a8f","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":72,"lineEnd":81,"locator":"POLICY(5).md:lines 72–81","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-931e5a655c49cb35cbf5","recordKey":"GUIDE-EU-AI-ACT-70f400ea3508@59c61f418f4e6713","sourceRowId":"ROW-MD-77e6f042aa89bcc118f0","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":82,"lineEnd":111,"locator":"POLICY(5).md:lines 82–111","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-558a1d16db6da97b1cd9","recordKey":"GUIDE-EU-AI-ACT-a7847c271ab6@878fa9e01941c77b","sourceRowId":"ROW-MD-136f39855bb5885ec844","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":112,"lineEnd":165,"locator":"POLICY(5).md:lines 112–165","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-43fee3299c50191c6433","recordKey":"GUIDE-EU-AI-ACT-ad2259d97b50@e1d2c8b03a935aad","sourceRowId":"ROW-MD-e679367039fdaf63d819","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":166,"lineEnd":193,"locator":"POLICY(5).md:lines 166–193","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-c491a70ab49577cf567d","recordKey":"GUIDE-EU-AI-ACT-6abf8bb7c8f9@e3fcfee6665a341f","sourceRowId":"ROW-MD-edd835dcae1517d07941","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":194,"lineEnd":216,"locator":"POLICY(5).md:lines 194–216","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-28cfaaec9bebb6d2eaff","recordKey":"GUIDE-EU-AI-ACT-810b29b3574d@4ea902416e0ee643","sourceRowId":"ROW-MD-007424a9098adeacdf8e","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":217,"lineEnd":246,"locator":"POLICY(5).md:lines 217–246","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-8ded5f255a64216583ba","recordKey":"GUIDE-EU-AI-ACT-3cd5968c04de@5b53a06a327fc041","sourceRowId":"ROW-MD-f459832a4df9243130bf","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":247,"lineEnd":269,"locator":"POLICY(5).md:lines 247–269","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-6c2c885bd9c0980e31ba","recordKey":"GUIDE-EU-AI-ACT-2bd7a097a3c3@d003fdb2ad7da7de","sourceRowId":"ROW-MD-b8b9263cbf7f2030ec5e","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":270,"lineEnd":290,"locator":"POLICY(5).md:lines 270–290","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-4a0f4d1c9a17e98b2e1e","recordKey":"GUIDE-EU-AI-ACT-d1c940a3e06b@8d00dd6449e18a3b","sourceRowId":"ROW-MD-48616932d0d99e0c0d72","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":291,"lineEnd":317,"locator":"POLICY(5).md:lines 291–317","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-acda3522cbfe85077646","recordKey":"GUIDE-EU-AI-ACT-be3f672a4b53@12b7627ee8a7046b","sourceRowId":"ROW-MD-9da0a773f8abfb8529d1","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":318,"lineEnd":342,"locator":"POLICY(5).md:lines 318–342","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-9cfb35c7b4fd1648a86d","recordKey":"GUIDE-EU-AI-ACT-444206375e2a@9d26e40f2da6bb66","sourceRowId":"ROW-MD-c1c7ea088f964add83c6","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":343,"lineEnd":361,"locator":"POLICY(5).md:lines 343–361","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-0117194fa91415a13aa1","recordKey":"GUIDE-EU-AI-ACT-2d768359c990@fad023d9d5e2ab71","sourceRowId":"ROW-MD-819f5e9828a427d8df3b","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":362,"lineEnd":382,"locator":"POLICY(5).md:lines 362–382","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-c03bf393533395b7cd09","recordKey":"GUIDE-EU-AI-ACT-68fff543384e@0a377af95dbbf478","sourceRowId":"ROW-MD-ac034d8692fce62e2173","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":383,"lineEnd":412,"locator":"POLICY(5).md:lines 383–412","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-5ef760ec22efc59a94b9","recordKey":"GUIDE-EU-AI-ACT-a56c0c13d733@928b9968948e8586","sourceRowId":"ROW-MD-947a8231e727edbf0552","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":413,"lineEnd":434,"locator":"POLICY(5).md:lines 413–434","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-fdcaba14e40815cb1b78","recordKey":"GUIDE-EU-AI-ACT-406870edffeb@265482f748ccf455","sourceRowId":"ROW-MD-5aca69ab7b926151cb3f","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":435,"lineEnd":448,"locator":"POLICY(5).md:lines 435–448","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-c79a9dc657e6db741301","recordKey":"GUIDE-EU-AI-ACT-be00b216fdaf@f65dd62b9929e8f1","sourceRowId":"ROW-MD-708e9ac9afa577982287","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":449,"lineEnd":471,"locator":"POLICY(5).md:lines 449–471","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-13029871e2efa465d120","recordKey":"GUIDE-EU-AI-ACT-83b0bcc1cfbd@78f28c0b02969d19","sourceRowId":"ROW-MD-102c611601d1cf611a5c","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":451,"lineEnd":456,"locator":"POLICY(5).md:lines 451–456","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-992f5b05c60ab7c9fb08","recordKey":"GUIDE-EU-AI-ACT-8dffffde2c70@027b6a04b4faad0e","sourceRowId":"ROW-MD-436071ac2fcaf7a65e43","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":457,"lineEnd":463,"locator":"POLICY(5).md:lines 457–463","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-1e829908ebc295985fb8","recordKey":"GUIDE-EU-AI-ACT-8e818ccb0fef@3b7abef3874e6f1c","sourceRowId":"ROW-MD-255ae67bdd6b3deea470","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":464,"lineEnd":471,"locator":"POLICY(5).md:lines 464–471","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-a294d830e408f9fbe25a","recordKey":"MD-CTRL-EU-AI-ACT-9-1-@5bec8b894d92882b","sourceRowId":"ROW-MD-33db61466c41c303ae62","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":172,"lineEnd":173,"locator":"POLICY(5).md:lines 172–173","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-841ac9a9c83be7969704","recordKey":"MD-CTRL-EU-AI-ACT-9-2-@51c3f8ab111e3ef5","sourceRowId":"ROW-MD-1728103c46fcd4ac7c9b","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":174,"lineEnd":179,"locator":"POLICY(5).md:lines 174–179","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-489914c890590e5f35dd","recordKey":"MD-CTRL-EU-AI-ACT-9-4-@e401d0abd504c8b1","sourceRowId":"ROW-MD-ca549135ce808d7785ea","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":180,"lineEnd":181,"locator":"POLICY(5).md:lines 180–181","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-65268b8e62711fe71396","recordKey":"MD-CTRL-EU-AI-ACT-9-5-@fdc5560100fd6335","sourceRowId":"ROW-MD-360d4b798ee21e1beee7","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":182,"lineEnd":183,"locator":"POLICY(5).md:lines 182–183","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-54f92cf3c7f13a90d30e","recordKey":"MD-CTRL-EU-AI-ACT-9-6-@a9ee456f4433d8fe","sourceRowId":"ROW-MD-594c654c5cad4984aedb","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":184,"lineEnd":185,"locator":"POLICY(5).md:lines 184–185","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-e8eeaf6b72a58c934ead","recordKey":"MD-CTRL-EU-AI-ACT-9-7-@262fe538cb34eacc","sourceRowId":"ROW-MD-8947173a77130dd1acd7","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":186,"lineEnd":187,"locator":"POLICY(5).md:lines 186–187","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-ce57842cbe89a371f18b","recordKey":"MD-CTRL-EU-AI-ACT-9-8-@e3fa4515dc9c64e3","sourceRowId":"ROW-MD-ebac09fb968816fe6e23","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":188,"lineEnd":193,"locator":"POLICY(5).md:lines 188–193","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-40422c2606f622f5c5fb","recordKey":"MD-CTRL-EU-AI-ACT-10-2-@a7dce78116ce2014","sourceRowId":"ROW-MD-c4a1dd489a00d4c7c59f","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":198,"lineEnd":206,"locator":"POLICY(5).md:lines 198–206","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-104fecaa969b7c253b7e","recordKey":"MD-CTRL-EU-AI-ACT-10-3-@1ce76d7345575584","sourceRowId":"ROW-MD-d14b13309dffd878f971","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":207,"lineEnd":208,"locator":"POLICY(5).md:lines 207–208","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-22cb465247f06ce4c106","recordKey":"MD-CTRL-EU-AI-ACT-10-4-@aa75ff3914ffc284","sourceRowId":"ROW-MD-d94e4a433bf68a7b8216","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":209,"lineEnd":210,"locator":"POLICY(5).md:lines 209–210","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-eb1b6f500605a7aebb28","recordKey":"MD-CTRL-EU-AI-ACT-10-5-@7e0bc0ba9d6d6412","sourceRowId":"ROW-MD-164051f23a0b977ad584","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":211,"lineEnd":216,"locator":"POLICY(5).md:lines 211–216","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-f66675bd1269e980b9e4","recordKey":"MD-CTRL-EU-AI-ACT-13-1-@e4de22262c5355d6","sourceRowId":"ROW-MD-3983dc5d9a9400d8ec20","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":221,"lineEnd":222,"locator":"POLICY(5).md:lines 221–222","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-2729ea020f496cb0a556","recordKey":"MD-CTRL-EU-AI-ACT-13-2-@ae3ce4bab942592a","sourceRowId":"ROW-MD-3c65e7b5a3f204cbc355","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":223,"lineEnd":235,"locator":"POLICY(5).md:lines 223–235","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-5cb09cceaf5a807e152c","recordKey":"MD-CTRL-EU-AI-ACT-13-3-@f228d898e674d933","sourceRowId":"ROW-MD-0241ee603af208254e1c","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":236,"lineEnd":246,"locator":"POLICY(5).md:lines 236–246","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-32ace26f5242ce0fe21a","recordKey":"MD-CTRL-EU-AI-ACT-14-1-@f52eff8120a90c2e","sourceRowId":"ROW-MD-d08eb167ab552e2283de","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":251,"lineEnd":252,"locator":"POLICY(5).md:lines 251–252","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-7a3c44563d3b60cdccce","recordKey":"MD-CTRL-EU-AI-ACT-14-2-@5e8d41765cdf2e60","sourceRowId":"ROW-MD-4718c7f7a9910251fb94","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":253,"lineEnd":254,"locator":"POLICY(5).md:lines 253–254","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-9f6cc2da9987754a2d94","recordKey":"MD-CTRL-EU-AI-ACT-14-3-@8f0eaa8f1c405ff4","sourceRowId":"ROW-MD-f37fb389dd22d17c047f","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":255,"lineEnd":261,"locator":"POLICY(5).md:lines 255–261","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-1d1a4f7815dec09dd5b5","recordKey":"MD-CTRL-EU-AI-ACT-14-4-@ca77c391a877ecbb","sourceRowId":"ROW-MD-8a69d3068047506fd41f","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":262,"lineEnd":263,"locator":"POLICY(5).md:lines 262–263","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-fc0f855bab77b0d2db94","recordKey":"MD-CTRL-EU-AI-ACT-14-5-@af795797cc364252","sourceRowId":"ROW-MD-f38a488e2f1342a5b63c","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":264,"lineEnd":269,"locator":"POLICY(5).md:lines 264–269","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-6b891449e2705f629183","recordKey":"MD-CTRL-EU-AI-ACT-15-1-@b3e518f9d429b45e","sourceRowId":"ROW-MD-a900d397e132f59b4e1b","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":272,"lineEnd":273,"locator":"POLICY(5).md:lines 272–273","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-84bf2f33fe1979640fca","recordKey":"MD-CTRL-EU-AI-ACT-15-2-@503fca7940ba7748","sourceRowId":"ROW-MD-bc453c622abcd39a63b0","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":274,"lineEnd":275,"locator":"POLICY(5).md:lines 274–275","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-54212318a31152c8558d","recordKey":"MD-CTRL-EU-AI-ACT-15-3-@cf8a59d9043b2983","sourceRowId":"ROW-MD-74dc0d5003db990ed4d6","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":276,"lineEnd":282,"locator":"POLICY(5).md:lines 276–282","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-48d2d12e928867bfb315","recordKey":"MD-CTRL-EU-AI-ACT-15-4-@1e19ebf3d5aebd44","sourceRowId":"ROW-MD-c69eb8c16195d1eb946d","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":283,"lineEnd":284,"locator":"POLICY(5).md:lines 283–284","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-4473e7508a934dac29ab","recordKey":"MD-CTRL-EU-AI-ACT-15-5-@f5fb81f718cfe769","sourceRowId":"ROW-MD-a71064e87dfaea8e786c","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":285,"lineEnd":290,"locator":"POLICY(5).md:lines 285–290","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-21a7c8a1069374c07a09","recordKey":"MD-CTRL-EU-AI-ACT-52-1-@058abb0e89a7813e","sourceRowId":"ROW-MD-797468111bd4de6ed50c","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":295,"lineEnd":300,"locator":"POLICY(5).md:lines 295–300","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-a935dfb5e2a09413f607","recordKey":"MD-CTRL-EU-AI-ACT-52-2-@fcd1dc217971ff35","sourceRowId":"ROW-MD-f0ab560dcf05ff5bc549","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":301,"lineEnd":311,"locator":"POLICY(5).md:lines 301–311","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-8e2124262cebdd5843fb","recordKey":"MD-CTRL-EU-AI-ACT-52-5-@5a666ea0f8aca324","sourceRowId":"ROW-MD-c04def94dbbd9d140e2a","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":312,"lineEnd":317,"locator":"POLICY(5).md:lines 312–317","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-abaf64141aced923b417","recordKey":"MD-CTRL-EU-AI-ACT-71-1-@0bbab87f8356282e","sourceRowId":"ROW-MD-4893380b79a190ce8138","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":322,"lineEnd":323,"locator":"POLICY(5).md:lines 322–323","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-350be28f8c111c1eee05","recordKey":"MD-CTRL-EU-AI-ACT-71-3-@e33680f9cc493c26","sourceRowId":"ROW-MD-7273ccb505af0966dc64","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":324,"lineEnd":329,"locator":"POLICY(5).md:lines 324–329","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-a6780714b9809c28cf3b","recordKey":"MD-CTRL-EU-AI-ACT-71-4-@4821a27b7f16337b","sourceRowId":"ROW-MD-2720d68a892b107e4ffd","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":330,"lineEnd":331,"locator":"POLICY(5).md:lines 330–331","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-7c48e676d42208223a9e","recordKey":"MD-CTRL-EU-AI-ACT-71-7-@3d02e8cd9482f5bd","sourceRowId":"ROW-MD-80cae17691f5890c0c68","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":332,"lineEnd":333,"locator":"POLICY(5).md:lines 332–333","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-9c3bb30cd59477b6f13e","recordKey":"MD-CTRL-EU-AI-ACT-71-8-@dcf40a65d12e2da2","sourceRowId":"ROW-MD-2d9f3b7931a9ea390944","sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","workbook":"POLICY(5).md","sheet":"POLICY(5).md","row":334,"lineEnd":342,"locator":"POLICY(5).md:lines 334–342","sourceSha256":"952eee7420eda0a8bdd0629f1b6d7220d92876d7818527e999303020f6e69e75"},{"id":"PRV-MD-e4ef696808c128d34d89","recordKey":"FW-FEDRAMP@7206bc418288eb24","sourceRowId":"ROW-MD-c8a4bca90d6b6dac7acb","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":1,"lineEnd":10,"locator":"POLICY(6).md:lines 1–10","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-8d72057ed8005f34e1a1","recordKey":"GUIDE-FEDRAMP-d4b1ea5708dd@d31094c30784f57d","sourceRowId":"ROW-MD-a2d6973f4316a724d34e","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":10,"lineEnd":17,"locator":"POLICY(6).md:lines 10–17","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-53543eb4125a09c76b54","recordKey":"GUIDE-FEDRAMP-51bb5216f8b9@25e68f0c2fe84d00","sourceRowId":"ROW-MD-f3bb6ea1a10d5a6fc37e","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":18,"lineEnd":60,"locator":"POLICY(6).md:lines 18–60","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-8d046b10d2c37ce2ea0f","recordKey":"GUIDE-FEDRAMP-7b5e5d2e0702@7164dd7c57b4745c","sourceRowId":"ROW-MD-32821bdb15f3ba9ec5bd","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":20,"lineEnd":46,"locator":"POLICY(6).md:lines 20–46","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-57a91219a2889f3a2f03","recordKey":"GUIDE-FEDRAMP-46d62dc73a79@5bf1de7bc74c6119","sourceRowId":"ROW-MD-78303b59bd91d53ff2fe","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":47,"lineEnd":60,"locator":"POLICY(6).md:lines 47–60","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-43351e6972ab4b936520","recordKey":"GUIDE-FEDRAMP-199c97ad51b8@b3d16adde1e130b6","sourceRowId":"ROW-MD-ce40d980f89c9c53de2c","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":61,"lineEnd":85,"locator":"POLICY(6).md:lines 61–85","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-9a8ce6462a34c1bd3400","recordKey":"GUIDE-FEDRAMP-d74e11b26a06@db2e815847981854","sourceRowId":"ROW-MD-5398e5395a61f01255f6","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":65,"lineEnd":70,"locator":"POLICY(6).md:lines 65–70","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-6b81c32575078e8e3401","recordKey":"GUIDE-FEDRAMP-bd43d0eaaa5c@f9ec0f35d486ca95","sourceRowId":"ROW-MD-1f4ac371c00caed70eb6","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":71,"lineEnd":77,"locator":"POLICY(6).md:lines 71–77","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-0dc4751e942682d4b6fc","recordKey":"GUIDE-FEDRAMP-ce50169f05da@00aec29ece1369b0","sourceRowId":"ROW-MD-a61222afaea1a6b92e75","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":78,"lineEnd":85,"locator":"POLICY(6).md:lines 78–85","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-7267f7b72501f9df4750","recordKey":"GUIDE-FEDRAMP-fbbaed9d1fde@85c6285bd6d071d0","sourceRowId":"ROW-MD-b920ee2206331384abd5","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":86,"lineEnd":127,"locator":"POLICY(6).md:lines 86–127","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-7252e60fd8b2a73fc09c","recordKey":"GUIDE-FEDRAMP-6a88a9389a37@3fae9544f28a6763","sourceRowId":"ROW-MD-6c160e20faf743a30e05","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":88,"lineEnd":96,"locator":"POLICY(6).md:lines 88–96","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-2e17a6cd1c85c9c48aa1","recordKey":"GUIDE-FEDRAMP-ce67e8b0224b@532339e68f110f40","sourceRowId":"ROW-MD-60f8fe75aa0fcb8338ea","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":97,"lineEnd":117,"locator":"POLICY(6).md:lines 97–117","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-c3f2934d94d3f1de995e","recordKey":"GUIDE-FEDRAMP-bfbc4e114dd3@f713ac52913cd56a","sourceRowId":"ROW-MD-f765dd95c065b5293c25","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":118,"lineEnd":127,"locator":"POLICY(6).md:lines 118–127","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-1729fc9ea4486b89ebca","recordKey":"GUIDE-FEDRAMP-f2ff23fc6f9f@99ecd0ee7e0dfd7a","sourceRowId":"ROW-MD-447595ab60b80f792ca8","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":128,"lineEnd":165,"locator":"POLICY(6).md:lines 128–165","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-2d618357260d65a38969","recordKey":"GUIDE-FEDRAMP-258910ac2424@a2350d73e009ceed","sourceRowId":"ROW-MD-b1ca864c01565a79230d","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":130,"lineEnd":134,"locator":"POLICY(6).md:lines 130–134","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-e3fad1bf3f578a95816d","recordKey":"GUIDE-FEDRAMP-8bbe6f991c6c@aaa1e49cb2d68ecf","sourceRowId":"ROW-MD-2f00585a6ed7dfa9a599","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":135,"lineEnd":151,"locator":"POLICY(6).md:lines 135–151","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-43a09b460b15b9a6841d","recordKey":"GUIDE-FEDRAMP-666405d246b7@5c2f524a4ccebd9a","sourceRowId":"ROW-MD-f609e83c7fd25fb6b53e","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":152,"lineEnd":156,"locator":"POLICY(6).md:lines 152–156","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-e8200943bf3960101b41","recordKey":"GUIDE-FEDRAMP-5f92b85aa101@c12c653121b33be0","sourceRowId":"ROW-MD-dda95cc32005a463fd52","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":157,"lineEnd":165,"locator":"POLICY(6).md:lines 157–165","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-d2cbcafb074edd0c0146","recordKey":"GUIDE-FEDRAMP-30ce4c9fff52@9e7d5e9bf16bff19","sourceRowId":"ROW-MD-5375e355adc1ea01f53e","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":166,"lineEnd":214,"locator":"POLICY(6).md:lines 166–214","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-80a01817b2ba3a948652","recordKey":"GUIDE-FEDRAMP-65c138d5509f@80dee4cb5165a40e","sourceRowId":"ROW-MD-b8649e178646e584af2e","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":168,"lineEnd":170,"locator":"POLICY(6).md:lines 168–170","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-12f666f6315ed25510a9","recordKey":"GUIDE-FEDRAMP-ca3304e28b24@3c5b0f46700bd588","sourceRowId":"ROW-MD-91936683b3fcc70d9d26","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":171,"lineEnd":214,"locator":"POLICY(6).md:lines 171–214","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-2f3deb8b2af6e072e8ec","recordKey":"GUIDE-FEDRAMP-0da62f354193@9a65fb444e7db7f3","sourceRowId":"ROW-MD-51d542eee63cc330a91a","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":215,"lineEnd":245,"locator":"POLICY(6).md:lines 215–245","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-dd5ba049d84b9f96236f","recordKey":"GUIDE-FEDRAMP-0ea4e22d9287@435bae627e795c0e","sourceRowId":"ROW-MD-2b3c9210358c7da736f3","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":217,"lineEnd":240,"locator":"POLICY(6).md:lines 217–240","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-1a5d1b27438f5f48f95d","recordKey":"GUIDE-FEDRAMP-8cbae23203cb@f2979c7e9d10cd2e","sourceRowId":"ROW-MD-398e0ec2ce2c0f22d0fb","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":241,"lineEnd":245,"locator":"POLICY(6).md:lines 241–245","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-0993476372bc69028b46","recordKey":"GUIDE-FEDRAMP-0a1a03af4b1b@b80e9b6053a27fae","sourceRowId":"ROW-MD-d2a309f5276566b8b044","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":246,"lineEnd":287,"locator":"POLICY(6).md:lines 246–287","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-bdd8ead421a7aa3c90f7","recordKey":"GUIDE-FEDRAMP-69824d3b0e70@47fbdd9fc7f4ac13","sourceRowId":"ROW-MD-feac68c8220072ed0ea5","sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","workbook":"POLICY(6).md","sheet":"POLICY(6).md","row":288,"lineEnd":297,"locator":"POLICY(6).md:lines 288–297","sourceSha256":"6bc3eb5520724cd48439a40f1a243f5d7b34774748e0a6e08045c00711f8c478"},{"id":"PRV-MD-29f2f02eb7a81d8790c5","recordKey":"FW-ISO-42001@28241fae4a19810f","sourceRowId":"ROW-MD-245de49e2b5313bbba5f","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":1,"lineEnd":10,"locator":"POLICY(7).md:lines 1–10","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-ccf9d041269254646026","recordKey":"GUIDE-ISO-42001-7c6db84cd8c4@3bc51136634fc40e","sourceRowId":"ROW-MD-7f5c1286ceb2464f37a0","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":11,"lineEnd":31,"locator":"POLICY(7).md:lines 11–31","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-bfce254d27e02d14ebfc","recordKey":"GUIDE-ISO-42001-ae397bc490c1@ad752048ff465c99","sourceRowId":"ROW-MD-246cdcdddb59aa446c23","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":32,"lineEnd":67,"locator":"POLICY(7).md:lines 32–67","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-16f8592cbf6ea1322628","recordKey":"GUIDE-ISO-42001-aacb45a1ed8d@08bb02aa48f4bfa1","sourceRowId":"ROW-MD-ab72fcbb79ea4437d7f3","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":68,"lineEnd":377,"locator":"POLICY(7).md:lines 68–377","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-d975503014eeafe7cac3","recordKey":"GUIDE-ISO-42001-b566bba7e495@845777a1cabdfb1b","sourceRowId":"ROW-MD-120b496e79efcb065c2e","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":70,"lineEnd":76,"locator":"POLICY(7).md:lines 70–76","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-a81651a30f1d54fc336c","recordKey":"GUIDE-ISO-42001-dc7d7769da1f@a22eed717505324b","sourceRowId":"ROW-MD-0a161827ca3090f6caea","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":77,"lineEnd":81,"locator":"POLICY(7).md:lines 77–81","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-9dde3db8a6a1a2360fe8","recordKey":"GUIDE-ISO-42001-886ce3b1e993@20116caad1ed39cc","sourceRowId":"ROW-MD-b61b1d3d706da47c7a39","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":82,"lineEnd":91,"locator":"POLICY(7).md:lines 82–91","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-12b480e0c244de34cc33","recordKey":"GUIDE-ISO-42001-793ac9ae7a5d@5d272a101bfbff2a","sourceRowId":"ROW-MD-0b148a00f959b399e896","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":92,"lineEnd":125,"locator":"POLICY(7).md:lines 92–125","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-0e333451d635d43e6ea9","recordKey":"GUIDE-ISO-42001-1ecb53ae5b83@4029dba246be29b6","sourceRowId":"ROW-MD-0ffd1344de87b5830292","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":126,"lineEnd":167,"locator":"POLICY(7).md:lines 126–167","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-84f23f1c99cb4862b095","recordKey":"GUIDE-ISO-42001-2a80864131f4@99f20bd4d6648ffe","sourceRowId":"ROW-MD-4b8793d50f1197053f04","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":168,"lineEnd":218,"locator":"POLICY(7).md:lines 168–218","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-cc52018e3822b37e1cf8","recordKey":"GUIDE-ISO-42001-a582b0e42e13@a7708ac51cba506a","sourceRowId":"ROW-MD-708080018d967de7a798","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":219,"lineEnd":269,"locator":"POLICY(7).md:lines 219–269","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-d2786618c728fe0895b4","recordKey":"GUIDE-ISO-42001-c5f57ff9b66e@e6527fa9a54ceec3","sourceRowId":"ROW-MD-2ecccd65b3d46c08f5f0","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":270,"lineEnd":317,"locator":"POLICY(7).md:lines 270–317","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-ddf19ea683ca16c3a022","recordKey":"GUIDE-ISO-42001-39b16eac9f6e@9c0fda06dc6624d2","sourceRowId":"ROW-MD-a0a0eb733ad78b20c98d","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":318,"lineEnd":358,"locator":"POLICY(7).md:lines 318–358","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-9784ced429e508291c99","recordKey":"GUIDE-ISO-42001-c2b8d01eb4ee@d18383a7f6eb6808","sourceRowId":"ROW-MD-7ab68da1f5acbf6a66bc","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":359,"lineEnd":377,"locator":"POLICY(7).md:lines 359–377","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-227ef36e7964b3a0052c","recordKey":"GUIDE-ISO-42001-6533523f5df9@9d3caf320644bc76","sourceRowId":"ROW-MD-f12dc778e3549bf980b9","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":378,"lineEnd":450,"locator":"POLICY(7).md:lines 378–450","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-b20a11def5e3e837e359","recordKey":"GUIDE-ISO-42001-7fb0b5ed1b72@b217cd182e323200","sourceRowId":"ROW-MD-15018fbdf31006a48184","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":451,"lineEnd":477,"locator":"POLICY(7).md:lines 451–477","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-57009fbee9f5686b6f23","recordKey":"GUIDE-ISO-42001-08d209fd5b33@b5275f1b978b7287","sourceRowId":"ROW-MD-49fddac960f1d0d7d9ef","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":478,"lineEnd":497,"locator":"POLICY(7).md:lines 478–497","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-bb851028af6a9f8148c8","recordKey":"GUIDE-ISO-42001-cd71633f0fc2@6b36906c7bc77ee4","sourceRowId":"ROW-MD-02e8752f782cc61b7371","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":498,"lineEnd":526,"locator":"POLICY(7).md:lines 498–526","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-7db1269fd62ebfb2a9ef","recordKey":"GUIDE-ISO-42001-d42e3bd38d0a@38db7de90efb22ce","sourceRowId":"ROW-MD-857bfae88cbaea56433f","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":527,"lineEnd":539,"locator":"POLICY(7).md:lines 527–539","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-1f8bb7b7b93c2d2ef566","recordKey":"MD-CTRL-ISO-42001-6.1.1@60c86a4b6f52bb30","sourceRowId":"ROW-MD-41f06155c8bdbc1233ff","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":174,"lineEnd":187,"locator":"POLICY(7).md:lines 174–187","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-4941e4b1e5edd3368789","recordKey":"MD-CTRL-ISO-42001-6.1.2@f5ba6f854ea753db","sourceRowId":"ROW-MD-82787b6a2c6deb96d42a","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":188,"lineEnd":195,"locator":"POLICY(7).md:lines 188–195","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-63f8f7d6874a6266fb0b","recordKey":"MD-CTRL-ISO-42001-6.1.3@4cbac668c4e2aafb","sourceRowId":"ROW-MD-3143e810d6f8a4611dbb","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":196,"lineEnd":218,"locator":"POLICY(7).md:lines 196–218","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-24e0512094637df3a49e","recordKey":"MD-CTRL-ISO-42001-7.5.1@69707987c069fc16","sourceRowId":"ROW-MD-a61a3cc9af779ff0c2b1","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":260,"lineEnd":261,"locator":"POLICY(7).md:lines 260–261","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-f57c30bcf18cd2751dc4","recordKey":"MD-CTRL-ISO-42001-7.5.2@a71f6796e748a2e8","sourceRowId":"ROW-MD-5edb14c50680f7a171c8","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":262,"lineEnd":263,"locator":"POLICY(7).md:lines 262–263","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-06e642876b978a97c66f","recordKey":"MD-CTRL-ISO-42001-7.5.3@941f62a64cb49911","sourceRowId":"ROW-MD-0e00ff8010344f74d911","sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","workbook":"POLICY(7).md","sheet":"POLICY(7).md","row":264,"lineEnd":269,"locator":"POLICY(7).md:lines 264–269","sourceSha256":"ef8be3fea8d9b33eb033a840cd719abe7ad5f4ffd2bd3a47d2a7484a4deeed32"},{"id":"PRV-MD-e0b7687f792bf2e25919","recordKey":"FW-NIST-800-53@535a8767b33f3a33","sourceRowId":"ROW-MD-54dd39f159d73febeb7c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":1,"lineEnd":10,"locator":"POLICY(8).md:lines 1–10","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-15d7cf70ec1d7401ca60","recordKey":"GUIDE-NIST-800-53-6f01a27d6a6f@d4b53e1b497c487b","sourceRowId":"ROW-MD-1a2084eb76b606dcdf1b","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":11,"lineEnd":25,"locator":"POLICY(8).md:lines 11–25","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-be7087a253973f424e3a","recordKey":"GUIDE-NIST-800-53-731b91db998a@462c5a0bf1798039","sourceRowId":"ROW-MD-7259081c7bea64bfa581","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":26,"lineEnd":52,"locator":"POLICY(8).md:lines 26–52","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-f16bcba0b06d55373b33","recordKey":"GUIDE-NIST-800-53-b950af7c81af@c88f4ee8bb4dbfe5","sourceRowId":"ROW-MD-cc8c8a4c6e80ce35c3dc","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":53,"lineEnd":481,"locator":"POLICY(8).md:lines 53–481","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-0c32761c650c1792111e","recordKey":"GUIDE-NIST-800-53-f2bf89da1da4@d5e73ec6aab7e575","sourceRowId":"ROW-MD-2db25eb81374e2072e9f","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":57,"lineEnd":87,"locator":"POLICY(8).md:lines 57–87","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-2d7a69c9bdea562e507c","recordKey":"GUIDE-NIST-800-53-0743deca6f7b@c2f483fbc22e746b","sourceRowId":"ROW-MD-88ec8e79d3fa09b97c69","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":88,"lineEnd":131,"locator":"POLICY(8).md:lines 88–131","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-c038536e76e9bef8ccf8","recordKey":"GUIDE-NIST-800-53-d147bc7034d0@0523c2965273d51a","sourceRowId":"ROW-MD-804ee25e774f43a6a49a","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":132,"lineEnd":165,"locator":"POLICY(8).md:lines 132–165","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-3277a4836a1299953350","recordKey":"GUIDE-NIST-800-53-1f56a3a417ea@624a7e6bb1239f71","sourceRowId":"ROW-MD-3256cd4db64cdef980ea","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":166,"lineEnd":202,"locator":"POLICY(8).md:lines 166–202","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-e75d264d29865bae5cab","recordKey":"GUIDE-NIST-800-53-1331bdd740d3@a0b6978c0652b99c","sourceRowId":"ROW-MD-28f49138ee09681b842c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":203,"lineEnd":236,"locator":"POLICY(8).md:lines 203–236","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-6cd52960f526672e27db","recordKey":"GUIDE-NIST-800-53-418994068646@d2ec7e502a31b081","sourceRowId":"ROW-MD-6694149c54efc91873d7","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":237,"lineEnd":275,"locator":"POLICY(8).md:lines 237–275","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-4d51f92999caa912edf1","recordKey":"GUIDE-NIST-800-53-8203737bcad6@b194315c5584aade","sourceRowId":"ROW-MD-3fa1b5a89f50a6a85fec","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":276,"lineEnd":309,"locator":"POLICY(8).md:lines 276–309","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-2ad9d51dcaf85c7aa46f","recordKey":"GUIDE-NIST-800-53-736ea77000b8@fea1f874eab0216b","sourceRowId":"ROW-MD-b8e77ee302941c3cc0bb","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":310,"lineEnd":344,"locator":"POLICY(8).md:lines 310–344","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-61ba921e96cf656d5ab3","recordKey":"GUIDE-NIST-800-53-f1486694983a@cb6c81d2063349cf","sourceRowId":"ROW-MD-bd09b2c23cd8f2773724","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":345,"lineEnd":394,"locator":"POLICY(8).md:lines 345–394","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-6ac759f041afc0d3f5de","recordKey":"GUIDE-NIST-800-53-adb5566704f5@e729eb62a8aea3b5","sourceRowId":"ROW-MD-78f7cd24e50d6d9f2d1c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":395,"lineEnd":431,"locator":"POLICY(8).md:lines 395–431","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-c37b0faa9aa84c457a9e","recordKey":"GUIDE-NIST-800-53-9adfc07ac816@d28ae77fb99c199b","sourceRowId":"ROW-MD-9c6640c2389dbb48c27a","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":432,"lineEnd":481,"locator":"POLICY(8).md:lines 432–481","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-970ce50709e669a89423","recordKey":"GUIDE-NIST-800-53-19c4d11e2a52@9b23c0114c875da5","sourceRowId":"ROW-MD-7dc125c0619c6ed1e46c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":482,"lineEnd":517,"locator":"POLICY(8).md:lines 482–517","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-4d7d1e1aa882d63005fa","recordKey":"GUIDE-NIST-800-53-29e4be67bb64@e15901b9447103a5","sourceRowId":"ROW-MD-e37543cd2380df4f1825","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":486,"lineEnd":495,"locator":"POLICY(8).md:lines 486–495","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-0207a84dc582fc0ec0ea","recordKey":"GUIDE-NIST-800-53-739d010f67db@67d0dc1f8ee0b454","sourceRowId":"ROW-MD-1a1e991ae409f7fb05d6","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":496,"lineEnd":505,"locator":"POLICY(8).md:lines 496–505","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-7f464742c4fe04665b13","recordKey":"GUIDE-NIST-800-53-31beb12f9cd8@37949cb5e01270cd","sourceRowId":"ROW-MD-4d58a0249238f58670c5","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":506,"lineEnd":517,"locator":"POLICY(8).md:lines 506–517","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-3dc0ea39b935e04da4dc","recordKey":"GUIDE-NIST-800-53-ebbde2e3b2f5@797e5a166229d141","sourceRowId":"ROW-MD-ed82942c77fb31c41f25","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":518,"lineEnd":553,"locator":"POLICY(8).md:lines 518–553","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-7fbad4f61d46fd2ede57","recordKey":"GUIDE-NIST-800-53-2eebb65a40bd@499d3b7dcf89a257","sourceRowId":"ROW-MD-1b26174f567150d8a431","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":522,"lineEnd":529,"locator":"POLICY(8).md:lines 522–529","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-3c8ff2b86b57b287f0d7","recordKey":"GUIDE-NIST-800-53-a7525c04851c@81f099eda58e210d","sourceRowId":"ROW-MD-540d7a225a233eef14fd","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":530,"lineEnd":542,"locator":"POLICY(8).md:lines 530–542","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-4fe15c04d097a58e9a3b","recordKey":"GUIDE-NIST-800-53-bec100c5792c@8cdde3f477e5d273","sourceRowId":"ROW-MD-dd3ea32f891d00dbe5c3","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":543,"lineEnd":553,"locator":"POLICY(8).md:lines 543–553","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-aa7c6b276f66ad33dc14","recordKey":"GUIDE-NIST-800-53-e0409438abb1@a75885e36e0d7710","sourceRowId":"ROW-MD-e0151037d1c3aa759f69","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":554,"lineEnd":584,"locator":"POLICY(8).md:lines 554–584","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-15779ed016f593c9ad3a","recordKey":"GUIDE-NIST-800-53-f0a601342e91@dcec9a029ab33a57","sourceRowId":"ROW-MD-721eb03c00433563789b","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":558,"lineEnd":565,"locator":"POLICY(8).md:lines 558–565","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-4f162c84f59b1ef90316","recordKey":"GUIDE-NIST-800-53-c73acc1a14c9@6978decbe1821433","sourceRowId":"ROW-MD-f9452695f60ca7befd14","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":566,"lineEnd":578,"locator":"POLICY(8).md:lines 566–578","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-899e743e7a337ed1fead","recordKey":"GUIDE-NIST-800-53-73615bad7de2@156331b87924f9c8","sourceRowId":"ROW-MD-d2c5604133ceaf25f97d","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":579,"lineEnd":584,"locator":"POLICY(8).md:lines 579–584","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-043cea607ed947e222b8","recordKey":"GUIDE-NIST-800-53-e65249c4d2c1@7f6ba98d9cae3f50","sourceRowId":"ROW-MD-4f786c5d1d806eed1ef9","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":585,"lineEnd":602,"locator":"POLICY(8).md:lines 585–602","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-8c5e1d7eceffcab1e41b","recordKey":"MD-CTRL-NIST-800-53-AC-1@ffc5aee74d3fc65e","sourceRowId":"ROW-MD-4b043427b62ec4d17853","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":63,"lineEnd":65,"locator":"POLICY(8).md:lines 63–65","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-44c854204ad69561c32e","recordKey":"MD-CTRL-NIST-800-53-AC-2@3f85328fe1521853","sourceRowId":"ROW-MD-a4fb7d9173226c4fee2d","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":66,"lineEnd":68,"locator":"POLICY(8).md:lines 66–68","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-112ac7370ed8fb038e36","recordKey":"MD-CTRL-NIST-800-53-AC-3@87ed3ce01e96d062","sourceRowId":"ROW-MD-8fb0772540801b732bf3","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":69,"lineEnd":71,"locator":"POLICY(8).md:lines 69–71","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-c047c5ef80bba57500d2","recordKey":"MD-CTRL-NIST-800-53-AC-4@641056b3e2b83cb1","sourceRowId":"ROW-MD-8bb63cbc110bf8fde533","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":72,"lineEnd":74,"locator":"POLICY(8).md:lines 72–74","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-ed24ddc0a45394b6940d","recordKey":"MD-CTRL-NIST-800-53-AC-6@6cce771a8ebe982b","sourceRowId":"ROW-MD-e6afea7daa0b69654301","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":75,"lineEnd":77,"locator":"POLICY(8).md:lines 75–77","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-a20d2cc78867d7889fd2","recordKey":"MD-CTRL-NIST-800-53-AC-17@933a2051223687b5","sourceRowId":"ROW-MD-df985da4c94cac4284e3","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":78,"lineEnd":80,"locator":"POLICY(8).md:lines 78–80","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-00950cb827085f41fea6","recordKey":"MD-CTRL-NIST-800-53-AC-22@0d85b298668b280c","sourceRowId":"ROW-MD-fee486028be6fa9491ce","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":81,"lineEnd":87,"locator":"POLICY(8).md:lines 81–87","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-f7b7dd94929b8fc74a9d","recordKey":"MD-CTRL-NIST-800-53-AU-1@d05ac18178adc30d","sourceRowId":"ROW-MD-32f5eaf824de4f85c43b","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":94,"lineEnd":96,"locator":"POLICY(8).md:lines 94–96","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-d981d06e21c857466a2f","recordKey":"MD-CTRL-NIST-800-53-AU-2@ab193a7febc8a215","sourceRowId":"ROW-MD-e8457ba65445c8006e86","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":97,"lineEnd":106,"locator":"POLICY(8).md:lines 97–106","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-91a757d3c43c876aff52","recordKey":"MD-CTRL-NIST-800-53-AU-3@a5a2547b7300a36e","sourceRowId":"ROW-MD-8145bbd7b57371bd684c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":107,"lineEnd":109,"locator":"POLICY(8).md:lines 107–109","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-b58eed695ff357410701","recordKey":"MD-CTRL-NIST-800-53-AU-6@83cd30f14c8fa126","sourceRowId":"ROW-MD-4e40bfdcfb987ac6af14","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":110,"lineEnd":112,"locator":"POLICY(8).md:lines 110–112","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-4513febb50118f93813f","recordKey":"MD-CTRL-NIST-800-53-AU-9@fcde7a027e522d94","sourceRowId":"ROW-MD-4583fff059d94fb001dd","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":113,"lineEnd":115,"locator":"POLICY(8).md:lines 113–115","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-27084de3cc05f68cefc2","recordKey":"MD-CTRL-NIST-800-53-AU-10@08f387c8911d4d05","sourceRowId":"ROW-MD-1103e6d4f0244ebab8a4","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":116,"lineEnd":118,"locator":"POLICY(8).md:lines 116–118","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-42b516604f513c2f9c68","recordKey":"MD-CTRL-NIST-800-53-AU-11@a26d421379fb44f1","sourceRowId":"ROW-MD-7c7ae979ebe374755204","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":119,"lineEnd":121,"locator":"POLICY(8).md:lines 119–121","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-def6564ea2790fd50cb1","recordKey":"MD-CTRL-NIST-800-53-AU-12@037fdf52ec2a4527","sourceRowId":"ROW-MD-4f98f2e375b2fb5f7340","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":122,"lineEnd":124,"locator":"POLICY(8).md:lines 122–124","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-ea802bcf3f31f6e5a312","recordKey":"MD-CTRL-NIST-800-53-AU-14@5bd76e6a91f17539","sourceRowId":"ROW-MD-2abe48fc1a2ab1013ef6","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":125,"lineEnd":131,"locator":"POLICY(8).md:lines 125–131","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-56ace8e18c7c52ea100b","recordKey":"MD-CTRL-NIST-800-53-CA-1@1f09cd22b9f67243","sourceRowId":"ROW-MD-bc908e99bb9fbc8fd98c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":138,"lineEnd":140,"locator":"POLICY(8).md:lines 138–140","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-baed74b0afce52f467f7","recordKey":"MD-CTRL-NIST-800-53-CA-2@29a21d24d3f9cded","sourceRowId":"ROW-MD-bac1ba4a7154404d1af2","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":141,"lineEnd":143,"locator":"POLICY(8).md:lines 141–143","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-4229253fdc4059316b81","recordKey":"MD-CTRL-NIST-800-53-CA-3@e0d9f1d2eb445d9c","sourceRowId":"ROW-MD-9fada1482a60050f8451","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":144,"lineEnd":146,"locator":"POLICY(8).md:lines 144–146","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-1a22e262854037077f63","recordKey":"MD-CTRL-NIST-800-53-CA-5@bd5759ed9df51fc9","sourceRowId":"ROW-MD-193caeadb1b1ba9de9d0","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":147,"lineEnd":149,"locator":"POLICY(8).md:lines 147–149","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-79cd6db6b14a8b937ac0","recordKey":"MD-CTRL-NIST-800-53-CA-6@69232618983df2fe","sourceRowId":"ROW-MD-35a7f5dd00221efc8fc4","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":150,"lineEnd":152,"locator":"POLICY(8).md:lines 150–152","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-bfd4cedf6e0f61ab2bc6","recordKey":"MD-CTRL-NIST-800-53-CA-7@392ed8f13a4bfca4","sourceRowId":"ROW-MD-c77762487cdc633fffa2","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":153,"lineEnd":155,"locator":"POLICY(8).md:lines 153–155","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-e437835434c51fb6357e","recordKey":"MD-CTRL-NIST-800-53-CA-8@451236ee100f65b6","sourceRowId":"ROW-MD-34e67809e1e960018266","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":156,"lineEnd":158,"locator":"POLICY(8).md:lines 156–158","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-40db97019336402c9920","recordKey":"MD-CTRL-NIST-800-53-CA-9@c9f9401ec0608756","sourceRowId":"ROW-MD-3fe9dbdcde188a4078e9","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":159,"lineEnd":165,"locator":"POLICY(8).md:lines 159–165","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-291617ddc290e8d5c2b8","recordKey":"MD-CTRL-NIST-800-53-CM-1@bc57786ef48c3c55","sourceRowId":"ROW-MD-ddd006e9b303eeda8965","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":172,"lineEnd":174,"locator":"POLICY(8).md:lines 172–174","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-24d8f41da275e638394c","recordKey":"MD-CTRL-NIST-800-53-CM-2@6ca208a8af9d92e7","sourceRowId":"ROW-MD-0d20f755375e1b3c4c35","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":175,"lineEnd":177,"locator":"POLICY(8).md:lines 175–177","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-02bbe3c9ce74081e5298","recordKey":"MD-CTRL-NIST-800-53-CM-3@e91dda2288deb770","sourceRowId":"ROW-MD-0c1a5b68a63a512ab3e2","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":178,"lineEnd":180,"locator":"POLICY(8).md:lines 178–180","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-03a1d9238a882ef18db8","recordKey":"MD-CTRL-NIST-800-53-CM-4@d0963b8777d1594a","sourceRowId":"ROW-MD-48c26acf378f919e9c09","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":181,"lineEnd":183,"locator":"POLICY(8).md:lines 181–183","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-6c4c0207850463c9d75a","recordKey":"MD-CTRL-NIST-800-53-CM-6@63db226c32ee8b80","sourceRowId":"ROW-MD-98d3defd0c7919fc1277","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":184,"lineEnd":186,"locator":"POLICY(8).md:lines 184–186","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-2b3a66569ecd7ad62724","recordKey":"MD-CTRL-NIST-800-53-CM-7@a69c75d907ebf563","sourceRowId":"ROW-MD-44bd483b3d6f8cb7aef5","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":187,"lineEnd":189,"locator":"POLICY(8).md:lines 187–189","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-c8b016670f22585650dd","recordKey":"MD-CTRL-NIST-800-53-CM-8@1d08274a0812ff53","sourceRowId":"ROW-MD-7a48259ccd92a61b29db","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":190,"lineEnd":192,"locator":"POLICY(8).md:lines 190–192","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-44e4aa2689dd4d05db4c","recordKey":"MD-CTRL-NIST-800-53-CM-10@657eeba351ec85bb","sourceRowId":"ROW-MD-59e383bbeb9891b45d4c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":193,"lineEnd":195,"locator":"POLICY(8).md:lines 193–195","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-255bd1e08af761529114","recordKey":"MD-CTRL-NIST-800-53-CM-11@e8634afde5343f2c","sourceRowId":"ROW-MD-c4b4e6bae109f1bbb7dc","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":196,"lineEnd":202,"locator":"POLICY(8).md:lines 196–202","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-d5ae8b1e9b85580ea7f3","recordKey":"MD-CTRL-NIST-800-53-IA-1@44eec4dafeb6ab22","sourceRowId":"ROW-MD-4e59279280716715a6bb","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":209,"lineEnd":211,"locator":"POLICY(8).md:lines 209–211","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-7da54231161303d4e228","recordKey":"MD-CTRL-NIST-800-53-IA-2@4dbd18c7d07a8c02","sourceRowId":"ROW-MD-5b8515ee6f4084d91a4b","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":212,"lineEnd":214,"locator":"POLICY(8).md:lines 212–214","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-02d338d8fc5668486f86","recordKey":"MD-CTRL-NIST-800-53-IA-3@e59257ab71b137d1","sourceRowId":"ROW-MD-11ad7ff4cf2467e6c624","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":215,"lineEnd":217,"locator":"POLICY(8).md:lines 215–217","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-1091aeaac08e0d00e064","recordKey":"MD-CTRL-NIST-800-53-IA-4@5ccb98ae4773b0ae","sourceRowId":"ROW-MD-0539f55afc33b71a1559","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":218,"lineEnd":220,"locator":"POLICY(8).md:lines 218–220","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-a9fd682b6e1c9a5ceec8","recordKey":"MD-CTRL-NIST-800-53-IA-5@6912705fe10577c0","sourceRowId":"ROW-MD-ecf450dab242256a5299","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":221,"lineEnd":223,"locator":"POLICY(8).md:lines 221–223","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-32cd2c07767237373441","recordKey":"MD-CTRL-NIST-800-53-IA-8@1e9c45672f8be5e2","sourceRowId":"ROW-MD-dc8e0160fdf79a026fec","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":224,"lineEnd":226,"locator":"POLICY(8).md:lines 224–226","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-7fa4a275edb08b877421","recordKey":"MD-CTRL-NIST-800-53-IA-9@3b4a7410abb86aa0","sourceRowId":"ROW-MD-b996bf266ed762e912a7","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":227,"lineEnd":229,"locator":"POLICY(8).md:lines 227–229","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-f13ac430cd303ef5e924","recordKey":"MD-CTRL-NIST-800-53-IA-10@844b4ea2fbfe06a2","sourceRowId":"ROW-MD-affdbd1635b5e81c6bc0","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":230,"lineEnd":236,"locator":"POLICY(8).md:lines 230–236","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-750882f90ec69f4767c7","recordKey":"MD-CTRL-NIST-800-53-IR-1@dae3790d9c539d4f","sourceRowId":"ROW-MD-2824c7e8229abb6abd41","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":243,"lineEnd":245,"locator":"POLICY(8).md:lines 243–245","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-fe37f6c480a45ced4220","recordKey":"MD-CTRL-NIST-800-53-IR-2@18e62078d0aaf86e","sourceRowId":"ROW-MD-33b0a36bab828d2560ee","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":246,"lineEnd":248,"locator":"POLICY(8).md:lines 246–248","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-f59b83b44d01c3247fb0","recordKey":"MD-CTRL-NIST-800-53-IR-3@c3539103480ee029","sourceRowId":"ROW-MD-d5548d828161ec78cbb0","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":249,"lineEnd":251,"locator":"POLICY(8).md:lines 249–251","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-7ef8e37adbd3537198f6","recordKey":"MD-CTRL-NIST-800-53-IR-4@74f271e15a55d06f","sourceRowId":"ROW-MD-741fc57da92197b50859","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":252,"lineEnd":259,"locator":"POLICY(8).md:lines 252–259","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-4d9652ae905055e3d077","recordKey":"MD-CTRL-NIST-800-53-IR-5@e55da11cb54be2d6","sourceRowId":"ROW-MD-477e375dfc26da4c18ba","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":260,"lineEnd":262,"locator":"POLICY(8).md:lines 260–262","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-f178e965e847a9e0488b","recordKey":"MD-CTRL-NIST-800-53-IR-6@9e4dcdda8ecccb40","sourceRowId":"ROW-MD-dfc900db74196f2a3d82","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":263,"lineEnd":265,"locator":"POLICY(8).md:lines 263–265","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-e315c31b8cb4943ce659","recordKey":"MD-CTRL-NIST-800-53-IR-7@fa507783126d7133","sourceRowId":"ROW-MD-024624f010ec2b52f5d3","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":266,"lineEnd":268,"locator":"POLICY(8).md:lines 266–268","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-d6d58bb0b3c86cd483fe","recordKey":"MD-CTRL-NIST-800-53-IR-8@51f32f068339c089","sourceRowId":"ROW-MD-39ef5857e424a5930233","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":269,"lineEnd":275,"locator":"POLICY(8).md:lines 269–275","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-a444f33e8c32df4d6a08","recordKey":"MD-CTRL-NIST-800-53-PM-1@69750f5f0416c2fa","sourceRowId":"ROW-MD-3eeeb00968db42fd7f4f","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":282,"lineEnd":284,"locator":"POLICY(8).md:lines 282–284","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-f79d3d59a6de12dacdda","recordKey":"MD-CTRL-NIST-800-53-PM-2@795047a8cbe9fbb5","sourceRowId":"ROW-MD-a8dae4f7a2dd096e4e2c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":285,"lineEnd":287,"locator":"POLICY(8).md:lines 285–287","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-d3b12905833d95039ecf","recordKey":"MD-CTRL-NIST-800-53-PM-9@7503567857e7df87","sourceRowId":"ROW-MD-b4f4b50967e8b1361882","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":288,"lineEnd":290,"locator":"POLICY(8).md:lines 288–290","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-33955b8587a52708a7af","recordKey":"MD-CTRL-NIST-800-53-PM-10@021385ebe95aa945","sourceRowId":"ROW-MD-08a5153845f5af9bfa36","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":291,"lineEnd":293,"locator":"POLICY(8).md:lines 291–293","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-e86a6add4e611714eee7","recordKey":"MD-CTRL-NIST-800-53-PM-11@6404267950f4384c","sourceRowId":"ROW-MD-b2baed813d47abdf2d04","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":294,"lineEnd":296,"locator":"POLICY(8).md:lines 294–296","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-9afc9078576577ef60b8","recordKey":"MD-CTRL-NIST-800-53-PM-28@1535dca973c04265","sourceRowId":"ROW-MD-4b35a7eae7d1614bbfc0","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":297,"lineEnd":299,"locator":"POLICY(8).md:lines 297–299","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-1c80a85a571fcc9e6b55","recordKey":"MD-CTRL-NIST-800-53-PM-30@bd194fc8faba5a62","sourceRowId":"ROW-MD-5a60ae02e803314cd44d","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":300,"lineEnd":302,"locator":"POLICY(8).md:lines 300–302","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-c254e128558fd44b50b1","recordKey":"MD-CTRL-NIST-800-53-PM-31@8ec47a6977771a5d","sourceRowId":"ROW-MD-ba63a588abd542f9e79b","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":303,"lineEnd":309,"locator":"POLICY(8).md:lines 303–309","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-cb57ef1eaff9a2429086","recordKey":"MD-CTRL-NIST-800-53-RA-1@d702535aea729240","sourceRowId":"ROW-MD-fe41230cddb9f33cae7c","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":316,"lineEnd":318,"locator":"POLICY(8).md:lines 316–318","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-260f6e439a921249a496","recordKey":"MD-CTRL-NIST-800-53-RA-2@142900acfb09c925","sourceRowId":"ROW-MD-001fec884a55d5889bda","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":319,"lineEnd":321,"locator":"POLICY(8).md:lines 319–321","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-9b012df0065921209c29","recordKey":"MD-CTRL-NIST-800-53-RA-3@d00b852124c3dec7","sourceRowId":"ROW-MD-fecceba6f99ecc03f10a","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":322,"lineEnd":328,"locator":"POLICY(8).md:lines 322–328","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-25eaef03e41d3715b6d4","recordKey":"MD-CTRL-NIST-800-53-RA-5@57426b8d738375a3","sourceRowId":"ROW-MD-4d21dc183122828e74a7","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":329,"lineEnd":331,"locator":"POLICY(8).md:lines 329–331","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-b5de6a3e2de45bd6bc23","recordKey":"MD-CTRL-NIST-800-53-RA-7@ee7ce7823a829c1c","sourceRowId":"ROW-MD-7c61cb1f650871066f07","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":332,"lineEnd":334,"locator":"POLICY(8).md:lines 332–334","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-8d62c103355bdf9c9d45","recordKey":"MD-CTRL-NIST-800-53-RA-9@70a28b2a6c497cc9","sourceRowId":"ROW-MD-4f654599e174a588bf0a","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":335,"lineEnd":337,"locator":"POLICY(8).md:lines 335–337","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-502c97a13a9dbfdfb47d","recordKey":"MD-CTRL-NIST-800-53-RA-10@eba55ec082405cec","sourceRowId":"ROW-MD-f303eecfca068c3264cc","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":338,"lineEnd":344,"locator":"POLICY(8).md:lines 338–344","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-fd905ae5af28b4ed4ad5","recordKey":"MD-CTRL-NIST-800-53-SA-1@309b07e6cc036608","sourceRowId":"ROW-MD-c22811b526b6d39ae652","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":351,"lineEnd":353,"locator":"POLICY(8).md:lines 351–353","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-873571a9f126ae5c27f2","recordKey":"MD-CTRL-NIST-800-53-SA-3@b815d0da54550870","sourceRowId":"ROW-MD-59cc334f318005693db5","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":354,"lineEnd":356,"locator":"POLICY(8).md:lines 354–356","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-ec267f972619a33a9297","recordKey":"MD-CTRL-NIST-800-53-SA-4@2089f0161299c68f","sourceRowId":"ROW-MD-a166f070ba1627c78b93","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":357,"lineEnd":366,"locator":"POLICY(8).md:lines 357–366","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-a9ecefda09e905e4ba4c","recordKey":"MD-CTRL-NIST-800-53-SA-5@e77f15a31d58575e","sourceRowId":"ROW-MD-76a4f25556e5e304a7a9","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":367,"lineEnd":369,"locator":"POLICY(8).md:lines 367–369","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-17cf883fcdf75ffbefbe","recordKey":"MD-CTRL-NIST-800-53-SA-8@2b86c88f0eecd714","sourceRowId":"ROW-MD-b0f2261ffb0bf86860a7","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":370,"lineEnd":372,"locator":"POLICY(8).md:lines 370–372","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-3f5ab023315a4445fdb6","recordKey":"MD-CTRL-NIST-800-53-SA-9@3c5e2b7020feae29","sourceRowId":"ROW-MD-90bb4a277b5b1a16bec9","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":373,"lineEnd":375,"locator":"POLICY(8).md:lines 373–375","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-8b3cf1e5789c82e46a66","recordKey":"MD-CTRL-NIST-800-53-SA-10@a4d719708b6892dc","sourceRowId":"ROW-MD-3671ff6bd2a74490a0de","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":376,"lineEnd":378,"locator":"POLICY(8).md:lines 376–378","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-3660c3c29c09fd9b4a5c","recordKey":"MD-CTRL-NIST-800-53-SA-11@12de82f7c2a7535a","sourceRowId":"ROW-MD-fa09ba1c85ef0c6ff5f7","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":379,"lineEnd":381,"locator":"POLICY(8).md:lines 379–381","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-b7c49a3eb853881d63fe","recordKey":"MD-CTRL-NIST-800-53-SA-15@cefad96f4aebe687","sourceRowId":"ROW-MD-202e486e9ddae7c4463a","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":382,"lineEnd":384,"locator":"POLICY(8).md:lines 382–384","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-2c451d8b591509012ea5","recordKey":"MD-CTRL-NIST-800-53-SA-16@db44a794b2764652","sourceRowId":"ROW-MD-5f149253c3f960f21633","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":385,"lineEnd":387,"locator":"POLICY(8).md:lines 385–387","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-aa869df0539f11d20b9d","recordKey":"MD-CTRL-NIST-800-53-SA-17@2d9b2c327e2565c2","sourceRowId":"ROW-MD-3a41165e55776b6bc37f","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":388,"lineEnd":394,"locator":"POLICY(8).md:lines 388–394","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-b9b8e94392c8a52517bb","recordKey":"MD-CTRL-NIST-800-53-SC-1@b4d57711604fb27e","sourceRowId":"ROW-MD-001d752eb42885acbaa3","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":401,"lineEnd":403,"locator":"POLICY(8).md:lines 401–403","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-ff011002dde446f433ad","recordKey":"MD-CTRL-NIST-800-53-SC-5@ce265468b83475c0","sourceRowId":"ROW-MD-601f6fc65e448cb7ca49","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":404,"lineEnd":406,"locator":"POLICY(8).md:lines 404–406","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-8294f325491ec5da740e","recordKey":"MD-CTRL-NIST-800-53-SC-7@d10fc1ec31afd8d6","sourceRowId":"ROW-MD-c46c39a9c53e6b1eac61","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":407,"lineEnd":409,"locator":"POLICY(8).md:lines 407–409","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-163ac042a8e40683265c","recordKey":"MD-CTRL-NIST-800-53-SC-8@7b948b208b7abf07","sourceRowId":"ROW-MD-6ddcaa95d81fd72bdcee","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":410,"lineEnd":412,"locator":"POLICY(8).md:lines 410–412","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-f45111ab06c77536a94b","recordKey":"MD-CTRL-NIST-800-53-SC-12@8dfd4e26096126e7","sourceRowId":"ROW-MD-61817e851486194372c3","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":413,"lineEnd":415,"locator":"POLICY(8).md:lines 413–415","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-f28c2e63cc7b42be70c3","recordKey":"MD-CTRL-NIST-800-53-SC-13@c27d59cc80254553","sourceRowId":"ROW-MD-030be6ff65cd50889806","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":416,"lineEnd":418,"locator":"POLICY(8).md:lines 416–418","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-48fafde3426a425098e3","recordKey":"MD-CTRL-NIST-800-53-SC-28@26a647ade2207565","sourceRowId":"ROW-MD-896722ef3d7b017f2218","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":419,"lineEnd":421,"locator":"POLICY(8).md:lines 419–421","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-d87f4acf819dd2bce021","recordKey":"MD-CTRL-NIST-800-53-SC-39@7c12ddd5379d47ac","sourceRowId":"ROW-MD-f326ccf4d5aa15794b50","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":422,"lineEnd":424,"locator":"POLICY(8).md:lines 422–424","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-84deeac6e0f167e66a1d","recordKey":"MD-CTRL-NIST-800-53-SC-45@fe95bc3ea1490562","sourceRowId":"ROW-MD-8e2546ae044ff2710c20","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":425,"lineEnd":431,"locator":"POLICY(8).md:lines 425–431","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-c8e83f2d80bfc380b1a4","recordKey":"MD-CTRL-NIST-800-53-SI-1@4ac016ff436432f1","sourceRowId":"ROW-MD-053f79b4c19abc76bfcc","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":438,"lineEnd":440,"locator":"POLICY(8).md:lines 438–440","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-aeec440ffc249b937545","recordKey":"MD-CTRL-NIST-800-53-SI-2@8334352df167f779","sourceRowId":"ROW-MD-6b2d78b86a180a307643","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":441,"lineEnd":443,"locator":"POLICY(8).md:lines 441–443","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-92ed63ee9c919b68b4a3","recordKey":"MD-CTRL-NIST-800-53-SI-3@36a9351db2e579f5","sourceRowId":"ROW-MD-447b95a6a19166638802","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":444,"lineEnd":446,"locator":"POLICY(8).md:lines 444–446","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-f9d553e4deed9f7a1cc8","recordKey":"MD-CTRL-NIST-800-53-SI-4@ef1e6b7493043f32","sourceRowId":"ROW-MD-1c85a666d700bb6b216f","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":447,"lineEnd":449,"locator":"POLICY(8).md:lines 447–449","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-217a7d4ffb13e8dcacad","recordKey":"MD-CTRL-NIST-800-53-SI-5@c971f424e49dc627","sourceRowId":"ROW-MD-c10c9ea64c15f6023dfb","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":450,"lineEnd":452,"locator":"POLICY(8).md:lines 450–452","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-96f339a69af7852ff0f8","recordKey":"MD-CTRL-NIST-800-53-SI-7@0e6f9a93a3f85800","sourceRowId":"ROW-MD-20ae12266520508f48f9","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":453,"lineEnd":459,"locator":"POLICY(8).md:lines 453–459","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-66cb35b331918000c019","recordKey":"MD-CTRL-NIST-800-53-SI-8@bc876d5de3499002","sourceRowId":"ROW-MD-0e5363bd9ace21c1280b","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":460,"lineEnd":462,"locator":"POLICY(8).md:lines 460–462","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-1fd4f1dd78ad81b33096","recordKey":"MD-CTRL-NIST-800-53-SI-10@bc113287605ea9a9","sourceRowId":"ROW-MD-b4303affb8ef442d034b","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":463,"lineEnd":465,"locator":"POLICY(8).md:lines 463–465","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-02ea076711f8fd593696","recordKey":"MD-CTRL-NIST-800-53-SI-12@795eeae5d78bd687","sourceRowId":"ROW-MD-6ab5807256b742c51594","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":466,"lineEnd":468,"locator":"POLICY(8).md:lines 466–468","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-dc32f8df32ced481b816","recordKey":"MD-CTRL-NIST-800-53-SI-14@3c584cf219106ab8","sourceRowId":"ROW-MD-16ec417fa2de8cff6bca","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":469,"lineEnd":471,"locator":"POLICY(8).md:lines 469–471","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-51660ae3e80fac2923ce","recordKey":"MD-CTRL-NIST-800-53-SI-19@95632491c2dd0957","sourceRowId":"ROW-MD-cf06ace2d60b4f0dd713","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":472,"lineEnd":474,"locator":"POLICY(8).md:lines 472–474","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-1f40b255a3566bdfdff2","recordKey":"MD-CTRL-NIST-800-53-SI-20@c8ecbf25dfb02463","sourceRowId":"ROW-MD-ee89c1949891156f78e0","sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","workbook":"POLICY(8).md","sheet":"POLICY(8).md","row":475,"lineEnd":481,"locator":"POLICY(8).md:lines 475–481","sourceSha256":"4818dbe94063b8d9178c062c689c12fbffc2dbfab47de42a78a8093c819dcb06"},{"id":"PRV-MD-11fdc1bb05b1bc054f68","recordKey":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","sourceRowId":"ROW-MD-3e61289d4a2f681935b4","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":1,"lineEnd":10,"locator":"POLICY(9).md:lines 1–10","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-26e0b3d0a381fc7e2edb","recordKey":"GUIDE-NIST-AI-RMF-7c6db84cd8c4@0e9f2bee89aa5338","sourceRowId":"ROW-MD-021aa678f6b481426fbe","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":11,"lineEnd":24,"locator":"POLICY(9).md:lines 11–24","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-c5a7a47bb1189cd65f0d","recordKey":"GUIDE-NIST-AI-RMF-dc191148229a@5bd1e394c3c18f3f","sourceRowId":"ROW-MD-a829bf4dc38c7a1f43fb","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":25,"lineEnd":36,"locator":"POLICY(9).md:lines 25–36","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-e8a7ff6658326e32279f","recordKey":"GUIDE-NIST-AI-RMF-de65ea7212a1@259f65bf14c86181","sourceRowId":"ROW-MD-01c59c3792646933a0d1","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":37,"lineEnd":64,"locator":"POLICY(9).md:lines 37–64","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-08c86769e23f128f1738","recordKey":"GUIDE-NIST-AI-RMF-d1571dca21dd@3210336c4fe6b49d","sourceRowId":"ROW-MD-9ff81da4d3af4462c60f","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":39,"lineEnd":44,"locator":"POLICY(9).md:lines 39–44","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-11535977d2c1ab5f9aca","recordKey":"GUIDE-NIST-AI-RMF-a29c7c79013c@263671feea0b9021","sourceRowId":"ROW-MD-c0928f8f92df3ca6c646","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":45,"lineEnd":50,"locator":"POLICY(9).md:lines 45–50","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-8321e78b07b4e9671ed0","recordKey":"GUIDE-NIST-AI-RMF-4f8971da28d6@1fdab7ff5532c7e9","sourceRowId":"ROW-MD-07834c1b8f97fb6019b4","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":51,"lineEnd":56,"locator":"POLICY(9).md:lines 51–56","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-b22cf35ccb7189f8baaa","recordKey":"GUIDE-NIST-AI-RMF-67bf02f03c63@b71e7ae6744b87dd","sourceRowId":"ROW-MD-54a5fd752274f3b7cc5a","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":57,"lineEnd":64,"locator":"POLICY(9).md:lines 57–64","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-2a193f9f6a00c49f789a","recordKey":"GUIDE-NIST-AI-RMF-4e4b91eb92c2@a36520d442951010","sourceRowId":"ROW-MD-4ec8bec4bb51aa4836b7","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":65,"lineEnd":321,"locator":"POLICY(9).md:lines 65–321","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-73e975e2fd0bd5647eab","recordKey":"GUIDE-NIST-AI-RMF-062eb065e58e@6c463216a74b7cf1","sourceRowId":"ROW-MD-7b656b862163cd8f8e41","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":67,"lineEnd":136,"locator":"POLICY(9).md:lines 67–136","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-8591daaf19ac164f6b64","recordKey":"GUIDE-NIST-AI-RMF-927be92340ef@f5ecae1e6f760bc7","sourceRowId":"ROW-MD-787d2743cf0dcc708d67","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":137,"lineEnd":207,"locator":"POLICY(9).md:lines 137–207","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-082a6f77dab301fc8588","recordKey":"GUIDE-NIST-AI-RMF-e4cae8eec3a7@c129fa4bb56f9cbc","sourceRowId":"ROW-MD-59c93071255208109ce7","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":208,"lineEnd":264,"locator":"POLICY(9).md:lines 208–264","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-ec3686a92e21eda882d1","recordKey":"GUIDE-NIST-AI-RMF-a919355c4e09@0591523d8c0a9635","sourceRowId":"ROW-MD-22acb400550dc2c3972b","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":265,"lineEnd":321,"locator":"POLICY(9).md:lines 265–321","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-e406f3201f6ea8bc1474","recordKey":"GUIDE-NIST-AI-RMF-e318cd54a2b7@72f29d480d06f9c3","sourceRowId":"ROW-MD-317b8884b3314e305c00","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":322,"lineEnd":364,"locator":"POLICY(9).md:lines 322–364","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-5421fc15b5fe38f90531","recordKey":"GUIDE-NIST-AI-RMF-dac8513ddd37@6b1f6e12d859d904","sourceRowId":"ROW-MD-c83090e093da550f4e03","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":324,"lineEnd":358,"locator":"POLICY(9).md:lines 324–358","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-d837386b30c8e34b9803","recordKey":"GUIDE-NIST-AI-RMF-85df6670bfba@311d05c17dd6514b","sourceRowId":"ROW-MD-1608f5be0e5b32cc30d5","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":359,"lineEnd":364,"locator":"POLICY(9).md:lines 359–364","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-e5c5c66b42229325ea35","recordKey":"GUIDE-NIST-AI-RMF-a17b86a657d5@2a0a15cf90e53939","sourceRowId":"ROW-MD-866c8c4b5b71daa5022d","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":365,"lineEnd":411,"locator":"POLICY(9).md:lines 365–411","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-5c10994f585ab35beb64","recordKey":"GUIDE-NIST-AI-RMF-04c74e63063d@61c4203de98a0df6","sourceRowId":"ROW-MD-fa86f5cd609ffba0d920","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":367,"lineEnd":377,"locator":"POLICY(9).md:lines 367–377","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-2f6a2f4b252ff15dcae3","recordKey":"GUIDE-NIST-AI-RMF-e64fca448669@04bc7d28f3ce21ff","sourceRowId":"ROW-MD-90e6003977e026dca827","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":378,"lineEnd":388,"locator":"POLICY(9).md:lines 378–388","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-674d892af588f52e8417","recordKey":"GUIDE-NIST-AI-RMF-54c30d9f2758@672e9717a620ec50","sourceRowId":"ROW-MD-3e74406bfb5f5ad3c8bf","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":389,"lineEnd":399,"locator":"POLICY(9).md:lines 389–399","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-c80ff55126ae89810675","recordKey":"GUIDE-NIST-AI-RMF-acae6214195c@e9cd01e808172860","sourceRowId":"ROW-MD-05babb0a2336fd090d25","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":400,"lineEnd":411,"locator":"POLICY(9).md:lines 400–411","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-c6ff421f21c3ce1760bc","recordKey":"GUIDE-NIST-AI-RMF-f4955f27718e@0f8e4b82e29ad23a","sourceRowId":"ROW-MD-7b56f7d01998b7dfae1e","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":412,"lineEnd":454,"locator":"POLICY(9).md:lines 412–454","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-3b42c43ab46216cd1665","recordKey":"GUIDE-NIST-AI-RMF-27ef85883347@cadbe8d331e0b436","sourceRowId":"ROW-MD-3a3a54e97d08b772cb7f","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":414,"lineEnd":423,"locator":"POLICY(9).md:lines 414–423","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-d67acce6410340807a0c","recordKey":"GUIDE-NIST-AI-RMF-40cd5d352cd9@9640d7036af8ac0b","sourceRowId":"ROW-MD-35c8ec8afeac024a7ed7","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":424,"lineEnd":433,"locator":"POLICY(9).md:lines 424–433","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-090f75c50eefc417be4a","recordKey":"GUIDE-NIST-AI-RMF-167ce49106e6@28a3786f2493069f","sourceRowId":"ROW-MD-e7504852f3c433dbfffa","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":434,"lineEnd":443,"locator":"POLICY(9).md:lines 434–443","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-b82fd0bc82239fc5e8c9","recordKey":"GUIDE-NIST-AI-RMF-bd8b35579fc3@83814a74b2ae9d80","sourceRowId":"ROW-MD-a677e8da9eeeb0f24ec6","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":444,"lineEnd":447,"locator":"POLICY(9).md:lines 444–447","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-26201cf6413188f5af06","recordKey":"GUIDE-NIST-AI-RMF-369744f54a55@6203fd0a0fc4911b","sourceRowId":"ROW-MD-65d831a9ae863fccd60f","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":448,"lineEnd":454,"locator":"POLICY(9).md:lines 448–454","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-a1d9eada456a7047bb6b","recordKey":"MD-CTRL-NIST-AI-RMF-GV-1@0de2bf71e02dd5cd","sourceRowId":"ROW-MD-4e31b79db300d683abfe","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":69,"lineEnd":70,"locator":"POLICY(9).md:lines 69–70","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-b4fa66d1b94449919405","recordKey":"MD-CTRL-NIST-AI-RMF-GV-1.1@bdbcfd71ba42be06","sourceRowId":"ROW-MD-177bdd7507a00da3c8af","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":71,"lineEnd":73,"locator":"POLICY(9).md:lines 71–73","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-c8793e52596bfd1d3c42","recordKey":"MD-CTRL-NIST-AI-RMF-GV-1.2@ab473567d15e4af5","sourceRowId":"ROW-MD-c918a1eaed5f8c55ccff","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":74,"lineEnd":76,"locator":"POLICY(9).md:lines 74–76","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-827e82c73fea48df3dcf","recordKey":"MD-CTRL-NIST-AI-RMF-GV-1.3@d22d1e83339c8c63","sourceRowId":"ROW-MD-5d3ab65281558b5939bd","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":77,"lineEnd":79,"locator":"POLICY(9).md:lines 77–79","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-e34e1b3ea5c535a92fd5","recordKey":"MD-CTRL-NIST-AI-RMF-GV-1.4@2020dd450f236171","sourceRowId":"ROW-MD-f4e383914149cfbcfdb8","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":80,"lineEnd":82,"locator":"POLICY(9).md:lines 80–82","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-0dbffb10519f978cc3b2","recordKey":"MD-CTRL-NIST-AI-RMF-GV-1.5@aaaf26ad3a8a4fd4","sourceRowId":"ROW-MD-8c9d1cb692ce9d67f515","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":83,"lineEnd":85,"locator":"POLICY(9).md:lines 83–85","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-68a776cf7a9dc9f8c7ad","recordKey":"MD-CTRL-NIST-AI-RMF-GV-1.6@be0e2e03a9219756","sourceRowId":"ROW-MD-021470f190c347ae99ad","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":86,"lineEnd":88,"locator":"POLICY(9).md:lines 86–88","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-d72adc58f4896bdac7f1","recordKey":"MD-CTRL-NIST-AI-RMF-GV-2@69f0fa0562a7bb7b","sourceRowId":"ROW-MD-171ebf4d85342840a87f","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":89,"lineEnd":90,"locator":"POLICY(9).md:lines 89–90","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-5e69a5d0b922071f3a6d","recordKey":"MD-CTRL-NIST-AI-RMF-GV-2.1@6f97ef6893eb6791","sourceRowId":"ROW-MD-e5dd501b1e5fe82d5748","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":91,"lineEnd":93,"locator":"POLICY(9).md:lines 91–93","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-aac35982991625217a3c","recordKey":"MD-CTRL-NIST-AI-RMF-GV-2.2@14c9e3dd1e7ae2d2","sourceRowId":"ROW-MD-a6c34de9758059bc1f32","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":94,"lineEnd":96,"locator":"POLICY(9).md:lines 94–96","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-e5fcd2e0d84d79035c8c","recordKey":"MD-CTRL-NIST-AI-RMF-GV-2.3@61c182f47632821e","sourceRowId":"ROW-MD-5564d90de92b8a2e402a","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":97,"lineEnd":99,"locator":"POLICY(9).md:lines 97–99","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-ec93be3b1fd6105a46ee","recordKey":"MD-CTRL-NIST-AI-RMF-GV-3@1558fb47f7cf9932","sourceRowId":"ROW-MD-03b8b151a6160ae888e4","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":100,"lineEnd":101,"locator":"POLICY(9).md:lines 100–101","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-3ad9f5876c6c6ef1e93b","recordKey":"MD-CTRL-NIST-AI-RMF-GV-3.1@91b2ef14962b8d77","sourceRowId":"ROW-MD-b982eb91741a12814bec","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":102,"lineEnd":104,"locator":"POLICY(9).md:lines 102–104","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-111ade1a5d87f33080dc","recordKey":"MD-CTRL-NIST-AI-RMF-GV-3.2@3a67f386bc577301","sourceRowId":"ROW-MD-7b7ac68e5047f6bb5c97","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":105,"lineEnd":107,"locator":"POLICY(9).md:lines 105–107","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-744203cb2a66b529f0b4","recordKey":"MD-CTRL-NIST-AI-RMF-GV-3.3@38c99ab4d4ea7203","sourceRowId":"ROW-MD-70ee7153467b9d0d8f77","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":108,"lineEnd":110,"locator":"POLICY(9).md:lines 108–110","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-4afb004eaccdfd405c5b","recordKey":"MD-CTRL-NIST-AI-RMF-GV-4@3556d8bf940083af","sourceRowId":"ROW-MD-f1f14fb3100558c99a02","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":111,"lineEnd":112,"locator":"POLICY(9).md:lines 111–112","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-118775690f7a63466125","recordKey":"MD-CTRL-NIST-AI-RMF-GV-4.1@a974cd747263f200","sourceRowId":"ROW-MD-e6310d8c79736ece3cae","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":113,"lineEnd":115,"locator":"POLICY(9).md:lines 113–115","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-64fe279a4c3378eae07f","recordKey":"MD-CTRL-NIST-AI-RMF-GV-4.2@a622ff3f078e93cf","sourceRowId":"ROW-MD-a8455722a0e98b4b2fdf","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":116,"lineEnd":118,"locator":"POLICY(9).md:lines 116–118","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-0e5221304c2feff43dc1","recordKey":"MD-CTRL-NIST-AI-RMF-GV-5@93dc995b8ff9abde","sourceRowId":"ROW-MD-763999a5c1b68a2dce43","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":119,"lineEnd":120,"locator":"POLICY(9).md:lines 119–120","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-5882a477ba2c6a2f007f","recordKey":"MD-CTRL-NIST-AI-RMF-GV-5.1@84d34fd03f15c80e","sourceRowId":"ROW-MD-8ddf0ec21ccd7aae80ca","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":121,"lineEnd":123,"locator":"POLICY(9).md:lines 121–123","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-b8b81cf7facf27dcc556","recordKey":"MD-CTRL-NIST-AI-RMF-GV-5.2@965d4067681d82b9","sourceRowId":"ROW-MD-2589d922aef35ca16195","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":124,"lineEnd":126,"locator":"POLICY(9).md:lines 124–126","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-db89a9270f66a927317b","recordKey":"MD-CTRL-NIST-AI-RMF-GV-6@a4ba43eaa1337653","sourceRowId":"ROW-MD-05b44b54908867bbf74e","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":127,"lineEnd":128,"locator":"POLICY(9).md:lines 127–128","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-906bbfa0a8e2d41f5112","recordKey":"MD-CTRL-NIST-AI-RMF-GV-6.1@7209d881fb2885bc","sourceRowId":"ROW-MD-a00df580d4203690b628","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":129,"lineEnd":131,"locator":"POLICY(9).md:lines 129–131","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-f6eca171dc471a128aeb","recordKey":"MD-CTRL-NIST-AI-RMF-GV-6.2@4c79e228b7ca2411","sourceRowId":"ROW-MD-2a88ac4934bcf1e3fbf4","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":132,"lineEnd":136,"locator":"POLICY(9).md:lines 132–136","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-17b5750c84a6de20ef64","recordKey":"MD-CTRL-NIST-AI-RMF-MP-1@46fa049af6fa11e7","sourceRowId":"ROW-MD-141a3272174e25b613e4","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":139,"lineEnd":140,"locator":"POLICY(9).md:lines 139–140","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-bcd83df2e764b481b7fa","recordKey":"MD-CTRL-NIST-AI-RMF-MP-1.1@948bbc263b6bf018","sourceRowId":"ROW-MD-08c4012662b309e53e15","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":141,"lineEnd":143,"locator":"POLICY(9).md:lines 141–143","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-907f37d20ed56c182fd2","recordKey":"MD-CTRL-NIST-AI-RMF-MP-1.2@d6c1d3bfbec54b27","sourceRowId":"ROW-MD-3824088982f7a18b7c27","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":144,"lineEnd":146,"locator":"POLICY(9).md:lines 144–146","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-7850d208f9c9e4e473d5","recordKey":"MD-CTRL-NIST-AI-RMF-MP-1.3@4dc810d10cd18048","sourceRowId":"ROW-MD-31e46f2c859975d5ac28","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":147,"lineEnd":149,"locator":"POLICY(9).md:lines 147–149","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-a404ebf754cdc744eb21","recordKey":"MD-CTRL-NIST-AI-RMF-MP-1.4@ace0923cc2ee941c","sourceRowId":"ROW-MD-a503a1b3ab39ea3e66a6","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":150,"lineEnd":152,"locator":"POLICY(9).md:lines 150–152","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-441aea6d7df936d055f0","recordKey":"MD-CTRL-NIST-AI-RMF-MP-1.5@a7ff6a88b989b09c","sourceRowId":"ROW-MD-acaddaebe97e2f82e741","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":153,"lineEnd":155,"locator":"POLICY(9).md:lines 153–155","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-400e5a1942be5d226db8","recordKey":"MD-CTRL-NIST-AI-RMF-MP-1.6@4b5819ed7019fad3","sourceRowId":"ROW-MD-f748f73f8e2f09a41b3e","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":156,"lineEnd":158,"locator":"POLICY(9).md:lines 156–158","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-defde91200e2262eb9ba","recordKey":"MD-CTRL-NIST-AI-RMF-MP-2@7ed5f2910241eb56","sourceRowId":"ROW-MD-848e120ae1c5eadbe2eb","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":159,"lineEnd":160,"locator":"POLICY(9).md:lines 159–160","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-13089edede8f8735a4f8","recordKey":"MD-CTRL-NIST-AI-RMF-MP-2.1@d4b8bcdeb93c2a5a","sourceRowId":"ROW-MD-82e32368ca32e7e0d0f6","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":161,"lineEnd":163,"locator":"POLICY(9).md:lines 161–163","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-d6783b8ec3a95ecf0d7a","recordKey":"MD-CTRL-NIST-AI-RMF-MP-2.2@7a833f69ddb44d12","sourceRowId":"ROW-MD-7a9ce958aaf36ce10606","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":164,"lineEnd":166,"locator":"POLICY(9).md:lines 164–166","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-b60592218654d0822641","recordKey":"MD-CTRL-NIST-AI-RMF-MP-2.3@2818bc1bf5b0b45e","sourceRowId":"ROW-MD-c11b0e2fb6a02bbbba85","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":167,"lineEnd":169,"locator":"POLICY(9).md:lines 167–169","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-bab554ab42b5a211b692","recordKey":"MD-CTRL-NIST-AI-RMF-MP-3@0197e7801ff1eef2","sourceRowId":"ROW-MD-216981fd25eb8f120377","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":170,"lineEnd":171,"locator":"POLICY(9).md:lines 170–171","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-fcfea2a81f4f3f72059a","recordKey":"MD-CTRL-NIST-AI-RMF-MP-3.1@d746171a4ecb38ae","sourceRowId":"ROW-MD-1a8e735258bbf92a2a4b","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":172,"lineEnd":174,"locator":"POLICY(9).md:lines 172–174","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-6edc51f8d17ef9c5c47c","recordKey":"MD-CTRL-NIST-AI-RMF-MP-3.2@9bb861a173d6c988","sourceRowId":"ROW-MD-14e15e3564e981f42b08","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":175,"lineEnd":177,"locator":"POLICY(9).md:lines 175–177","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-0f653cc3e9bc63d21cc4","recordKey":"MD-CTRL-NIST-AI-RMF-MP-3.3@164d4cf369dbdb7b","sourceRowId":"ROW-MD-ee4c9677708f642a98c1","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":178,"lineEnd":180,"locator":"POLICY(9).md:lines 178–180","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-b24b1361aa252ede7bed","recordKey":"MD-CTRL-NIST-AI-RMF-MP-4@116809592f02d31d","sourceRowId":"ROW-MD-583fc8b7920a0ae1d1e5","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":181,"lineEnd":182,"locator":"POLICY(9).md:lines 181–182","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-2bbded1ba772e6e068d3","recordKey":"MD-CTRL-NIST-AI-RMF-MP-4.1@19ef7cb4c6564ed8","sourceRowId":"ROW-MD-d6ddca35ad7fa8d2e941","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":183,"lineEnd":185,"locator":"POLICY(9).md:lines 183–185","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-aaf26e682a45526d385c","recordKey":"MD-CTRL-NIST-AI-RMF-MP-4.2@8c1931b7addc0936","sourceRowId":"ROW-MD-990a679ee17bc0a802af","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":186,"lineEnd":188,"locator":"POLICY(9).md:lines 186–188","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-bae31d933da2007a6223","recordKey":"MD-CTRL-NIST-AI-RMF-MP-5@85c46fc251a9ab85","sourceRowId":"ROW-MD-92bad368146b3d515ade","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":189,"lineEnd":190,"locator":"POLICY(9).md:lines 189–190","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-ed4f5ceadccc2873f4da","recordKey":"MD-CTRL-NIST-AI-RMF-MP-5.1@996cf16264eaf3ff","sourceRowId":"ROW-MD-39ad28f428e04b59f67a","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":191,"lineEnd":193,"locator":"POLICY(9).md:lines 191–193","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-b77f3aa3bc2df8a51059","recordKey":"MD-CTRL-NIST-AI-RMF-MP-5.2@1b0bb9682f4942e2","sourceRowId":"ROW-MD-2a8d6f1e55b3422abbb2","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":194,"lineEnd":196,"locator":"POLICY(9).md:lines 194–196","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-fcd9847d227660fe1bb7","recordKey":"MD-CTRL-NIST-AI-RMF-MP-5.3@b6c9d0c08416d3ad","sourceRowId":"ROW-MD-7635411ad8e787dd6113","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":197,"lineEnd":199,"locator":"POLICY(9).md:lines 197–199","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-adf4311f493b57b6d7ef","recordKey":"MD-CTRL-NIST-AI-RMF-MP-5.4@7121982e45e8874f","sourceRowId":"ROW-MD-cf6a0d612707fc9160ee","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":200,"lineEnd":202,"locator":"POLICY(9).md:lines 200–202","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-35204061ee3e4ba175bb","recordKey":"MD-CTRL-NIST-AI-RMF-MP-5.5@19531afae23ba3c1","sourceRowId":"ROW-MD-cbcddc5c168d37b977de","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":203,"lineEnd":207,"locator":"POLICY(9).md:lines 203–207","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-14ca40df9f182e59e72b","recordKey":"MD-CTRL-NIST-AI-RMF-MS-1@3db895bbb56b2968","sourceRowId":"ROW-MD-673782116109b494c4e2","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":210,"lineEnd":211,"locator":"POLICY(9).md:lines 210–211","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-baefa55653345d068137","recordKey":"MD-CTRL-NIST-AI-RMF-MS-1.1@a54bc54c8aa5c92e","sourceRowId":"ROW-MD-088cbb12b7bde0228c71","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":212,"lineEnd":214,"locator":"POLICY(9).md:lines 212–214","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-abd54845bf53b8e54a84","recordKey":"MD-CTRL-NIST-AI-RMF-MS-1.2@6a2f2ebcef2e6151","sourceRowId":"ROW-MD-0119b31b1e8722334425","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":215,"lineEnd":217,"locator":"POLICY(9).md:lines 215–217","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-62de69d52b8bae7e7d63","recordKey":"MD-CTRL-NIST-AI-RMF-MS-1.3@4bb2f120858c1ad3","sourceRowId":"ROW-MD-5e0e044a8140dd05544b","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":218,"lineEnd":220,"locator":"POLICY(9).md:lines 218–220","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-1ec62caa08fe61d4da0d","recordKey":"MD-CTRL-NIST-AI-RMF-MS-2@f56b66173a3f92e8","sourceRowId":"ROW-MD-2a23cd02ddae6b708a33","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":221,"lineEnd":222,"locator":"POLICY(9).md:lines 221–222","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-e71b689ff20728d61804","recordKey":"MD-CTRL-NIST-AI-RMF-MS-2.1@1d81c09bf1afde53","sourceRowId":"ROW-MD-72dc10cef1b1804134cb","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":223,"lineEnd":225,"locator":"POLICY(9).md:lines 223–225","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-67bd1776c8b306a0993d","recordKey":"MD-CTRL-NIST-AI-RMF-MS-2.2@829bb463942d1486","sourceRowId":"ROW-MD-ea9b77e42a0de216f725","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":226,"lineEnd":228,"locator":"POLICY(9).md:lines 226–228","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-29c5389babcb8cdb244b","recordKey":"MD-CTRL-NIST-AI-RMF-MS-2.3@1f93e70b9d8b4eb9","sourceRowId":"ROW-MD-919d39689b34388321c0","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":229,"lineEnd":231,"locator":"POLICY(9).md:lines 229–231","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-ed4e0c9c3a50c1c9c2e4","recordKey":"MD-CTRL-NIST-AI-RMF-MS-2.4@621355bb503e08e8","sourceRowId":"ROW-MD-e48400367b294f27e3a6","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":232,"lineEnd":234,"locator":"POLICY(9).md:lines 232–234","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-56fd9aeabe70b11febd9","recordKey":"MD-CTRL-NIST-AI-RMF-MS-2.5@9cd16c6b1ee118d7","sourceRowId":"ROW-MD-4a6e287bc097281d957c","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":235,"lineEnd":237,"locator":"POLICY(9).md:lines 235–237","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-86b5db2cd00ed58bf312","recordKey":"MD-CTRL-NIST-AI-RMF-MS-2.6@67a44d3238b92bf7","sourceRowId":"ROW-MD-eeb5173e52a4da839c68","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":238,"lineEnd":240,"locator":"POLICY(9).md:lines 238–240","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-f1742fbd903ad2647305","recordKey":"MD-CTRL-NIST-AI-RMF-MS-3@7c5dfb51d57ba7ef","sourceRowId":"ROW-MD-397159b6fc49c7468759","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":241,"lineEnd":242,"locator":"POLICY(9).md:lines 241–242","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-7991db46ee1aff7f4c5e","recordKey":"MD-CTRL-NIST-AI-RMF-MS-3.1@2ba441a6cb62d709","sourceRowId":"ROW-MD-be0780f98227c042dc01","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":243,"lineEnd":245,"locator":"POLICY(9).md:lines 243–245","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-3da45410437daf1ef44d","recordKey":"MD-CTRL-NIST-AI-RMF-MS-3.2@ad1af42485a958a4","sourceRowId":"ROW-MD-ace36b47747e84c5a577","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":246,"lineEnd":248,"locator":"POLICY(9).md:lines 246–248","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-8ad1caf72ac388e043c4","recordKey":"MD-CTRL-NIST-AI-RMF-MS-3.3@dac1b0c4325b68cc","sourceRowId":"ROW-MD-8a096612c794d33bdfe4","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":249,"lineEnd":251,"locator":"POLICY(9).md:lines 249–251","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-67ba33c3336b2637ea9b","recordKey":"MD-CTRL-NIST-AI-RMF-MS-3.4@0b8137f06e7a2949","sourceRowId":"ROW-MD-ed8dd4f418eb5d72a7a0","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":252,"lineEnd":254,"locator":"POLICY(9).md:lines 252–254","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-8f828d88941bcda776df","recordKey":"MD-CTRL-NIST-AI-RMF-MS-4@5ca3ca99c4aa3259","sourceRowId":"ROW-MD-f629e496fe3c12ddb6f2","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":255,"lineEnd":256,"locator":"POLICY(9).md:lines 255–256","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-ce83d2e58e78c587d27c","recordKey":"MD-CTRL-NIST-AI-RMF-MS-4.1@b643563d272a7c58","sourceRowId":"ROW-MD-fc762be4b889b5375ff0","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":257,"lineEnd":259,"locator":"POLICY(9).md:lines 257–259","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-a4f54a832b1a305bd6f6","recordKey":"MD-CTRL-NIST-AI-RMF-MS-4.2@555cf50a631386bb","sourceRowId":"ROW-MD-2ce2db2ec831495e5732","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":260,"lineEnd":264,"locator":"POLICY(9).md:lines 260–264","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-c21fd2fb5cd05c63f6f9","recordKey":"MD-CTRL-NIST-AI-RMF-MG-1@3d2e30ac47caad63","sourceRowId":"ROW-MD-96a51ce79a72205b8104","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":267,"lineEnd":268,"locator":"POLICY(9).md:lines 267–268","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-a9d4b9aa382169651b4c","recordKey":"MD-CTRL-NIST-AI-RMF-MG-1.1@c8fc8c5d1f8338ae","sourceRowId":"ROW-MD-e184ed513d043dc6d053","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":269,"lineEnd":271,"locator":"POLICY(9).md:lines 269–271","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-bf01c6ae023a61d945f2","recordKey":"MD-CTRL-NIST-AI-RMF-MG-1.2@4767f43db3a271de","sourceRowId":"ROW-MD-41998f04c8cbdf4d0af1","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":272,"lineEnd":274,"locator":"POLICY(9).md:lines 272–274","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-fef248094c1451256b0e","recordKey":"MD-CTRL-NIST-AI-RMF-MG-1.3@0d3757fb71970b26","sourceRowId":"ROW-MD-a8997e9c26146a1013d6","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":275,"lineEnd":277,"locator":"POLICY(9).md:lines 275–277","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-a67930cbbf8e99ecd104","recordKey":"MD-CTRL-NIST-AI-RMF-MG-2@1612f29b60ecb89e","sourceRowId":"ROW-MD-31cac3b2b69acb944887","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":278,"lineEnd":279,"locator":"POLICY(9).md:lines 278–279","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-d71547efb0a4ca9dd618","recordKey":"MD-CTRL-NIST-AI-RMF-MG-2.1@56900e8e5880f6ab","sourceRowId":"ROW-MD-f46fed402b61a1793ab9","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":280,"lineEnd":282,"locator":"POLICY(9).md:lines 280–282","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-92edcf70ddf84ff50b5e","recordKey":"MD-CTRL-NIST-AI-RMF-MG-2.2@05301d4e5281ab61","sourceRowId":"ROW-MD-94de39ecb15f49200fce","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":283,"lineEnd":285,"locator":"POLICY(9).md:lines 283–285","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-1faf728406e0a9ed3aa3","recordKey":"MD-CTRL-NIST-AI-RMF-MG-2.3@6d48f395ec619a37","sourceRowId":"ROW-MD-f9e1251f0d96dfbae4e2","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":286,"lineEnd":288,"locator":"POLICY(9).md:lines 286–288","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-085f2f6e61068ebd13d0","recordKey":"MD-CTRL-NIST-AI-RMF-MG-2.4@b934cd7280da0290","sourceRowId":"ROW-MD-360545ebdc2335ea124a","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":289,"lineEnd":291,"locator":"POLICY(9).md:lines 289–291","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-ef212aadca39a469f745","recordKey":"MD-CTRL-NIST-AI-RMF-MG-3@51ec0c06c6e0589e","sourceRowId":"ROW-MD-63caf64e931f921b1add","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":292,"lineEnd":293,"locator":"POLICY(9).md:lines 292–293","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-a1b7b281d82a8b9ced43","recordKey":"MD-CTRL-NIST-AI-RMF-MG-3.1@c848d8590de967bc","sourceRowId":"ROW-MD-8c8ee9abe89f7d93df75","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":294,"lineEnd":296,"locator":"POLICY(9).md:lines 294–296","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-092d13da3d0d0ea8aed9","recordKey":"MD-CTRL-NIST-AI-RMF-MG-3.2@c0f884a2359551c6","sourceRowId":"ROW-MD-5c183d6c10ac8b190bee","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":297,"lineEnd":299,"locator":"POLICY(9).md:lines 297–299","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-0c674508a6776143b3a8","recordKey":"MD-CTRL-NIST-AI-RMF-MG-3.3@610a85d7bb36dc41","sourceRowId":"ROW-MD-ced34cc91892b4b08444","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":300,"lineEnd":302,"locator":"POLICY(9).md:lines 300–302","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-cb77d9b2df16714a5ec2","recordKey":"MD-CTRL-NIST-AI-RMF-MG-3.4@c198b1aab695886f","sourceRowId":"ROW-MD-d4febbbdf002104c0c7d","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":303,"lineEnd":305,"locator":"POLICY(9).md:lines 303–305","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-f080f97e1dd9c28ea11d","recordKey":"MD-CTRL-NIST-AI-RMF-MG-4@c5f5cc304b06fbc9","sourceRowId":"ROW-MD-80839cc4b0565f8dde71","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":306,"lineEnd":307,"locator":"POLICY(9).md:lines 306–307","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-c47fd37431d6c80e9d2d","recordKey":"MD-CTRL-NIST-AI-RMF-MG-4.1@e3b40befb48fe092","sourceRowId":"ROW-MD-4d5cd7cbabf5ceefdce6","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":308,"lineEnd":310,"locator":"POLICY(9).md:lines 308–310","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-62cd3272a95b205f344c","recordKey":"MD-CTRL-NIST-AI-RMF-MG-4.2@7821ca590c95a3b6","sourceRowId":"ROW-MD-1317688f3a3f22a51b1f","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":311,"lineEnd":313,"locator":"POLICY(9).md:lines 311–313","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-060f1aac03fa93cd4b29","recordKey":"MD-CTRL-NIST-AI-RMF-MG-4.3@4b10893d8fcf1c84","sourceRowId":"ROW-MD-3850b6cbc7817f0de44f","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":314,"lineEnd":316,"locator":"POLICY(9).md:lines 314–316","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-9c80ecbf475f629de1d7","recordKey":"MD-CTRL-NIST-AI-RMF-MG-4.4@ef983e76a584418a","sourceRowId":"ROW-MD-ba198ca0f572efd4455a","sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","workbook":"POLICY(9).md","sheet":"POLICY(9).md","row":317,"lineEnd":321,"locator":"POLICY(9).md:lines 317–321","sourceSha256":"aca4e7485fc3b0a9e556f0ee23426fa9eeb2082f7b0e1bcac9b045860fe486a9"},{"id":"PRV-MD-2883dec0c12930dec654","recordKey":"FW-OWASP-LLM-2025@cf74d9c685ef413a","sourceRowId":"ROW-MD-1fffbe224e8fdf3e89fd","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":1,"lineEnd":10,"locator":"POLICY(10).md:lines 1–10","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-174657eb8cc01f13d4e8","recordKey":"GUIDE-OWASP-LLM-2025-d4b1ea5708dd@cd44ac29977646fd","sourceRowId":"ROW-MD-596ecabce0458b03d2bc","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":10,"lineEnd":15,"locator":"POLICY(10).md:lines 10–15","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-c099e9f5ff0e7528b452","recordKey":"GUIDE-OWASP-LLM-2025-25fa7b58c8a8@cf882bdb5202a8a5","sourceRowId":"ROW-MD-c43688e9ef0893977ad1","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":16,"lineEnd":52,"locator":"POLICY(10).md:lines 16–52","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-9d9391975d43fa90bc16","recordKey":"GUIDE-OWASP-LLM-2025-30014e32669c@a999ad4b6bf365c4","sourceRowId":"ROW-MD-ea765c1684ae13394cdc","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":18,"lineEnd":20,"locator":"POLICY(10).md:lines 18–20","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-b592a8747bc6ebb7cd23","recordKey":"GUIDE-OWASP-LLM-2025-6a0068187d05@029b6f3794e02275","sourceRowId":"ROW-MD-8138f832664c3b3c77ce","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":21,"lineEnd":27,"locator":"POLICY(10).md:lines 21–27","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-5f4e2cd53767c350a9e0","recordKey":"GUIDE-OWASP-LLM-2025-ed9bcdeffe38@099de8c76e54338f","sourceRowId":"ROW-MD-a77b0188bd65915ce5f7","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":28,"lineEnd":34,"locator":"POLICY(10).md:lines 28–34","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-b3b00dddad3bbeba04b6","recordKey":"GUIDE-OWASP-LLM-2025-ae9ad1b46138@b345118b4dd7d52b","sourceRowId":"ROW-MD-00c032ac3878e4d66e08","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":35,"lineEnd":41,"locator":"POLICY(10).md:lines 35–41","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-a4cd7396d13ed20bd881","recordKey":"GUIDE-OWASP-LLM-2025-8668f86ea2b9@9dfe8ff685d63e25","sourceRowId":"ROW-MD-f6ab7a1b6320228a3ccf","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":42,"lineEnd":44,"locator":"POLICY(10).md:lines 42–44","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-122250125bfa56ed161e","recordKey":"GUIDE-OWASP-LLM-2025-f68bab7e3905@79a457b93f0bf4bd","sourceRowId":"ROW-MD-02504f87cdd7116ef664","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":45,"lineEnd":47,"locator":"POLICY(10).md:lines 45–47","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-61ce2c6e1c7e9c191d75","recordKey":"GUIDE-OWASP-LLM-2025-3c955bf27a33@a31bfb4c6bdc407b","sourceRowId":"ROW-MD-c43ddd4b05a65ab16a4f","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":48,"lineEnd":52,"locator":"POLICY(10).md:lines 48–52","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-ee2160bde10bc11dc801","recordKey":"GUIDE-OWASP-LLM-2025-53a66f6341e1@6555f52e8452d880","sourceRowId":"ROW-MD-d510d185b3da7f4a68ff","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":53,"lineEnd":89,"locator":"POLICY(10).md:lines 53–89","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-e91452b633d057b11c10","recordKey":"GUIDE-OWASP-LLM-2025-b6f5e5a7a236@329fcac81f726bb4","sourceRowId":"ROW-MD-c4b5b41c4a53237b777d","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":55,"lineEnd":57,"locator":"POLICY(10).md:lines 55–57","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-e0fde0d138ebe9cd77b0","recordKey":"GUIDE-OWASP-LLM-2025-66eccc7d5a2e@427bd71f0b232d76","sourceRowId":"ROW-MD-7ec4b34e673752d4a5bb","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":58,"lineEnd":64,"locator":"POLICY(10).md:lines 58–64","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-40574ab7928872c84b47","recordKey":"GUIDE-OWASP-LLM-2025-06bab9e19df5@291a039c2afef20d","sourceRowId":"ROW-MD-b9f5c6cb3f7369eba43c","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":65,"lineEnd":71,"locator":"POLICY(10).md:lines 65–71","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-f818134ee0c1cb3e8b0b","recordKey":"GUIDE-OWASP-LLM-2025-b0392b89d1e5@433f7facc64c24f6","sourceRowId":"ROW-MD-b3e1543d20ba9950562f","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":72,"lineEnd":78,"locator":"POLICY(10).md:lines 72–78","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-39022cb5bf9cd32600f6","recordKey":"GUIDE-OWASP-LLM-2025-6b31f1dab462@8ba0780917311d2d","sourceRowId":"ROW-MD-e7db0a5e48700740bd93","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":79,"lineEnd":81,"locator":"POLICY(10).md:lines 79–81","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-9a8f45f9be3286dd3708","recordKey":"GUIDE-OWASP-LLM-2025-dbd0bcddf152@6a5c852556ea0206","sourceRowId":"ROW-MD-e164fbb411d4f68efa60","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":82,"lineEnd":84,"locator":"POLICY(10).md:lines 82–84","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-7e947a6e6b4665f4e5b8","recordKey":"GUIDE-OWASP-LLM-2025-df0252acd5f3@ca80c398783a4bde","sourceRowId":"ROW-MD-d53d9f267f2bb961b31f","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":85,"lineEnd":89,"locator":"POLICY(10).md:lines 85–89","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-34a1028cf50145eb7534","recordKey":"GUIDE-OWASP-LLM-2025-6f85a1a132eb@6f89618929f57d67","sourceRowId":"ROW-MD-3087cc35824223090148","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":90,"lineEnd":126,"locator":"POLICY(10).md:lines 90–126","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-20ef65338e9961856639","recordKey":"GUIDE-OWASP-LLM-2025-d1c0f03cc24d@3908b2f7213c1d8f","sourceRowId":"ROW-MD-05c958cb8fd90873abc8","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":92,"lineEnd":94,"locator":"POLICY(10).md:lines 92–94","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-d8d35390445744693c2e","recordKey":"GUIDE-OWASP-LLM-2025-3f43e0354a54@e448dff1d90ecf0d","sourceRowId":"ROW-MD-a4a7c007d1b522715349","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":95,"lineEnd":101,"locator":"POLICY(10).md:lines 95–101","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-fafcaa6fa3a16a2c8d1b","recordKey":"GUIDE-OWASP-LLM-2025-833a87566bc1@ab06e4ad60d2c83f","sourceRowId":"ROW-MD-2ecc1d454e7d7b5b3da5","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":102,"lineEnd":108,"locator":"POLICY(10).md:lines 102–108","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-376a44d09f1bd3ad2302","recordKey":"GUIDE-OWASP-LLM-2025-7706e7e9b7b6@fd1611c5b3ad9f26","sourceRowId":"ROW-MD-e8f0614bff3ac7777033","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":109,"lineEnd":115,"locator":"POLICY(10).md:lines 109–115","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-f75f0bd7dfb66b49e448","recordKey":"GUIDE-OWASP-LLM-2025-70c023247d26@ebbe7b07f906eb6d","sourceRowId":"ROW-MD-ee6f84ba67be2388564d","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":116,"lineEnd":118,"locator":"POLICY(10).md:lines 116–118","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-de54f21f4eb6fabdcfd0","recordKey":"GUIDE-OWASP-LLM-2025-71440703f4b7@fc8b9d083ab47bb0","sourceRowId":"ROW-MD-b145b33bf04745628411","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":119,"lineEnd":121,"locator":"POLICY(10).md:lines 119–121","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-9ba74176a5078c083c23","recordKey":"GUIDE-OWASP-LLM-2025-ddd044ffba36@f5b909b17365b6ca","sourceRowId":"ROW-MD-6e9403dc2fe5791991ce","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":122,"lineEnd":126,"locator":"POLICY(10).md:lines 122–126","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-f02daf94712b5ddd679d","recordKey":"GUIDE-OWASP-LLM-2025-b8b8b3821562@087f01d94c518a46","sourceRowId":"ROW-MD-7443063355b74ccd9517","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":127,"lineEnd":162,"locator":"POLICY(10).md:lines 127–162","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-f699016f4c885fd600d5","recordKey":"GUIDE-OWASP-LLM-2025-ec98e4af2fe3@d968b48094cf6c68","sourceRowId":"ROW-MD-5c8ddc8e9dcd58c5181a","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":129,"lineEnd":131,"locator":"POLICY(10).md:lines 129–131","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-51a4c8309ccc3103e140","recordKey":"GUIDE-OWASP-LLM-2025-b01dd39ee9eb@107d847e9a140a40","sourceRowId":"ROW-MD-93d1861a27f88816bc71","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":132,"lineEnd":137,"locator":"POLICY(10).md:lines 132–137","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-c1115379c1a92cf49183","recordKey":"GUIDE-OWASP-LLM-2025-9fce493a2e4e@0453f5d39db0076b","sourceRowId":"ROW-MD-a0b95924b82326fd9740","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":138,"lineEnd":144,"locator":"POLICY(10).md:lines 138–144","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-50a5df3fa63e63a1f30c","recordKey":"GUIDE-OWASP-LLM-2025-87f93fc34f39@67a0b58181f1fa98","sourceRowId":"ROW-MD-eaea333aca845d752877","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":145,"lineEnd":151,"locator":"POLICY(10).md:lines 145–151","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-30f5881fb4d9f1430c33","recordKey":"GUIDE-OWASP-LLM-2025-81d2108e2b97@6bbabbd9979771af","sourceRowId":"ROW-MD-6589842a7e5928631cbd","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":152,"lineEnd":154,"locator":"POLICY(10).md:lines 152–154","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-012517e8a25a12f2214b","recordKey":"GUIDE-OWASP-LLM-2025-fe44732a946d@9bd0d5c3ca83a12c","sourceRowId":"ROW-MD-98d59a9856255e9d3c6b","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":155,"lineEnd":157,"locator":"POLICY(10).md:lines 155–157","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-f1a5964c15f6c745d925","recordKey":"GUIDE-OWASP-LLM-2025-1e15f2a62cf2@8ff548031a0a226a","sourceRowId":"ROW-MD-da2adb70dfab2dd220c3","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":158,"lineEnd":162,"locator":"POLICY(10).md:lines 158–162","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-82c6cc3f3bc2fa3976d6","recordKey":"GUIDE-OWASP-LLM-2025-f9ac17eaac49@a9b8748b9bc6c714","sourceRowId":"ROW-MD-6cd868d7e4efdfd0ffea","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":163,"lineEnd":198,"locator":"POLICY(10).md:lines 163–198","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-93b3f5d5258cf6bcc5cb","recordKey":"GUIDE-OWASP-LLM-2025-c78216df5eac@0b951f8a52c4ad6c","sourceRowId":"ROW-MD-f7a6d44249d4266a2254","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":165,"lineEnd":167,"locator":"POLICY(10).md:lines 165–167","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-decf3bbe6745e1e8d920","recordKey":"GUIDE-OWASP-LLM-2025-d5c26cf498a7@8ed3adf0ab2c3253","sourceRowId":"ROW-MD-c5fbf32aa5cbb6a07e6e","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":168,"lineEnd":174,"locator":"POLICY(10).md:lines 168–174","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-43cdc5c56e5db2175fee","recordKey":"GUIDE-OWASP-LLM-2025-f3540baee82f@bd6ac8c6af661d50","sourceRowId":"ROW-MD-f791c89d2f742da932df","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":175,"lineEnd":180,"locator":"POLICY(10).md:lines 175–180","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-35703215ff1d2f7aabfd","recordKey":"GUIDE-OWASP-LLM-2025-157ee04104e7@15e9ae5b64736133","sourceRowId":"ROW-MD-65b5b08bcd50b1cb10d1","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":181,"lineEnd":187,"locator":"POLICY(10).md:lines 181–187","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-74e87283c40952407663","recordKey":"GUIDE-OWASP-LLM-2025-bb73c2b77831@0d1748c203c889f7","sourceRowId":"ROW-MD-3bcb46c85cfb0ceae43e","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":188,"lineEnd":190,"locator":"POLICY(10).md:lines 188–190","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-4ddf8aacb6569efe0062","recordKey":"GUIDE-OWASP-LLM-2025-3962733dc087@1f1f8deaf9fd59a4","sourceRowId":"ROW-MD-8b53ea0786c3c1c87216","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":191,"lineEnd":193,"locator":"POLICY(10).md:lines 191–193","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-126964cfcaefee543ab9","recordKey":"GUIDE-OWASP-LLM-2025-1226515d46f4@35b5a5f74c340c4e","sourceRowId":"ROW-MD-935807c4889d62f5ec93","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":194,"lineEnd":198,"locator":"POLICY(10).md:lines 194–198","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-36c2211cfdc7524bc97b","recordKey":"GUIDE-OWASP-LLM-2025-4c849547fb93@2d8a428244f449c9","sourceRowId":"ROW-MD-df47bf77ed3e1161b021","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":199,"lineEnd":233,"locator":"POLICY(10).md:lines 199–233","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-35d7093646112f5b62ed","recordKey":"GUIDE-OWASP-LLM-2025-12d7f20e97aa@fe801f8a2d7889c3","sourceRowId":"ROW-MD-46c2ed7325d97aa99695","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":201,"lineEnd":203,"locator":"POLICY(10).md:lines 201–203","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-1d9786583d96252e26ae","recordKey":"GUIDE-OWASP-LLM-2025-44dedd4b1869@0586318b52800bf9","sourceRowId":"ROW-MD-4f461162c13766da63c5","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":204,"lineEnd":209,"locator":"POLICY(10).md:lines 204–209","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-0c1f51eb35222a91a192","recordKey":"GUIDE-OWASP-LLM-2025-e4dc38dde086@08dc7672848d4a40","sourceRowId":"ROW-MD-21c9b6388410c85ad242","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":210,"lineEnd":215,"locator":"POLICY(10).md:lines 210–215","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-e15c0806669e605f3051","recordKey":"GUIDE-OWASP-LLM-2025-0b2e07fa8e29@831898f078d1b763","sourceRowId":"ROW-MD-3426706924a0f4ed4177","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":216,"lineEnd":222,"locator":"POLICY(10).md:lines 216–222","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-02e1a48497b4c3b613cd","recordKey":"GUIDE-OWASP-LLM-2025-5ccb3347058a@85fd67460a3650d7","sourceRowId":"ROW-MD-3859973906b22795b299","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":223,"lineEnd":225,"locator":"POLICY(10).md:lines 223–225","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-c2ec4961262e9d694cc9","recordKey":"GUIDE-OWASP-LLM-2025-e76e0ae7e054@f1acc931a2ccbe18","sourceRowId":"ROW-MD-e4336095233d5226d9f5","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":226,"lineEnd":228,"locator":"POLICY(10).md:lines 226–228","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-9e22bb18cbe7df2ad705","recordKey":"GUIDE-OWASP-LLM-2025-389a2eb29de7@049169f27717f2a4","sourceRowId":"ROW-MD-442f3fe4ed30038c75bc","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":229,"lineEnd":233,"locator":"POLICY(10).md:lines 229–233","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-89c1b4f1d0f5bf32ca35","recordKey":"GUIDE-OWASP-LLM-2025-07d274f56b42@170722f267b3b8ad","sourceRowId":"ROW-MD-d26a12680e2f837bc0f8","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":234,"lineEnd":268,"locator":"POLICY(10).md:lines 234–268","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-4eebf04e16ca9ed643dd","recordKey":"GUIDE-OWASP-LLM-2025-939b442560c6@99f123349d4f9da9","sourceRowId":"ROW-MD-2cced0c20f59b602d37f","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":236,"lineEnd":238,"locator":"POLICY(10).md:lines 236–238","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-a71e60508256703d03e7","recordKey":"GUIDE-OWASP-LLM-2025-eb1dc90907fb@e264c9b534ccb8c8","sourceRowId":"ROW-MD-ba0a4efb5c6a5219ebc6","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":239,"lineEnd":244,"locator":"POLICY(10).md:lines 239–244","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-ac628ea76b518f9e817b","recordKey":"GUIDE-OWASP-LLM-2025-a755af857924@fda6bb1be92157e5","sourceRowId":"ROW-MD-2c0469c361a8a74fae1d","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":245,"lineEnd":250,"locator":"POLICY(10).md:lines 245–250","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-539760807c7aef006c57","recordKey":"GUIDE-OWASP-LLM-2025-c9b02a4092b4@26fb833baba3fae2","sourceRowId":"ROW-MD-f209a42b0df6f0a80ba9","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":251,"lineEnd":257,"locator":"POLICY(10).md:lines 251–257","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-bb8cdb38af26d07fe1be","recordKey":"GUIDE-OWASP-LLM-2025-78f477d17d08@56d8b428f60f0dfe","sourceRowId":"ROW-MD-b0e592ce65871c5d78e8","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":258,"lineEnd":260,"locator":"POLICY(10).md:lines 258–260","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-e6a3a43728a2f401bd74","recordKey":"GUIDE-OWASP-LLM-2025-0d13f6c26718@8ab4954acf5d683c","sourceRowId":"ROW-MD-52f02590fe36df23dac8","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":261,"lineEnd":263,"locator":"POLICY(10).md:lines 261–263","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-8b25d30f0e147083a56a","recordKey":"GUIDE-OWASP-LLM-2025-36078fd2244a@39741edb162d20ee","sourceRowId":"ROW-MD-41b2216d7c9b0bdee073","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":264,"lineEnd":268,"locator":"POLICY(10).md:lines 264–268","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-ec83752d651b6e8bdfc1","recordKey":"GUIDE-OWASP-LLM-2025-318712d2f340@5ea94e6248985221","sourceRowId":"ROW-MD-705fd1081d624ca63dec","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":269,"lineEnd":303,"locator":"POLICY(10).md:lines 269–303","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-f7f8fcebddd9cb54baad","recordKey":"GUIDE-OWASP-LLM-2025-5ac4070bfd22@12281d88dad3c76f","sourceRowId":"ROW-MD-ea95dd45948c8957e56b","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":271,"lineEnd":273,"locator":"POLICY(10).md:lines 271–273","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-9f8fb9123e6587908c89","recordKey":"GUIDE-OWASP-LLM-2025-d688c985ff87@f21236fce59db60c","sourceRowId":"ROW-MD-1233b725f1a3994f53d2","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":274,"lineEnd":279,"locator":"POLICY(10).md:lines 274–279","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-96ea5945510f9cd8914b","recordKey":"GUIDE-OWASP-LLM-2025-47c7b15c5e00@899675ebcaa91aad","sourceRowId":"ROW-MD-ad0a1d44f2148ec1f3b2","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":280,"lineEnd":285,"locator":"POLICY(10).md:lines 280–285","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-3c988bec20ef6e096320","recordKey":"GUIDE-OWASP-LLM-2025-c30a8864d6b7@c7f10ef3b4888d45","sourceRowId":"ROW-MD-64109db54079ed2d0aee","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":286,"lineEnd":292,"locator":"POLICY(10).md:lines 286–292","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-7becb3f3e8a135ce803f","recordKey":"GUIDE-OWASP-LLM-2025-c99af8fb9b72@e8f96efc4c3fa3f9","sourceRowId":"ROW-MD-491025ca7ddd64669640","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":293,"lineEnd":295,"locator":"POLICY(10).md:lines 293–295","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-b9a2368e3708f1e314fd","recordKey":"GUIDE-OWASP-LLM-2025-d27feb93b609@464ba8fefee39f23","sourceRowId":"ROW-MD-b53d16e203ff9fb351a9","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":296,"lineEnd":298,"locator":"POLICY(10).md:lines 296–298","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-8eee5f683f8724a41884","recordKey":"GUIDE-OWASP-LLM-2025-d9c16257105d@56f7b1ab2b5a62f5","sourceRowId":"ROW-MD-cd4c30a6ae901fcd0a48","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":299,"lineEnd":303,"locator":"POLICY(10).md:lines 299–303","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-ba5c93390a47482abed7","recordKey":"GUIDE-OWASP-LLM-2025-e9fe62e9b03b@c767198a491c5a72","sourceRowId":"ROW-MD-4d60299c5c5e67a01637","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":304,"lineEnd":339,"locator":"POLICY(10).md:lines 304–339","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-17a4c99c3c0aa8ffb6a9","recordKey":"GUIDE-OWASP-LLM-2025-4971f15eae25@9513c0449c91d085","sourceRowId":"ROW-MD-d13518a0257900cc86ae","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":306,"lineEnd":308,"locator":"POLICY(10).md:lines 306–308","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-7d20aa5cc59ba5b81d04","recordKey":"GUIDE-OWASP-LLM-2025-ea404651be03@21956335e6e226f5","sourceRowId":"ROW-MD-4b110d30528f0207875f","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":309,"lineEnd":314,"locator":"POLICY(10).md:lines 309–314","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-436ca906394bb42d7626","recordKey":"GUIDE-OWASP-LLM-2025-b6d9654c7322@8400dd6f7e8be934","sourceRowId":"ROW-MD-e722c82e4f3cc18b1cd7","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":315,"lineEnd":321,"locator":"POLICY(10).md:lines 315–321","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-789c1985e2ca2f8282f8","recordKey":"GUIDE-OWASP-LLM-2025-1295be80c5ef@6dfe248c03858897","sourceRowId":"ROW-MD-41e3868cf7a18be32be5","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":322,"lineEnd":328,"locator":"POLICY(10).md:lines 322–328","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-b843480833eb90b100ca","recordKey":"GUIDE-OWASP-LLM-2025-96a223013baa@d21759c22fba7220","sourceRowId":"ROW-MD-ecde04d14371140e41eb","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":329,"lineEnd":331,"locator":"POLICY(10).md:lines 329–331","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-7bb1f72df59adfe60674","recordKey":"GUIDE-OWASP-LLM-2025-bbdd28946ee5@60caedb08e98fa32","sourceRowId":"ROW-MD-2e79c62ed015ce5c2136","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":332,"lineEnd":334,"locator":"POLICY(10).md:lines 332–334","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-641fb71d099da1cefe50","recordKey":"GUIDE-OWASP-LLM-2025-680e0fb740f6@cbb979e80f389d5d","sourceRowId":"ROW-MD-685390583072acddb703","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":335,"lineEnd":339,"locator":"POLICY(10).md:lines 335–339","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-11df60fa0367a18039b0","recordKey":"GUIDE-OWASP-LLM-2025-3d7a231766b7@28796b76df479a62","sourceRowId":"ROW-MD-ad7689e486171f46823f","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":340,"lineEnd":374,"locator":"POLICY(10).md:lines 340–374","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-8d2a228cd300496fb131","recordKey":"GUIDE-OWASP-LLM-2025-0c521534ee21@a623bd8664b932b1","sourceRowId":"ROW-MD-8e2e9b4dc5a6db699077","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":342,"lineEnd":344,"locator":"POLICY(10).md:lines 342–344","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-0a0a3a7573cca9fd93f3","recordKey":"GUIDE-OWASP-LLM-2025-8eea2c58ecbf@95513d429c113232","sourceRowId":"ROW-MD-ea4aef6f5bce0a7b8e39","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":345,"lineEnd":350,"locator":"POLICY(10).md:lines 345–350","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-951a046f1fcf52a2fff1","recordKey":"GUIDE-OWASP-LLM-2025-91aa88183e20@e342f8d7488ef5b5","sourceRowId":"ROW-MD-042a6393279cc669bc48","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":351,"lineEnd":356,"locator":"POLICY(10).md:lines 351–356","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-a6d50075f3e5d15d8ad6","recordKey":"GUIDE-OWASP-LLM-2025-bda235d59494@ee1fefa9c1071500","sourceRowId":"ROW-MD-ecbd9af1dde9be45b3dc","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":357,"lineEnd":363,"locator":"POLICY(10).md:lines 357–363","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-f97a935a03a90b571dd8","recordKey":"GUIDE-OWASP-LLM-2025-7798ca0d2dfa@2363b774d4fb43f4","sourceRowId":"ROW-MD-c045926634cde18239d2","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":364,"lineEnd":366,"locator":"POLICY(10).md:lines 364–366","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-9719c5a345becfc683a9","recordKey":"GUIDE-OWASP-LLM-2025-922edb48d46d@af4eff0667977fa6","sourceRowId":"ROW-MD-549fc8dc3feffc770d09","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":367,"lineEnd":369,"locator":"POLICY(10).md:lines 367–369","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-79580bf9f5c51266d9a1","recordKey":"GUIDE-OWASP-LLM-2025-dd1187cf221c@aa2cf0eb7a86ea0c","sourceRowId":"ROW-MD-336dda202e993752b778","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":370,"lineEnd":374,"locator":"POLICY(10).md:lines 370–374","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-7221a39cd502a0e7f472","recordKey":"GUIDE-OWASP-LLM-2025-d1b02093c29d@7aaeff2d2d37c5a1","sourceRowId":"ROW-MD-4ec71568b0fa1a91d697","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":375,"lineEnd":391,"locator":"POLICY(10).md:lines 375–391","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"},{"id":"PRV-MD-bbc2c77a1230e4fcf5bf","recordKey":"GUIDE-OWASP-LLM-2025-69824d3b0e70@f045b4e2d26280e4","sourceRowId":"ROW-MD-54413fd9f83f7a07e72c","sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","workbook":"POLICY(10).md","sheet":"POLICY(10).md","row":392,"lineEnd":398,"locator":"POLICY(10).md:lines 392–398","sourceSha256":"3d2cb13d3349744d1bf765e010c889c62bd7007a2ac2e156df14d4cafb2d18e1"}],"relationships":[{"id":"MAP-6d401f0681616c03189ce4cd","from":"AIR-4DC94000A9@1d5863420bba9e58","to":"REQ-b7d3b1830c19b99be4e4@bb7054070dea3d29","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cisa-ncsc-secure-ai-development@d0ff5974b6aa","locator":"Secure development / assets"},"fromKeys":["AIR-4DC94000A9@1d5863420bba9e58"],"toKeys":["REQ-b7d3b1830c19b99be4e4@bb7054070dea3d29"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0e29b7dafbbceeadd36ee396","from":"AIR-AB2476BBAB@130c3fac51082d54","to":"REQ-7b8a5464ca68b7ac7697@af9ea8771d10602f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cisa-ncsc-secure-ai-development@d0ff5974b6aa","locator":"Secure development / documentation"},"fromKeys":["AIR-AB2476BBAB@130c3fac51082d54"],"toKeys":["REQ-7b8a5464ca68b7ac7697@af9ea8771d10602f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1a5e58081db8a5e01cc40974","from":"AIR-DA02521292@fb0f442688ba560a","to":"REQ-e68f628ba8efbc32d295@290b9772b8ec02bc","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 7(2)"},"fromKeys":["AIR-DA02521292@fb0f442688ba560a"],"toKeys":["REQ-e68f628ba8efbc32d295@290b9772b8ec02bc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-37482ddc676581c82d9a9290","from":"AIR-4849919367@1edcc23cf35b43e4","to":"REQ-7ea00f6e94002269b690@46a5ade1d798a019","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nc-public-genai@fdb108006ef7","locator":"p.5, appropriate use, bullet 1"},"fromKeys":["AIR-4849919367@1edcc23cf35b43e4"],"toKeys":["REQ-7ea00f6e94002269b690@46a5ade1d798a019"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c1261b049a719322a663225d","from":"AIR-727F5459C2@05d7396f20ccf349","to":"REQ-a6857dfd2d9159dbdff0@938fe85b16b627a3","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"omb-m-25-22@9224fb5053c1","locator":"4(d)(ii)(E)(I)"},"fromKeys":["AIR-727F5459C2@05d7396f20ccf349"],"toKeys":["REQ-a6857dfd2d9159dbdff0@938fe85b16b627a3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-79f36c2126ff28f15272095f","from":"AIR-36FDB9AAD2@1e225e4043da0e0f","to":"REQ-ddaaa83fe3c583de4393@43129ef1bd1a8c00","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 5(1)(e)"},"fromKeys":["AIR-36FDB9AAD2@1e225e4043da0e0f"],"toKeys":["REQ-ddaaa83fe3c583de4393@43129ef1bd1a8c00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-48ebd7c312c271d7443f5384","from":"AIR-8E3444C5DD@24c0145c2464366a","to":"REQ-9a616c404019e6ec61a0@fe2c8d5f8a08d7f2","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 5(2)"},"fromKeys":["AIR-8E3444C5DD@24c0145c2464366a"],"toKeys":["REQ-9a616c404019e6ec61a0@fe2c8d5f8a08d7f2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cd8d9947577c031bcb3b457e","from":"AIR-653ED4C38B@a19421791b38bd15","to":"REQ-c12b030ab1c1af7e3f1e@97d0e51f4f2d575d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"ca-automated-decisions@025abfffca33","locator":"6.2.4"},"fromKeys":["AIR-653ED4C38B@a19421791b38bd15"],"toKeys":["REQ-c12b030ab1c1af7e3f1e@97d0e51f4f2d575d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a3e3b092404d7bf01d82658d","from":"AIR-AA8C667747@e811992389077596","to":"REQ-24868067f86e7d176fc6@1e9e21fdb3199be9","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"pa-ai-2026@f9ebb0c412ba","locator":"5.2.6.2, p.7"},"fromKeys":["AIR-AA8C667747@e811992389077596"],"toKeys":["REQ-24868067f86e7d176fc6@1e9e21fdb3199be9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f39d1e4b53703cd84b48183e","from":"AIR-ABAA5F0412@a224b4705d19abd7","to":"REQ-40fae525877779a624f5@47dafd4deca0f34c","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 10(2)(a)"},"fromKeys":["AIR-ABAA5F0412@a224b4705d19abd7"],"toKeys":["REQ-40fae525877779a624f5@47dafd4deca0f34c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a762102f873cc96100a0660b","from":"AIR-584850ADDF@237be1194f0adc35","to":"REQ-cb5b8d47812bf23bada7@017070dd9c87316a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 15(1)"},"fromKeys":["AIR-584850ADDF@237be1194f0adc35"],"toKeys":["REQ-cb5b8d47812bf23bada7@017070dd9c87316a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e105fb4aaad5c3af2d90f838","from":"AIR-0EAF27F441@f0be17c777da998d","to":"REQ-92ada46c1fb503fa8880@722fa3a24dec97af","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 10(3)"},"fromKeys":["AIR-0EAF27F441@f0be17c777da998d"],"toKeys":["REQ-92ada46c1fb503fa8880@722fa3a24dec97af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8670ab8e44f5586b49df5107","from":"AIR-2D3230CFEA@db9d6234e0c4c651","to":"REQ-39be28de097cadddc21d@16e717eaaf46e3aa","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 26(4)"},"fromKeys":["AIR-2D3230CFEA@db9d6234e0c4c651"],"toKeys":["REQ-39be28de097cadddc21d@16e717eaaf46e3aa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ca0f99e0ad9bb6f22f44933c","from":"AIR-41D9F2CC95@665332b2581266bc","to":"REQ-a4f022c3f1437d5fb2ad@097cc4e839b3ce9c","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"msu-genai-guidelines@2b6ba5512b77","locator":"Non-Permissible Uses, final paragraph"},"fromKeys":["AIR-41D9F2CC95@665332b2581266bc"],"toKeys":["REQ-a4f022c3f1437d5fb2ad@097cc4e839b3ce9c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d491894a501417d5ee6a5a14","from":"AIR-3867F71ADB@b352f8f186701b7b","to":"REQ-cac385deb46224061a35@cb8709ed5fd4ce68","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 2.12"},"fromKeys":["AIR-3867F71ADB@b352f8f186701b7b"],"toKeys":["REQ-cac385deb46224061a35@cb8709ed5fd4ce68"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-16a20b5f3adea9bffc4346b4","from":"AIR-9A5BD1A87A@0e29409bc678f694","to":"REQ-f2bf54d31f77c3a259e5@bce3e2cdcdec1335","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 53(1)(c)"},"fromKeys":["AIR-9A5BD1A87A@0e29409bc678f694"],"toKeys":["REQ-f2bf54d31f77c3a259e5@bce3e2cdcdec1335"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0d85517267bd6b29e1bc9dcc","from":"AIR-6BBD510385@c5d5a0a2782a143b","to":"REQ-31e86ebfe1689669bd88@907eccf50b45941f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 25(1)"},"fromKeys":["AIR-6BBD510385@c5d5a0a2782a143b"],"toKeys":["REQ-31e86ebfe1689669bd88@907eccf50b45941f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-545f0a634152da7880675bd5","from":"AIR-19AAD3D220@9039963c5253c129","to":"REQ-21dc284ae3b88e999715@61700a51c74faffb","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 7(4)"},"fromKeys":["AIR-19AAD3D220@9039963c5253c129"],"toKeys":["REQ-21dc284ae3b88e999715@61700a51c74faffb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-640a25ec7be7ee7792e19c9a","from":"AIR-1C31FD0739@9438a27a13e45099","to":"REQ-dc669e117a26fa10a033@fa004bbe5c530eee","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-privacy-1@1244c574bf2a","locator":"ID.IM-P3"},"fromKeys":["AIR-1C31FD0739@9438a27a13e45099"],"toKeys":["REQ-dc669e117a26fa10a033@fa004bbe5c530eee"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-46d94601ab73f0255a0bad29","from":"AIR-A0754F863D@ff197327de98039f","to":"REQ-980c8352a10bf8057860@b124d0d845b8bc48","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-privacy-1@1244c574bf2a","locator":"ID.IM-P5"},"fromKeys":["AIR-A0754F863D@ff197327de98039f"],"toKeys":["REQ-980c8352a10bf8057860@b124d0d845b8bc48"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-26f6f4685ae9d62dc85ee171","from":"AIR-32A014BA72@80809bb2d11324b7","to":"REQ-e1e763b1c986693a59be@0a02076da227c914","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-privacy-1@1244c574bf2a","locator":"ID.IM-P1"},"fromKeys":["AIR-32A014BA72@80809bb2d11324b7"],"toKeys":["REQ-e1e763b1c986693a59be@0a02076da227c914"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-48492b592c08aceef94bb099","from":"AIR-7265A37732@017a7c56129fae99","to":"REQ-0d5dcfe0e9173d9da324@209a3fbda9a26078","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-privacy-1@1244c574bf2a","locator":"ID.IM-P4"},"fromKeys":["AIR-7265A37732@017a7c56129fae99"],"toKeys":["REQ-0d5dcfe0e9173d9da324@209a3fbda9a26078"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f4a2995a2116f7a543f8f721","from":"AIR-54647B2218@04ec7c174b09443f","to":"REQ-fd275359ec250a538470@041e81073695ed14","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 35(1)"},"fromKeys":["AIR-54647B2218@04ec7c174b09443f"],"toKeys":["REQ-fd275359ec250a538470@041e81073695ed14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ec4d00eae02e6e0dde53eea9","from":"AIR-4FA53D5DDD@6bd3ff49f43409cc","to":"REQ-18021553f67c616cba69@611f0ce1e0c7ffbd","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 53(1)(d)"},"fromKeys":["AIR-4FA53D5DDD@6bd3ff49f43409cc"],"toKeys":["REQ-18021553f67c616cba69@611f0ce1e0c7ffbd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c5a90a9c3ea0be809faa0ade","from":"AIR-2ABDCD7376@06f5b6a210731a85","to":"REQ-7e6d946ac1ed8e229529@fb96ea6214fb8cdd","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 4(3)"},"fromKeys":["AIR-2ABDCD7376@06f5b6a210731a85"],"toKeys":["REQ-7e6d946ac1ed8e229529@fb96ea6214fb8cdd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6876c6ad0be0c5a4ac23247f","from":"AIR-A31D302A1B@e7538e87b5117430","to":"REQ-2dcd88856952895e0903@f841643c09946590","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"pa-ai-2026@f9ebb0c412ba","locator":"5.1.4, p.2"},"fromKeys":["AIR-A31D302A1B@e7538e87b5117430"],"toKeys":["REQ-2dcd88856952895e0903@f841643c09946590"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e42eca39cf3d1469bcea3c73","from":"AIR-B1B0E054D0@9ce679f11b6245e3","to":"REQ-b1820f781f6f9a3b7fb7@fb5d5c551fee68cd","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nc-public-genai@fdb108006ef7","locator":"p.5, data sharing, bullets 1–2"},"fromKeys":["AIR-B1B0E054D0@9ce679f11b6245e3"],"toKeys":["REQ-b1820f781f6f9a3b7fb7@fb5d5c551fee68cd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5174791bf6d0dc855927524d","from":"AIR-50088C8736@1fd711dd4abe9f75","to":"REQ-d64c20159fb10d25cf0d@bdfad88bee792f8b","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 7(1)"},"fromKeys":["AIR-50088C8736@1fd711dd4abe9f75"],"toKeys":["REQ-d64c20159fb10d25cf0d@bdfad88bee792f8b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fbeec996dccb834e7b1acd02","from":"AIR-6E435F72F8@4d22d944b760bee5","to":"REQ-c8b97f6cc2809143dfde@fecafaeececfc1c5","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nsa-cisa-secure-ai-deployment@6eacc566971b","locator":"Summary / validation"},"fromKeys":["AIR-6E435F72F8@4d22d944b760bee5"],"toKeys":["REQ-c8b97f6cc2809143dfde@fecafaeececfc1c5"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e001f1deb55680e163923c82","from":"AIR-9B67275315@16e7d7f05ae6bbb2","to":"REQ-422994066ef08134eb88@a08a421005ea2956","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 4.1"},"fromKeys":["AIR-9B67275315@16e7d7f05ae6bbb2"],"toKeys":["REQ-422994066ef08134eb88@a08a421005ea2956"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-749227101e85c06108035c31","from":"AIR-1BE3C102BD@73c7232546f1b4e9","to":"REQ-cbf3565a33b39d2ad2ae@756acbd55bf53954","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"omb-m-25-21@2965141a9c5b","locator":"4(a)(ii)"},"fromKeys":["AIR-1BE3C102BD@73c7232546f1b4e9"],"toKeys":["REQ-cbf3565a33b39d2ad2ae@756acbd55bf53954"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d50294232dde57c51d06e8ef","from":"AIR-587EDFB2DD@b8810ad503621000","to":"REQ-e17870f951e7b6b2b401@650b253670091880","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 3.2"},"fromKeys":["AIR-587EDFB2DD@b8810ad503621000"],"toKeys":["REQ-e17870f951e7b6b2b401@650b253670091880"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-695b9fc23baedde76065ac8b","from":"AIR-B4750175C0@149648d306b67ce5","to":"REQ-358238f423a0178d41b9@0a27921c00681c3a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 4.2"},"fromKeys":["AIR-B4750175C0@149648d306b67ce5"],"toKeys":["REQ-358238f423a0178d41b9@0a27921c00681c3a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f1f1aecc3dd19ec8746c36e9","from":"AIR-CFAE0A69A5@e49fa223cd0cb762","to":"REQ-36790cbc2b226390e28a@f487b4a61b9d9b4a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"omb-m-25-22@9224fb5053c1","locator":"4(d)(i)"},"fromKeys":["AIR-CFAE0A69A5@e49fa223cd0cb762"],"toKeys":["REQ-36790cbc2b226390e28a@f487b4a61b9d9b4a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2b9ecd1c7081ead350b40167","from":"AIR-33B04C2296@841ed4850964440b","to":"REQ-ccb29427b3e456f0cf81@f300f2981f9d7339","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 2.5"},"fromKeys":["AIR-33B04C2296@841ed4850964440b"],"toKeys":["REQ-ccb29427b3e456f0cf81@f300f2981f9d7339"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c5f6b145670311bdb4cd40fe","from":"AIR-F1A3CFC876@379e3e5f01416194","to":"REQ-bec4bed1b7cc111add87@2096b52819242a73","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 2.1"},"fromKeys":["AIR-F1A3CFC876@379e3e5f01416194"],"toKeys":["REQ-bec4bed1b7cc111add87@2096b52819242a73"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b6a73187b482f5ac0864883f","from":"AIR-A271230967@6c27fb177bb45d30","to":"REQ-55fd24dfbc339646a321@0ae1238ca3411c1a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 4.3"},"fromKeys":["AIR-A271230967@6c27fb177bb45d30"],"toKeys":["REQ-55fd24dfbc339646a321@0ae1238ca3411c1a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9508cc9cfa14b1ad99636eec","from":"AIR-AD7B04DC9D@04e3ca392f0df072","to":"REQ-dbde9d758ba1c53d4f0d@6fa7a9df4256b8fe","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 2.13"},"fromKeys":["AIR-AD7B04DC9D@04e3ca392f0df072"],"toKeys":["REQ-dbde9d758ba1c53d4f0d@6fa7a9df4256b8fe"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a117a3acd5d9c16e6ec375e9","from":"AIR-DFA60F69C7@34d1f2384eaff36b","to":"REQ-fbf883a316c6cf06eecf@0daa4d98bb777bc8","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 1.3"},"fromKeys":["AIR-DFA60F69C7@34d1f2384eaff36b"],"toKeys":["REQ-fbf883a316c6cf06eecf@0daa4d98bb777bc8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-583b169548e433ca4f517282","from":"AIR-E80EDA7CD6@036513630d55f1a6","to":"REQ-883c3374fc9f9bfc68f6@7b681ed2f562b41e","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 2.3"},"fromKeys":["AIR-E80EDA7CD6@036513630d55f1a6"],"toKeys":["REQ-883c3374fc9f9bfc68f6@7b681ed2f562b41e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d56ee328f9681622a4fac368","from":"AIR-95915B3947@e69e1136b78ff50b","to":"REQ-620d6ec5be6d0047d03b@c7844ca94e10c180","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 55(1)(a)"},"fromKeys":["AIR-95915B3947@e69e1136b78ff50b"],"toKeys":["REQ-620d6ec5be6d0047d03b@c7844ca94e10c180"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a2884cc59cee4ad6f70573e8","from":"AIR-1237C81D58@059fc01b368e6947","to":"REQ-5b78b3220e4c2e155620@9c3734809f9b4f0d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"ca-automated-decisions@025abfffca33","locator":"6.2.6.1"},"fromKeys":["AIR-1237C81D58@059fc01b368e6947"],"toKeys":["REQ-5b78b3220e4c2e155620@9c3734809f9b4f0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8236e51558a7bcede726aab7","from":"AIR-2EBCC14EEF@f8cd4a247e9eb702","to":"REQ-761207966dc1eaab9507@39d38bea515aedd3","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 1.1"},"fromKeys":["AIR-2EBCC14EEF@f8cd4a247e9eb702"],"toKeys":["REQ-761207966dc1eaab9507@39d38bea515aedd3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7493905c1ff2abf5fefc8e73","from":"AIR-ABF5BBD0E9@0328d6d72be161a1","to":"REQ-a47c8d074bf4147393f1@34750a73cf90c28b","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 9(7)"},"fromKeys":["AIR-ABF5BBD0E9@0328d6d72be161a1"],"toKeys":["REQ-a47c8d074bf4147393f1@34750a73cf90c28b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-25d94277c7c403ba124d592e","from":"AIR-AA1B934A14@623aa668561d8032","to":"REQ-87371ae5a63336fe0927@556fa73b36621b50","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"omb-m-26-04@8cd9a5e0e73d","locator":"Agency Actions (a)"},"fromKeys":["AIR-AA1B934A14@623aa668561d8032"],"toKeys":["REQ-87371ae5a63336fe0927@556fa73b36621b50"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-61e1a83d547c908bcc10bef6","from":"AIR-9958F2923D@5b9a621c5b466bec","to":"REQ-a59859e0c4a87606f03e@1354022f920495e5","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 2.11"},"fromKeys":["AIR-9958F2923D@5b9a621c5b466bec"],"toKeys":["REQ-a59859e0c4a87606f03e@1354022f920495e5"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-789f493bd60215434e12794a","from":"AIR-0370617F00@db2749549f56e03b","to":"REQ-82b5365cb210d545ce8a@1f6541d2eb7dc485","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 10(2)(f)"},"fromKeys":["AIR-0370617F00@db2749549f56e03b"],"toKeys":["REQ-82b5365cb210d545ce8a@1f6541d2eb7dc485"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-703e97911b29ad8299c64019","from":"AIR-50B746363D@36a623ea31f9bbda","to":"REQ-71da0e5d420636e13b13@5d80bef0ae62e1fd","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"va-ai-ea400@2e593dc57bbb","locator":"p.5, Ethical Use"},"fromKeys":["AIR-50B746363D@36a623ea31f9bbda"],"toKeys":["REQ-71da0e5d420636e13b13@5d80bef0ae62e1fd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-37229b01f72e40aeb243364f","from":"AIR-04955B1030@a3bb8bd27a5794a1","to":"REQ-9f98fb05c7d01c7d90c4@be8fa9d14fb716a9","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 3.1"},"fromKeys":["AIR-04955B1030@a3bb8bd27a5794a1"],"toKeys":["REQ-9f98fb05c7d01c7d90c4@be8fa9d14fb716a9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0a678466ab174a51fcf864b8","from":"AIR-4483D77189@872494c580e8a595","to":"REQ-95a6fff42aa80a0adece@dce58360b28bdbd7","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 4(2)"},"fromKeys":["AIR-4483D77189@872494c580e8a595"],"toKeys":["REQ-95a6fff42aa80a0adece@dce58360b28bdbd7"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5566a34edc84a0d432c54676","from":"AIR-3307E11EB9@2700a775f8da9b21","to":"REQ-23bf5e6b970948cffdef@863eb038813e1b6b","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nsa-cisa-secure-ai-deployment@6eacc566971b","locator":"Deployment architecture / boundaries"},"fromKeys":["AIR-3307E11EB9@2700a775f8da9b21"],"toKeys":["REQ-23bf5e6b970948cffdef@863eb038813e1b6b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-544dedf04f187a7fe3f51ba1","from":"AIR-8566190520@7d33916dd6f567ff","to":"REQ-3c364d7f3227affdef5c@871e26db4780821f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nsa-cisa-secure-ai-deployment@6eacc566971b","locator":"Deployment governance / threat model"},"fromKeys":["AIR-8566190520@7d33916dd6f567ff"],"toKeys":["REQ-3c364d7f3227affdef5c@871e26db4780821f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7f296921f23f6251d906ce16","from":"AIR-602BA32576@a69c70a20564200e","to":"REQ-1a6a62c557aa93951734@a21d56cd9e4f0985","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nsa-cisa-secure-ai-deployment@6eacc566971b","locator":"Summary / model weights"},"fromKeys":["AIR-602BA32576@a69c70a20564200e"],"toKeys":["REQ-1a6a62c557aa93951734@a21d56cd9e4f0985"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e4c17425ae2202be160f9c2","from":"AIR-08171EB6BD@275b6e07d9f31fe3","to":"REQ-5dbc16030f8514f1ccb6@57a92b094807f6ee","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 15(1)"},"fromKeys":["AIR-08171EB6BD@275b6e07d9f31fe3"],"toKeys":["REQ-5dbc16030f8514f1ccb6@57a92b094807f6ee"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d1261e8d8a32af088289beb2","from":"AIR-599AAF4DAB@1720a88a3cae6692","to":"REQ-99facc01668588c1d26e@4aa43448419a697f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 9"},"fromKeys":["AIR-599AAF4DAB@1720a88a3cae6692"],"toKeys":["REQ-99facc01668588c1d26e@4aa43448419a697f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-987d86979075efa9e4b72a16","from":"AIR-8B82635DEA@1d78eb894fae8a0f","to":"REQ-97adb8a6a224db055967@7c42a3576fa72bf2","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"ca-automated-decisions@025abfffca33","locator":"6.1.2"},"fromKeys":["AIR-8B82635DEA@1d78eb894fae8a0f"],"toKeys":["REQ-97adb8a6a224db055967@7c42a3576fa72bf2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5f94d28337d435340c65cfbc","from":"AIR-2C5DD821EE@53e9a115afca361b","to":"REQ-9befc4b9f29bdfc40e10@8e928e03e9c2737c","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Manage 2.2"},"fromKeys":["AIR-2C5DD821EE@53e9a115afca361b"],"toKeys":["REQ-9befc4b9f29bdfc40e10@8e928e03e9c2737c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-86f7637e8444d9e772aea82e","from":"AIR-342C0977BB@761e80b20f52373a","to":"REQ-fd9615e170a4f40b43f1@fcd2dc5b2f200c16","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 5(1)(c)"},"fromKeys":["AIR-342C0977BB@761e80b20f52373a"],"toKeys":["REQ-fd9615e170a4f40b43f1@fcd2dc5b2f200c16"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7a8382b315f19429041b8e9c","from":"AIR-AC38374E07@f4b6ff20ba87b97b","to":"REQ-f7127b76dffb2120156d@5c3b1bf2c0cd54c4","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 27(1)"},"fromKeys":["AIR-AC38374E07@f4b6ff20ba87b97b"],"toKeys":["REQ-f7127b76dffb2120156d@5c3b1bf2c0cd54c4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0f6908f853fdf16c4b553dec","from":"AIR-9E7F166E73@602687ff4895a4e9","to":"REQ-1dc235a72fc3ac90be1e@13b1a9368f890fbb","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 55(1)(b)"},"fromKeys":["AIR-9E7F166E73@602687ff4895a4e9"],"toKeys":["REQ-1dc235a72fc3ac90be1e@13b1a9368f890fbb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c38937cee9c81afb125286ae","from":"AIR-4EA78BC0D9@790ae68a9c089b79","to":"REQ-5566f52b769fb05a9808@0bd57494ca0eaae9","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 1.2"},"fromKeys":["AIR-4EA78BC0D9@790ae68a9c089b79"],"toKeys":["REQ-5566f52b769fb05a9808@0bd57494ca0eaae9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-962ef1d787a8e1dbdab7179b","from":"AIR-29043D921A@228d236f393a3d58","to":"REQ-81f5812632ddc6a12dbc@2e384664fd98c7b2","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 2.3"},"fromKeys":["AIR-29043D921A@228d236f393a3d58"],"toKeys":["REQ-81f5812632ddc6a12dbc@2e384664fd98c7b2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1067386bdc4c996e8aa6e674","from":"AIR-184958056C@a31940c1d965bcb1","to":"REQ-6aea115e40204609bd23@6663ad09bb2d2443","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 9(1)"},"fromKeys":["AIR-184958056C@a31940c1d965bcb1"],"toKeys":["REQ-6aea115e40204609bd23@6663ad09bb2d2443"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e4aa015d845e28c0f3ae2e95","from":"AIR-E7F9A07274@453678b2d8eb8b8e","to":"REQ-80639893619975229fb7@f2b6696b2e20849f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 5.1"},"fromKeys":["AIR-E7F9A07274@453678b2d8eb8b8e"],"toKeys":["REQ-80639893619975229fb7@f2b6696b2e20849f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f15cbb9d98f16aecc1ff071d","from":"AIR-3B0B09F1A3@11413c778a47cf3c","to":"REQ-b8c26d63f50b6187d3d9@f56bfdfa88166293","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 17"},"fromKeys":["AIR-3B0B09F1A3@11413c778a47cf3c"],"toKeys":["REQ-b8c26d63f50b6187d3d9@f56bfdfa88166293"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de2b44761dafd8218618cb8b","from":"AIR-F3D285541D@bc96e432e51bf4d2","to":"REQ-ff3f355c32e9e443122e@00b393b0a74394cb","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Manage 2.1"},"fromKeys":["AIR-F3D285541D@bc96e432e51bf4d2"],"toKeys":["REQ-ff3f355c32e9e443122e@00b393b0a74394cb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-166e1a079e5ab53fc099032d","from":"AIR-242001C9D0@d5bb3a8f15cc4543","to":"REQ-f017d6e5ac967df3dad5@9ad3233d634fdde6","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"msu-genai-guidelines@2b6ba5512b77","locator":"Procuring or Registering, paragraph 2"},"fromKeys":["AIR-242001C9D0@d5bb3a8f15cc4543"],"toKeys":["REQ-f017d6e5ac967df3dad5@9ad3233d634fdde6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2fee0b21193da04243bfd7f9","from":"AIR-1003DA2A0B@0300bded90f382ce","to":"REQ-f93a18bb1ab3c8736a53@6fe19328547cb66a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"omb-m-25-22@9224fb5053c1","locator":"4(e)(i)"},"fromKeys":["AIR-1003DA2A0B@0300bded90f382ce"],"toKeys":["REQ-f93a18bb1ab3c8736a53@6fe19328547cb66a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ee88989fb61adfd1c91fc86","from":"AIR-4AD720A286@fc42372987a55441","to":"REQ-fa044b36248db1b6f637@caa218387d7a2c2b","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"omb-m-25-21@2965141a9c5b","locator":"4(b)(ii)"},"fromKeys":["AIR-4AD720A286@fc42372987a55441"],"toKeys":["REQ-fa044b36248db1b6f637@caa218387d7a2c2b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2271d088de802fc4d5a71692","from":"AIR-7939E9BF07@9a167fc297fb8774","to":"REQ-a9f4db572f7db3709c7e@d335ef4c49dc0295","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"omb-m-25-21@2965141a9c5b","locator":"3(b)(v)"},"fromKeys":["AIR-7939E9BF07@9a167fc297fb8774"],"toKeys":["REQ-a9f4db572f7db3709c7e@d335ef4c49dc0295"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-01708194ef07fc9dffb7197d","from":"AIR-8EB0EC219E@b40bbbac8f211201","to":"REQ-d8473a2a44914645c0a6@3881b77d3d017300","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 3.4"},"fromKeys":["AIR-8EB0EC219E@b40bbbac8f211201"],"toKeys":["REQ-d8473a2a44914645c0a6@3881b77d3d017300"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0af1700f637767edf2d88725","from":"AIR-B098FE0267@9c690d85f3bff28c","to":"REQ-7062dfb2abfa0568c3c6@3be93e2fad23aabf","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 1.7"},"fromKeys":["AIR-B098FE0267@9c690d85f3bff28c"],"toKeys":["REQ-7062dfb2abfa0568c3c6@3be93e2fad23aabf"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-084bfdc8a78d8d7b7b234c7b","from":"AIR-E069B1B813@d0e787d52df48a64","to":"REQ-9123110ea1dc5563c2c0@d083918612e755b7","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 2.1"},"fromKeys":["AIR-E069B1B813@d0e787d52df48a64"],"toKeys":["REQ-9123110ea1dc5563c2c0@d083918612e755b7"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0fa093ff384d0c015e7eb9b9","from":"AIR-260ECC7519@acfa461478a2370b","to":"REQ-9ea1e6cfe18133c933b5@156e49fdf41528a7","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 1.4"},"fromKeys":["AIR-260ECC7519@acfa461478a2370b"],"toKeys":["REQ-9ea1e6cfe18133c933b5@156e49fdf41528a7"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-226880f5f0c1a86a7720523b","from":"AIR-1394624FB2@17b1694d9f8b5889","to":"REQ-ddfeb966305e207a46d8@a90e5850a5545900","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 1.3"},"fromKeys":["AIR-1394624FB2@17b1694d9f8b5889"],"toKeys":["REQ-ddfeb966305e207a46d8@a90e5850a5545900"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2b31be56234da9e1335e8634","from":"AIR-65283B4BFC@0734a37af474e127","to":"REQ-ba24f1554e754d2c8d56@9f7dabcbd35a090d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Manage 1.1"},"fromKeys":["AIR-65283B4BFC@0734a37af474e127"],"toKeys":["REQ-ba24f1554e754d2c8d56@9f7dabcbd35a090d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3ac4dd7c8fa6e767ce81b961","from":"AIR-1A04293BCD@0d554e062cff5e8e","to":"REQ-3ca339132cc9b03fcff4@fa7ea245ab1f2992","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"msu-genai-guidelines@2b6ba5512b77","locator":"Teaching and Learning, detection paragraph"},"fromKeys":["AIR-1A04293BCD@0d554e062cff5e8e"],"toKeys":["REQ-3ca339132cc9b03fcff4@fa7ea245ab1f2992"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-88d43b3db40b69cb15e1b19f","from":"AIR-604F1B8C71@46ee19ff4fd8682a","to":"REQ-03176ecf6566459f379c@97dc9a980a45e36f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nc-public-genai@fdb108006ef7","locator":"p.5, appropriate use, bullet 2"},"fromKeys":["AIR-604F1B8C71@46ee19ff4fd8682a"],"toKeys":["REQ-03176ecf6566459f379c@97dc9a980a45e36f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-90f56f30119c505da07ed3af","from":"AIR-6A21A315BB@d5897846efcefb70","to":"REQ-22983301e6c9273a60e6@c927cc0480336e6c","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 2.3"},"fromKeys":["AIR-6A21A315BB@d5897846efcefb70"],"toKeys":["REQ-22983301e6c9273a60e6@c927cc0480336e6c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-16e75ae74b72b2f15ee2e33b","from":"AIR-7B1A838FFF@e020695aeaedbd45","to":"REQ-04fecf9f342191797c85@f337eac9040d6493","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 2.2"},"fromKeys":["AIR-7B1A838FFF@e020695aeaedbd45"],"toKeys":["REQ-04fecf9f342191797c85@f337eac9040d6493"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ab2bf2e12684cec2a2cbb581","from":"AIR-9EE4AB873B@619363766d1fff2c","to":"REQ-b453067b2286002fe358@ed97c41ec108e32d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 1.5"},"fromKeys":["AIR-9EE4AB873B@619363766d1fff2c"],"toKeys":["REQ-b453067b2286002fe358@ed97c41ec108e32d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4d13e03d896162a764001013","from":"AIR-8822957DD8@04ee6dbcff4c4b33","to":"REQ-cd259338cb0ad4131831@60fddfc2c31532db","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 2.1"},"fromKeys":["AIR-8822957DD8@04ee6dbcff4c4b33"],"toKeys":["REQ-cd259338cb0ad4131831@60fddfc2c31532db"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0f95a674d58299da56155871","from":"AIR-E477C3290A@a1d566c6c34de5c9","to":"REQ-c8f8795f03e451c41169@7963bb19d2bd5215","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 4.2"},"fromKeys":["AIR-E477C3290A@a1d566c6c34de5c9"],"toKeys":["REQ-c8f8795f03e451c41169@7963bb19d2bd5215"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-304bc2ae17b479cf0b9fb12d","from":"AIR-5C041B0CCA@7ea28a695e4aad1a","to":"REQ-76d5c155839d60609d4e@de9fa50f8c8efeaa","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 1.1"},"fromKeys":["AIR-5C041B0CCA@7ea28a695e4aad1a"],"toKeys":["REQ-76d5c155839d60609d4e@de9fa50f8c8efeaa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-60ee848ca12b6f2fe516e9ac","from":"AIR-F61F6AC2CB@56d05301885c6e58","to":"REQ-aec30342b786871fccc0@9d8d629bcd7582c1","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 1.1"},"fromKeys":["AIR-F61F6AC2CB@56d05301885c6e58"],"toKeys":["REQ-aec30342b786871fccc0@9d8d629bcd7582c1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dbdc18cd76ba9d19d8c5a2cb","from":"AIR-AC404254CF@fdd21907e0626ce6","to":"REQ-f3f1ac33ee118f95ea90@8622e366e77e7b05","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 4.2"},"fromKeys":["AIR-AC404254CF@fdd21907e0626ce6"],"toKeys":["REQ-f3f1ac33ee118f95ea90@8622e366e77e7b05"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-50ea26f6fb96bffe465e43c0","from":"AIR-98C41762F1@537bb60241a02d70","to":"REQ-8e507e6a09c46f1cec03@aa2d98621f83ee92","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Manage 1.4"},"fromKeys":["AIR-98C41762F1@537bb60241a02d70"],"toKeys":["REQ-8e507e6a09c46f1cec03@aa2d98621f83ee92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-99312b72f5c4ce1e2bb8dc86","from":"AIR-692200D867@2cf95dc9e58cedd1","to":"REQ-02950f8c52a65032e88d@d8b679bfd274ca7c","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 1.3"},"fromKeys":["AIR-692200D867@2cf95dc9e58cedd1"],"toKeys":["REQ-02950f8c52a65032e88d@d8b679bfd274ca7c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5b6c2302af65df0085984492","from":"AIR-4306CEE8C8@b0544a675ee7f8b8","to":"REQ-b0396ad7b4cee26e6b98@f9c9b8f654dd1293","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 3.1"},"fromKeys":["AIR-4306CEE8C8@b0544a675ee7f8b8"],"toKeys":["REQ-b0396ad7b4cee26e6b98@f9c9b8f654dd1293"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cb421c28c6feeb69caed3222","from":"AIR-DD41393A6A@130e2fc97601e5c6","to":"REQ-847e46792ed17f616fe6@399fbc5703d6fb9e","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 1.6"},"fromKeys":["AIR-DD41393A6A@130e2fc97601e5c6"],"toKeys":["REQ-847e46792ed17f616fe6@399fbc5703d6fb9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-06a48a7534cdae0fc79a77db","from":"AIR-C57A5D1D72@dc7e31aaa4a56cf2","to":"REQ-647825a1659fb46b3eeb@e1dbdc15773b7705","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 12(1)"},"fromKeys":["AIR-C57A5D1D72@dc7e31aaa4a56cf2"],"toKeys":["REQ-647825a1659fb46b3eeb@e1dbdc15773b7705"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d90c88be99b7fe61b66693d0","from":"AIR-9EC219543F@ebf1af41b7a47c54","to":"REQ-083b66009492b287e64e@1cd525f4b6e1d977","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 7(3)"},"fromKeys":["AIR-9EC219543F@ebf1af41b7a47c54"],"toKeys":["REQ-083b66009492b287e64e@1cd525f4b6e1d977"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-463f3b6fdb0013a9782ad788","from":"AIR-6630D57F8E@2e89ffefec328e15","to":"REQ-890a916d06f30a7e3518@fde4a02670c80951","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 4"},"fromKeys":["AIR-6630D57F8E@2e89ffefec328e15"],"toKeys":["REQ-890a916d06f30a7e3518@fde4a02670c80951"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c9e5086599e156fb6c7864d5","from":"AIR-D8C5075D47@d84ddd521abe79d6","to":"REQ-123460e487116850fce7@62fa77de470efc9f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 15(4)"},"fromKeys":["AIR-D8C5075D47@d84ddd521abe79d6"],"toKeys":["REQ-123460e487116850fce7@62fa77de470efc9f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-20f8174c28abf23f7fcf58e4","from":"AIR-96F8E30D4E@554a9bdfd5daf88b","to":"REQ-57b2a55927ecec909b66@dfce2bd0391935e4","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 72(1)"},"fromKeys":["AIR-96F8E30D4E@554a9bdfd5daf88b"],"toKeys":["REQ-57b2a55927ecec909b66@dfce2bd0391935e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3a2ff495a994dd73e1c605ec","from":"AIR-2D3F66EE87@a9f992bc13c78b6e","to":"REQ-4b0c1a948483c2b39dda@c8b84cbcc64277a9","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 17(1)"},"fromKeys":["AIR-2D3F66EE87@a9f992bc13c78b6e"],"toKeys":["REQ-4b0c1a948483c2b39dda@c8b84cbcc64277a9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-081cb244f25947687a8bfbf3","from":"AIR-972D7C9D89@f58f1a8cded65e60","to":"REQ-4b48a8df3e6a8dc85644@4755d12faba8b594","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 9(1)"},"fromKeys":["AIR-972D7C9D89@f58f1a8cded65e60"],"toKeys":["REQ-4b48a8df3e6a8dc85644@4755d12faba8b594"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4702f05e5461257fe83cd692","from":"AIR-22E9FC8F8B@0dadc34a046b3598","to":"REQ-ce608b65a3781065cbe4@92bfafc5c0a4ebc3","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 15"},"fromKeys":["AIR-22E9FC8F8B@0dadc34a046b3598"],"toKeys":["REQ-ce608b65a3781065cbe4@92bfafc5c0a4ebc3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d2a6d7f48ef1ca0fefa2ada5","from":"AIR-601E866E1A@caf69c88ed9bf9fc","to":"REQ-b7315292d173d8e00aa2@5fa3c11702567f6d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-genai-profile@735d08bf9863","locator":"GV-1.4-001"},"fromKeys":["AIR-601E866E1A@caf69c88ed9bf9fc"],"toKeys":["REQ-b7315292d173d8e00aa2@5fa3c11702567f6d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bec3837f72ab798b640bbb9c","from":"AIR-6F2EEB6462@e739d9d7e4daf8e5","to":"REQ-6e1f9a94207f264fd2eb@d45831c85d869b94","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 5.2"},"fromKeys":["AIR-6F2EEB6462@e739d9d7e4daf8e5"],"toKeys":["REQ-6e1f9a94207f264fd2eb@d45831c85d869b94"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6e481609545e7f5f2c320715","from":"AIR-D4E3A56AB8@aec3865ec09bb78e","to":"REQ-12ede2e0f974afd286ca@ccebc9e5f868bd69","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 5.1"},"fromKeys":["AIR-D4E3A56AB8@aec3865ec09bb78e"],"toKeys":["REQ-12ede2e0f974afd286ca@ccebc9e5f868bd69"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-10ce2794a2cfb332518c07c9","from":"AIR-8F9AE0F269@a1d23a19bcf73815","to":"REQ-d4ec9df0706eb58bef64@b69d92ee62627b77","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 3.2"},"fromKeys":["AIR-8F9AE0F269@a1d23a19bcf73815"],"toKeys":["REQ-d4ec9df0706eb58bef64@b69d92ee62627b77"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-601dfbea6673309375038dc6","from":"AIR-7F4EB9435F@004c59994b3cf4b5","to":"REQ-94fe18703059b98d84e6@df4f2396cc5be7fc","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 26(1)"},"fromKeys":["AIR-7F4EB9435F@004c59994b3cf4b5"],"toKeys":["REQ-94fe18703059b98d84e6@df4f2396cc5be7fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c7f37fc4bcf33cd9dcf9445f","from":"AIR-C1F74ECF84@7dc33a77a8d3a773","to":"REQ-0f2f5de858f666011246@e48294c0d4725a29","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 6(1)"},"fromKeys":["AIR-C1F74ECF84@7dc33a77a8d3a773"],"toKeys":["REQ-0f2f5de858f666011246@e48294c0d4725a29"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d888a0659f9a8f7a3a972425","from":"AIR-FD9E9E9724@1012ed2a7988dabb","to":"REQ-51022a42f5c5bbf3384c@8059bad11a3dc257","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 9(2)(a)"},"fromKeys":["AIR-FD9E9E9724@1012ed2a7988dabb"],"toKeys":["REQ-51022a42f5c5bbf3384c@8059bad11a3dc257"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e5c4a678297437b0da42590d","from":"AIR-9E0C4702D4@e3f3f142eb8523dc","to":"REQ-0bf05af2b1254d36d95d@d30eaa162d7deae2","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Manage 4.1"},"fromKeys":["AIR-9E0C4702D4@e3f3f142eb8523dc"],"toKeys":["REQ-0bf05af2b1254d36d95d@d30eaa162d7deae2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a5a2487787a7bc71234896f1","from":"AIR-03619CE6CD@adca6df93b142c79","to":"REQ-63224732018095a8089e@f43a685ff1a519e1","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 4(5)"},"fromKeys":["AIR-03619CE6CD@adca6df93b142c79"],"toKeys":["REQ-63224732018095a8089e@f43a685ff1a519e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e2db5d3b4a6921da33eddf0f","from":"AIR-A7714C60EE@d62d0078bc9e65e1","to":"REQ-b52ccaaf3e8e10f8c00c@2e26ffed7814b73a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 5.2"},"fromKeys":["AIR-A7714C60EE@d62d0078bc9e65e1"],"toKeys":["REQ-b52ccaaf3e8e10f8c00c@2e26ffed7814b73a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c7861310a0319878c5318cf5","from":"AIR-F306231C79@caf52b00cf41c374","to":"REQ-4983b02c1cebf6d6aea2@58444c7567d8cb0e","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 5(1)(f)"},"fromKeys":["AIR-F306231C79@caf52b00cf41c374"],"toKeys":["REQ-4983b02c1cebf6d6aea2@58444c7567d8cb0e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d07fdde9219f8f6e2e6c1a67","from":"AIR-FBD73FD1D8@fcebf6c55b97a17c","to":"REQ-a9ae419481302815f1d0@abdf184cba44bde4","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 26(7)"},"fromKeys":["AIR-FBD73FD1D8@fcebf6c55b97a17c"],"toKeys":["REQ-a9ae419481302815f1d0@abdf184cba44bde4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-db1ced23ae08607349d799e4","from":"AIR-8E51985BF0@1e5d0cfb9d125308","to":"REQ-28f3f77520c9204560c4@aa4b99e2b6706ce4","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"va-ai-ea400@2e593dc57bbb","locator":"pp.6–7, AI Disclaimers"},"fromKeys":["AIR-8E51985BF0@1e5d0cfb9d125308"],"toKeys":["REQ-28f3f77520c9204560c4@aa4b99e2b6706ce4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-042c56ba5932513d3069f3f4","from":"AIR-B9CECE710F@c4f81501268171a4","to":"REQ-3c34dac5f16de11d0f68@aada738f18e17446","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 50(3)"},"fromKeys":["AIR-B9CECE710F@c4f81501268171a4"],"toKeys":["REQ-3c34dac5f16de11d0f68@aada738f18e17446"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4f7eef03797e1b9be7254dd1","from":"AIR-86AF529571@ccb86427e4aadc8a","to":"REQ-137a5e80ab9922df5589@b790c3d7ca398dd4","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 50(1)"},"fromKeys":["AIR-86AF529571@ccb86427e4aadc8a"],"toKeys":["REQ-137a5e80ab9922df5589@b790c3d7ca398dd4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-10ba643eb5849891c3f4cdee","from":"AIR-04690263D1@a422dc4de9c630fa","to":"REQ-4c87ce80a824e1809d2b@a1d582a7fca4582a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Manage 4.2"},"fromKeys":["AIR-04690263D1@a422dc4de9c630fa"],"toKeys":["REQ-4c87ce80a824e1809d2b@a1d582a7fca4582a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e6ecb6a3001f546255c51f0a","from":"AIR-E3E35C8AE8@d9113f51a24ef8f6","to":"REQ-2c8c97278a2065b3e485@9949a3a16b462abd","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 1.2"},"fromKeys":["AIR-E3E35C8AE8@d9113f51a24ef8f6"],"toKeys":["REQ-2c8c97278a2065b3e485@9949a3a16b462abd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-212ccd816298b65a0dd4b98e","from":"AIR-9365A6ADE2@20d6eb8a48ebd2d4","to":"REQ-9fd01009c21d518c8da0@5f02801ed31239dd","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 1.6"},"fromKeys":["AIR-9365A6ADE2@20d6eb8a48ebd2d4"],"toKeys":["REQ-9fd01009c21d518c8da0@5f02801ed31239dd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b2df9d48a3030395c4cacea1","from":"AIR-6DAA5CD4FD@ec0680416b29fb99","to":"REQ-774839a06883b715ad20@30711930a22740f3","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-genai-profile@735d08bf9863","locator":"GV-1.6-001"},"fromKeys":["AIR-6DAA5CD4FD@ec0680416b29fb99"],"toKeys":["REQ-774839a06883b715ad20@30711930a22740f3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3946d6c428bcfd9def9756dd","from":"AIR-B43991A570@e07dc0ac83da75fe","to":"REQ-1a3621b4e8901f30a0c1@783151438967103c","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-genai-profile@735d08bf9863","locator":"GV-6.1-007"},"fromKeys":["AIR-B43991A570@e07dc0ac83da75fe"],"toKeys":["REQ-1a3621b4e8901f30a0c1@783151438967103c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-48cb01d0ffb7ca301848545f","from":"AIR-D1EC03300E@ff3e30b28afc2253","to":"REQ-900ae8b1e74aec38d7b5@1cd7a44bcd50d8ec","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 1.2"},"fromKeys":["AIR-D1EC03300E@ff3e30b28afc2253"],"toKeys":["REQ-900ae8b1e74aec38d7b5@1cd7a44bcd50d8ec"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c71a71b2ac7e6810e2d3f904","from":"AIR-F027EE41CE@d677a0372296b2c9","to":"REQ-7aaeefa3d5e8885dbe47@22f9968b24be7363","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 5(1)(b)"},"fromKeys":["AIR-F027EE41CE@d677a0372296b2c9"],"toKeys":["REQ-7aaeefa3d5e8885dbe47@22f9968b24be7363"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7f669eb82c708760bb10e92b","from":"AIR-423A77F29F@614fa00dae363777","to":"REQ-ccc1d850fa92195f850e@ce02b4de954c06c9","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 53(1)(a)"},"fromKeys":["AIR-423A77F29F@614fa00dae363777"],"toKeys":["REQ-ccc1d850fa92195f850e@ce02b4de954c06c9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-38563f7246fd81b31a0aa664","from":"AIR-689F104CE2@0bd6e76036538bf1","to":"REQ-621a2c9dc38eca145938@7dfc01b0332526fe","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 30(1)"},"fromKeys":["AIR-689F104CE2@0bd6e76036538bf1"],"toKeys":["REQ-621a2c9dc38eca145938@7dfc01b0332526fe"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-abdc1801dc66a18334195209","from":"AIR-413925FF98@6b2df5091a42ef9a","to":"REQ-1bda73592ba3cba8a182@27250dec3bf7b573","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 4.1"},"fromKeys":["AIR-413925FF98@6b2df5091a42ef9a"],"toKeys":["REQ-1bda73592ba3cba8a182@27250dec3bf7b573"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-008ace2d403ef519412d39d7","from":"AIR-5C96C1D94B@47902f34b3a364f5","to":"REQ-56daf4ceb06f532d5c98@816069a426334126","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 50(2)"},"fromKeys":["AIR-5C96C1D94B@47902f34b3a364f5"],"toKeys":["REQ-56daf4ceb06f532d5c98@816069a426334126"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a70c079ee7d4781347419a29","from":"AIR-F6290E21EB@f19e8c0b437c9d53","to":"REQ-2f4fd8aad0a84889cf80@b7f897fd511bb6b2","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 2.4"},"fromKeys":["AIR-F6290E21EB@f19e8c0b437c9d53"],"toKeys":["REQ-2f4fd8aad0a84889cf80@b7f897fd511bb6b2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-56c3a3d3aca1adb27a3625b0","from":"AIR-20C51AF468@80172ed3950e5a4e","to":"REQ-33b02412d23168404375@4dffec5623f99c6d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 26(5)"},"fromKeys":["AIR-20C51AF468@80172ed3950e5a4e"],"toKeys":["REQ-33b02412d23168404375@4dffec5623f99c6d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5091774a32e8681260688517","from":"AIR-91B7104B7C@1ca75582d8a75712","to":"REQ-35b7bc66ae0969aa8da0@5909e640e26cd526","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-genai-profile@735d08bf9863","locator":"GV-1.5-003"},"fromKeys":["AIR-91B7104B7C@1ca75582d8a75712"],"toKeys":["REQ-35b7bc66ae0969aa8da0@5909e640e26cd526"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f5a29e98135babc86d40ab09","from":"AIR-E86C054724@9a8c36635cd43279","to":"REQ-3d10f985c754095079dc@56b168bc757bcccf","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Manage 3.2"},"fromKeys":["AIR-E86C054724@9a8c36635cd43279"],"toKeys":["REQ-3d10f985c754095079dc@56b168bc757bcccf"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-99c6d4fa5ec11c223d2420fd","from":"AIR-8FFA25BD3B@f5e87ca6e56ca7ed","to":"REQ-1cbedf68688bfd14fba5@d7b79e8944469257","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-genai-profile@735d08bf9863","locator":"GV-1.3-004"},"fromKeys":["AIR-8FFA25BD3B@f5e87ca6e56ca7ed"],"toKeys":["REQ-1cbedf68688bfd14fba5@d7b79e8944469257"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d09b4f58e378bf59236eae63","from":"AIR-79A1D26388@51c5488b7e041703","to":"REQ-45182d12c3135c56d3e0@0da4a9cd38e7bc23","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-800-171-r3@2eb9b17a4b7e","locator":"03.01.02"},"fromKeys":["AIR-79A1D26388@51c5488b7e041703"],"toKeys":["REQ-45182d12c3135c56d3e0@0da4a9cd38e7bc23"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-282d931b29ef4b7aab385b22","from":"AIR-D151BEE055@3af1ed44d6ed4b52","to":"REQ-ca05607ef6cc1788db55@08a65b9eb87ee8c6","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-800-53-r5@4f21062a3f36","locator":"AC-3"},"fromKeys":["AIR-D151BEE055@3af1ed44d6ed4b52"],"toKeys":["REQ-ca05607ef6cc1788db55@08a65b9eb87ee8c6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-380a0d67023d9af43c0e5346","from":"AIR-239800B9C4@ae7e87dc03c931ad","to":"REQ-b7a0cb40e002a7d1502a@a1a746b9237c548f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-csf-2@02163ac1eda6","locator":"PR.PS-04"},"fromKeys":["AIR-239800B9C4@ae7e87dc03c931ad"],"toKeys":["REQ-b7a0cb40e002a7d1502a@a1a746b9237c548f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a533758858c1684a8a4add20","from":"AIR-6CFD9FC4BD@f48d56c08a6188da","to":"REQ-d35808bd30363f52b154@bcb53f4fa874579e","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-csf-2@02163ac1eda6","locator":"ID.AM-02"},"fromKeys":["AIR-6CFD9FC4BD@f48d56c08a6188da"],"toKeys":["REQ-d35808bd30363f52b154@bcb53f4fa874579e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8cc716690f997b48ef9666b1","from":"AIR-64615EE538@7d73fe15bcc48eb4","to":"REQ-250fc8e135560ff142d0@642c89bca74561e3","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-csf-2@02163ac1eda6","locator":"ID.AM-01"},"fromKeys":["AIR-64615EE538@7d73fe15bcc48eb4"],"toKeys":["REQ-250fc8e135560ff142d0@642c89bca74561e3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-13d039dcad32fb364092ba79","from":"AIR-957F5E0FE9@cff4ebef1d4cca10","to":"REQ-bb97aa63367a6b4e4b15@0cbaf25e623b686a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-800-53-r5@4f21062a3f36","locator":"AC-6"},"fromKeys":["AIR-957F5E0FE9@cff4ebef1d4cca10"],"toKeys":["REQ-bb97aa63367a6b4e4b15@0cbaf25e623b686a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b14ed802c60fdde0da6f21ce","from":"AIR-DD72BC62FE@e9b55167d1115092","to":"REQ-311ad1c76a6f7e7dd90d@1a0c88239de0c53a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-800-171-r3@2eb9b17a4b7e","locator":"03.01.05(a)"},"fromKeys":["AIR-DD72BC62FE@e9b55167d1115092"],"toKeys":["REQ-311ad1c76a6f7e7dd90d@1a0c88239de0c53a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4a13185160cb061728023bf8","from":"AIR-2711651405@ad3986b7b3466500","to":"REQ-8bbce8d6e53152dac69c@2cb0e43635265660","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-800-171-r3@2eb9b17a4b7e","locator":"03.01.07(a)"},"fromKeys":["AIR-2711651405@ad3986b7b3466500"],"toKeys":["REQ-8bbce8d6e53152dac69c@2cb0e43635265660"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cfc19e99f4d3754c01c8df94","from":"AIR-8014471E79@cd2299a5772a4c71","to":"REQ-e840df8fa93d1494b8ad@10a1d40c8a72c5e8","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-csf-2@02163ac1eda6","locator":"PR.PS-05"},"fromKeys":["AIR-8014471E79@cd2299a5772a4c71"],"toKeys":["REQ-e840df8fa93d1494b8ad@10a1d40c8a72c5e8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-77ba105456c5a59e6afafff8","from":"AIR-93CD199B6D@eebad49411512bd1","to":"REQ-bd8be4f016ae42bb21a9@6a4868272521b857","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-800-171-r3@2eb9b17a4b7e","locator":"03.01.07(b)"},"fromKeys":["AIR-93CD199B6D@eebad49411512bd1"],"toKeys":["REQ-bd8be4f016ae42bb21a9@6a4868272521b857"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-689a9e47a753e5247a26f760","from":"AIR-10D05FADF9@6b35afe41ac0a5f4","to":"REQ-67e37d4f836552e3a4da@29598972f69405af","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Manage 1.3"},"fromKeys":["AIR-10D05FADF9@6b35afe41ac0a5f4"],"toKeys":["REQ-67e37d4f836552e3a4da@29598972f69405af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-21b6f5f93809b6bfc8dc8cc7","from":"AIR-DDC1AF69E8@e01ae87beaf929ab","to":"REQ-5e5d94ee8df3daba83f5@6a3163bafcd64d9c","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 5(1)(d)"},"fromKeys":["AIR-DDC1AF69E8@e01ae87beaf929ab"],"toKeys":["REQ-5e5d94ee8df3daba83f5@6a3163bafcd64d9c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-90bc4cfc06686e4218606c49","from":"AIR-6C1ECA98A1@79971c442fa84f2e","to":"REQ-694107580ec1e8a43e8e@08c8500665acca74","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 11(1)"},"fromKeys":["AIR-6C1ECA98A1@79971c442fa84f2e"],"toKeys":["REQ-694107580ec1e8a43e8e@08c8500665acca74"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8facf7cac71a0713b3385c94","from":"AIR-1AE367EE4E@f16ee6fc6066cd00","to":"REQ-7d0684e4db13f59da9e7@dd9f79e11aa32eca","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 10"},"fromKeys":["AIR-1AE367EE4E@f16ee6fc6066cd00"],"toKeys":["REQ-7d0684e4db13f59da9e7@dd9f79e11aa32eca"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5c5e7b24138ec2c62769b9e4","from":"AIR-8B497F4F74@731ecfa0018c376a","to":"REQ-31789f3da294b7f39345@0184a16939847f0e","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Manage 1.2"},"fromKeys":["AIR-8B497F4F74@731ecfa0018c376a"],"toKeys":["REQ-31789f3da294b7f39345@0184a16939847f0e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e57663b13517dc71b3b0d1c9","from":"AIR-0156EA65AB@302d0c170dbf354c","to":"REQ-b355790e12f878de5bf3@7c0d10cd9a0cd672","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 22(1)"},"fromKeys":["AIR-0156EA65AB@302d0c170dbf354c"],"toKeys":["REQ-b355790e12f878de5bf3@7c0d10cd9a0cd672"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2984732340f27eef50be28c8","from":"AIR-504A6F5FAE@a53448cc80e7901a","to":"REQ-367f9720323a475166c7@570df929d0364f33","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 11"},"fromKeys":["AIR-504A6F5FAE@a53448cc80e7901a"],"toKeys":["REQ-367f9720323a475166c7@570df929d0364f33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a450ea51bf5fc8858b76e1f7","from":"AIR-837D00B454@58d1236be88d2c69","to":"REQ-540a5ec93d2c287c5c5c@d2504728b6b43c2f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 53(1)(b)"},"fromKeys":["AIR-837D00B454@58d1236be88d2c69"],"toKeys":["REQ-540a5ec93d2c287c5c5c@d2504728b6b43c2f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e6c72368f7abbd7218e1d731","from":"AIR-3E2FF36AEB@c549587bacfe6983","to":"REQ-3e901d79e501758614d1@a2a8970829d58844","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 13(2)"},"fromKeys":["AIR-3E2FF36AEB@c549587bacfe6983"],"toKeys":["REQ-3e901d79e501758614d1@a2a8970829d58844"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6c94748e682a9de3994343c0","from":"AIR-130AE1C465@9bfdc1d72bba8156","to":"REQ-72fa92f64d43dc719fd7@bef75d74d4d7c9c5","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"ca-automated-decisions@025abfffca33","locator":"6.2.3"},"fromKeys":["AIR-130AE1C465@9bfdc1d72bba8156"],"toKeys":["REQ-72fa92f64d43dc719fd7@bef75d74d4d7c9c5"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c76deb645d4b00ecbe9163e1","from":"AIR-5E618A5099@99b7ad5ea4ffbf96","to":"REQ-5ff4e7ce70236b50dec4@f0213697c9831362","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 13"},"fromKeys":["AIR-5E618A5099@99b7ad5ea4ffbf96"],"toKeys":["REQ-5ff4e7ce70236b50dec4@f0213697c9831362"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-32a5ccc28b2df33569070cc5","from":"AIR-134DC94A5A@65d3e4c7bed571f0","to":"REQ-8e6d862191185e53d928@a5867538818dadfc","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"ca-automated-decisions@025abfffca33","locator":"6.1.1"},"fromKeys":["AIR-134DC94A5A@65d3e4c7bed571f0"],"toKeys":["REQ-8e6d862191185e53d928@a5867538818dadfc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c2a87e496256ab4cdce46a23","from":"AIR-687C1F2AA0@c86677a938736f82","to":"REQ-9b6d044c075f1d4b3568@2931003a3bf39a6f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 10"},"fromKeys":["AIR-687C1F2AA0@c86677a938736f82"],"toKeys":["REQ-9b6d044c075f1d4b3568@2931003a3bf39a6f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c1e4a1a9c241c16481bbbcaf","from":"AIR-A98A489B02@5a563fee90bb52f1","to":"REQ-3d95b7a5ec079babd952@c2743609cd9b0dd0","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nc-public-genai@fdb108006ef7","locator":"p.5, appropriate use, bullet 4"},"fromKeys":["AIR-A98A489B02@5a563fee90bb52f1"],"toKeys":["REQ-3d95b7a5ec079babd952@c2743609cd9b0dd0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7c2f7871925468b7ef76da96","from":"AIR-014E35D5FC@903aba701d5fd191","to":"REQ-bbe7d452929d8704b256@966447278f7d29f1","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 14"},"fromKeys":["AIR-014E35D5FC@903aba701d5fd191"],"toKeys":["REQ-bbe7d452929d8704b256@966447278f7d29f1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e7945008b039de972a4bfa56","from":"AIR-A3EACF1A4E@bdfcce3127b14f2e","to":"REQ-69d507ba6d68cbbeba4c@35fba408ec21383d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Manage 2.3"},"fromKeys":["AIR-A3EACF1A4E@bdfcce3127b14f2e"],"toKeys":["REQ-69d507ba6d68cbbeba4c@35fba408ec21383d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-69fdee66c1aa404e6d97f6ac","from":"AIR-1B927E390F@90b0968cc7bd920f","to":"REQ-dce482c09f1e24b1e76c@7673b10813241f9f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 19(1)"},"fromKeys":["AIR-1B927E390F@90b0968cc7bd920f"],"toKeys":["REQ-dce482c09f1e24b1e76c@7673b10813241f9f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d3ac3ca7562a7c12d13e544c","from":"AIR-FC504B8B3E@44396d3a1667e971","to":"REQ-7a01be229a7aab66aac3@ae3ec64aff6d0ac2","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 18(1)"},"fromKeys":["AIR-FC504B8B3E@44396d3a1667e971"],"toKeys":["REQ-7a01be229a7aab66aac3@ae3ec64aff6d0ac2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-38646d8f0da891ecf99774c9","from":"AIR-AEFB7467B3@e26b3eb75ade016c","to":"REQ-8fb0a1d7674de4f06a13@46fc9ba1e157750a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"ca-automated-decisions@025abfffca33","locator":"6.2.5"},"fromKeys":["AIR-AEFB7467B3@e26b3eb75ade016c"],"toKeys":["REQ-8fb0a1d7674de4f06a13@46fc9ba1e157750a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-34f5f6f0260521083de0bec0","from":"AIR-48A3BA0A96@b263653f0a99c7ad","to":"REQ-e14de96ca3ae5833e64c@89a91e8689ebffe1","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 28(1)"},"fromKeys":["AIR-48A3BA0A96@b263653f0a99c7ad"],"toKeys":["REQ-e14de96ca3ae5833e64c@89a91e8689ebffe1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8665a1942b6b13002bc58c81","from":"AIR-7C668908A8@78cf8740a649a0f3","to":"REQ-865366fbd2854e568a9d@496167594c70642b","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ssdf-1-1@50330a194ff2","locator":"PS.2.1"},"fromKeys":["AIR-7C668908A8@78cf8740a649a0f3"],"toKeys":["REQ-865366fbd2854e568a9d@496167594c70642b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-46d31aa0bdb0141ea0e22d88","from":"AIR-7AA947C3E4@118c7450b632ede7","to":"REQ-41650b18687474250b6e@c36c81693d0d9d2b","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ssdf-1-1@50330a194ff2","locator":"PS.1.1"},"fromKeys":["AIR-7AA947C3E4@118c7450b632ede7"],"toKeys":["REQ-41650b18687474250b6e@c36c81693d0d9d2b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e799fab2e6ece70cdcdb987e","from":"AIR-C25C44E28B@2731fcfc158e2fa1","to":"REQ-8be4c51029dd20e20d68@dd8ad91d41db054f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 3.3"},"fromKeys":["AIR-C25C44E28B@2731fcfc158e2fa1"],"toKeys":["REQ-8be4c51029dd20e20d68@dd8ad91d41db054f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c48141dde30efa5dc637035a","from":"AIR-635250368A@6c55b8ae37092884","to":"REQ-cf47c0dc3943e4671d0f@197b421977c71774","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 14"},"fromKeys":["AIR-635250368A@6c55b8ae37092884"],"toKeys":["REQ-cf47c0dc3943e4671d0f@197b421977c71774"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c99689ad9c83fc796fa09e92","from":"AIR-DA110B3EF2@5fb47f8a5be1b724","to":"REQ-22d22c422459eadfc51f@b74efdfd3e900f1a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 20(1)"},"fromKeys":["AIR-DA110B3EF2@5fb47f8a5be1b724"],"toKeys":["REQ-22d22c422459eadfc51f@b74efdfd3e900f1a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-65453bd353520cb251f583fc","from":"AIR-C8E01637B6@c05d05ad9a3b2910","to":"REQ-0735d7721e6081064e93@38d67cbe56090db9","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"pa-ai-2026@f9ebb0c412ba","locator":"5.1.5, p.2"},"fromKeys":["AIR-C8E01637B6@c05d05ad9a3b2910"],"toKeys":["REQ-0735d7721e6081064e93@38d67cbe56090db9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-17dd95f411a352e275e45743","from":"AIR-E4C9EA7E18@d8c85f5cc0d70f15","to":"REQ-e9a95beb399033f361bc@a51b015695bfc8fd","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 3.1"},"fromKeys":["AIR-E4C9EA7E18@d8c85f5cc0d70f15"],"toKeys":["REQ-e9a95beb399033f361bc@a51b015695bfc8fd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5c1278502bd6e886f9f72e7d","from":"AIR-E528E1DA42@48d256608f07f2b5","to":"REQ-c4c7d608b24e0eb29bb6@39c1582f7c224e6a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 2.2"},"fromKeys":["AIR-E528E1DA42@48d256608f07f2b5"],"toKeys":["REQ-c4c7d608b24e0eb29bb6@39c1582f7c224e6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-762250badfb517d9223bd046","from":"AIR-0BD6CF8CF8@290628708f099b2a","to":"REQ-8555c7ac20eba054615f@28868f5211c9bb73","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"ca-automated-decisions@025abfffca33","locator":"6.1.3"},"fromKeys":["AIR-0BD6CF8CF8@290628708f099b2a"],"toKeys":["REQ-8555c7ac20eba054615f@28868f5211c9bb73"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2c65916d1aacf457c393da7e","from":"AIR-5F6922C679@da9d666ec3ecbe6e","to":"REQ-66af2014a595673589f6@b1cc63832a5290cb","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"msu-genai-guidelines@2b6ba5512b77","locator":"Teaching and Learning, opening paragraph"},"fromKeys":["AIR-5F6922C679@da9d666ec3ecbe6e"],"toKeys":["REQ-66af2014a595673589f6@b1cc63832a5290cb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-06c009a060a19c582d3c209d","from":"AIR-32BF4E5A3E@f2cce8e56cb500cf","to":"REQ-5f456c39385a6df225bf@cb5c2c1b3190fdff","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"pa-ai-2026@f9ebb0c412ba","locator":"5.2, p.5"},"fromKeys":["AIR-32BF4E5A3E@f2cce8e56cb500cf"],"toKeys":["REQ-5f456c39385a6df225bf@cb5c2c1b3190fdff"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-54d16056705784eaa4522251","from":"AIR-32BF4E5A3E@f2cce8e56cb500cf","to":"REQ-70b853ba6d38511bd2cc@0eb180f40b4fe6b3","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"harvard-genai-guidelines@42cacddb870d","locator":"Protect confidential data, paragraph 2"},"fromKeys":["AIR-32BF4E5A3E@f2cce8e56cb500cf"],"toKeys":["REQ-70b853ba6d38511bd2cc@0eb180f40b4fe6b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9acb628533a7563f64c48dfb","from":"AIR-1BD7B65A31@f37aeab29f1a8c48","to":"REQ-4942cd01ca239be5b4d2@6cc7990c65a02e26","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"brookline-genai@8fce56b19d84","locator":"Use, bullet 2"},"fromKeys":["AIR-1BD7B65A31@f37aeab29f1a8c48"],"toKeys":["REQ-4942cd01ca239be5b4d2@6cc7990c65a02e26"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-982c48265060561d1edeedaf","from":"AIR-FED5F6D978@b3cf26d93229f90e","to":"REQ-2f6a2a6c35e90e36d165@672157cb844aa364","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 2.2"},"fromKeys":["AIR-FED5F6D978@b3cf26d93229f90e"],"toKeys":["REQ-2f6a2a6c35e90e36d165@672157cb844aa364"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3484e8d981b2657d31d9f4b3","from":"AIR-E59A08E459@33c8b38759b2908d","to":"REQ-9ebf08d4f32ee32a443c@cfc00be773345cc9","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 26(2)"},"fromKeys":["AIR-E59A08E459@33c8b38759b2908d"],"toKeys":["REQ-9ebf08d4f32ee32a443c@cfc00be773345cc9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2ea9835d7f7272aa349ed4f1","from":"AIR-E98925E526@6bd2395b938c69d4","to":"REQ-f80f8ffa2c639482b509@77a7de8daa45def1","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Map 3.5"},"fromKeys":["AIR-E98925E526@6bd2395b938c69d4"],"toKeys":["REQ-f80f8ffa2c639482b509@77a7de8daa45def1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b6833d0b304f8656394842bf","from":"AIR-2FB9BEA395@a3db1a2847eee5bc","to":"REQ-b5a6a29354ba501a8c8a@771136426cf3b545","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 3.2"},"fromKeys":["AIR-2FB9BEA395@a3db1a2847eee5bc"],"toKeys":["REQ-b5a6a29354ba501a8c8a@771136426cf3b545"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-71322b734b4f7e9eb1a3d0c8","from":"AIR-4D850F7FFA@e43b05ce5986a37b","to":"REQ-3bdab7d470592068ecff@f19a0c5512e83196","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"va-ai-ea400@2e593dc57bbb","locator":"p.5, Ethical Use"},"fromKeys":["AIR-4D850F7FFA@e43b05ce5986a37b"],"toKeys":["REQ-3bdab7d470592068ecff@f19a0c5512e83196"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6ff50eb3942f50f9a29bbeb8","from":"AIR-9F0606F820@5012763ddf10c824","to":"REQ-3c16a9dbc3afdc05839f@59185d2567f9bea0","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 14(1)"},"fromKeys":["AIR-9F0606F820@5012763ddf10c824"],"toKeys":["REQ-3c16a9dbc3afdc05839f@59185d2567f9bea0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f60e85c4ca5248c2f6d908d4","from":"AIR-BF19955A9B@735005e86bd3475f","to":"REQ-c09c8a39e58dbe4aa4cc@433f11fc3338fd8b","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 14(4)(d)"},"fromKeys":["AIR-BF19955A9B@735005e86bd3475f"],"toKeys":["REQ-c09c8a39e58dbe4aa4cc@433f11fc3338fd8b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5adb8f277cdfc8795211cdbc","from":"AIR-72DBAB9908@83ef03fd64caec83","to":"REQ-06134a67f9e4ae9a363a@4af1cfb4b135698e","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 14(4)(c)"},"fromKeys":["AIR-72DBAB9908@83ef03fd64caec83"],"toKeys":["REQ-06134a67f9e4ae9a363a@4af1cfb4b135698e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8502f8e7a0f4e3d03d0c9f74","from":"AIR-0865D3E990@af385593071ea4c8","to":"REQ-9a5586dab7f578ed2ae8@82b1eaf2284879a9","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 14(4)(e)"},"fromKeys":["AIR-0865D3E990@af385593071ea4c8"],"toKeys":["REQ-9a5586dab7f578ed2ae8@82b1eaf2284879a9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f774f770cb15aec598b60f21","from":"AIR-E0CAD3FF88@228493a9f6f40dd7","to":"REQ-52c721c629da81bb73b8@783db868b3fab41a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-genai-profile@735d08bf9863","locator":"GV-1.3-002"},"fromKeys":["AIR-E0CAD3FF88@228493a9f6f40dd7"],"toKeys":["REQ-52c721c629da81bb73b8@783db868b3fab41a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-26a90f0fb8d87f1a16ed0f09","from":"AIR-6E499BCE84@df500105ee99c8b7","to":"REQ-56967a1417c6c6ccf2b7@3fc6c1f3e928f9ce","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 3.3"},"fromKeys":["AIR-6E499BCE84@df500105ee99c8b7"],"toKeys":["REQ-56967a1417c6c6ccf2b7@3fc6c1f3e928f9ce"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c0d07a6a7284d0ec28dcaeb0","from":"AIR-4045E1AF90@0676fdd2f6b2d7dc","to":"REQ-372043fd82745a122811@94e234fccffc3d66","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"va-ai-ea400@2e593dc57bbb","locator":"p.7, Transparency Requirements"},"fromKeys":["AIR-4045E1AF90@0676fdd2f6b2d7dc"],"toKeys":["REQ-372043fd82745a122811@94e234fccffc3d66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ecf663c04c564cb9690e6cf7","from":"AIR-D5475CA27F@94cb73d4ed08239d","to":"REQ-2f7b7da6e2946bfd9b93@e235da79fa32c16b","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"brookline-genai@8fce56b19d84","locator":"Use, recording-app bullet"},"fromKeys":["AIR-D5475CA27F@94cb73d4ed08239d"],"toKeys":["REQ-2f7b7da6e2946bfd9b93@e235da79fa32c16b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a61a47d5a611c1285aaaa645","from":"AIR-0AEC8A401C@b648927da35f5f88","to":"REQ-9b416d22097ea9a90ab5@bb661b26578f6cea","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 1.5"},"fromKeys":["AIR-0AEC8A401C@b648927da35f5f88"],"toKeys":["REQ-9b416d22097ea9a90ab5@bb661b26578f6cea"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ce05f86c83acd49d678c202","from":"AIR-9987CCC485@6df1dc002d91d472","to":"REQ-44310325b2ecacecc199@833164726d8cfbea","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"harvard-genai-guidelines@42cacddb870d","locator":"Review content before publishing or sharing"},"fromKeys":["AIR-9987CCC485@6df1dc002d91d472"],"toKeys":["REQ-44310325b2ecacecc199@833164726d8cfbea"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b06c451847d9722d612150cc","from":"AIR-FEDC04B3F1@f043d388f59ae1c8","to":"REQ-d04a114d8e1c7f5ef9ad@eea8cd8d8d34b8e0","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"msu-genai-guidelines@2b6ba5512b77","locator":"General Expectations for Administrative Use"},"fromKeys":["AIR-FEDC04B3F1@f043d388f59ae1c8"],"toKeys":["REQ-d04a114d8e1c7f5ef9ad@eea8cd8d8d34b8e0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fba9c9c46fc3dcca4050b527","from":"AIR-7899BD6734@a456d1f9da1f7505","to":"REQ-c372b0edd972f16db81e@b9aff3c7a310a525","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"pa-ai-2026@f9ebb0c412ba","locator":"5.2.3, p.6"},"fromKeys":["AIR-7899BD6734@a456d1f9da1f7505"],"toKeys":["REQ-c372b0edd972f16db81e@b9aff3c7a310a525"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3136346b6100db2a3fc89b9c","from":"AIR-DCFE285C28@80f8b54157b055cf","to":"REQ-4de9d4350a2ae4eb5a96@3b9b45a2c61d9ece","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nc-public-genai@fdb108006ef7","locator":"p.5, appropriate use, bullet 3"},"fromKeys":["AIR-DCFE285C28@80f8b54157b055cf"],"toKeys":["REQ-4de9d4350a2ae4eb5a96@3b9b45a2c61d9ece"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-649c5921cb4204da13eadefb","from":"AIR-6F83A570B6@c5a86b6e888d1e7e","to":"REQ-7047a2227f8ef9669b87@c11fb810291fc853","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cisa-ncsc-secure-ai-development@d0ff5974b6aa","locator":"Secure development / assets"},"fromKeys":["AIR-6F83A570B6@c5a86b6e888d1e7e"],"toKeys":["REQ-7047a2227f8ef9669b87@c11fb810291fc853"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5535086395382b68c1feddb4","from":"AIR-D8BE1AA186@1b20bfcc68fa1712","to":"REQ-3209a8c3b69fc27f3b80@ebb2e66372f829c3","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 11"},"fromKeys":["AIR-D8BE1AA186@1b20bfcc68fa1712"],"toKeys":["REQ-3209a8c3b69fc27f3b80@ebb2e66372f829c3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8f5f673fd93a7506c51e915d","from":"AIR-99485B54FC@def03c1901e63f94","to":"REQ-ede42eb7a9415693e100@a72eb0e8307e3562","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"brookline-genai@8fce56b19d84","locator":"Use, security-review bullet"},"fromKeys":["AIR-99485B54FC@def03c1901e63f94"],"toKeys":["REQ-ede42eb7a9415693e100@a72eb0e8307e3562"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-06325bc3263a414e1c368342","from":"AIR-E89D3740A1@1bbda13ba2404d8d","to":"REQ-414d82e4d19d2cf62fe9@b1fc2f4a53cfc421","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 5(1)(g)"},"fromKeys":["AIR-E89D3740A1@1bbda13ba2404d8d"],"toKeys":["REQ-414d82e4d19d2cf62fe9@b1fc2f4a53cfc421"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3f6d25436900101dd16b2425","from":"AIR-471437DC20@654377fb15657e58","to":"REQ-4b3673ecfccce739fbb7@5c7d3c8e67a423d8","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 16"},"fromKeys":["AIR-471437DC20@654377fb15657e58"],"toKeys":["REQ-4b3673ecfccce739fbb7@5c7d3c8e67a423d8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f4596ea37d790b79fde30a7a","from":"AIR-04A480E942@1fad5149884758b7","to":"REQ-7e01c01d060b186531ba@b2acfbdcdd3d2eb3","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 17(1)"},"fromKeys":["AIR-04A480E942@1fad5149884758b7"],"toKeys":["REQ-7e01c01d060b186531ba@b2acfbdcdd3d2eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4176bf7b867cd930e5dd7283","from":"AIR-231E86FCF1@f84f67f595b58984","to":"REQ-be26153c6c755675a45d@a6a1bf3fdf49809c","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 7(3)"},"fromKeys":["AIR-231E86FCF1@f84f67f595b58984"],"toKeys":["REQ-be26153c6c755675a45d@a6a1bf3fdf49809c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a6eca046bca4c802682ac2c8","from":"AIR-C4036FF921@7b5c70c24f9fb8b6","to":"REQ-eb2bcc2af9e849902509@f0a7a8c5a39cbbc3","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 2.10"},"fromKeys":["AIR-C4036FF921@7b5c70c24f9fb8b6"],"toKeys":["REQ-eb2bcc2af9e849902509@f0a7a8c5a39cbbc3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b71e991e456382cb48324922","from":"AIR-65595252CE@0e47a820c6f27347","to":"REQ-8dd61021f600dc0421de@15535c420fa7a2d4","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"msu-genai-guidelines@2b6ba5512b77","locator":"Non-Permissible Uses, paragraph 3"},"fromKeys":["AIR-65595252CE@0e47a820c6f27347"],"toKeys":["REQ-8dd61021f600dc0421de@15535c420fa7a2d4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-36daa625a517af386dd57e85","from":"AIR-40C4A84CA0@d8e76ecbac03e5a2","to":"REQ-764d00378589ebeb1e59@dc125744ced5b60f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 5(1)(e)"},"fromKeys":["AIR-40C4A84CA0@d8e76ecbac03e5a2"],"toKeys":["REQ-764d00378589ebeb1e59@dc125744ced5b60f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b3f63b8302cd5426d13b9564","from":"AIR-5C638CD3DB@7aa35edd30765d47","to":"REQ-e0036facfcedf9f2db0a@2448d1ae40a367ce","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 5(1)(d)"},"fromKeys":["AIR-5C638CD3DB@7aa35edd30765d47"],"toKeys":["REQ-e0036facfcedf9f2db0a@2448d1ae40a367ce"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-13536e16ec82774a7659b988","from":"AIR-5DE52C1C2C@b8589288940671eb","to":"REQ-e8bc690daef1e401ff4f@5ffad916727c4737","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 5(1)(c)"},"fromKeys":["AIR-5DE52C1C2C@b8589288940671eb"],"toKeys":["REQ-e8bc690daef1e401ff4f@5ffad916727c4737"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cf5ae3b76f9c5f4785ec685a","from":"AIR-FED6DB2BF6@171f97503ad3de30","to":"REQ-fe08756799955e635df7@53ff5a10a6e86415","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 33(1)"},"fromKeys":["AIR-FED6DB2BF6@171f97503ad3de30"],"toKeys":["REQ-fe08756799955e635df7@53ff5a10a6e86415"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-68ccb8be40fba920a19ec427","from":"AIR-9752AE9F94@6b370d1498673bd2","to":"REQ-4f3a4fe2526e78705404@3d3ed4cf5b7d360f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"harvard-genai-guidelines@42cacddb870d","locator":"Use approved tools, bullet 3"},"fromKeys":["AIR-9752AE9F94@6b370d1498673bd2"],"toKeys":["REQ-4f3a4fe2526e78705404@3d3ed4cf5b7d360f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4c313b0d0cee79871823a4ec","from":"AIR-75F300981F@dbac33d943ce135d","to":"REQ-954fc0e9e2221227bec6@30549793ee6465fc","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-800-53-r5@4f21062a3f36","locator":"PT-2(a)"},"fromKeys":["AIR-75F300981F@dbac33d943ce135d"],"toKeys":["REQ-954fc0e9e2221227bec6@30549793ee6465fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-db24b4417213ae50ff2e6437","from":"AIR-70303212C7@78ebdd02d253a65e","to":"REQ-1aef10d35f45cb977dc3@c75b81f1244f0e4d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-800-53-r5@4f21062a3f36","locator":"PT-2(a)"},"fromKeys":["AIR-70303212C7@78ebdd02d253a65e"],"toKeys":["REQ-1aef10d35f45cb977dc3@c75b81f1244f0e4d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f5120683b5256849494ac506","from":"AIR-6486E8DBA4@a977535adfe8c5f9","to":"REQ-962a397fb1e94c50b1a4@556c58d4e3f2ca08","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-csf-2@02163ac1eda6","locator":"PR.DS-02"},"fromKeys":["AIR-6486E8DBA4@a977535adfe8c5f9"],"toKeys":["REQ-962a397fb1e94c50b1a4@556c58d4e3f2ca08"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b46f00e8e7cf2e0a76bf8f00","from":"AIR-B39B348823@0bbd2c78b730d31a","to":"REQ-e84ba0e6fc7bdd7b6e97@271467c6ee855455","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-800-53-r5@4f21062a3f36","locator":"PT-2(b)"},"fromKeys":["AIR-B39B348823@0bbd2c78b730d31a"],"toKeys":["REQ-e84ba0e6fc7bdd7b6e97@271467c6ee855455"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3984fe3a7b520eeeb6aad58a","from":"AIR-386B595FB5@7ef261ecda593467","to":"REQ-cf3fa5e3c1a0ee2157da@8fc12a7b48463d5d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 5(1)(a)"},"fromKeys":["AIR-386B595FB5@7ef261ecda593467"],"toKeys":["REQ-cf3fa5e3c1a0ee2157da@8fc12a7b48463d5d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d2051ecc45374cc39e33f123","from":"AIR-685E3BDEA7@f7b18353a9f38d68","to":"REQ-73957a3b8f26816dbbb6@6a4ee8f25f2c42b4","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 11"},"fromKeys":["AIR-685E3BDEA7@f7b18353a9f38d68"],"toKeys":["REQ-73957a3b8f26816dbbb6@6a4ee8f25f2c42b4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3c0c83999164a182a34a28ec","from":"AIR-CC0117ACB7@a39157a66d3ab446","to":"REQ-f42f61e7841580753d26@11dde61b9a43868d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 5(1)(f)"},"fromKeys":["AIR-CC0117ACB7@a39157a66d3ab446"],"toKeys":["REQ-f42f61e7841580753d26@11dde61b9a43868d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ced2a7c8258e982be35d72ee","from":"AIR-5D8AD7CDE4@25322c901b420703","to":"REQ-5442ab309dbdeaf0d695@7650f6171b372b85","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 4(4)"},"fromKeys":["AIR-5D8AD7CDE4@25322c901b420703"],"toKeys":["REQ-5442ab309dbdeaf0d695@7650f6171b372b85"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8cdd1747c81ba5aa3644219f","from":"AIR-8EDD597B2C@f5caafd8854d2856","to":"REQ-120a7381e4c5b8772065@e9fcc61b32d4851d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 12(1)"},"fromKeys":["AIR-8EDD597B2C@f5caafd8854d2856"],"toKeys":["REQ-120a7381e4c5b8772065@e9fcc61b32d4851d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6f84143c1e8091680183a7ed","from":"AIR-974125D9F2@87ea56034db7850c","to":"REQ-779b1a72cab2f5fe3dab@47d9ca3154303149","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 44"},"fromKeys":["AIR-974125D9F2@87ea56034db7850c"],"toKeys":["REQ-779b1a72cab2f5fe3dab@47d9ca3154303149"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-daf76e4a8cf20be148597cde","from":"AIR-3A61647692@f0f14c77d6718ec7","to":"REQ-aeb6c81679f4ddb98944@20a6b1c276d38482","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 6.1"},"fromKeys":["AIR-3A61647692@f0f14c77d6718ec7"],"toKeys":["REQ-aeb6c81679f4ddb98944@20a6b1c276d38482"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5a9bbad387f0c5c2fbbeff60","from":"AIR-5EF003576B@fd8937807d4dd124","to":"REQ-73cc00af69e823ad4e6a@bed58eec4f05746a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"harvard-genai-guidelines@42cacddb870d","locator":"Use approved tools, bullet 2"},"fromKeys":["AIR-5EF003576B@fd8937807d4dd124"],"toKeys":["REQ-73cc00af69e823ad4e6a@bed58eec4f05746a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c51c868dfc84152bdee678c3","from":"AIR-E05F392822@de62189c90557ced","to":"REQ-de9ce9ced245f2a75f05@5ee36eff3af034fb","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"omb-m-25-22@9224fb5053c1","locator":"4(d)(ii)(E)"},"fromKeys":["AIR-E05F392822@de62189c90557ced"],"toKeys":["REQ-de9ce9ced245f2a75f05@5ee36eff3af034fb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d967f1b969a1e1cba44c8500","from":"AIR-A80EF3B4B0@98587c97b69b08d7","to":"REQ-056c4c0f7228e3f516a3@ef1d5b4d1d4e7378","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"omb-m-26-04@8cd9a5e0e73d","locator":"Appendix A.1(A)(i)"},"fromKeys":["AIR-A80EF3B4B0@98587c97b69b08d7"],"toKeys":["REQ-056c4c0f7228e3f516a3@ef1d5b4d1d4e7378"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-451d2a8f4e30c1268bf553d5","from":"AIR-21AFA15D02@a7811294bc65a07f","to":"REQ-bbd838118adde1e3421d@e7ddb70631fec6e5","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"omb-m-26-04@8cd9a5e0e73d","locator":"Agency Actions (c)"},"fromKeys":["AIR-21AFA15D02@a7811294bc65a07f"],"toKeys":["REQ-bbd838118adde1e3421d@e7ddb70631fec6e5"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d632070daa10c38cea7717c4","from":"AIR-8312DD76DB@0295ab913e4e3e62","to":"REQ-f3023c9b3830d8d83880@1d26fea4a6986df0","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 6.2"},"fromKeys":["AIR-8312DD76DB@0295ab913e4e3e62"],"toKeys":["REQ-f3023c9b3830d8d83880@1d26fea4a6986df0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-25dc3ebe828d18cea76e08fc","from":"AIR-746FA0104C@5f1458d4a3aacef2","to":"REQ-abf3c145640b3dba6c72@5467a7092de6e3d3","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Manage 3.1"},"fromKeys":["AIR-746FA0104C@5f1458d4a3aacef2"],"toKeys":["REQ-abf3c145640b3dba6c72@5467a7092de6e3d3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-491a5942f993c80b2685adcc","from":"AIR-69B1D0BD8A@60600a5b89d7c7bd","to":"REQ-8598c3a442b8d508dcae@64582f81e66b8fe5","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cisa-ncsc-secure-ai-development@d0ff5974b6aa","locator":"Secure development / assets"},"fromKeys":["AIR-69B1D0BD8A@60600a5b89d7c7bd"],"toKeys":["REQ-8598c3a442b8d508dcae@64582f81e66b8fe5"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9e71e42d0d5d31077d658a0e","from":"AIR-4EB0C43D04@c2e0b8c3781c5053","to":"REQ-5cc8529e6645a60c36f4@0868c484372da460","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Manage 4.3"},"fromKeys":["AIR-4EB0C43D04@c2e0b8c3781c5053"],"toKeys":["REQ-5cc8529e6645a60c36f4@0868c484372da460"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b816f2b93ed2717b4dc98951","from":"AIR-EB5574CE22@27c89c0bee804f65","to":"REQ-467840673618bb9f7953@22960d5347e6ec00","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-genai-profile@735d08bf9863","locator":"GV-6.2-002"},"fromKeys":["AIR-EB5574CE22@27c89c0bee804f65"],"toKeys":["REQ-467840673618bb9f7953@22960d5347e6ec00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-61c1448f447a8fba8010daca","from":"AIR-E358CEFA41@80b6874b881ca2de","to":"REQ-174d5a7bbfbd13819e2d@7fa68be56f3f92d1","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 4.3"},"fromKeys":["AIR-E358CEFA41@80b6874b881ca2de"],"toKeys":["REQ-174d5a7bbfbd13819e2d@7fa68be56f3f92d1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1c4bef22ba3564961617c2b7","from":"AIR-0E39923F61@8a2f4d6b72dc1f31","to":"REQ-dc337ed3c5db722dd55f@12b45ce509ac6abe","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 4.1"},"fromKeys":["AIR-0E39923F61@8a2f4d6b72dc1f31"],"toKeys":["REQ-dc337ed3c5db722dd55f@12b45ce509ac6abe"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-244786ab8fcedb829ff80e80","from":"AIR-347AC3B548@e04bac9bfaafb68a","to":"REQ-263c38f46459c8a626d5@e8837b96b7f366ee","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Manage 2.4"},"fromKeys":["AIR-347AC3B548@e04bac9bfaafb68a"],"toKeys":["REQ-263c38f46459c8a626d5@e8837b96b7f366ee"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3d5c3fe3d462ff633fb27ece","from":"AIR-FC4DFA8060@27a742230b44339c","to":"REQ-e53bbcca689b8f323e93@46a4db01cb5635c5","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 2.6"},"fromKeys":["AIR-FC4DFA8060@27a742230b44339c"],"toKeys":["REQ-e53bbcca689b8f323e93@46a4db01cb5635c5"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6344b8cb6814733ffde1a569","from":"AIR-EBC5423CFD@2d0f74d7690e4f19","to":"REQ-c72315a9a8f4084a11c1@55b1d03043877e0d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nc-public-genai@fdb108006ef7","locator":"p.5, reporting, bullet 2"},"fromKeys":["AIR-EBC5423CFD@2d0f74d7690e4f19"],"toKeys":["REQ-c72315a9a8f4084a11c1@55b1d03043877e0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b4d512cef2f16f4ed1d60765","from":"AIR-F24F48122C@cabc825842e76334","to":"REQ-f056e68e74cd6129b4b5@be6395e8318bc3c9","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-genai-profile@735d08bf9863","locator":"GV-1.3-007"},"fromKeys":["AIR-F24F48122C@cabc825842e76334"],"toKeys":["REQ-f056e68e74cd6129b4b5@be6395e8318bc3c9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-029fcc809e9359b54f55fead","from":"AIR-4EE1F0E0DF@12b3a10bf8dfe8e7","to":"REQ-ca8c2e871d2be4009911@3c2bea82e2ec5a29","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 73(1)"},"fromKeys":["AIR-4EE1F0E0DF@12b3a10bf8dfe8e7"],"toKeys":["REQ-ca8c2e871d2be4009911@3c2bea82e2ec5a29"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bfbb906e6ad91315e008a372","from":"AIR-D711D2E5E0@0561cd3d226d57ce","to":"REQ-ac653975bb55378efd48@50eb4dfc8fb1dea4","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 55(1)(c)"},"fromKeys":["AIR-D711D2E5E0@0561cd3d226d57ce"],"toKeys":["REQ-ac653975bb55378efd48@50eb4dfc8fb1dea4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-864a14c9114560ce9098511d","from":"AIR-D1FFF5F35C@a4bcaf0acdb8196c","to":"REQ-160c858f2ef5d65b3318@122c8a471667fc8d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 5(1)(a)"},"fromKeys":["AIR-D1FFF5F35C@a4bcaf0acdb8196c"],"toKeys":["REQ-160c858f2ef5d65b3318@122c8a471667fc8d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ee3301f9450ecd7405c0fb23","from":"AIR-BB06F70AC1@ff157b8672270cb8","to":"REQ-348789e582add9620486@3dba0b769137c214","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 55(1)(d)"},"fromKeys":["AIR-BB06F70AC1@ff157b8672270cb8"],"toKeys":["REQ-348789e582add9620486@3dba0b769137c214"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7f6cd6ac40c2211d43b7c49a","from":"AIR-63476788C2@c32c1f927a34ffb2","to":"REQ-b12ae43539e29e787d6e@e2a2ba7c0133ba9a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 15(5)"},"fromKeys":["AIR-63476788C2@c32c1f927a34ffb2"],"toKeys":["REQ-b12ae43539e29e787d6e@e2a2ba7c0133ba9a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ec9e8c273a2cbb1c74cf34a7","from":"AIR-B8B189C1E1@00ac86f13ce23247","to":"REQ-f1d1766ca409cb1b94ad@97d1f739e1ee6c9d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 2.7"},"fromKeys":["AIR-B8B189C1E1@00ac86f13ce23247"],"toKeys":["REQ-f1d1766ca409cb1b94ad@97d1f739e1ee6c9d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-851b09de0f9999bd6849e4d8","from":"AIR-5D6EB58CC1@99e40328d1f59817","to":"REQ-e630840a32d158142e76@6c0fb79fd142c439","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 5(1)(b)"},"fromKeys":["AIR-5D6EB58CC1@99e40328d1f59817"],"toKeys":["REQ-e630840a32d158142e76@6c0fb79fd142c439"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1071f1e4f0cbc794637c6c54","from":"AIR-80606F42F7@b2d872cf597227e9","to":"REQ-2b38626f08e9745e834f@54b6d3ea178d83ed","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-gdpr@86540090d955","locator":"Article 32(1)"},"fromKeys":["AIR-80606F42F7@b2d872cf597227e9"],"toKeys":["REQ-2b38626f08e9745e834f@54b6d3ea178d83ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b9d784bc97eda5641bbd4b58","from":"AIR-49A6A9BEE4@a4d44b5353204e1b","to":"REQ-4baa93d7db267e71b543@bd2470399ea78f2f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"brookline-genai@8fce56b19d84","locator":"Use, prohibited-data bullet"},"fromKeys":["AIR-49A6A9BEE4@a4d44b5353204e1b"],"toKeys":["REQ-4baa93d7db267e71b543@bd2470399ea78f2f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-34998068d7ea31cf6222b5ea","from":"AIR-95F550699A@ee442d9172f563a6","to":"REQ-2db7c466c4751facea1d@07a343fb4018ba53","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nc-public-genai@fdb108006ef7","locator":"p.5, reporting, bullet 1"},"fromKeys":["AIR-95F550699A@ee442d9172f563a6"],"toKeys":["REQ-2db7c466c4751facea1d@07a343fb4018ba53"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c8b00dbaa51c6aae0e1f0035","from":"AIR-8D76274A01@40d42229a0510505","to":"REQ-f437100d0da2c6b29128@f803388d3665d05f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nc-public-genai@fdb108006ef7","locator":"p.5, data sharing, bullet 3"},"fromKeys":["AIR-8D76274A01@40d42229a0510505"],"toKeys":["REQ-f437100d0da2c6b29128@f803388d3665d05f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d79a729f28bfae6b91853317","from":"AIR-8D76274A01@40d42229a0510505","to":"REQ-a48c27ef5d29a8fc549f@736480c134f1f07e","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"brookline-genai@8fce56b19d84","locator":"Use, bullet 1"},"fromKeys":["AIR-8D76274A01@40d42229a0510505"],"toKeys":["REQ-a48c27ef5d29a8fc549f@736480c134f1f07e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0e0f6b077c2cf589e1d6e4b8","from":"AIR-0029859136@3d4d358d3575ab26","to":"REQ-2605f914435bf43244cb@691df22ed6b2af71","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 17"},"fromKeys":["AIR-0029859136@3d4d358d3575ab26"],"toKeys":["REQ-2605f914435bf43244cb@691df22ed6b2af71"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e95a2a1a87e6e81613534a35","from":"AIR-D67362ED3A@462abb625892a08e","to":"REQ-98264a78a4d42fcc9ba6@fb16c962b028817d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 4(3)"},"fromKeys":["AIR-D67362ED3A@462abb625892a08e"],"toKeys":["REQ-98264a78a4d42fcc9ba6@fb16c962b028817d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0fcde95830cf5e8cea20d012","from":"AIR-50E6F7AEC2@782d3ec5f5a25e1c","to":"REQ-8439f2b76fbf6e2d0ece@82f36d83fd21c7b3","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"va-ai-ea400@2e593dc57bbb","locator":"p.6, Approval Workflow / Exemptions"},"fromKeys":["AIR-50E6F7AEC2@782d3ec5f5a25e1c"],"toKeys":["REQ-8439f2b76fbf6e2d0ece@82f36d83fd21c7b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1a1e53e16826acdd3bc2bfd8","from":"AIR-59B6D94E34@f9b40f179c9acbff","to":"REQ-0ddbfcb7b02544b6212b@bb224a6d769cc96d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ssdf-1-1@50330a194ff2","locator":"RV.1.1"},"fromKeys":["AIR-59B6D94E34@f9b40f179c9acbff"],"toKeys":["REQ-0ddbfcb7b02544b6212b@bb224a6d769cc96d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d486d13828b61f537b4bbdb0","from":"AIR-BC2EBDF815@ba5cacc272d0c8ff","to":"REQ-79732c610c2ebbd687a5@e0a75e7d6267c1ef","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ssdf-1-1@50330a194ff2","locator":"RV.1.1"},"fromKeys":["AIR-BC2EBDF815@ba5cacc272d0c8ff"],"toKeys":["REQ-79732c610c2ebbd687a5@e0a75e7d6267c1ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-02e6bbdd2d1a0d2240b6d3f5","from":"AIR-F52DD6D81F@f56b78a67bafc8d2","to":"REQ-6033201d3b529672237c@25f838d0d0333610","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-genai-profile@735d08bf9863","locator":"GV-1.5-001"},"fromKeys":["AIR-F52DD6D81F@f56b78a67bafc8d2"],"toKeys":["REQ-6033201d3b529672237c@25f838d0d0333610"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-04a6c1e99f01bcb9181d80e6","from":"AIR-9B0903C354@7f143d94576da7f6","to":"REQ-cda255d44215b60ea5dc@66dffb078f9d0ba0","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 8"},"fromKeys":["AIR-9B0903C354@7f143d94576da7f6"],"toKeys":["REQ-cda255d44215b60ea5dc@66dffb078f9d0ba0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-917a53f7272010d7833827b7","from":"AIR-B8A087CCC2@0f50cbbae66bbfd9","to":"REQ-c7956512fcbfa445d58f@3ee4881d79ad119a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 13(1)"},"fromKeys":["AIR-B8A087CCC2@0f50cbbae66bbfd9"],"toKeys":["REQ-c7956512fcbfa445d58f@3ee4881d79ad119a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fb023e1f09a37dddb482fa1b","from":"AIR-8530787112@ba8fd4d18125f749","to":"REQ-cf1d9320a4583657a8b5@ca84a4d538d41dae","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"eu-ai-act@587d350ccaee","locator":"Article 50(4)"},"fromKeys":["AIR-8530787112@ba8fd4d18125f749"],"toKeys":["REQ-cf1d9320a4583657a8b5@ca84a4d538d41dae"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ec9d8c587067d9601f656887","from":"AIR-0A0DBE76B1@7670d7e907c28472","to":"REQ-f24fc6449230da5e49fa@fb128f87d22daf5e","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Govern 1.4"},"fromKeys":["AIR-0A0DBE76B1@7670d7e907c28472"],"toKeys":["REQ-f24fc6449230da5e49fa@fb128f87d22daf5e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2dd23869ff540153c1cfff55","from":"AIR-2C63EF342D@baf1d5a6e6a95322","to":"REQ-07177b727288ebbe340c@db87e2d16fb4d8f6","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-genai-profile@735d08bf9863","locator":"GV-1.4-002"},"fromKeys":["AIR-2C63EF342D@baf1d5a6e6a95322"],"toKeys":["REQ-07177b727288ebbe340c@db87e2d16fb4d8f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0111c2cfc5d0c1151ed15243","from":"AIR-0CD56857BE@bfb7684b32e64d32","to":"REQ-32ecf25eab15b50fe99b@c7800852d6532c1a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 8"},"fromKeys":["AIR-0CD56857BE@bfb7684b32e64d32"],"toKeys":["REQ-32ecf25eab15b50fe99b@c7800852d6532c1a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d8c813ea6b4e50a6fcee65d7","from":"AIR-2D2E913625@fed32907e88d1244","to":"REQ-aaddd5302a0acc74d662@8d04001e8ba5777a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 2.8"},"fromKeys":["AIR-2D2E913625@fed32907e88d1244"],"toKeys":["REQ-aaddd5302a0acc74d662@8d04001e8ba5777a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b338076c898334d7be0a1b36","from":"AIR-BDE09E3088@51e3e0c4ac111b76","to":"REQ-f2e7e3486f92cfea755b@2f568c3313743b0c","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"va-ai-ea400@2e593dc57bbb","locator":"p.5, Ethical Use"},"fromKeys":["AIR-BDE09E3088@51e3e0c4ac111b76"],"toKeys":["REQ-f2e7e3486f92cfea755b@2f568c3313743b0c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0922ac281bf5a6fcaaf3529c","from":"AIR-87BEC56E72@d70d49b2d92c4378","to":"REQ-498e40d0fc895b3c3bd2@f8ddc77f4222295e","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"nist-ai-rmf-1@eeff9d803ee6","locator":"Measure 2.9"},"fromKeys":["AIR-87BEC56E72@d70d49b2d92c4378"],"toKeys":["REQ-498e40d0fc895b3c3bd2@f8ddc77f4222295e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3197ff0e2d58d88f844e24b5","from":"AIR-5CE518437C@c4b0b36befd2d652","to":"REQ-bba500d608f066a97d96@35f791969523f64d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 4(5)"},"fromKeys":["AIR-5CE518437C@c4b0b36befd2d652"],"toKeys":["REQ-bba500d608f066a97d96@35f791969523f64d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1597decdf7678a96db10eed6","from":"AIR-1DD5F7B4C4@6a3dcdef0815bf45","to":"REQ-3b1cc690c87818d732e6@f591072a9626501a","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 12"},"fromKeys":["AIR-1DD5F7B4C4@6a3dcdef0815bf45"],"toKeys":["REQ-3b1cc690c87818d732e6@f591072a9626501a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d0fcd5a53b20a628df2e4755","from":"AIR-66E5FC0789@4a2300431d80ddac","to":"REQ-cf1d75d38c87cdd0f602@d4b6792523755de5","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"brookline-genai@8fce56b19d84","locator":"Use, transparency bullet"},"fromKeys":["AIR-66E5FC0789@4a2300431d80ddac"],"toKeys":["REQ-cf1d75d38c87cdd0f602@d4b6792523755de5"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-85ad7a121cdcfd4c3a31e4ca","from":"AIR-7F72121E8B@b050cce0ee004acb","to":"REQ-5a6275e7354ec46259ca@5aabc768f7c61dc6","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"ca-automated-decisions@025abfffca33","locator":"6.2.2"},"fromKeys":["AIR-7F72121E8B@b050cce0ee004acb"],"toKeys":["REQ-5a6275e7354ec46259ca@5aabc768f7c61dc6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dacbac5f7e897dc5b482a62c","from":"AIR-E28075A396@c05f72a406998f94","to":"REQ-746db119181e95815a8d@3aa0e02c00c6c11f","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"pa-ai-2026@f9ebb0c412ba","locator":"5.2.4, pp.6–7"},"fromKeys":["AIR-E28075A396@c05f72a406998f94"],"toKeys":["REQ-746db119181e95815a8d@3aa0e02c00c6c11f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aa1ad86f116828ec41068786","from":"AIR-9F12707A1E@3404b8d82f57c69f","to":"REQ-953e83bcb3054c5e86c6@238f394e4891678d","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"ca-automated-decisions@025abfffca33","locator":"6.2.1"},"fromKeys":["AIR-9F12707A1E@3404b8d82f57c69f"],"toKeys":["REQ-953e83bcb3054c5e86c6@238f394e4891678d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-92fba7881aa9b26f3cd930ba","from":"AIR-634CB1FAE6@9c443d797f303d0a","to":"REQ-e95210aad29d53fa234e@82771e923f9bf4ea","kind":"SUPPORTED_BY_SOURCE_REQUIREMENT","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceKey":"cn-genai-interim@d7fc895a372e","locator":"Article 8"},"fromKeys":["AIR-634CB1FAE6@9c443d797f303d0a"],"toKeys":["REQ-e95210aad29d53fa234e@82771e923f9bf4ea"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-91cb6383a525eaf3ef6ee936","from":"MS-RULE-DP-01","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"IA-5; AC-4","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!5:5","fromKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-daa8afb348cd06f239df3c34","from":"MS-RULE-DP-01","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"PR.AA; PR.DS","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!6:6","fromKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1651e317b12a9484606858f8","from":"MS-RULE-DP-01","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM02 Sensitive Information Disclosure","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!7:7","fromKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6b81557720c873dac2ecb7fa","from":"MS-RULE-DP-02","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"IA-5","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!8:8","fromKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1f1447a4209b5b04df155d61","from":"MS-RULE-DP-02","to":"FW-PCI-DSS","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Requirements 7–8","publisherUrl":"https://www.pcisecuritystandards.org/standards/pci-dss/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!9:9","fromKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"toKeys":["FW-PCI-DSS@26b432290466d636","FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9bdf864be36834ac632fde96","from":"MS-RULE-DP-02","to":"FW-GLBA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"16 CFR 314.4","publisherUrl":"https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!10:10","fromKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"toKeys":["FW-GLBA@ce5eb5a36e567a3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-73518142b485b52eef741c25","from":"MS-RULE-DP-03","to":"FW-PCI-DSS","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Req. 3.4 and 4","publisherUrl":"https://www.pcisecuritystandards.org/standards/pci-dss/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!11:11","fromKeys":["MS-RULE-DP-03@4cbb47b109e98f4a"],"toKeys":["FW-PCI-DSS@26b432290466d636","FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-32b7da873148a62de7e92ec4","from":"MS-RULE-DP-03","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM02","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!12:12","fromKeys":["MS-RULE-DP-03@4cbb47b109e98f4a"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2fe9b1ff1b06456b08f7bcbc","from":"MS-RULE-DP-04","to":"FW-PCI-DSS","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Req. 3.3.1","publisherUrl":"https://www.pcisecuritystandards.org/standards/pci-dss/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!13:13","fromKeys":["MS-RULE-DP-04@13c6ba85197d9a69"],"toKeys":["FW-PCI-DSS@26b432290466d636","FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f1394df5a041bfa1f7dea060","from":"MS-RULE-DP-04","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM02","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!14:14","fromKeys":["MS-RULE-DP-04@13c6ba85197d9a69"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7f6456b895d86b0a92b5b6fb","from":"MS-RULE-DP-05","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5, 25, 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!15:15","fromKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e4572afb285e36b459ee94ae","from":"MS-RULE-DP-05","to":"FW-HIPAA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"45 CFR 164.514(b) identifiers","publisherUrl":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!16:16","fromKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"toKeys":["FW-HIPAA@024563eb5b7c33a6","FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2db21b3bedf629df33d44601","from":"MS-RULE-DP-05","to":"FW-FERPA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"34 CFR 99.3","publisherUrl":"https://studentprivacy.ed.gov/ferpa","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!17:17","fromKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"toKeys":["FW-FERPA@adba7da3b8b49ee6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4912c51dd15f4307be6bc0ad","from":"MS-RULE-DP-06","to":"FW-GLBA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"16 CFR 314.4","publisherUrl":"https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!18:18","fromKeys":["MS-RULE-DP-06@af062b3863346b41"],"toKeys":["FW-GLBA@ce5eb5a36e567a3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-089734d83fe06e2551b2c33a","from":"MS-RULE-DP-06","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5 and 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!19:19","fromKeys":["MS-RULE-DP-06@af062b3863346b41"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fa983caeac9e5db23b3e485a","from":"MS-RULE-DP-07","to":"FW-HIPAA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"45 CFR 164.502; 164.308; 164.312","publisherUrl":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!20:20","fromKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"toKeys":["FW-HIPAA@024563eb5b7c33a6","FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-44aae323c35e7266548702cf","from":"MS-RULE-DP-07","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Data Privacy risk actions","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!21:21","fromKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c7cbdcb695602347cfd1ba07","from":"MS-RULE-DP-08","to":"FW-FERPA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"34 CFR 99.30; 99.37","publisherUrl":"https://studentprivacy.ed.gov/ferpa","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!22:22","fromKeys":["MS-RULE-DP-08@f94b476097640eb3"],"toKeys":["FW-FERPA@adba7da3b8b49ee6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-19d072f281710c701ee102a3","from":"MS-RULE-DP-08","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Data Privacy","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!23:23","fromKeys":["MS-RULE-DP-08@f94b476097640eb3"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1fc68f136f057d71dc43b919","from":"MS-RULE-DP-09","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5, 25, 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!24:24","fromKeys":["MS-RULE-DP-09@e32553c4840951b3"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4df2a2a358056b169912cddc","from":"MS-RULE-DP-09","to":"FW-CCPA-CPRA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Personal information; reasonable security","publisherUrl":"https://cppa.ca.gov/regulations/ccpa_updates.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!25:25","fromKeys":["MS-RULE-DP-09@e32553c4840951b3"],"toKeys":["FW-CCPA-CPRA@2726437e0cff599a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e56edb7e2bb2f295c5c1361a","from":"MS-RULE-DP-09","to":"FW-HIPAA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"45 CFR 164.514(b)","publisherUrl":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!26:26","fromKeys":["MS-RULE-DP-09@e32553c4840951b3"],"toKeys":["FW-HIPAA@024563eb5b7c33a6","FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d2956873dfdc078e3f4fc7fe","from":"MS-RULE-DP-10","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 9, 25, 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!27:27","fromKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-641718a034226bd42632bfdc","from":"MS-RULE-DP-10","to":"FW-CCPA-CPRA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Sensitive personal information","publisherUrl":"https://cppa.ca.gov/regulations/ccpa_updates.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!28:28","fromKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"toKeys":["FW-CCPA-CPRA@2726437e0cff599a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f9cc0a7a3ef9441c391763db","from":"MS-RULE-DP-10","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5, 9, 10","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!29:29","fromKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f35f4e5677a19cb0f58d1f51","from":"MS-RULE-DP-11","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5, 25, 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!30:30","fromKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ac6666d816679918deb79866","from":"MS-RULE-DP-11","to":"FW-CCPA-CPRA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Sensitive personal information","publisherUrl":"https://cppa.ca.gov/regulations/ccpa_updates.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!31:31","fromKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"toKeys":["FW-CCPA-CPRA@2726437e0cff599a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c830c2df74d721ee7888f6e6","from":"MS-RULE-DP-12","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AC-4; MP; SC families","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!32:32","fromKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ce4610b237f8d745ad56c873","from":"MS-RULE-DP-12","to":"FW-FEDRAMP","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Information-flow and boundary controls","publisherUrl":"https://www.fedramp.gov/archive/2023-05-30-rev-5-baselines-have-been-approved-and-released/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!33:33","fromKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"toKeys":["FW-FEDRAMP@0431d549dd6dc7e6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2e026c57e71cdd2fdefc67e0","from":"MS-RULE-DP-13","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AC-4; PL-8","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!34:34","fromKeys":["MS-RULE-DP-13@1299bbf89c50bd1a"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4cde5c06c3df80ddde03db23","from":"MS-RULE-DP-13","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Agency risk management","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!35:35","fromKeys":["MS-RULE-DP-13@1299bbf89c50bd1a"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-22349dc6b37ffdeb887c01d1","from":"MS-RULE-DP-14","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"C1.1 Confidentiality","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!36:36","fromKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ffe6781ea625e9601e1e9e9f","from":"MS-RULE-DP-14","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"PR.DS","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!37:37","fromKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8e15200565075753a66d5ef2","from":"MS-RULE-DP-14","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM02","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!38:38","fromKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-21647c4c85b72cd86e7691d3","from":"MS-RULE-DP-15","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"ID.RA; PR.PS","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!39:39","fromKeys":["MS-RULE-DP-15@208a0f796d79405e"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e8912d9c223897886080af0f","from":"MS-RULE-DP-15","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"CM-8; RA-5; SC-7","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!40:40","fromKeys":["MS-RULE-DP-15@208a0f796d79405e"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b8681ce3827d1362294bc946","from":"MS-RULE-DP-15","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"CC4.2; CC6","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!41:41","fromKeys":["MS-RULE-DP-15@208a0f796d79405e"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f07dc1446c4a68d1d5bec2ae","from":"MS-RULE-DP-16","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"C1.1; P-series","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!42:42","fromKeys":["MS-RULE-DP-16@d0dca88853814a51"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b59166574f24e21658beeb97","from":"MS-RULE-DP-16","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5 and 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!43:43","fromKeys":["MS-RULE-DP-16@d0dca88853814a51"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0eca5e4a283e20db6ff17515","from":"MS-RULE-DP-16","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Data Privacy","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!44:44","fromKeys":["MS-RULE-DP-16@d0dca88853814a51"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2c382276389e41451f7ba4a5","from":"MS-RULE-DP-17","to":"FW-SOX","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Reporting integrity / ICFR","publisherUrl":"https://www.sec.gov/spotlight/sarbanes-oxley.htm","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!45:45","fromKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"toKeys":["FW-SOX@6b53f8d76c60deb9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-86ba4721604308e93031a554","from":"MS-RULE-DP-17","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Confidentiality","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!46:46","fromKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-06032e8e7bf0465a723407a4","from":"MS-RULE-DP-18","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"C1.1","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!47:47","fromKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ba110f0b8c6163231618bb4","from":"MS-RULE-DP-18","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"PR.DS","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!48:48","fromKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-70ad5fb30d2f2143f5e4eaf4","from":"MS-RULE-AU-01","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Approved GAI provider lists","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!49:49","fromKeys":["MS-RULE-AU-01@32b7d4ac14b06f7b"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-13408f760a29d1eecd92a1a2","from":"MS-RULE-AU-01","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"GV.SC; ID.AM","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!50:50","fromKeys":["MS-RULE-AU-01@32b7d4ac14b06f7b"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9133bbeb1af19cb65cecfafe","from":"MS-RULE-AU-02","to":"FW-GLBA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"16 CFR 314.4; MFA","publisherUrl":"https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!51:51","fromKeys":["MS-RULE-AU-02@1a166eaeb8f7f1ad"],"toKeys":["FW-GLBA@ce5eb5a36e567a3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aea6e024cef39eccc6b4e6f7","from":"MS-RULE-AU-02","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"IA-2; IA-5","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!52:52","fromKeys":["MS-RULE-AU-02@1a166eaeb8f7f1ad"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-edd117060a73558c9900f077","from":"MS-RULE-AU-02","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"PR.AA","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!53:53","fromKeys":["MS-RULE-AU-02@1a166eaeb8f7f1ad"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c42a423e0de38642a697fd37","from":"MS-RULE-AU-03","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AC-2; AC-3; AC-6","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!54:54","fromKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e8f75287f8c81dec12415f57","from":"MS-RULE-AU-03","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"CC6.1","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!55:55","fromKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2b076195606bf59b9509157e","from":"MS-RULE-AU-04","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 9 and 26","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!56:56","fromKeys":["MS-RULE-AU-04@d51101a040857487"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d77b218c572dbd21eac55770","from":"MS-RULE-AU-04","to":"FW-ISO-42005","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AI impact assessment","publisherUrl":"https://www.iso.org/standard/42005","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!57:57","fromKeys":["MS-RULE-AU-04@d51101a040857487"],"toKeys":["FW-ISO-42005@b02139bf544ce4bf"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-395faf2a5bbdaa8caa72b6c6","from":"MS-RULE-AU-04","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"High-impact AI practices","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!58:58","fromKeys":["MS-RULE-AU-04@d51101a040857487"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2d1e217d98f81f702ee4e86e","from":"MS-RULE-AU-05","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5, 25, 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!59:59","fromKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3f6de3cf142f64c5b37efd62","from":"MS-RULE-AU-05","to":"FW-OMB-M25-22","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Acquisition and data terms","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!60:60","fromKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"toKeys":["FW-OMB-M25-22@1dd0effe69b2dd83"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ff025fffd4ddb8de61ca87c3","from":"MS-RULE-AU-06","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Third-party and value-chain actions","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!61:61","fromKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-09efa8458fab1e43770bd939","from":"MS-RULE-AU-06","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Confidentiality and privacy","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!62:62","fromKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-48a41e7882e990f91e514ec4","from":"MS-RULE-AU-06","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Purpose limitation","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!63:63","fromKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f7a12a2c33743999d6489a5d","from":"MS-RULE-AU-07","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"IA-2; AC-2","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!64:64","fromKeys":["MS-RULE-AU-07@989c3a6787fc6689"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b8f4606c53c3c6eb2edb305f","from":"MS-RULE-AU-07","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"CC6.1","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!65:65","fromKeys":["MS-RULE-AU-07@989c3a6787fc6689"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b4cc56c998b426a38385d99f","from":"MS-RULE-AU-08","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"ID.AM","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!66:66","fromKeys":["MS-RULE-AU-08@4eda0a221f3ef380"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7048ef28e0e210098e23a029","from":"MS-RULE-AU-08","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Approved provider lists","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!67:67","fromKeys":["MS-RULE-AU-08@4eda0a221f3ef380"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2f9708accc1d3f5848d77b99","from":"MS-RULE-AU-08","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM04 Supply Chain","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!68:68","fromKeys":["MS-RULE-AU-08@4eda0a221f3ef380"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2bd99484c60887dd43e33770","from":"MS-RULE-IN-01","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM01 Prompt Injection","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!69:69","fromKeys":["MS-RULE-IN-01@e4fe11be1a20f12f"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-73e2e30500ea451730c5a5ad","from":"MS-RULE-IN-01","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Information Security risk actions","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!70:70","fromKeys":["MS-RULE-IN-01@e4fe11be1a20f12f"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-69dd56156cd4db38d046885d","from":"MS-RULE-IN-02","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM01","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!71:71","fromKeys":["MS-RULE-IN-02@dbb47a84e8a96c05"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8653b4181c20b512cc8e62ee","from":"MS-RULE-IN-02","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM08 Hidden Context Exposure","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!72:72","fromKeys":["MS-RULE-IN-02@dbb47a84e8a96c05"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-78bb78f35b4275ce2d4628b4","from":"MS-RULE-IN-03","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM01","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!73:73","fromKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e809231fc4666a028b6e48f3","from":"MS-RULE-IN-03","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Pre-deployment testing","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!74:74","fromKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f0845cce3cb89b23278003ca","from":"MS-RULE-IN-04","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Information Security; Dangerous/Violent content","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!75:75","fromKeys":["MS-RULE-IN-04@40341d186f0bd606"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7aa117592b16af8f6fdcd019","from":"MS-RULE-IN-04","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM03 Excessive Agency","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!76:76","fromKeys":["MS-RULE-IN-04@40341d186f0bd606"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-23d592950bda7dd6550f7663","from":"MS-RULE-IN-05","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"PR.DS; DE.CM","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!77:77","fromKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-494d0bca5640ce95361fe362","from":"MS-RULE-IN-05","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM04 Supply Chain","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!78:78","fromKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de04adc800b36f5037f84f44","from":"MS-RULE-IN-06","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM05 Data and Model Poisoning","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!79:79","fromKeys":["MS-RULE-IN-06@478a04da335c1e7f"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-00e196373ce19ff0e8d3c1ae","from":"MS-RULE-IN-06","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM09 Vector and Embedding Weaknesses","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!80:80","fromKeys":["MS-RULE-IN-06@478a04da335c1e7f"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c5ceee89b86d73b410ac71e8","from":"MS-RULE-IN-06","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Data governance and testing","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!81:81","fromKeys":["MS-RULE-IN-06@478a04da335c1e7f"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f8e56d456d34740e78b5f7e5","from":"MS-RULE-IN-07","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Acceptable-use policies","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!82:82","fromKeys":["MS-RULE-IN-07@31e317962beaeb5b"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-afceff8a3f968734198608de","from":"MS-RULE-IN-07","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 9, 13, 26","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!83:83","fromKeys":["MS-RULE-IN-07@31e317962beaeb5b"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-142013d6a74ef06c951c5086","from":"MS-RULE-IN-08","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM06 Unbounded Consumption","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!84:84","fromKeys":["MS-RULE-IN-08@94324ccfd3a491ef"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b673d93d8599c7ff234696d2","from":"MS-RULE-IN-08","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Operational monitoring","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!85:85","fromKeys":["MS-RULE-IN-08@94324ccfd3a491ef"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9eb102808eec8134d6d03ea6","from":"MS-RULE-OU-01","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM02","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!86:86","fromKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-441f1c8841389ae21b8386a1","from":"MS-RULE-OU-01","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Detect PII in outputs","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!87:87","fromKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-40ff2ac5288c627d268db6eb","from":"MS-RULE-OU-01","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 25 and 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!88:88","fromKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a539855aaff6bac35da5e9f5","from":"MS-RULE-OU-02","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM08 Hidden Context Exposure","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!89:89","fromKeys":["MS-RULE-OU-02@4965655028a3d485"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bbe35f96651976e34de965a1","from":"MS-RULE-OU-02","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM02","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!90:90","fromKeys":["MS-RULE-OU-02@4965655028a3d485"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-78b72b5dda6995734d71d756","from":"MS-RULE-OU-03","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM07 Misinformation","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!91:91","fromKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-47aabfbe3a6982c54ec443e7","from":"MS-RULE-OU-03","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Confabulation; source/citation review","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!92:92","fromKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cc28c55d0112b91b69b08916","from":"MS-RULE-OU-04","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 14 and 26","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!93:93","fromKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4bbd7547d70ad8860cc970b0","from":"MS-RULE-OU-04","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Art. 22","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!94:94","fromKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c63a56b5cbfbf2c79b8842e9","from":"MS-RULE-OU-04","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Human oversight and fail-safe","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!95:95","fromKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-63a90f41b7699f0658be65c1","from":"MS-RULE-OU-05","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 9, 10, 15","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!96:96","fromKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-899e60f268db2f58af666b71","from":"MS-RULE-OU-05","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Harmful Bias and Homogenization","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!97:97","fromKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4f6ad727eea760b283e6308b","from":"MS-RULE-OU-05","to":"FW-CO-AI","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"High-risk AI governance","publisherUrl":"https://coag.gov/ai/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!98:98","fromKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"toKeys":["FW-CO-AI@dc656cacb5cb1e38"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d0272211ffc2235994973c51","from":"MS-RULE-OU-06","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Harmful Bias; Human-AI Configuration","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!99:99","fromKeys":["MS-RULE-OU-06@ce0137df984ac601"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-04ceeef136e8f95746b91c21","from":"MS-RULE-OU-07","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Dangerous/Violent or Hateful Content; CBRN","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!100:100","fromKeys":["MS-RULE-OU-07@7d5bc203e83e95c9"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6ee1dac09536557215f40c77","from":"MS-RULE-OU-07","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Art. 5 where applicable","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!101:101","fromKeys":["MS-RULE-OU-07@7d5bc203e83e95c9"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e6d8760c280a687db2fc83f5","from":"MS-RULE-OU-08","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM10 Improper Output Handling","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!102:102","fromKeys":["MS-RULE-OU-08@4c7bb6dc00dfcbfd"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2c9929d3ca2b0ddb41d5143b","from":"MS-RULE-OU-08","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"PR.PS","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!103:103","fromKeys":["MS-RULE-OU-08@4c7bb6dc00dfcbfd"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c994212b27a798469b0ed06e","from":"MS-RULE-OU-09","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM10 Improper Output Handling","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!104:104","fromKeys":["MS-RULE-OU-09@2ffb1322457172b3"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5c89ceb382af20d1028262fe","from":"MS-RULE-OU-09","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Information Security","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!105:105","fromKeys":["MS-RULE-OU-09@2ffb1322457172b3"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fc82a46265fd64d31414bba4","from":"MS-RULE-OU-10","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Intellectual Property","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!106:106","fromKeys":["MS-RULE-OU-10@2332653b89bcd331"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a1232b33965ca26bb24f0f96","from":"MS-RULE-OU-10","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"GPAI transparency obligations","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!107:107","fromKeys":["MS-RULE-OU-10@2332653b89bcd331"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d20fc477c9fb9347dbaec2fc","from":"MS-RULE-OU-11","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5, 25, 32, 35","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!108:108","fromKeys":["MS-RULE-OU-11@0710643d8a955cf6"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-23a21cf70c2aae782fa6556a","from":"MS-RULE-OU-11","to":"FW-HIPAA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"45 CFR 164.514","publisherUrl":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!109:109","fromKeys":["MS-RULE-OU-11@0710643d8a955cf6"],"toKeys":["FW-HIPAA@024563eb5b7c33a6","FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4a9eefe784a2b6089a864333","from":"MS-RULE-OU-12","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Art. 50","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!110:110","fromKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d9e08d12fbfb3b0a2f70b3b1","from":"MS-RULE-OU-12","to":"FW-CO-AI","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Chatbot and AI disclosures","publisherUrl":"https://coag.gov/ai/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!111:111","fromKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"toKeys":["FW-CO-AI@dc656cacb5cb1e38"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a3c22a7ace590db4258bca0c","from":"MS-RULE-OU-12","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Content provenance","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!112:112","fromKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a6c720e8da72cb3f43abad03","from":"MS-RULE-AG-01","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM03 Excessive Agency","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!113:113","fromKeys":["MS-RULE-AG-01@e6aee1767c267990"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-89010dd94428f80297f18a2c","from":"MS-RULE-AG-01","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM04 Supply Chain","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!114:114","fromKeys":["MS-RULE-AG-01@e6aee1767c267990"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b7361cafbd8ff39b01edddbc","from":"MS-RULE-AG-02","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AC-6; IA-5","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!115:115","fromKeys":["MS-RULE-AG-02@d4d178c0433fd6d4"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6c4aff78e7e3c156f0366fca","from":"MS-RULE-AG-02","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM03","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!116:116","fromKeys":["MS-RULE-AG-02@d4d178c0433fd6d4"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5872dd8d20b4177c528b8221","from":"MS-RULE-AG-03","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM03","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!117:117","fromKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b44225b527dfb379956580d6","from":"MS-RULE-AG-03","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Art. 14","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!118:118","fromKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-182f40f77321b86bd9f1e2bd","from":"MS-RULE-AG-03","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Human oversight and fail-safe","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!119:119","fromKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d7ba26d60186b327bbccf7ab","from":"MS-RULE-AG-04","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Art. 22","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!120:120","fromKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-221e4b30b016153872a33321","from":"MS-RULE-AG-04","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 14 and 26","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!121:121","fromKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ab3ffd620fb10221d5743ea8","from":"MS-RULE-AG-04","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"High-impact AI","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!122:122","fromKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0c44e9211ca3028aad45b309","from":"MS-RULE-AG-05","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM03","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!123:123","fromKeys":["MS-RULE-AG-05@8829d873310f18f9"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-40db2436d6152bcd7ed4bc10","from":"MS-RULE-AG-05","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Human-AI Configuration","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!124:124","fromKeys":["MS-RULE-AG-05@8829d873310f18f9"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5762281d812c99b3128b45a5","from":"MS-RULE-AG-06","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM03","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!125:125","fromKeys":["MS-RULE-AG-06@6371f819b40b0d97"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7628608574db7c0bceab7d61","from":"MS-RULE-AG-06","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AC-3; CM-3","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!126:126","fromKeys":["MS-RULE-AG-06@6371f819b40b0d97"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cacce1f63a874fcdd90d6048","from":"MS-RULE-AG-07","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM03; LLM06","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!127:127","fromKeys":["MS-RULE-AG-07@c2fb36c556cb8a62"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b34356baee409a6084428abc","from":"MS-RULE-AG-08","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM08; LLM09","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!128:128","fromKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c982d0900f92592ef9fcea69","from":"MS-RULE-AG-08","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"CC6; Confidentiality","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!129:129","fromKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-df2818303adb7a2e4c5cc37d","from":"MS-RULE-AG-09","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM05; LLM08","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!130:130","fromKeys":["MS-RULE-AG-09@2bd07e82a72d4f2e"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-692eff408e3224fce33bf11e","from":"MS-RULE-AG-09","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5 and 25","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!131:131","fromKeys":["MS-RULE-AG-09@2bd07e82a72d4f2e"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aea2ef343304daa2f9054bf9","from":"MS-RULE-AG-10","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM04","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!132:132","fromKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-11049f90b9d6f32825ceaa30","from":"MS-RULE-AG-10","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"GV.SC; ID.RA","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!133:133","fromKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2ebd0b83f0d25f6a58a80cfa","from":"MS-RULE-OP-01","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Art. 12","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!134:134","fromKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c9bd6f1712bdb519c5a844dc","from":"MS-RULE-OP-01","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AU family","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!135:135","fromKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ebbeae535a75544f5e5749d8","from":"MS-RULE-OP-01","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"CC7","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!136:136","fromKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8711d052110aaf4c6a5122ef","from":"MS-RULE-OP-02","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Content provenance and source review","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!137:137","fromKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-20df401cea7944109be274e0","from":"MS-RULE-OP-02","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 13 and 50","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!138:138","fromKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-48efdd4b496da2590c237ebc","from":"MS-RULE-OP-03","to":"FW-NIST-AI-RMF","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"MEASURE and MANAGE","publisherUrl":"https://www.nist.gov/itl/ai-risk-management-framework","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!139:139","fromKeys":["MS-RULE-OP-03@410599212edc432e"],"toKeys":["FW-NIST-AI-RMF@aba341d53497210b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1a60b754b91801daff99583f","from":"MS-RULE-OP-03","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Ongoing monitoring","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!140:140","fromKeys":["MS-RULE-OP-03@410599212edc432e"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-da28b2e4ebd127f7702831a6","from":"MS-RULE-OP-03","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 9 and 15","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!141:141","fromKeys":["MS-RULE-OP-03@410599212edc432e"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dba71a276de4b89c997045c1","from":"MS-RULE-OP-04","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"RS and RC","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!142:142","fromKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b4b69e551a0390d0047193b4","from":"MS-RULE-OP-04","to":"FW-NIST-AI-RMF","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"MANAGE","publisherUrl":"https://www.nist.gov/itl/ai-risk-management-framework","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!143:143","fromKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"toKeys":["FW-NIST-AI-RMF@aba341d53497210b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-960602d115146577b3354b56","from":"MS-RULE-OP-05","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Fail-safe and discontinuation","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!144:144","fromKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bfa4ff9f57638b20ae58dc58","from":"MS-RULE-OP-05","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Halt systems presenting unacceptable risk","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!145:145","fromKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1cea36c3433dd27af3fd0eb4","from":"MS-RULE-OP-05","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Art. 14","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!146:146","fromKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-85ddd2cac6ae431765c5af65","from":"MS-RULE-OP-06","to":"FW-ISO-5338","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AI system lifecycle","publisherUrl":"https://www.iso.org/standard/81118.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!147:147","fromKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"toKeys":["FW-ISO-5338@5384b7599ab287e8","FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-52517f4ecdb5c50423c9cbe9","from":"MS-RULE-OP-06","to":"FW-ISO-42005","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Impact reassessment","publisherUrl":"https://www.iso.org/standard/42005","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!148:148","fromKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"toKeys":["FW-ISO-42005@b02139bf544ce4bf"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9263f6adf0b7c071027ee245","from":"MS-RULE-OP-06","to":"FW-NIST-AI-RMF","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"GOVERN/MANAGE","publisherUrl":"https://www.nist.gov/itl/ai-risk-management-framework","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!149:149","fromKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"toKeys":["FW-NIST-AI-RMF@aba341d53497210b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5c825be2f98b64e3bc7ee8aa","from":"MS-RULE-OP-07","to":"FW-NIST-AI-RMF","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Risk treatment and accountability","publisherUrl":"https://www.nist.gov/itl/ai-risk-management-framework","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!150:150","fromKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"toKeys":["FW-NIST-AI-RMF@aba341d53497210b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c665656cb49737a92d900481","from":"MS-RULE-OP-07","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"CA-5; risk acceptance context","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!151:151","fromKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-08876729f59c6dbcf1c3683f","from":"MS-RULE-OP-08","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Remedies and human review","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!152:152","fromKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-910e9f447f89c33444f708cb","from":"MS-RULE-OP-08","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 13–15 and 22","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!153:153","fromKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e5cebc03b32ce67ce806976","from":"MS-RULE-OP-08","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Human oversight/transparency","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!154:154","fromKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1bc528129aa6ba278efd8b0d","from":"MS-RULE-OP-09","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"ID.AM","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!155:155","fromKeys":["MS-RULE-OP-09@ec587343b8220a51"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8cc880cd77f2d3c7418083a3","from":"MS-RULE-OP-09","to":"FW-NIST-AI-RMF","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"GOVERN/MAP","publisherUrl":"https://www.nist.gov/itl/ai-risk-management-framework","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!156:156","fromKeys":["MS-RULE-OP-09@ec587343b8220a51"],"toKeys":["FW-NIST-AI-RMF@aba341d53497210b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-006b530bf6bcea845c90d3b4","from":"MS-RULE-OP-09","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Annual AI use-case inventory","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!157:157","fromKeys":["MS-RULE-OP-09@ec587343b8220a51"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-52690803977f607ab0b6dd0c","from":"MS-RULE-OP-10","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM04","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!158:158","fromKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-32b8032d071ee214d9491e82","from":"MS-RULE-OP-10","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"GV.SC","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!159:159","fromKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bbd2b80a62e3e3a1d6a301ae","from":"MS-RULE-OP-10","to":"FW-OMB-M25-22","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AI acquisition","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!160:160","fromKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"toKeys":["FW-OMB-M25-22@1dd0effe69b2dd83"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8505e63d911718b7682ce895","from":"MS-RULE-OP-11","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5 and 17","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!161:161","fromKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-31ed6debe7412ebd01706e09","from":"MS-RULE-OP-11","to":"FW-ISO-5338","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Lifecycle processes","publisherUrl":"https://www.iso.org/standard/81118.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!162:162","fromKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"toKeys":["FW-ISO-5338@5384b7599ab287e8","FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3f793cd3dcb1e80260c8ab55","from":"MS-RULE-OP-11","to":"FW-NIST-AI-RMF","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"MANAGE","publisherUrl":"https://www.nist.gov/itl/ai-risk-management-framework","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!163:163","fromKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"toKeys":["FW-NIST-AI-RMF@aba341d53497210b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a7a2a95906c2654c38b9d2a4","from":"MS-RULE-OP-12","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Pre-deployment testing; go/no-go thresholds","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!164:164","fromKeys":["MS-RULE-OP-12@04d0287d10225094"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0c0a15fb4e1eae722b22e93c","from":"MS-RULE-OP-12","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 9 and 15","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!165:165","fromKeys":["MS-RULE-OP-12@04d0287d10225094"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-becd6b422809e007684cca87","from":"MS-RULE-OP-12","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Pre-deployment testing and independent review","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'06 Rule Framework Map'!166:166","fromKeys":["MS-RULE-OP-12@04d0287d10225094"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-df0f28b58c135a1ae0f6f08d","from":"TAIM-GOVERN-1.1@35b911ad2aa6f0f1","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!5:5","fromKeys":["TAIM-GOVERN-1.1@35b911ad2aa6f0f1"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ebf9c7b101667ccb4c92330f","from":"TAIM-GOVERN-1.1@35b911ad2aa6f0f1","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!5:5","fromKeys":["TAIM-GOVERN-1.1@35b911ad2aa6f0f1"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1a1e59f6496ba1bc0e21d7d8","from":"TAIM-GOVERN-1.3@6129b834f8908bde","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!7:7","fromKeys":["TAIM-GOVERN-1.3@6129b834f8908bde"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5a62a81d2ddf9244311780b3","from":"TAIM-GOVERN-1.3@6129b834f8908bde","to":"MS-RULE-OP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!7:7","fromKeys":["TAIM-GOVERN-1.3@6129b834f8908bde"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-897c18698615964dd2f05d3a","from":"TAIM-GOVERN-1.4@2cf04928037dcfee","to":"MS-RULE-OU-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!8:8","fromKeys":["TAIM-GOVERN-1.4@2cf04928037dcfee"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6b19c7dd229b3c4e3ea697b5","from":"TAIM-GOVERN-1.4@2cf04928037dcfee","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!8:8","fromKeys":["TAIM-GOVERN-1.4@2cf04928037dcfee"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e87321d19d193b947c5a91ee","from":"TAIM-GOVERN-1.4@2cf04928037dcfee","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!8:8","fromKeys":["TAIM-GOVERN-1.4@2cf04928037dcfee"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-54e4ba5a775437c7b44b8451","from":"TAIM-GOVERN-1.4@2cf04928037dcfee","to":"MS-RULE-OP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!8:8","fromKeys":["TAIM-GOVERN-1.4@2cf04928037dcfee"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2eaf925054dc9ffe8e6d726d","from":"TAIM-GOVERN-1.5@92357b32e10b5e02","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!9:9","fromKeys":["TAIM-GOVERN-1.5@92357b32e10b5e02"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eaa3704ca19d670ccbed4cf7","from":"TAIM-GOVERN-1.5@92357b32e10b5e02","to":"MS-RULE-AU-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!9:9","fromKeys":["TAIM-GOVERN-1.5@92357b32e10b5e02"],"toKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7fda94382d465c5779a01ebf","from":"TAIM-GOVERN-1.6@382c72c8bff29604","to":"MS-RULE-OP-09","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!10:10","fromKeys":["TAIM-GOVERN-1.6@382c72c8bff29604"],"toKeys":["MS-RULE-OP-09@ec587343b8220a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-394cf961f16ba353bf61bdc1","from":"TAIM-GOVERN-1.6@382c72c8bff29604","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!10:10","fromKeys":["TAIM-GOVERN-1.6@382c72c8bff29604"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b7de4a00e736fdaf2c1a9ad5","from":"TAIM-GOVERN-1.6@382c72c8bff29604","to":"MS-RULE-OP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!10:10","fromKeys":["TAIM-GOVERN-1.6@382c72c8bff29604"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b487451ccfe2092c407141e9","from":"TAIM-GOVERN-1.7@198eee5654f91ae3","to":"MS-RULE-OP-11","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!11:11","fromKeys":["TAIM-GOVERN-1.7@198eee5654f91ae3"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3c7eb5e959a2a0b3e2dbe21a","from":"TAIM-GOVERN-1.7@198eee5654f91ae3","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!11:11","fromKeys":["TAIM-GOVERN-1.7@198eee5654f91ae3"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fdad0fc08a015d86d01a91ae","from":"TAIM-GOVERN-2.1@198893140402361c","to":"MS-RULE-AU-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!12:12","fromKeys":["TAIM-GOVERN-2.1@198893140402361c"],"toKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-189fbbcea4c6015020ffb6cd","from":"TAIM-GOVERN-2.1@198893140402361c","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!12:12","fromKeys":["TAIM-GOVERN-2.1@198893140402361c"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8d4c4cc221af49040d1533c1","from":"TAIM-GOVERN-2.1@198893140402361c","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!12:12","fromKeys":["TAIM-GOVERN-2.1@198893140402361c"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9c3ea92aca371673128b2395","from":"TAIM-GOVERN-2.2@9b46d32788988ef2","to":"MS-RULE-AU-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!13:13","fromKeys":["TAIM-GOVERN-2.2@9b46d32788988ef2"],"toKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0998c55e3fd3b5d84a250b24","from":"TAIM-GOVERN-2.3@e28fde83a8cc90e1","to":"MS-RULE-AU-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!14:14","fromKeys":["TAIM-GOVERN-2.3@e28fde83a8cc90e1"],"toKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-48f4783f581afe5423540164","from":"TAIM-GOVERN-3.1@2427dcd86ebd4f7b","to":"MS-RULE-OP-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!15:15","fromKeys":["TAIM-GOVERN-3.1@2427dcd86ebd4f7b"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9aff76c4584ac4904dff1433","from":"TAIM-GOVERN-3.2@9c41c08d8d6c9ac6","to":"MS-RULE-AU-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!16:16","fromKeys":["TAIM-GOVERN-3.2@9c41c08d8d6c9ac6"],"toKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c86b1efbc33c20f2c27fd45d","from":"TAIM-GOVERN-4.2@c1e4d61854eedbe8","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!18:18","fromKeys":["TAIM-GOVERN-4.2@c1e4d61854eedbe8"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-99cd82f4458357f68325fcd0","from":"TAIM-GOVERN-4.2@c1e4d61854eedbe8","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!18:18","fromKeys":["TAIM-GOVERN-4.2@c1e4d61854eedbe8"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-411a251cac8ea1ec2acb0148","from":"TAIM-GOVERN-4.2@c1e4d61854eedbe8","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!18:18","fromKeys":["TAIM-GOVERN-4.2@c1e4d61854eedbe8"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7ba46ee073010eaf362a91ba","from":"TAIM-GOVERN-4.2@c1e4d61854eedbe8","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!18:18","fromKeys":["TAIM-GOVERN-4.2@c1e4d61854eedbe8"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dffe227f75c7d6cab6b233f7","from":"TAIM-GOVERN-4.3@6c63b10d0830b670","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!19:19","fromKeys":["TAIM-GOVERN-4.3@6c63b10d0830b670"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c76f4468e745398f693320e4","from":"TAIM-GOVERN-4.3@6c63b10d0830b670","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!19:19","fromKeys":["TAIM-GOVERN-4.3@6c63b10d0830b670"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0ee667aef2d471a9f2ff2ef3","from":"TAIM-GOVERN-4.3@6c63b10d0830b670","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!19:19","fromKeys":["TAIM-GOVERN-4.3@6c63b10d0830b670"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7d0958745ac20220aeb14b1a","from":"TAIM-GOVERN-4.3@6c63b10d0830b670","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!19:19","fromKeys":["TAIM-GOVERN-4.3@6c63b10d0830b670"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ae983054cdcdf8947dd5fd51","from":"TAIM-GOVERN-5.1@68f585618af89993","to":"MS-RULE-OP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!20:20","fromKeys":["TAIM-GOVERN-5.1@68f585618af89993"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-85db53964b4584984c929bd0","from":"TAIM-GOVERN-5.2@fe8607850f8d2ca6","to":"MS-RULE-OP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!21:21","fromKeys":["TAIM-GOVERN-5.2@fe8607850f8d2ca6"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fffffc6fdd81aa4c91a02af4","from":"TAIM-GOVERN-6.1@b8216e0b6ff98607","to":"MS-RULE-OP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!22:22","fromKeys":["TAIM-GOVERN-6.1@b8216e0b6ff98607"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1d973716931c00eb3c934c98","from":"TAIM-GOVERN-6.1@b8216e0b6ff98607","to":"MS-RULE-AG-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!22:22","fromKeys":["TAIM-GOVERN-6.1@b8216e0b6ff98607"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3097d6a32f76c422f152101b","from":"TAIM-GOVERN-6.2@054b3cd3c85b2f5d","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!23:23","fromKeys":["TAIM-GOVERN-6.2@054b3cd3c85b2f5d"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bcf603851aa2e014c87c06c7","from":"TAIM-GOVERN-6.2@054b3cd3c85b2f5d","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!23:23","fromKeys":["TAIM-GOVERN-6.2@054b3cd3c85b2f5d"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b099fad7fbb475591e9542cf","from":"TAIM-GOVERN-6.2@054b3cd3c85b2f5d","to":"MS-RULE-OP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!23:23","fromKeys":["TAIM-GOVERN-6.2@054b3cd3c85b2f5d"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-88708dbd5d5600300b5e0df5","from":"TAIM-GOVERN-6.2@054b3cd3c85b2f5d","to":"MS-RULE-AG-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!23:23","fromKeys":["TAIM-GOVERN-6.2@054b3cd3c85b2f5d"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-43a6488dd22ef31458e6013b","from":"TAIM-MAP-1.1@f7aec3e0fde77d65","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!24:24","fromKeys":["TAIM-MAP-1.1@f7aec3e0fde77d65"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5a949e4b08427743b307083e","from":"TAIM-MAP-1.1@f7aec3e0fde77d65","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!24:24","fromKeys":["TAIM-MAP-1.1@f7aec3e0fde77d65"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-09c3ae01800ba563d35f5e59","from":"TAIM-MAP-1.1@f7aec3e0fde77d65","to":"MS-RULE-OP-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!24:24","fromKeys":["TAIM-MAP-1.1@f7aec3e0fde77d65"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-79b38319838b70caefe6c1a9","from":"TAIM-MAP-1.1@f7aec3e0fde77d65","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!24:24","fromKeys":["TAIM-MAP-1.1@f7aec3e0fde77d65"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-28a62ae750f9ee898e83bb40","from":"TAIM-MAP-1.1@f7aec3e0fde77d65","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!24:24","fromKeys":["TAIM-MAP-1.1@f7aec3e0fde77d65"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-59550b74a02eb6a2df966a18","from":"TAIM-MAP-1.2@93024a692d8324ff","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!25:25","fromKeys":["TAIM-MAP-1.2@93024a692d8324ff"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3f52dd425c4632ab92553f7f","from":"TAIM-MAP-1.2@93024a692d8324ff","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!25:25","fromKeys":["TAIM-MAP-1.2@93024a692d8324ff"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-24aadc5c5eb271f905a1d86f","from":"TAIM-MAP-1.3@405b97af733bc900","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!26:26","fromKeys":["TAIM-MAP-1.3@405b97af733bc900"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-81ebd48cbfd38e8e4087c375","from":"TAIM-MAP-1.3@405b97af733bc900","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!26:26","fromKeys":["TAIM-MAP-1.3@405b97af733bc900"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a62b87d8ac2116ebfd4bc467","from":"TAIM-MAP-1.4@867a4ceeddb4119d","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!27:27","fromKeys":["TAIM-MAP-1.4@867a4ceeddb4119d"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-074802062bc41392001ae8c6","from":"TAIM-MAP-1.4@867a4ceeddb4119d","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!27:27","fromKeys":["TAIM-MAP-1.4@867a4ceeddb4119d"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e92cbbf453929375e018636","from":"TAIM-MAP-1.5@7b28c9d1495f3a89","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!28:28","fromKeys":["TAIM-MAP-1.5@7b28c9d1495f3a89"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cb5f4f1b206e55b691057d0a","from":"TAIM-MAP-1.5@7b28c9d1495f3a89","to":"MS-RULE-OP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!28:28","fromKeys":["TAIM-MAP-1.5@7b28c9d1495f3a89"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0f3f7be63beb087dc0993f15","from":"TAIM-MAP-1.5@7b28c9d1495f3a89","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!28:28","fromKeys":["TAIM-MAP-1.5@7b28c9d1495f3a89"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a3139895558c62f6ab59bee9","from":"TAIM-MAP-1.5@7b28c9d1495f3a89","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!28:28","fromKeys":["TAIM-MAP-1.5@7b28c9d1495f3a89"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b3c295be6d5d43c9f9c37888","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c230516907bafa8fdcb887c5","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-232ce8f5a09744f0a1f82dac","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-09","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-969d6c629d687c34cee6c713","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2d62c649959b8a85dc47a1e6","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-11","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-31d86df1f8cd1f68349af41a","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d861648ffb4cb2bbf33d7618","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-13","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-13@1299bbf89c50bd1a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ff49dc9a647b1697fe4f36fc","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-14","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a5031fc50cd53cd8856f2317","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-15","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-333c8be63ec8ce99a61e6f86","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-16","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c06732bb6158a0b5e479dcb7","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-17","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3a6015e45643ab7db7365d69","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-18","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-90b7064413065f73258f7fe7","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-OU-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8aebc1998cfab35da80eb8b4","from":"TAIM-MAP-2.2@c9b1594e914d9478","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!31:31","fromKeys":["TAIM-MAP-2.2@c9b1594e914d9478"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-efb42bde04660f264dd0c088","from":"TAIM-MAP-2.2@c9b1594e914d9478","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!31:31","fromKeys":["TAIM-MAP-2.2@c9b1594e914d9478"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a9cf1cc2eda08a0753357f2c","from":"TAIM-MAP-2.3@98b8065b9500c2b5","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!32:32","fromKeys":["TAIM-MAP-2.3@98b8065b9500c2b5"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8e6b743948a3c9c18e5102fd","from":"TAIM-MAP-2.3@98b8065b9500c2b5","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!32:32","fromKeys":["TAIM-MAP-2.3@98b8065b9500c2b5"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0f404db1e121b3519dc0db0a","from":"TAIM-MAP-2.3@98b8065b9500c2b5","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!32:32","fromKeys":["TAIM-MAP-2.3@98b8065b9500c2b5"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4bf6fd2175a9b572b8fc247e","from":"TAIM-MAP-2.3@98b8065b9500c2b5","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!32:32","fromKeys":["TAIM-MAP-2.3@98b8065b9500c2b5"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0a61aea684e7c88a695b95e5","from":"TAIM-MAP-3.1@5aadf0f832148043","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!33:33","fromKeys":["TAIM-MAP-3.1@5aadf0f832148043"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-23a582045b3105097ca75dbd","from":"TAIM-MAP-3.1@5aadf0f832148043","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!33:33","fromKeys":["TAIM-MAP-3.1@5aadf0f832148043"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-969e6a67be0f45a068e51695","from":"TAIM-MAP-3.1@5aadf0f832148043","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!33:33","fromKeys":["TAIM-MAP-3.1@5aadf0f832148043"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0706af02a7b8cd6b71da5ab9","from":"TAIM-MAP-3.1@5aadf0f832148043","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!33:33","fromKeys":["TAIM-MAP-3.1@5aadf0f832148043"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-84dfffbd53f9c352669244df","from":"TAIM-MAP-3.2@68f17d5dab909a30","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!34:34","fromKeys":["TAIM-MAP-3.2@68f17d5dab909a30"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-db517342272d1794417d4c95","from":"TAIM-MAP-3.2@68f17d5dab909a30","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!34:34","fromKeys":["TAIM-MAP-3.2@68f17d5dab909a30"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ea9243404790f1032fc871f5","from":"TAIM-MAP-3.2@68f17d5dab909a30","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!34:34","fromKeys":["TAIM-MAP-3.2@68f17d5dab909a30"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2f1e144a85d764761c4971a5","from":"TAIM-MAP-3.2@68f17d5dab909a30","to":"MS-RULE-OP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!34:34","fromKeys":["TAIM-MAP-3.2@68f17d5dab909a30"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b0952312525a0b5a68cba036","from":"TAIM-MAP-3.2@68f17d5dab909a30","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!34:34","fromKeys":["TAIM-MAP-3.2@68f17d5dab909a30"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b23794a1ecfbaeafd4aa2630","from":"TAIM-MAP-3.3@2dcbe4ab43aa4492","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!35:35","fromKeys":["TAIM-MAP-3.3@2dcbe4ab43aa4492"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8adfe148513a7f186a130782","from":"TAIM-MAP-3.3@2dcbe4ab43aa4492","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!35:35","fromKeys":["TAIM-MAP-3.3@2dcbe4ab43aa4492"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-42b95688bd3aa69f6f2c701a","from":"TAIM-MAP-3.4@e310d1f6e2a1ea35","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!36:36","fromKeys":["TAIM-MAP-3.4@e310d1f6e2a1ea35"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-67fa2c65229901eb0a35b219","from":"TAIM-MAP-3.4@e310d1f6e2a1ea35","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!36:36","fromKeys":["TAIM-MAP-3.4@e310d1f6e2a1ea35"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aef434ee366f23df5d9f0523","from":"TAIM-MAP-3.4@e310d1f6e2a1ea35","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!36:36","fromKeys":["TAIM-MAP-3.4@e310d1f6e2a1ea35"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-99b742471965573586a5e46c","from":"TAIM-MAP-3.4@e310d1f6e2a1ea35","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!36:36","fromKeys":["TAIM-MAP-3.4@e310d1f6e2a1ea35"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-10753767c61b4aed62d8b72d","from":"TAIM-MAP-3.5@03aad24c9f287fab","to":"MS-RULE-OU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!37:37","fromKeys":["TAIM-MAP-3.5@03aad24c9f287fab"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3693f087e1922e142b8af4b3","from":"TAIM-MAP-3.5@03aad24c9f287fab","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!37:37","fromKeys":["TAIM-MAP-3.5@03aad24c9f287fab"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1536457c7a58404c9645dd4d","from":"TAIM-MAP-3.5@03aad24c9f287fab","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!37:37","fromKeys":["TAIM-MAP-3.5@03aad24c9f287fab"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5e79c8c6d29c90ca8bec1745","from":"TAIM-MAP-3.5@03aad24c9f287fab","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!37:37","fromKeys":["TAIM-MAP-3.5@03aad24c9f287fab"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-269b06506c76e6796742544b","from":"TAIM-MAP-4.1@47a77b8622793a72","to":"MS-RULE-OP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!38:38","fromKeys":["TAIM-MAP-4.1@47a77b8622793a72"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ccc95f037ced4b1b36618515","from":"TAIM-MAP-4.1@47a77b8622793a72","to":"MS-RULE-AG-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!38:38","fromKeys":["TAIM-MAP-4.1@47a77b8622793a72"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d9d4593348d17cfd5b59aa86","from":"TAIM-MAP-4.1@47a77b8622793a72","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!38:38","fromKeys":["TAIM-MAP-4.1@47a77b8622793a72"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-df251368dc3a91444796955b","from":"TAIM-MAP-4.1@47a77b8622793a72","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!38:38","fromKeys":["TAIM-MAP-4.1@47a77b8622793a72"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0591e8ee158a47731136e4e3","from":"TAIM-MAP-4.2@ba7614350b99a7d0","to":"MS-RULE-OP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!39:39","fromKeys":["TAIM-MAP-4.2@ba7614350b99a7d0"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cad59caa8d3479ee471a9670","from":"TAIM-MAP-4.2@ba7614350b99a7d0","to":"MS-RULE-AG-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!39:39","fromKeys":["TAIM-MAP-4.2@ba7614350b99a7d0"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d1127a1f1daccc7f2981d484","from":"TAIM-MAP-4.2@ba7614350b99a7d0","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!39:39","fromKeys":["TAIM-MAP-4.2@ba7614350b99a7d0"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eae68301d71875eb84d419c7","from":"TAIM-MAP-4.2@ba7614350b99a7d0","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!39:39","fromKeys":["TAIM-MAP-4.2@ba7614350b99a7d0"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c32c12d6ecccbad98e3caff2","from":"TAIM-MAP-5.1@4170d53e4eea6a66","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!40:40","fromKeys":["TAIM-MAP-5.1@4170d53e4eea6a66"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-40fc1299270b55a92456dcee","from":"TAIM-MAP-5.1@4170d53e4eea6a66","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!40:40","fromKeys":["TAIM-MAP-5.1@4170d53e4eea6a66"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eaccd3d08a8c04eecf9bae38","from":"TAIM-MAP-5.1@4170d53e4eea6a66","to":"MS-RULE-OP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!40:40","fromKeys":["TAIM-MAP-5.1@4170d53e4eea6a66"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ff4938166447a66fca5a0848","from":"TAIM-MAP-5.1@4170d53e4eea6a66","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!40:40","fromKeys":["TAIM-MAP-5.1@4170d53e4eea6a66"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c3e5171e95065973cd42fb27","from":"TAIM-MAP-5.1@4170d53e4eea6a66","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!40:40","fromKeys":["TAIM-MAP-5.1@4170d53e4eea6a66"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b3bdefd547a5a4edf052e8f2","from":"TAIM-MAP-5.2@4fe1fea3a40c08e0","to":"MS-RULE-OP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!41:41","fromKeys":["TAIM-MAP-5.2@4fe1fea3a40c08e0"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9ef1e0c106f4cb46fbf017bf","from":"TAIM-MAP-5.2@4fe1fea3a40c08e0","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!41:41","fromKeys":["TAIM-MAP-5.2@4fe1fea3a40c08e0"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dc5c5a3ccb8d72c46f79b98c","from":"TAIM-MAP-5.2@4fe1fea3a40c08e0","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!41:41","fromKeys":["TAIM-MAP-5.2@4fe1fea3a40c08e0"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-39e9f3a42d80eccc3fedf8a2","from":"TAIM-MEASURE-1.1@80d658f30e1d4e80","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!42:42","fromKeys":["TAIM-MEASURE-1.1@80d658f30e1d4e80"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e3634229591b67b37a10d831","from":"TAIM-MEASURE-1.1@80d658f30e1d4e80","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!42:42","fromKeys":["TAIM-MEASURE-1.1@80d658f30e1d4e80"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9a010eff1da7659d21deb803","from":"TAIM-MEASURE-1.1@80d658f30e1d4e80","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!42:42","fromKeys":["TAIM-MEASURE-1.1@80d658f30e1d4e80"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7b093d6f463c35ce78c8c815","from":"TAIM-MEASURE-1.2@b5c24007b17017b3","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!43:43","fromKeys":["TAIM-MEASURE-1.2@b5c24007b17017b3"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3fe807f6ff89bacea6c03cd3","from":"TAIM-MEASURE-1.2@b5c24007b17017b3","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!43:43","fromKeys":["TAIM-MEASURE-1.2@b5c24007b17017b3"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0f6828960a8e4c823ccb9ffd","from":"TAIM-MEASURE-1.2@b5c24007b17017b3","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!43:43","fromKeys":["TAIM-MEASURE-1.2@b5c24007b17017b3"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fd2c9c403b50953514303eca","from":"TAIM-MEASURE-1.2@b5c24007b17017b3","to":"MS-RULE-OP-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!43:43","fromKeys":["TAIM-MEASURE-1.2@b5c24007b17017b3"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-655950b787b38844f7e0daaa","from":"TAIM-MEASURE-1.3@438e7613521eceac","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!44:44","fromKeys":["TAIM-MEASURE-1.3@438e7613521eceac"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e5c5b6af0e973fb71271a757","from":"TAIM-MEASURE-1.3@438e7613521eceac","to":"MS-RULE-OP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!44:44","fromKeys":["TAIM-MEASURE-1.3@438e7613521eceac"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b7b678cfa00162a57bafc1af","from":"TAIM-MEASURE-1.3@438e7613521eceac","to":"MS-RULE-OP-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!44:44","fromKeys":["TAIM-MEASURE-1.3@438e7613521eceac"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0540623166e955610e543d16","from":"TAIM-MEASURE-2.1@bfec014736abe868","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!45:45","fromKeys":["TAIM-MEASURE-2.1@bfec014736abe868"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cafe1c066e7f8e33af6a6afa","from":"TAIM-MEASURE-2.1@bfec014736abe868","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!45:45","fromKeys":["TAIM-MEASURE-2.1@bfec014736abe868"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9695b84773b736730ff6f183","from":"TAIM-MEASURE-2.1@bfec014736abe868","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!45:45","fromKeys":["TAIM-MEASURE-2.1@bfec014736abe868"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-da8356f4c297eb8a5b506bf1","from":"TAIM-MEASURE-2.1@bfec014736abe868","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!45:45","fromKeys":["TAIM-MEASURE-2.1@bfec014736abe868"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-99cf87da205c539840c3efba","from":"TAIM-MEASURE-2.2@f1b91c01b8b926be","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!46:46","fromKeys":["TAIM-MEASURE-2.2@f1b91c01b8b926be"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-745858d1e15fe06123feb1db","from":"TAIM-MEASURE-2.2@f1b91c01b8b926be","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!46:46","fromKeys":["TAIM-MEASURE-2.2@f1b91c01b8b926be"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-32bc3200cfdd02fb09f368c3","from":"TAIM-MEASURE-2.3@f396bee25387e21c","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!47:47","fromKeys":["TAIM-MEASURE-2.3@f396bee25387e21c"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a1a24992c066e5c69eec7009","from":"TAIM-MEASURE-2.3@f396bee25387e21c","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!47:47","fromKeys":["TAIM-MEASURE-2.3@f396bee25387e21c"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-224a79261c0a5a64fc3c9185","from":"TAIM-MEASURE-2.3@f396bee25387e21c","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!47:47","fromKeys":["TAIM-MEASURE-2.3@f396bee25387e21c"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-90b3c4764aeba8707035b1da","from":"TAIM-MEASURE-2.3@f396bee25387e21c","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!47:47","fromKeys":["TAIM-MEASURE-2.3@f396bee25387e21c"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-294710da10b6c268d4f77652","from":"TAIM-MEASURE-2.4@30416b6b4c6068dd","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!48:48","fromKeys":["TAIM-MEASURE-2.4@30416b6b4c6068dd"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ad719ea89748e95ad4e6022f","from":"TAIM-MEASURE-2.5@f17bf250e010d494","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!49:49","fromKeys":["TAIM-MEASURE-2.5@f17bf250e010d494"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bfc78b0d4b76cc8a56c781ff","from":"TAIM-MEASURE-2.5@f17bf250e010d494","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!49:49","fromKeys":["TAIM-MEASURE-2.5@f17bf250e010d494"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7c331b9d660e5e40a2be2c92","from":"TAIM-MEASURE-2.5@f17bf250e010d494","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!49:49","fromKeys":["TAIM-MEASURE-2.5@f17bf250e010d494"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-459c21a08badff16134b48d4","from":"TAIM-MEASURE-2.5@f17bf250e010d494","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!49:49","fromKeys":["TAIM-MEASURE-2.5@f17bf250e010d494"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e0abf1ab7f308821155be5c9","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8d842ddf48ee4ac1c55cd828","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-IN-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-IN-01@e4fe11be1a20f12f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-271d729e6a3202557b925763","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-IN-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-IN-02@dbb47a84e8a96c05"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-45cc726b65363e8cf341cde4","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-IN-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4354ca08b1c92062e511bbc2","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-IN-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-IN-04@40341d186f0bd606"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7214bb2961c2835646cc29ab","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-IN-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5a2fa6ee70ea89e3a54c688d","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-IN-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-IN-06@478a04da335c1e7f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-59dcf0ec1875b6592cd9c92a","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f331b8be655d4aa936e8b786","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-38a783e882012b3346d10ba4","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-OP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-69f5a605762d3868e87e5700","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-IN-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-IN-01@e4fe11be1a20f12f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d9b038b39617a999f81bf565","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-IN-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-IN-02@dbb47a84e8a96c05"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0951b1d3a2aeff999962fd8f","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-IN-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e065295b9a4449a0fd20d3f3","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-IN-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-IN-04@40341d186f0bd606"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f254d0005cdbf39e635faba2","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-IN-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f5c41b8746eb31974d4359cf","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-IN-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-IN-06@478a04da335c1e7f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b029506d3d7a3400103716ff","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3417efbeccb53a779c3200e1","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-84fbdfe1913d3edb546613ed","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dd32f0f6c08c48620a9cfd42","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-46183ad7dd895f53431eba89","from":"TAIM-MEASURE-2.8@927b0554749a76e0","to":"MS-RULE-OU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!52:52","fromKeys":["TAIM-MEASURE-2.8@927b0554749a76e0"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-28b19a17ebbc61de63ce39aa","from":"TAIM-MEASURE-2.8@927b0554749a76e0","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!52:52","fromKeys":["TAIM-MEASURE-2.8@927b0554749a76e0"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-98cf34ad3c95fc57a08469de","from":"TAIM-MEASURE-2.8@927b0554749a76e0","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!52:52","fromKeys":["TAIM-MEASURE-2.8@927b0554749a76e0"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cf7453cbb6718a0a624310dc","from":"TAIM-MEASURE-2.8@927b0554749a76e0","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!52:52","fromKeys":["TAIM-MEASURE-2.8@927b0554749a76e0"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ba557273fe04fc57f69d9c16","from":"TAIM-MEASURE-2.9@3e99c99461743bec","to":"MS-RULE-OU-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!53:53","fromKeys":["TAIM-MEASURE-2.9@3e99c99461743bec"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-78f821a33c4ded203698af96","from":"TAIM-MEASURE-2.9@3e99c99461743bec","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!53:53","fromKeys":["TAIM-MEASURE-2.9@3e99c99461743bec"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d72154cdabacbab1862757a1","from":"TAIM-MEASURE-2.9@3e99c99461743bec","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!53:53","fromKeys":["TAIM-MEASURE-2.9@3e99c99461743bec"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-99fb99fd403d03cf12c870f6","from":"TAIM-MEASURE-2.9@3e99c99461743bec","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!53:53","fromKeys":["TAIM-MEASURE-2.9@3e99c99461743bec"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6c9cccc173e15f51dc01211c","from":"TAIM-MEASURE-2.9@3e99c99461743bec","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!53:53","fromKeys":["TAIM-MEASURE-2.9@3e99c99461743bec"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-559e15fb27c56564829a1763","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a968d0338fadadddfd430dd0","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0a7fbf85eb072d19fe594eea","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-09","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c53b38886f01611b2be67f4f","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-72c49165ae669debcc6ade05","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-11","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ad5aba05f674781faee223c1","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8f1d42da81b96ca9159bcc97","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-13","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-13@1299bbf89c50bd1a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-95ac3b935b6e20c3655666a7","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-14","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2a523d6888e30a77aba6272d","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-15","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-68c9b766a223d13dc9f3e066","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-16","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f26e62b34cba96841a3d564d","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-17","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-268eb584eeb4ff0a2a086832","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-18","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e4069d8b6496c2ebdbe2dbb5","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-OU-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5a1e6c9103ca8254ba5457e5","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-508c9b811646516de74108c9","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c54052db936afed30e39c03a","from":"TAIM-MEASURE-2.11@69c078796341cd3b","to":"MS-RULE-OU-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!55:55","fromKeys":["TAIM-MEASURE-2.11@69c078796341cd3b"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4529657cc7c7eb3cf3b6c7b0","from":"TAIM-MEASURE-2.11@69c078796341cd3b","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!55:55","fromKeys":["TAIM-MEASURE-2.11@69c078796341cd3b"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e596a26a3ef62c9dcd6121ac","from":"TAIM-MEASURE-2.11@69c078796341cd3b","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!55:55","fromKeys":["TAIM-MEASURE-2.11@69c078796341cd3b"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ec50417335c08640881e7160","from":"TAIM-MEASURE-2.11@69c078796341cd3b","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!55:55","fromKeys":["TAIM-MEASURE-2.11@69c078796341cd3b"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3dcd4aadbf20de0d25117fdd","from":"TAIM-MEASURE-2.11@69c078796341cd3b","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!55:55","fromKeys":["TAIM-MEASURE-2.11@69c078796341cd3b"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-047dbb2cc4142aa7918091e3","from":"TAIM-MEASURE-2.12@12d74b82b770347a","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!56:56","fromKeys":["TAIM-MEASURE-2.12@12d74b82b770347a"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0b0b20fcf799447be41f9d6f","from":"TAIM-MEASURE-2.12@12d74b82b770347a","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!56:56","fromKeys":["TAIM-MEASURE-2.12@12d74b82b770347a"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e1b2aefe2349420d22cd8640","from":"TAIM-MEASURE-2.13@12d2da14f2779af3","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!57:57","fromKeys":["TAIM-MEASURE-2.13@12d2da14f2779af3"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1a5b758668bc9795f2c13d4e","from":"TAIM-MEASURE-2.13@12d2da14f2779af3","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!57:57","fromKeys":["TAIM-MEASURE-2.13@12d2da14f2779af3"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e3905e2a78efa23cacae49a3","from":"TAIM-MEASURE-2.13@12d2da14f2779af3","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!57:57","fromKeys":["TAIM-MEASURE-2.13@12d2da14f2779af3"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3490d28ef3d94e1a05b6947c","from":"TAIM-MEASURE-2.13@12d2da14f2779af3","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!57:57","fromKeys":["TAIM-MEASURE-2.13@12d2da14f2779af3"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-35214a97bc7652be4d62e3de","from":"TAIM-MEASURE-3.1@6a9415a16f00ace2","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!58:58","fromKeys":["TAIM-MEASURE-3.1@6a9415a16f00ace2"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b770a53992a3e683e3993ab7","from":"TAIM-MEASURE-3.1@6a9415a16f00ace2","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!58:58","fromKeys":["TAIM-MEASURE-3.1@6a9415a16f00ace2"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-398633f0c42e3d57e663e4f6","from":"TAIM-MEASURE-3.1@6a9415a16f00ace2","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!58:58","fromKeys":["TAIM-MEASURE-3.1@6a9415a16f00ace2"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ea07a0da127075a6634a757f","from":"TAIM-MEASURE-3.1@6a9415a16f00ace2","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!58:58","fromKeys":["TAIM-MEASURE-3.1@6a9415a16f00ace2"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a839f0beb004b044f3ded7ec","from":"TAIM-MEASURE-3.2@0a3eca3853caf2e2","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!59:59","fromKeys":["TAIM-MEASURE-3.2@0a3eca3853caf2e2"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a07840e5d9c84d5984647c9a","from":"TAIM-MEASURE-3.3@6a5560394079e008","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!60:60","fromKeys":["TAIM-MEASURE-3.3@6a5560394079e008"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1b0bdf3adc982b30cbca94e0","from":"TAIM-MEASURE-3.3@6a5560394079e008","to":"MS-RULE-OP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!60:60","fromKeys":["TAIM-MEASURE-3.3@6a5560394079e008"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2ff91eae141a64434907bded","from":"TAIM-MEASURE-3.3@6a5560394079e008","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!60:60","fromKeys":["TAIM-MEASURE-3.3@6a5560394079e008"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ddcbafad772eab4a7270499","from":"TAIM-MEASURE-4.1@87efb87b60ce14d1","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!61:61","fromKeys":["TAIM-MEASURE-4.1@87efb87b60ce14d1"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-532ed0be7781aa9936da2c13","from":"TAIM-MEASURE-4.1@87efb87b60ce14d1","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!61:61","fromKeys":["TAIM-MEASURE-4.1@87efb87b60ce14d1"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a3e54e96f0dd8f090c5100c2","from":"TAIM-MEASURE-4.2@441148e8e1148dbe","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!62:62","fromKeys":["TAIM-MEASURE-4.2@441148e8e1148dbe"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-646217b4b127166414339b3e","from":"TAIM-MEASURE-4.2@441148e8e1148dbe","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!62:62","fromKeys":["TAIM-MEASURE-4.2@441148e8e1148dbe"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9892e9ae11dcef20ea808f64","from":"TAIM-MEASURE-4.2@441148e8e1148dbe","to":"MS-RULE-OP-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!62:62","fromKeys":["TAIM-MEASURE-4.2@441148e8e1148dbe"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0d2075a57eb52e7fa301b73f","from":"TAIM-MEASURE-4.2@441148e8e1148dbe","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!62:62","fromKeys":["TAIM-MEASURE-4.2@441148e8e1148dbe"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4889421444f8cbd92b6abb85","from":"TAIM-MEASURE-4.2@441148e8e1148dbe","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!62:62","fromKeys":["TAIM-MEASURE-4.2@441148e8e1148dbe"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ee34413b6a79393db01c6669","from":"TAIM-MEASURE-4.3@759303d11da3ea95","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!63:63","fromKeys":["TAIM-MEASURE-4.3@759303d11da3ea95"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aa7efaccecf44d697c3c8904","from":"TAIM-MEASURE-4.3@759303d11da3ea95","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!63:63","fromKeys":["TAIM-MEASURE-4.3@759303d11da3ea95"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dfa57e78885c354f0c00ee17","from":"TAIM-MEASURE-4.3@759303d11da3ea95","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!63:63","fromKeys":["TAIM-MEASURE-4.3@759303d11da3ea95"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-84eaae8ef4291a5279252230","from":"TAIM-MEASURE-4.3@759303d11da3ea95","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!63:63","fromKeys":["TAIM-MEASURE-4.3@759303d11da3ea95"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8be5971e7a0b76e29547faab","from":"TAIM-MANAGE-1.2@725fe00a61b98e10","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!65:65","fromKeys":["TAIM-MANAGE-1.2@725fe00a61b98e10"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9bae2f58738ac9fbe001a79e","from":"TAIM-MANAGE-1.2@725fe00a61b98e10","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!65:65","fromKeys":["TAIM-MANAGE-1.2@725fe00a61b98e10"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4b824d66900dc628afbaacf7","from":"TAIM-MANAGE-1.3@113dba8419d60368","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!66:66","fromKeys":["TAIM-MANAGE-1.3@113dba8419d60368"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-197e14ade924ea547b47fdc2","from":"TAIM-MANAGE-1.3@113dba8419d60368","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!66:66","fromKeys":["TAIM-MANAGE-1.3@113dba8419d60368"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-257f2a6a93b97d90138ceb02","from":"TAIM-MANAGE-1.4@706dd15eb7c4daeb","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!67:67","fromKeys":["TAIM-MANAGE-1.4@706dd15eb7c4daeb"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bb9a1cabf875376a6c163daf","from":"TAIM-MANAGE-1.4@706dd15eb7c4daeb","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!67:67","fromKeys":["TAIM-MANAGE-1.4@706dd15eb7c4daeb"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5e519922a63a75c6720dca49","from":"TAIM-MANAGE-2.3@f69713d6045063b5","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!70:70","fromKeys":["TAIM-MANAGE-2.3@f69713d6045063b5"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dded4cdfb88cdd7b86cb7f79","from":"TAIM-MANAGE-2.3@f69713d6045063b5","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!70:70","fromKeys":["TAIM-MANAGE-2.3@f69713d6045063b5"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-772ca1c4cd7781ebe0ea1ec7","from":"TAIM-MANAGE-2.4@4c58d159afdc4362","to":"MS-RULE-OP-11","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!71:71","fromKeys":["TAIM-MANAGE-2.4@4c58d159afdc4362"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d716ea26061f06a2b24cf57f","from":"TAIM-MANAGE-2.4@4c58d159afdc4362","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!71:71","fromKeys":["TAIM-MANAGE-2.4@4c58d159afdc4362"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e7c1810d32662201dc0ae8b3","from":"TAIM-MANAGE-2.4@4c58d159afdc4362","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!71:71","fromKeys":["TAIM-MANAGE-2.4@4c58d159afdc4362"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-20a4de676a9e72a84069ef8e","from":"TAIM-MANAGE-2.4@4c58d159afdc4362","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!71:71","fromKeys":["TAIM-MANAGE-2.4@4c58d159afdc4362"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c48ab4440247d39a3c1ce2b2","from":"TAIM-MANAGE-2.4@4c58d159afdc4362","to":"MS-RULE-AU-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!71:71","fromKeys":["TAIM-MANAGE-2.4@4c58d159afdc4362"],"toKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ea6f41a5c9fe3bd0f0d7380","from":"TAIM-MANAGE-3.1@fa0c648cdd610fd5","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!72:72","fromKeys":["TAIM-MANAGE-3.1@fa0c648cdd610fd5"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5906a6c7c50b58938b9821d9","from":"TAIM-MANAGE-3.1@fa0c648cdd610fd5","to":"MS-RULE-OP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!72:72","fromKeys":["TAIM-MANAGE-3.1@fa0c648cdd610fd5"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b8045f99345bed6cc6fdc7b8","from":"TAIM-MANAGE-3.1@fa0c648cdd610fd5","to":"MS-RULE-AG-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!72:72","fromKeys":["TAIM-MANAGE-3.1@fa0c648cdd610fd5"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fd0dce316bca7d820e25bd25","from":"TAIM-MANAGE-3.1@fa0c648cdd610fd5","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!72:72","fromKeys":["TAIM-MANAGE-3.1@fa0c648cdd610fd5"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2e2e2de0140c2d60f6cad46d","from":"TAIM-MANAGE-3.1@fa0c648cdd610fd5","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!72:72","fromKeys":["TAIM-MANAGE-3.1@fa0c648cdd610fd5"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-606445a5f4322a4f97863603","from":"TAIM-MANAGE-3.2@72d098f451a97bfc","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!73:73","fromKeys":["TAIM-MANAGE-3.2@72d098f451a97bfc"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dffd3bfd46a6aafd504fdf8c","from":"TAIM-MANAGE-3.2@72d098f451a97bfc","to":"MS-RULE-OP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!73:73","fromKeys":["TAIM-MANAGE-3.2@72d098f451a97bfc"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-abd6063051731e84e23366a6","from":"TAIM-MANAGE-3.2@72d098f451a97bfc","to":"MS-RULE-AG-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!73:73","fromKeys":["TAIM-MANAGE-3.2@72d098f451a97bfc"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-830f908dee269a0586856535","from":"TAIM-MANAGE-4.1@ba6d42802623e508","to":"MS-RULE-OP-11","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!74:74","fromKeys":["TAIM-MANAGE-4.1@ba6d42802623e508"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-84861b478435c618727979d6","from":"TAIM-MANAGE-4.1@ba6d42802623e508","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!74:74","fromKeys":["TAIM-MANAGE-4.1@ba6d42802623e508"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-518370bf8b183ad1ae0cf32c","from":"TAIM-MANAGE-4.1@ba6d42802623e508","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!74:74","fromKeys":["TAIM-MANAGE-4.1@ba6d42802623e508"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-47aaf45ab1a6104e0e5d333a","from":"TAIM-MANAGE-4.1@ba6d42802623e508","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!74:74","fromKeys":["TAIM-MANAGE-4.1@ba6d42802623e508"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f5cbb60aa87fbb9918a219ae","from":"TAIM-MANAGE-4.1@ba6d42802623e508","to":"MS-RULE-OP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!74:74","fromKeys":["TAIM-MANAGE-4.1@ba6d42802623e508"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bd14c50438e9963d6dfcc4e0","from":"TAIM-MANAGE-4.2@6622b89a3cfef575","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!75:75","fromKeys":["TAIM-MANAGE-4.2@6622b89a3cfef575"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-07f2e27eda5726a98577e94e","from":"TAIM-MANAGE-4.2@6622b89a3cfef575","to":"MS-RULE-OP-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!75:75","fromKeys":["TAIM-MANAGE-4.2@6622b89a3cfef575"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ecf88f251ba0258c87e1f20","from":"TAIM-MANAGE-4.3@6d72e9f28c581992","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!76:76","fromKeys":["TAIM-MANAGE-4.3@6d72e9f28c581992"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-48b7075f2cecbdce0047c9e5","from":"TAIM-MANAGE-4.3@6d72e9f28c581992","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!76:76","fromKeys":["TAIM-MANAGE-4.3@6d72e9f28c581992"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d5402c988cfe4a6ace6f8d87","from":"TAIM-MANAGE-4.3@6d72e9f28c581992","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!76:76","fromKeys":["TAIM-MANAGE-4.3@6d72e9f28c581992"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bcf55806232335acd813489c","from":"TAIM-MANAGE-4.3@6d72e9f28c581992","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'07 TAIM Control Map'!76:76","fromKeys":["TAIM-MANAGE-4.3@6d72e9f28c581992"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d776d7e69d809a9b6e336952","from":"MS-POL-POL-01@49c4c01e6c0532bb","to":"MS-RULE-OP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!5:5","fromKeys":["MS-POL-POL-01@49c4c01e6c0532bb"],"toKeys":["MS-RULE-OP-09@ec587343b8220a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5b5f32633cf5fd8879141cd2","from":"MS-POL-POL-01@49c4c01e6c0532bb","to":"MS-RULE-AU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!5:5","fromKeys":["MS-POL-POL-01@49c4c01e6c0532bb"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2bd7a3993c7c163e554b89a6","from":"MS-POL-POL-01@49c4c01e6c0532bb","to":"MS-RULE-OP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!5:5","fromKeys":["MS-POL-POL-01@49c4c01e6c0532bb"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-66077763af1595d4bd629e43","from":"MS-POL-POL-02@aa0847ee55585424","to":"MS-RULE-IN-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!6:6","fromKeys":["MS-POL-POL-02@aa0847ee55585424"],"toKeys":["MS-RULE-IN-07@31e317962beaeb5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-edc707962180b60109aab1f1","from":"MS-POL-POL-02@aa0847ee55585424","to":"MS-RULE-OU-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!6:6","fromKeys":["MS-POL-POL-02@aa0847ee55585424"],"toKeys":["MS-RULE-OU-06@ce0137df984ac601"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b52532a9469af82b31496280","from":"MS-POL-POL-02@aa0847ee55585424","to":"MS-RULE-OU-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!6:6","fromKeys":["MS-POL-POL-02@aa0847ee55585424"],"toKeys":["MS-RULE-OU-07@7d5bc203e83e95c9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5ac489013419fe6028987a57","from":"MS-POL-POL-03@11c99e7398913f0f","to":"MS-RULE-AU-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!7:7","fromKeys":["MS-POL-POL-03@11c99e7398913f0f"],"toKeys":["MS-RULE-AU-01@32b7d4ac14b06f7b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6025f261dca83715e1354007","from":"MS-POL-POL-03@11c99e7398913f0f","to":"MS-RULE-AU-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!7:7","fromKeys":["MS-POL-POL-03@11c99e7398913f0f"],"toKeys":["MS-RULE-AU-02@1a166eaeb8f7f1ad"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f9e0b92c28dbad080653c382","from":"MS-POL-POL-03@11c99e7398913f0f","to":"MS-RULE-AU-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!7:7","fromKeys":["MS-POL-POL-03@11c99e7398913f0f"],"toKeys":["MS-RULE-AU-08@4eda0a221f3ef380"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fc43f7a8373cb8e7053f2b9a","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6c0eaa3120ed8ddaff560d67","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-56b42377fbc7c3660e2d37a8","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-03@4cbb47b109e98f4a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f57601d71b0eb7f595549edb","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-04@13c6ba85197d9a69"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-667da56b0c8095f1d805401c","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f159c45818bb052b645e262b","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-06@af062b3863346b41"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-90c6c90559a8006cec9ec181","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1befba77e2b2235f81a63fb0","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-55f50e4a4f9812fe4b166b14","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-982b644988a0ee079196873a","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5105b543dfd32eb68d3844fe","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6496204c09a2f5b00b0ff530","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-19cc03301afdf74dac429ff0","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-13","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-13@1299bbf89c50bd1a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d5c17f3428aab8f700f8587f","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-14","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5c3218daab7183d1dae545b0","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-15","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e01cd51fbf9c7409b338722d","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-16","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f186fa885a87b11f9d64e720","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-17","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-710b34dff5cc64f7bd3ae4b1","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-18","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fbe0b25a59253f87ec6d7fc1","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-AU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e2ec9f47fbc3193bbe39e93d","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-AU-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a109dbba7cfd90f48773d475","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e46ce389667ff16d2df3931b","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-02@4965655028a3d485"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-51596fdc8c3341f5408df05c","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-83b2ea576a2d4cfa7713490e","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cfd8d75bf44e8ba1c6ef262f","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7553f96a26e4bca63ff34348","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-06@ce0137df984ac601"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5b8eb182aa6655dceba77513","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-07@7d5bc203e83e95c9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-251cb113b5366d4350bbad2b","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-08@4c7bb6dc00dfcbfd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1b281f133382fc1a0c7c1699","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-09@2ffb1322457172b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b9c8b2417e42df882c6064df","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-10@2332653b89bcd331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-21b85234f60b91943c50f155","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-11@0710643d8a955cf6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bf5860271f3db6fa97c19f77","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8a91d5d29dd80108969d01cd","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-17685b43c90f626465e9fcaa","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-06@af062b3863346b41"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-98b54762301e15d1b974c00c","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c7c44d8d492808ee87dac3a2","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-77307f01546a17a602c2fd17","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-783afb26d921e8d4948267c4","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fc255e8d33c7844535c3d9de","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9d6f02d25179f4b78400d46e","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-OU-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-OU-11@0710643d8a955cf6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7f111cf57eee3c584ee555ff","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-IN-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!11:11","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-IN-01@e4fe11be1a20f12f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b87eddab2cd288eed1200eeb","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-IN-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!11:11","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-IN-02@dbb47a84e8a96c05"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a173b213b8e331a7940f1451","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-IN-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!11:11","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a14aadf4aa0e4562255f6359","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-IN-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!11:11","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-IN-04@40341d186f0bd606"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e1ddafbb4ddb0f7f833b7638","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-IN-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!11:11","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e0e10fc1c9e6d1c30e46c6d4","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-DP-15","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!11:11","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-56e30c594c9e644dc46fa827","from":"MS-POL-POL-08@ee4729bdeed9ad16","to":"MS-RULE-OU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!12:12","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-adc21f4c17d88e28909a1623","from":"MS-POL-POL-08@ee4729bdeed9ad16","to":"MS-RULE-OU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!12:12","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0bb55ddd1b814cb14137d74a","from":"MS-POL-POL-08@ee4729bdeed9ad16","to":"MS-RULE-AG-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!12:12","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16"],"toKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-be3592c76de988f7476e2f47","from":"MS-POL-POL-08@ee4729bdeed9ad16","to":"MS-RULE-AG-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!12:12","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16"],"toKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d2016bb8dd52b0672d27c5ec","from":"MS-POL-POL-08@ee4729bdeed9ad16","to":"MS-RULE-OP-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!12:12","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5ebf23c365e7c4b84613dd7e","from":"MS-POL-POL-09@30cd5cb249f58ae2","to":"MS-RULE-AU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!13:13","fromKeys":["MS-POL-POL-09@30cd5cb249f58ae2"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-933693e81ae64e5d2b1e0190","from":"MS-POL-POL-09@30cd5cb249f58ae2","to":"MS-RULE-OP-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!13:13","fromKeys":["MS-POL-POL-09@30cd5cb249f58ae2"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-acdde0af2c80a2ff822852e0","from":"MS-POL-POL-09@30cd5cb249f58ae2","to":"MS-RULE-OP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!13:13","fromKeys":["MS-POL-POL-09@30cd5cb249f58ae2"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-80ef93e239fd07eff375cb7e","from":"MS-POL-POL-10@cce53ffd6ac04512","to":"MS-RULE-OP-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!14:14","fromKeys":["MS-POL-POL-10@cce53ffd6ac04512"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9e5eb8fe5c33ea4e2125f9ee","from":"MS-POL-POL-10@cce53ffd6ac04512","to":"MS-RULE-OP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!14:14","fromKeys":["MS-POL-POL-10@cce53ffd6ac04512"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d6fd7a95802a9e395481913a","from":"MS-POL-POL-11@4cbd6ed56751cc97","to":"MS-RULE-OP-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!15:15","fromKeys":["MS-POL-POL-11@4cbd6ed56751cc97"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ba2c539fd52f5196d4d0429d","from":"MS-POL-POL-11@4cbd6ed56751cc97","to":"MS-RULE-OP-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!15:15","fromKeys":["MS-POL-POL-11@4cbd6ed56751cc97"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-df7fb269cf91550dafdc9773","from":"MS-POL-POL-11@4cbd6ed56751cc97","to":"MS-RULE-OP-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!15:15","fromKeys":["MS-POL-POL-11@4cbd6ed56751cc97"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-76adc1386f5774f5c9f88a48","from":"MS-POL-POL-12@2bcf920fc5a05e6b","to":"MS-RULE-OP-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!16:16","fromKeys":["MS-POL-POL-12@2bcf920fc5a05e6b"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9c304eca054867aa5a11f079","from":"MS-POL-POL-12@2bcf920fc5a05e6b","to":"MS-RULE-OP-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!16:16","fromKeys":["MS-POL-POL-12@2bcf920fc5a05e6b"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7c3dbdd4258c265682fb9eed","from":"MS-POL-POL-13@e8a7e91b791104ce","to":"MS-RULE-AU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!17:17","fromKeys":["MS-POL-POL-13@e8a7e91b791104ce"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-efab871381fcf640a92cdb5d","from":"MS-POL-POL-13@e8a7e91b791104ce","to":"MS-RULE-AU-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!17:17","fromKeys":["MS-POL-POL-13@e8a7e91b791104ce"],"toKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c4e3bdc440d0ddc638759e15","from":"MS-POL-POL-13@e8a7e91b791104ce","to":"MS-RULE-OP-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!17:17","fromKeys":["MS-POL-POL-13@e8a7e91b791104ce"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-02bbf5bfbed04c227dd013eb","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-01@e6aee1767c267990"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-65e2474f9c51f8a91e14bfc9","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-02@d4d178c0433fd6d4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1c8dcfc6e08b33267f557745","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4abcab414546d02fe6ca7239","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-938b272c7518374efea474ac","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-05@8829d873310f18f9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fc3f1b13c382da38642054ef","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-06@6371f819b40b0d97"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de449b719930c0e257f6344b","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-07@c2fb36c556cb8a62"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9330f14434aa206ed0fd1673","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7d2b564b3145ea34b5fd82bc","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-09@2bd07e82a72d4f2e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7dd36556487315e1d2143001","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-IN-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-IN-08@94324ccfd3a491ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d53ec549486d30d95871a2bb","from":"MS-POL-POL-15@66ce06439b6303c8","to":"MS-RULE-OU-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!19:19","fromKeys":["MS-POL-POL-15@66ce06439b6303c8"],"toKeys":["MS-RULE-OU-08@4c7bb6dc00dfcbfd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c90efbbb33df097bd46e77bc","from":"MS-POL-POL-15@66ce06439b6303c8","to":"MS-RULE-OU-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!19:19","fromKeys":["MS-POL-POL-15@66ce06439b6303c8"],"toKeys":["MS-RULE-OU-09@2ffb1322457172b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b311ddb7127009aa79f6e633","from":"MS-POL-POL-15@66ce06439b6303c8","to":"MS-RULE-OP-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!19:19","fromKeys":["MS-POL-POL-15@66ce06439b6303c8"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c9b7dff08448f48cf3430450","from":"MS-POL-POL-15@66ce06439b6303c8","to":"MS-RULE-OP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!19:19","fromKeys":["MS-POL-POL-15@66ce06439b6303c8"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-581015b1056a30959666ff46","from":"MS-POL-POL-16@e96f7674899ecd20","to":"MS-RULE-OU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!20:20","fromKeys":["MS-POL-POL-16@e96f7674899ecd20"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-52a1c453ea32e5f1f5c8da62","from":"MS-POL-POL-17@fbd2f1193b92724a","to":"MS-RULE-OU-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!21:21","fromKeys":["MS-POL-POL-17@fbd2f1193b92724a"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b9c0e5b5692ffe841cf2c34f","from":"MS-POL-POL-17@fbd2f1193b92724a","to":"MS-RULE-OU-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!21:21","fromKeys":["MS-POL-POL-17@fbd2f1193b92724a"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-645f416b7b3169d2fbd56041","from":"MS-POL-POL-17@fbd2f1193b92724a","to":"MS-RULE-OP-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!21:21","fromKeys":["MS-POL-POL-17@fbd2f1193b92724a"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8bee49f1ac41f53fd83cf659","from":"MS-POL-POL-18@97f5690fa7f7084e","to":"MS-RULE-DP-14","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!22:22","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f7b48c6ac0a514d056e88459","from":"MS-POL-POL-18@97f5690fa7f7084e","to":"MS-RULE-DP-16","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!22:22","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e96cd2ff4d34df98de36b44b","from":"MS-POL-POL-18@97f5690fa7f7084e","to":"MS-RULE-DP-17","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!22:22","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4875591ee56f33c06c185ec6","from":"MS-POL-POL-18@97f5690fa7f7084e","to":"MS-RULE-DP-18","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!22:22","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2aa56f57a95f1f6e90bcb474","from":"MS-POL-POL-18@97f5690fa7f7084e","to":"MS-RULE-OU-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!22:22","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e"],"toKeys":["MS-RULE-OU-10@2332653b89bcd331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5c8341c67ecbfead31199516","from":"MS-POL-POL-20@ea163decd6c07a16","to":"MS-RULE-OP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!24:24","fromKeys":["MS-POL-POL-20@ea163decd6c07a16"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4f0283cf8b29593cd5ffc5cf","from":"MS-POL-POL-20@ea163decd6c07a16","to":"MS-RULE-OP-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!24:24","fromKeys":["MS-POL-POL-20@ea163decd6c07a16"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e0523c7be0c755b109055a99","from":"MS-POL-POL-21@9a99a10275e80192","to":"MS-RULE-OP-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!25:25","fromKeys":["MS-POL-POL-21@9a99a10275e80192"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-989694506378d1008519e44c","from":"MS-POL-POL-22@7864cb607001d95d","to":"MS-RULE-IN-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!26:26","fromKeys":["MS-POL-POL-22@7864cb607001d95d"],"toKeys":["MS-RULE-IN-06@478a04da335c1e7f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bf4a8f4be6fb615cb0a608f5","from":"MS-POL-POL-22@7864cb607001d95d","to":"MS-RULE-AG-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!26:26","fromKeys":["MS-POL-POL-22@7864cb607001d95d"],"toKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d1137e9af53bf8c45466ef8e","from":"MS-POL-POL-22@7864cb607001d95d","to":"MS-RULE-AG-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'08 Internal Policies'!26:26","fromKeys":["MS-POL-POL-22@7864cb607001d95d"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0a2cab16e1a552dc599563c7","from":"MS-OVERLAY-CUS-01@ef016720fa4b77d5","to":"MS-RULE-DP-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!5:5","fromKeys":["MS-OVERLAY-CUS-01@ef016720fa4b77d5"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eb4e656a9f0753a256b0cabf","from":"MS-OVERLAY-CUS-01@ef016720fa4b77d5","to":"MS-RULE-DP-09","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!5:5","fromKeys":["MS-OVERLAY-CUS-01@ef016720fa4b77d5"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1151e46ed26f0f9c6b22114a","from":"MS-OVERLAY-CUS-02@2bdb2cb7097a15c7","to":"MS-RULE-DP-14","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!6:6","fromKeys":["MS-OVERLAY-CUS-02@2bdb2cb7097a15c7"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-286577ba867121506a4345ed","from":"MS-OVERLAY-CUS-02@2bdb2cb7097a15c7","to":"MS-RULE-DP-16","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!6:6","fromKeys":["MS-OVERLAY-CUS-02@2bdb2cb7097a15c7"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1330f9d93ad17513987a5747","from":"MS-OVERLAY-CUS-02@2bdb2cb7097a15c7","to":"MS-RULE-DP-18","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!6:6","fromKeys":["MS-OVERLAY-CUS-02@2bdb2cb7097a15c7"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0796e019bfa95fef9327dcdd","from":"MS-OVERLAY-CUS-03@9e0dd72cbcd36d06","to":"MS-RULE-AU-01","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!7:7","fromKeys":["MS-OVERLAY-CUS-03@9e0dd72cbcd36d06"],"toKeys":["MS-RULE-AU-01@32b7d4ac14b06f7b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aec0fa838608177d28f6e7d2","from":"MS-OVERLAY-CUS-03@9e0dd72cbcd36d06","to":"MS-RULE-AG-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!7:7","fromKeys":["MS-OVERLAY-CUS-03@9e0dd72cbcd36d06"],"toKeys":["MS-RULE-AG-05@8829d873310f18f9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-804a1bbf645460ab89b88b6d","from":"MS-OVERLAY-CUS-04@1f8a3af1c8e871ca","to":"MS-RULE-DP-14","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!8:8","fromKeys":["MS-OVERLAY-CUS-04@1f8a3af1c8e871ca"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a0268c43f46d7b5256a57ad8","from":"MS-OVERLAY-CUS-04@1f8a3af1c8e871ca","to":"MS-RULE-DP-16","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!8:8","fromKeys":["MS-OVERLAY-CUS-04@1f8a3af1c8e871ca"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-45e179431ff59a92bdbfccce","from":"MS-OVERLAY-CUS-05@312949a220d7aa56","to":"MS-RULE-AU-04","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!9:9","fromKeys":["MS-OVERLAY-CUS-05@312949a220d7aa56"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d4c852781748fadaef629a42","from":"MS-OVERLAY-CUS-06@b76726eea76800fb","to":"MS-RULE-AU-02","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!10:10","fromKeys":["MS-OVERLAY-CUS-06@b76726eea76800fb"],"toKeys":["MS-RULE-AU-02@1a166eaeb8f7f1ad"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ee0ee408b27d744de6fc7140","from":"MS-OVERLAY-CUS-06@b76726eea76800fb","to":"MS-RULE-AU-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!10:10","fromKeys":["MS-OVERLAY-CUS-06@b76726eea76800fb"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-35c64cea3cab4afd509250ab","from":"MS-OVERLAY-CUS-06@b76726eea76800fb","to":"MS-RULE-AU-06","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!10:10","fromKeys":["MS-OVERLAY-CUS-06@b76726eea76800fb"],"toKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4063d8ecf8ef7557667bec3f","from":"MS-OVERLAY-CUS-07@e7e1902f4641a2b9","to":"MS-RULE-OU-04","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!11:11","fromKeys":["MS-OVERLAY-CUS-07@e7e1902f4641a2b9"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fb7522364080882814bf936f","from":"MS-OVERLAY-CUS-07@e7e1902f4641a2b9","to":"MS-RULE-OU-12","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!11:11","fromKeys":["MS-OVERLAY-CUS-07@e7e1902f4641a2b9"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5fcd04b99152e2f99b9ecb5b","from":"MS-OVERLAY-CUS-08@f2e9d1cd2e00bcf6","to":"MS-RULE-AG-07","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!12:12","fromKeys":["MS-OVERLAY-CUS-08@f2e9d1cd2e00bcf6"],"toKeys":["MS-RULE-AG-07@c2fb36c556cb8a62"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3cffb8340f1f17c895e939d0","from":"MS-OVERLAY-CUS-09@fa0395a46d9792dd","to":"MS-RULE-AG-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!13:13","fromKeys":["MS-OVERLAY-CUS-09@fa0395a46d9792dd"],"toKeys":["MS-RULE-AG-05@8829d873310f18f9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0aaa31ed392f031a159e9068","from":"MS-OVERLAY-CUS-10@d2a5b80a68088779","to":"MS-RULE-AG-01","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!14:14","fromKeys":["MS-OVERLAY-CUS-10@d2a5b80a68088779"],"toKeys":["MS-RULE-AG-01@e6aee1767c267990"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-42fe2aa68687bf716a4fc61d","from":"MS-OVERLAY-CUS-10@d2a5b80a68088779","to":"MS-RULE-AG-10","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!14:14","fromKeys":["MS-OVERLAY-CUS-10@d2a5b80a68088779"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fcdaa518d52a4d91234eb3ef","from":"MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7","to":"MS-RULE-AU-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!15:15","fromKeys":["MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-999b3f9005db104f3c5c3fd6","from":"MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7","to":"MS-RULE-OP-11","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!15:15","fromKeys":["MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4e2f5c9ded10de5c17017c20","from":"MS-OVERLAY-CUS-12@b7241f443c6c3622","to":"MS-RULE-DP-01","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!16:16","fromKeys":["MS-OVERLAY-CUS-12@b7241f443c6c3622"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-da7fdd92000b115d56007e0a","from":"MS-OVERLAY-CUS-12@b7241f443c6c3622","to":"MS-RULE-DP-15","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!16:16","fromKeys":["MS-OVERLAY-CUS-12@b7241f443c6c3622"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2ddc70b5a72fb73d15523914","from":"MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7","to":"MS-RULE-IN-03","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!17:17","fromKeys":["MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7"],"toKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3f1deea4d4004399ca6ebe4c","from":"MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7","to":"MS-RULE-IN-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!17:17","fromKeys":["MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7"],"toKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c6dd22fbce5ac648908c4694","from":"MS-OVERLAY-CUS-14@360b13cad7621179","to":"MS-RULE-IN-07","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!18:18","fromKeys":["MS-OVERLAY-CUS-14@360b13cad7621179"],"toKeys":["MS-RULE-IN-07@31e317962beaeb5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dec2954be8458c6396600160","from":"MS-OVERLAY-CUS-14@360b13cad7621179","to":"MS-RULE-OU-04","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!18:18","fromKeys":["MS-OVERLAY-CUS-14@360b13cad7621179"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c3f743a3ca4427f659abcc6d","from":"MS-OVERLAY-CUS-15@bdd9abeff8cb9654","to":"MS-RULE-AG-03","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!19:19","fromKeys":["MS-OVERLAY-CUS-15@bdd9abeff8cb9654"],"toKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f9c0dfcc0e791c75722aa72a","from":"MS-OVERLAY-CUS-15@bdd9abeff8cb9654","to":"MS-RULE-AG-04","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!19:19","fromKeys":["MS-OVERLAY-CUS-15@bdd9abeff8cb9654"],"toKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-47f43c91d8ff3637281d07f7","from":"MS-OVERLAY-CUS-15@bdd9abeff8cb9654","to":"MS-RULE-OP-08","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!19:19","fromKeys":["MS-OVERLAY-CUS-15@bdd9abeff8cb9654"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6e3916e33aca55c6a6f4024c","from":"MS-OVERLAY-CUS-16@5dc4891c003c8c70","to":"MS-RULE-OU-01","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!20:20","fromKeys":["MS-OVERLAY-CUS-16@5dc4891c003c8c70"],"toKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5a1f934a39071c069df41d80","from":"MS-OVERLAY-CUS-16@5dc4891c003c8c70","to":"MS-RULE-OU-02","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!20:20","fromKeys":["MS-OVERLAY-CUS-16@5dc4891c003c8c70"],"toKeys":["MS-RULE-OU-02@4965655028a3d485"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a9aadb451e02120cf9a2d531","from":"MS-OVERLAY-CUS-16@5dc4891c003c8c70","to":"MS-RULE-AG-08","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!20:20","fromKeys":["MS-OVERLAY-CUS-16@5dc4891c003c8c70"],"toKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-043f22245e2a6f7eb0114aec","from":"MS-OVERLAY-CUS-17@3b8c3e6e3715795f","to":"MS-RULE-OU-03","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!21:21","fromKeys":["MS-OVERLAY-CUS-17@3b8c3e6e3715795f"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-38cbc0f8ea33ef085ecb67c6","from":"MS-OVERLAY-CUS-17@3b8c3e6e3715795f","to":"MS-RULE-OU-12","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!21:21","fromKeys":["MS-OVERLAY-CUS-17@3b8c3e6e3715795f"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6c07218fbd3e24efaea84b41","from":"MS-OVERLAY-CUS-17@3b8c3e6e3715795f","to":"MS-RULE-AG-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!21:21","fromKeys":["MS-OVERLAY-CUS-17@3b8c3e6e3715795f"],"toKeys":["MS-RULE-AG-05@8829d873310f18f9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7d04144d60b857088d039d9a","from":"MS-OVERLAY-CUS-18@d7a54daf6d4edffb","to":"MS-RULE-OP-06","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!22:22","fromKeys":["MS-OVERLAY-CUS-18@d7a54daf6d4edffb"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ee00697cf3b2dbdcd84b94c3","from":"MS-OVERLAY-CUS-18@d7a54daf6d4edffb","to":"MS-RULE-OP-12","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'09 Custom Rule Backlog'!22:22","fromKeys":["MS-OVERLAY-CUS-18@d7a54daf6d4edffb"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f5e213963d1eebd15987625f","from":"MS-SEED-fc49123874e83c92@1ed210287f703b82","to":"MS-RULE-DP-01","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-csf-2","frameworkTitle":"NIST CSF","locator":"PR.AA — Identity Management & Access Control","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!5:5","fromKeys":["MS-SEED-fc49123874e83c92@1ed210287f703b82"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1fbf7a5ea5f4354fee6b1c10","from":"MS-SEED-fc49123874e83c92@1ed210287f703b82","to":"MS-RULE-DP-02","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-csf-2","frameworkTitle":"NIST CSF","locator":"PR.AA — Identity Management & Access Control","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!5:5","fromKeys":["MS-SEED-fc49123874e83c92@1ed210287f703b82"],"toKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-02bb2af7c9c408812f708729","from":"MS-SEED-98c36050538db5d1@65ffe1e6e8668a51","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-csf-2","frameworkTitle":"NIST CSF","locator":"PR.IR — Technology Infrastructure Resilience","suggestedCanonical":"DP-15"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!6:6","fromKeys":["MS-SEED-98c36050538db5d1@65ffe1e6e8668a51"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3a40e48901b52f6076efbf1f","from":"MS-SEED-ea7497b6cbeba00e@7470eaf94aa87c41","to":"MS-RULE-OP-04","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-csf-2","frameworkTitle":"NIST CSF","locator":"RS.CO — Incident Response Communication","suggestedCanonical":"OP-04"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!7:7","fromKeys":["MS-SEED-ea7497b6cbeba00e@7470eaf94aa87c41"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f87c0a4b98f88dad501c4f3e","from":"MS-SEED-ad9fe38d530f8f1e@d7fcddbdb30bd016","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-csf-2","frameworkTitle":"NIST CSF","locator":"ID.RA — Risk Assessment","suggestedCanonical":"DP-15"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!8:8","fromKeys":["MS-SEED-ad9fe38d530f8f1e@d7fcddbdb30bd016"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-244e6ab9ac9320a6530fee98","from":"MS-SEED-3c262146dff584d9@65146e1683c930ec","to":"MS-RULE-DP-01","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-800-53","frameworkTitle":"NIST 800-53","locator":"IA-5 — Authenticator Management","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!9:9","fromKeys":["MS-SEED-3c262146dff584d9@65146e1683c930ec"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-44df2c7ac8527b3d41045cec","from":"MS-SEED-3c262146dff584d9@65146e1683c930ec","to":"MS-RULE-DP-02","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-800-53","frameworkTitle":"NIST 800-53","locator":"IA-5 — Authenticator Management","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!9:9","fromKeys":["MS-SEED-3c262146dff584d9@65146e1683c930ec"],"toKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0a34548127e5991ea67fa928","from":"MS-SEED-71dcb43d4ab69039@2cb8ac94477f4fc1","to":"MS-RULE-DP-05","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-800-53","frameworkTitle":"NIST 800-53","locator":"PT-2 / SI-19 — PII Processing & De-identification","suggestedCanonical":"DP-05"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!10:10","fromKeys":["MS-SEED-71dcb43d4ab69039@2cb8ac94477f4fc1"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1b5b77c5e940c17aff46c6d8","from":"MS-SEED-189bbb416d04da7a@9eca359a04a266eb","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-800-53","frameworkTitle":"NIST 800-53","locator":"CM-8 / SC-7 — System Inventory & Boundary Protection","suggestedCanonical":"DP-15"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!11:11","fromKeys":["MS-SEED-189bbb416d04da7a@9eca359a04a266eb"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e462a4c238aae02af66a6ed1","from":"MS-SEED-fa17b2e8b13c54ec@c3bb1f47e455b596","to":"MS-RULE-DP-12","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-800-53","frameworkTitle":"NIST 800-53","locator":"AC-4 — Information Flow Enforcement","suggestedCanonical":"DP-12"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!12:12","fromKeys":["MS-SEED-fa17b2e8b13c54ec@c3bb1f47e455b596"],"toKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5ac7dbc76302509a4cfbfdc3","from":"MS-SEED-0d5943f602c4e0c6@0b72544338892151","to":"MS-RULE-DP-16","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"soc2","frameworkTitle":"SOC 2","locator":"CC6.1 / C1.1 — Logical Access & Confidentiality","suggestedCanonical":"DP-16"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!13:13","fromKeys":["MS-SEED-0d5943f602c4e0c6@0b72544338892151"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f8750ced88553b3a7bfe83cc","from":"MS-SEED-fabd8a5fa3829b34@a1173a790d6af788","to":"MS-RULE-DP-01","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"soc2","frameworkTitle":"SOC 2","locator":"CC6.1 — Logical & Physical Access Controls","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!14:14","fromKeys":["MS-SEED-fabd8a5fa3829b34@a1173a790d6af788"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-460e4f7f4dfe75399bd72a17","from":"MS-SEED-fabd8a5fa3829b34@a1173a790d6af788","to":"MS-RULE-DP-02","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"soc2","frameworkTitle":"SOC 2","locator":"CC6.1 — Logical & Physical Access Controls","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!14:14","fromKeys":["MS-SEED-fabd8a5fa3829b34@a1173a790d6af788"],"toKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-639a0e4a0f8c23b9a6697665","from":"MS-SEED-18fc98793e3aa932@1b1b44969e446920","to":"MS-RULE-DP-09","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"soc2","frameworkTitle":"SOC 2","locator":"C1.1 — Confidential Information Identification","suggestedCanonical":"DP-09"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!15:15","fromKeys":["MS-SEED-18fc98793e3aa932@1b1b44969e446920"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6aab4d431f44d881161962a3","from":"MS-SEED-68e6b67355afdda4@2380ad816add7da2","to":"MS-RULE-DP-18","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"soc2","frameworkTitle":"SOC 2","locator":"CC4.2 — Internal Control Evaluations","suggestedCanonical":"DP-18 / DP-15"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!16:16","fromKeys":["MS-SEED-68e6b67355afdda4@2380ad816add7da2"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a91ac3f8d947d9cf455eef8f","from":"MS-SEED-68e6b67355afdda4@2380ad816add7da2","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"soc2","frameworkTitle":"SOC 2","locator":"CC4.2 — Internal Control Evaluations","suggestedCanonical":"DP-18 / DP-15"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!16:16","fromKeys":["MS-SEED-68e6b67355afdda4@2380ad816add7da2"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5a0579372dab28f507a7f4fe","from":"MS-SEED-1362e1ef9da30d6a@a69019f699a9743e","to":"MS-RULE-DP-05","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"hipaa","frameworkTitle":"HIPAA","locator":"45 CFR §164.514(b) — De-identification","suggestedCanonical":"DP-05"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!17:17","fromKeys":["MS-SEED-1362e1ef9da30d6a@a69019f699a9743e"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9213aec598474d30021eb094","from":"MS-SEED-fc55d1561526efc3@99d4d53f8b22179d","to":"MS-RULE-DP-07","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"hipaa","frameworkTitle":"HIPAA","locator":"45 CFR §164.514(b)(2) — Identifiers","suggestedCanonical":"DP-07"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!18:18","fromKeys":["MS-SEED-fc55d1561526efc3@99d4d53f8b22179d"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-124ac74ee7c1f93f209c762a","from":"MS-SEED-273c936c3ac5a321@609ed6ce29a693b3","to":"MS-RULE-DP-07","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"hipaa","frameworkTitle":"HIPAA","locator":"45 CFR §164.514(b)(2) — Identifiers","suggestedCanonical":"DP-07"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!19:19","fromKeys":["MS-SEED-273c936c3ac5a321@609ed6ce29a693b3"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-096b93af66481909df8c5c2a","from":"MS-SEED-38a0f0c058b76861@f7e97b882e8d03d9","to":"MS-RULE-DP-07","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"hipaa","frameworkTitle":"HIPAA","locator":"45 CFR §164.502 — Uses & Disclosures of PHI","suggestedCanonical":"DP-07"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!20:20","fromKeys":["MS-SEED-38a0f0c058b76861@f7e97b882e8d03d9"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d4ed1ff0542cad3192d7f4e1","from":"MS-SEED-59116351fad45b18@cef308c28bb05b77","to":"MS-RULE-DP-03","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"pci-dss-4","frameworkTitle":"PCI DSS","locator":"Req. 3.4 — PAN Rendered Unreadable","suggestedCanonical":"DP-03"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!21:21","fromKeys":["MS-SEED-59116351fad45b18@cef308c28bb05b77"],"toKeys":["MS-RULE-DP-03@4cbb47b109e98f4a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-919fb54e1e3830f0d9664b95","from":"MS-SEED-c3235745be75933b@c2946015ae62bccb","to":"MS-RULE-DP-04","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"pci-dss-4","frameworkTitle":"PCI DSS","locator":"Req. 3.3.1 — Sensitive Authentication Data","suggestedCanonical":"DP-04"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!22:22","fromKeys":["MS-SEED-c3235745be75933b@c2946015ae62bccb"],"toKeys":["MS-RULE-DP-04@13c6ba85197d9a69"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d5bd1100dab62b1958ce9395","from":"MS-SEED-7c38f47e89353be2@c668276dcce2c02c","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"pci-dss-4","frameworkTitle":"PCI DSS","locator":"Req. 1.2 — Network Security Controls","suggestedCanonical":"DP-15"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!23:23","fromKeys":["MS-SEED-7c38f47e89353be2@c668276dcce2c02c"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7503393d1de90407c244051f","from":"MS-SEED-3545abaedc039060@41f9aeca34965328","to":"MS-RULE-DP-09","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"ccpa","frameworkTitle":"CCPA","locator":"Cal. Civ. Code §1798.140(v) — Personal Information","suggestedCanonical":"DP-09"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!24:24","fromKeys":["MS-SEED-3545abaedc039060@41f9aeca34965328"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-97f0edb3f8f8f72446c564c3","from":"MS-SEED-f14ef687ebdcf6dd@e868935a9f5522b7","to":"MS-RULE-DP-09","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"ccpa","frameworkTitle":"CCPA","locator":"Cal. Civ. Code §1798.140(v) — Personal Information","suggestedCanonical":"DP-09"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!25:25","fromKeys":["MS-SEED-f14ef687ebdcf6dd@e868935a9f5522b7"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7c2baf753a3eeda8aee23b10","from":"MS-SEED-f24cc8315666f56b@0b522650197658e0","to":"MS-RULE-DP-05","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"ccpa","frameworkTitle":"CCPA","locator":"Cal. Civ. Code §1798.81.5 — Reasonable Security","suggestedCanonical":"DP-05"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!27:27","fromKeys":["MS-SEED-f24cc8315666f56b@0b522650197658e0"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7c67d8d44efb5a3446c5b446","from":"MS-SEED-af63591ae8a0d1d3@cf9fcbd0c3f96907","to":"MS-RULE-DP-06","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"glba","frameworkTitle":"GLBA","locator":"Safeguards Rule, 16 CFR 314.4","suggestedCanonical":"DP-06"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!28:28","fromKeys":["MS-SEED-af63591ae8a0d1d3@cf9fcbd0c3f96907"],"toKeys":["MS-RULE-DP-06@af062b3863346b41"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3005366369229c774d40b824","from":"MS-SEED-9b9cda9c97338d12@ceb60bcac22b5550","to":"MS-RULE-DP-03","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"glba","frameworkTitle":"GLBA","locator":"Safeguards Rule, 16 CFR 314.4","suggestedCanonical":"DP-03"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!29:29","fromKeys":["MS-SEED-9b9cda9c97338d12@ceb60bcac22b5550"],"toKeys":["MS-RULE-DP-03@4cbb47b109e98f4a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-39d4498d4005a56265c5dbfc","from":"MS-SEED-45c0aa82a09ceac4@b7de303ed373dc1e","to":"MS-RULE-DP-06","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"glba","frameworkTitle":"GLBA","locator":"Privacy Rule, 16 CFR 313.10","suggestedCanonical":"DP-06"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!30:30","fromKeys":["MS-SEED-45c0aa82a09ceac4@b7de303ed373dc1e"],"toKeys":["MS-RULE-DP-06@af062b3863346b41"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-347ba9195dac4d6428356d95","from":"MS-SEED-6962f396beb2c752@af6c264d193e2846","to":"MS-RULE-DP-17","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"sox","frameworkTitle":"SOX","locator":"§409 — Real-Time Issuer Disclosures / Reg FD","suggestedCanonical":"DP-17"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!31:31","fromKeys":["MS-SEED-6962f396beb2c752@af6c264d193e2846"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e973e762ef8237d653ffb3a8","from":"MS-SEED-274a1827288fe0cb@596d8feb02101b0a","to":"MS-RULE-DP-17","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"sox","frameworkTitle":"SOX","locator":"§302 — Corporate Responsibility for Reports","suggestedCanonical":"DP-17"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!32:32","fromKeys":["MS-SEED-274a1827288fe0cb@596d8feb02101b0a"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c20d1b4d170066491b2152e4","from":"MS-SEED-af6d2822af49aa78@15cfcad58c3a6910","to":"MS-RULE-DP-18","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"sox","frameworkTitle":"SOX","locator":"§802 — Records Retention","suggestedCanonical":"DP-18 / DP-15"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!33:33","fromKeys":["MS-SEED-af6d2822af49aa78@15cfcad58c3a6910"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-675feb8fa68d0ee2663e39e2","from":"MS-SEED-af6d2822af49aa78@15cfcad58c3a6910","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"sox","frameworkTitle":"SOX","locator":"§802 — Records Retention","suggestedCanonical":"DP-18 / DP-15"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!33:33","fromKeys":["MS-SEED-af6d2822af49aa78@15cfcad58c3a6910"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-36e60d9ab5b4118af34c7dc4","from":"MS-SEED-773a80bd6da7f832@fbd7a85624f21c94","to":"MS-RULE-DP-01","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"fedramp","frameworkTitle":"FedRAMP","locator":"IA-5 — Authenticator Management","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!34:34","fromKeys":["MS-SEED-773a80bd6da7f832@fbd7a85624f21c94"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2667cf0e5e7dff852c92cdb8","from":"MS-SEED-773a80bd6da7f832@fbd7a85624f21c94","to":"MS-RULE-DP-02","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"fedramp","frameworkTitle":"FedRAMP","locator":"IA-5 — Authenticator Management","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!34:34","fromKeys":["MS-SEED-773a80bd6da7f832@fbd7a85624f21c94"],"toKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4d912280dfa5b9c36816ec45","from":"MS-SEED-db227e3fca1cbc72@ad3e673390385458","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"fedramp","frameworkTitle":"FedRAMP","locator":"CA-3 — Information Exchange","suggestedCanonical":"DP-15"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!35:35","fromKeys":["MS-SEED-db227e3fca1cbc72@ad3e673390385458"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-294fa3610fdb579b38ceadfa","from":"MS-SEED-3b2df0684d924bea@d76862e507e52a9e","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"fedramp","frameworkTitle":"FedRAMP","locator":"SC-7 — Boundary Protection","suggestedCanonical":"DP-15"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!36:36","fromKeys":["MS-SEED-3b2df0684d924bea@d76862e507e52a9e"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d99bd2e26cd3604c87f344aa","from":"MS-SEED-3a800d0a422ff4cf@bb27bd955ce6ac5b","to":"MS-RULE-DP-08","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"ferpa","frameworkTitle":"FERPA","locator":"34 CFR §99.30 — Prior Consent to Disclose","suggestedCanonical":"DP-08"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!37:37","fromKeys":["MS-SEED-3a800d0a422ff4cf@bb27bd955ce6ac5b"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-beae39b4704af6cb210ebdf0","from":"MS-SEED-e7da922c47d356c8@a8f292c00608d481","to":"MS-RULE-DP-05","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"ferpa","frameworkTitle":"FERPA","locator":"34 CFR §99.3 — Personally Identifiable Information","suggestedCanonical":"DP-05"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!38:38","fromKeys":["MS-SEED-e7da922c47d356c8@a8f292c00608d481"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fc52302046857150eacdb6ac","from":"MS-SEED-0318ca8123595a60@ce3f096f7c803475","to":"MS-RULE-DP-08","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"ferpa","frameworkTitle":"FERPA","locator":"34 CFR §99.37 — Directory Information","suggestedCanonical":"DP-08"},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'12 Code Seed Crosswalk'!39:39","fromKeys":["MS-SEED-0318ca8123595a60@ce3f096f7c803475"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4e351a788b2c9055baacece7","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.1\n8.7\n9.11.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8f6c0b4a50735887b4ca29ff","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018\n5.4.2 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-770d0be92b09f8d8b313185f","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.1.3\n6.3.4.3\n6.3.8.3\n6.4.1.3\n6.4.2.3\n6.4.3.3\n6.4.8.2\n6.4.8.3\n6.4.17\n6.4.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0773df849d2f3d99b765dcd8","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n5.5\n6.1\n6.4\n6.6.1\n6.7.3\nA.1.2\nA.1.3\nA.1.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de15478dce342266943dbf54","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.2\n5.15.1\n5.15.5\n5.17\n5.18\n5.19.5.4\n5.19.7.3\n6.2.2\n8.1\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-655ef7ead5bef2cf91072d93","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1c9ebf570b57a6b28a593ad8","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-17f071fb9f05065de8847400","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7ae07e72553c047f55d738c4","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d14a4dc50e7590cd57e5fa9f","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6b5460f1f5ad7e643aa9c1cb","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-886b50f7853ac1d2e1db1a05","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-51fb281a4496bb370ba525d9","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-92db283e5ec265640dc474ad","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1 - Understanding the organization and its context\n6.2 - AI objectives and planning to achieve them\nB.2.2 - AI policy\nB.2.4 - Review of the AI policy","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-db90de82c7b357497f377109","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Alabama: Enacted facial recognition restrictions (2022) and laws against sexual and political deepfakes (2024).\nAlaska: No significant AI-specific legislation enacted as of April 2025.\nArkansas: Proposed bills (HB127, SB59) to criminalize deceptive deepfakes in elections and require AI chatbot disclosures.\nCalifornia: Deepfake regulations (electoral and sexual), chatbot disclosures, bias audits for criminal justice agencies; vetoed AI safety bill (Sept 2024); exploring AI avatars for court rulings.\nIdaho: Bill introduced that requires AI chatbot disclosures in consumer transactions (2025).\nKansas: No significant AI-specific legislation enacted as of April 2025.\nMississippi: Enacted political and sexual deepfake laws (2024).\nMissouri: No significant AI-specific legislation enacted as of April 2025.\nMontana: No significant AI-specific legislation enacted as of April 2025.\nNebraska: No significant AI-specific legislation enacted as of April 2025.\nNew Hampshire: Prohibits Department of Motor Vehicles use of Facial recognition technology (2014/2016); sexual deepfake and election fraud laws (2024).\nOhio: No significant AI-specific legislation enacted as of April 2025.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA establishes many new statutory requirements for legal compliance in use, deployment, and prohibited uses of AI (e.g., manipulation, discrimination, certain biometrics).\nUtah: AI Policy Act (2024): UAIPA liability cannot be transferred to AI reinforces NIST's accountability even when AI is involved; legal responsibility must be maintained.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e4577df9da00bdb2ce9e51d4","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.2\n9.3\n9.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9a26258b375ddc87ab6ea780","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.3.3\n6.5.5.1\n6.5.5.5\n8.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fee8caaeedf148827ae42edf","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4f88c8797074183c1e67af69","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n5.2\n6.3.8.3\n6.4.2.3\n6.4.3.1\n6.4.11.1\nA.2.3\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-be35141758190b002d3bcea7","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7b771d4889c191e54e364ddc","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-66c257d70f837399232de388","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RR-03\nGV.SC-01\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2e7395fe9c0008bf88b2b2ef","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e21c10299133eac165b9fd37","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d0e93a7dfd6827ee1810532f","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a6ee40baee681c6854b0711f","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-512744bc46ebf78bef808e7b","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e47f5ca25af38d37dfda5591","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5caa7504220f9b6cfa763deb","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fa610a4e6631cb07b4c8a154","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.9.3 - Objectives for responsible use of AI system\nB.6.1.2 - Objectives for responsible development of AI system\nB.6.1.3 - Processes for responsible design and development of AI systems\nB.10.3 - Suppliers\nB.2.2 - AI policy\n4.4 - AI management system\n5.2 - AI Policy","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f3010047c0408ef44bb12dde","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA requires alignment with NIST AI RMF and ISO 42001, which codifies adherence to trustworthy AI characteristics and risk frameworks.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-69387bcff5a439df1370139b","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9637d324ad2098525852df1b","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b8ede8603555db849865eaaf","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.2 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a2e123d589c15cc50c31c5db","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.3.4\n6.4.3.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-210a90dfe444af6b06935821","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-924bd11089a44e98eeb1114d","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.2\n6.2.5\n6.2.6\n6.2.7\n9.4\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3b96e845246cbb067134c7ee","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a61eee75c013ac646ffc9060","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dc8ca00226004c97c94459a6","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6af2354baa40f74f33f04460","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-477bc2bc642e5a0cf78066b4","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1d697bc8ba8e71b453f98a51","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2baa2262ba76dacf7c0efd46","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b615b0fb57d776bf831a1d0c","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-85cf8669ff336f15fa67838d","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.2 - AI risk assessment_x000D_\n6.1.1 - General_x000D_\n6.1.3 - AI risk treatment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fbb94ad1a55feacc45edb3ec","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f7999c3b06603e3d370dcaea","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-035bc58a803e69cf1a7dab59","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-927dc3e7b2353114702ac75b","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-008cd86d8675260d3b914b25","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.3.4\n6.3.5.3\n6.4.3.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-77c13f8d6513077a15981e4c","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-100c765d3a3a85fc64cca359","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-89c7874bb6cbae89f44f35b7","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.PO-01","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d738d9579308c4d423c8695c","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9038d27e256e96ccae24b98f","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6a3713761af4fc4af7f9893e","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a59ea15c061bcbea6360d188","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-be91db602dd8d02fe328d293","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-67023a3486d87fa36dc14e14","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9fc6c8cc3da9e8ccce17fd67","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-59b04796f2d4e5eb1050d1b5","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment_x000D_\n8.3 - AI risk treatment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a3a92ac76ff14504c130679f","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA applies to government and covered healthcare disclosure, prohibits dark patterns, mandates transparency when AI is in use.\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0b9288b54d8caf31bbe5559b","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d51d13b4a11a987da84339de","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3\n8.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c8d9e1222e4dfce7306ed58a","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.6 - ISO 31000:2018\n5.4.3 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-10ea8cdbdcd5514cb6dcf5f6","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1\n5.4.3\n6.1.1.2\n6.1.2\n6.2.1\n6.2.2\n6.2.3.2\n6.2.4.2\n6.2.5.2\n6.2.6.2\n6.3.1.2\n6.3.2.2\n6.3.3.2\n6.3.4.2\n6.3.5.2\n6.3.6.2\n6.3.7\n6.3.8.2\n6.4.1.2\n6.4.2.2\n6.4.3.2\n6.4.4\n6.4.5\n6.4.6\n6.4.7.2\n6.4.8.2\n6.4.9.2\n6.4.10\n6.4.11.2\n6.4.12.2\n6.4.14.2\n6.4.15.2\n6.4.16.2\n6.4.17.2\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-40178ba00e40b9fcd0766e51","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2\n6.3\n6.5\n6.7.1\n6.7.2\n6.7.3\nA.1.3\nA.1.4\nA.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dbf792f5c2c5560488661eb9","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.19","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a98390f3c64519d75ae59e82","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OV-01","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8a967dfafd41209d66924af3","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2f9b04a618663dda662d7eb6","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2507ee9dad17e8ebbb28c97e","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-87d6c23eb8282fe413b466c4","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1c8d9e1b0cb3796135e72d47","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-73af4b23008b3e0e42cd5d0c","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0149870dcf68ca4a259999dd","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-76bf23b88d85ca8bdbd0c750","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.2 - AI risk assessment_x000D_\n8.3 - AI risk treatment_x000D_\n8.4 - AI system impact assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c0068b8886066df81e6b8522","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e3f22ccc64e4c84941fd013e","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-49d159b708de914ed71534bd","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-98bbb95a1b6863a48d624f4d","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n6.2.3.3\n6.2.4.1\n6.2.4.3\n6.2.6.3\n6.3.1.1\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6fc60498e36ab69b769e6e40","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n5.3\n6.3\n6.7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fdc36d5a47489044ae425459","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-31e8b35a08b90b711ed38321","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.AM-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1432b066aea46af957e2fd60","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bec3e3f90e9e52069117a311","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-93021234ca1066e8e7084ecb","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ebc93d079d9beeacc052050e","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-263b80bff0046d927b298e74","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4a254ce9a9363683c6509556","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f7ddd9c620271d6ca4686aec","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-11de92d61a577a4c5513a0c8","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.4.5 - System and computing resources_x000D_\nB.4.3 - Data resources_x000D_\nB.4.4 - Tooling resources_x000D_\nB.4.6 - Human resources_x000D_\nB.4.2 - Resource documentation","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-294d727fdf15df433816e767","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Connecticut: Established AI Task Force (2023); developing \"AI Bill of Rights\"; mandates annual inventory of state AI systems.\nNew Jersey: Governor's AI Task Force to study impact (2023).\nOklahoma: Governor's AI task force to study and develop policy recommendations (2023).\nPennsylvania: Generative AI Governing Board to guide policy, use, and deployment (2023).\nSouth Carolina: House AI study special committee (2024).\nWest Virginia: 2023 supply chain and AI hearing.\nWyoming: Select committee discussing synthetic media regulations (2023).","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fb12b90bd38e566765366ee3","from":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!8:8","fromKeys":["TAIM-GOVERN-1.7@a55511fa1ec1c70a"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-62e1c3ddce982f6fcf68e68c","from":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.3.3.3\n6.4.8.2\n6.4.8.3\n6.4.17.1\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!8:8","fromKeys":["TAIM-GOVERN-1.7@a55511fa1ec1c70a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-19598e7c1b4e8edbcc1d21c2","from":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n5.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!8:8","fromKeys":["TAIM-GOVERN-1.7@a55511fa1ec1c70a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-406b7a81409450bcd06f2bb2","from":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.9","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!8:8","fromKeys":["TAIM-GOVERN-1.7@a55511fa1ec1c70a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cf8e3a007289b78ddae076b7","from":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.6 - AI system operation and monitoring","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!8:8","fromKeys":["TAIM-GOVERN-1.7@a55511fa1ec1c70a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-29677abc9553e41dd91e18b4","from":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!8:8","fromKeys":["TAIM-GOVERN-1.7@a55511fa1ec1c70a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cd6aaaf0243b02623880994b","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ed21258883c9cf2535555d3","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2493ec451fbde45aa5fe3c30","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.5 - ISO 3100:2018\n6.2 ISO 3100:2015","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-edf2d65357db9973b746e978","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.4.3\n6.4.2.3\n6.4.7.3\n6.4.9.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b04323b140ee8e6ba71179a7","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1\n6.2\n6.3\n6.7.1\n6.7.3\nA2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ea1ae5674d67c1dedc8a48e","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.19","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a83c4679a2e18c8fc864468c","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.1 - Monitoring, measurement, analysis, and evaluation\n5.3 - Roles, responsibilities and authorities\n7.1 - Resources\n7.2 - Competence\n7.3 - Awareness\n7.4 - Communication\nB.3.2 - AI roles and responsibilities","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ff20f5ae74b670e942b5d609","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA establishes AG enforcement, complaints portal, and state advisory council with defined statutory responsibilities.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0db5680078c1099d799d4145","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b29f5d6c64e1bef0fc015442","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aee6a9afcc0c59bd06d14782","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.12.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-906c511c4a55ea373f556f29","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1\n4.3\n5.1\n6.7.2\n6.7.5\nA.1.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-306a2c2943ec1d5bc6978649","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d7f6d2ddfc2b79ceb82761b1","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"PR.AT-01\nPR.AT-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-002c3322b342189ce0e1a417","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eba6b7f817c70ae0eb95e8f8","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8f330b319e1a98b342339be8","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-86d775c4fb62fb56f8de9c65","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-83443916a7e9428d928b467c","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ec194ca1ec6821a7b4857342","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b80571dc9f011a77f0a99980","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-21410cdf6f0fbe3e398f90af","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.2 - Competence","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c96cccff67bf76d3e044ed82","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-14e0bd84e0ec08a94a784cd1","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"A.2.2.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4869552cb1cac423bd89b3d2","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-090bf00d1adc37419ed4332a","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3\n6.4.3.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1a65512fb44943e96f2ac512","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b108b51a9486ae421678b3e5","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2280f90c5d002571adb7846f","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-04\nGV.RR-01","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8b2fa03b86c22ae91dce0569","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a4e06b01a84120f208f56c74","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d6df72bc6d03064111d80b0d","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-37af6ed48424604adc3c059b","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4c21e78b903d82a7da0bf9c6","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eb1a1183282a025ea21843c5","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a447f3ce1f0c7995bdf8126b","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5bec6eade2451fa9492179d2","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1 - Leadership and commitment\n9.3.1 - General\n9.3.2 - Management review inputs\n9.3.3 - Management review results\n5.2 - AI Policy\nB.2.2 - AI Policy","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cd5480fb941e9351d47e9869","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d27a6ea48c3cf6966e72acd7","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-88ea69921297ca08b97110d5","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-66f82bf35a69907674b62b25","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0fed56ecb9838c9331b75dd4","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-619c1fac53e6c4f524a15706","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.3\n6.5\n6.7.1\n6.7.2\n6.7.3\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2df6aa096909166268a0bf47","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4e758175d1110e1262ebb65e","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.4.6 - Human resources_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e8034749edf6b3d7027752e","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e7623fb641d85c4558d35bbd","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-af39bbd1ecd1dd88d6739aef","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-08cd097a6d3dced32ee5ced2","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.3 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-88734fbdfc2f982741eb86e0","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a3e119311ba2910b70a36a8e","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.2\n6.6.2\n6.7.4\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9610dd788cfa036fcc8c69e7","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.5\n3.1.16\n3.3.3\n5.1\n5.13\n7.1\n7.4.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9d3c7c1273fe49dff0631cb9","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.SC-01","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de35d05cea8fae26f8a8d536","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-704275cb536e83c7643d2182","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-89db83b8cd1d49601b31770f","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1b1ac8005f2ffadf40b40af6","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3ab6c7a1b8c6790638b9371b","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fbdc573e2edbfe2a7bad43d6","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-567bd8f5243dbde05cf7e786","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3afcaff04302e1df318c7739","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.9.3 - Objectives for responsible use of AI system_x000D_\nB.4.6 - Human resources_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\n7.2 - Competence_x000D_\nB.3.2 - Management review inputs","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e06bf19cb4f9551886387e70","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f540bd8063542d77ca677132","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a0985c0107408949a2269b3e","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-507e83368b63638a1d2baa48","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.3\n6.4.2.6\n6.4.3.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d4c0293a889f90754e147b9f","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3\n6.4.3.3\n6.4.17.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-096c6d22931e974c91b6ed9c","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-90722efb6708042ca2906700","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.16\n5.15.2\n5.15.3\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ab61f7f17768d17fd02fb648","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.AM-05\nID.RA-04\nID.RA-05\nID.RA-07\nDE.AE-04","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fd4e7316779a1485c0b4b77e","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c328f134eb63da69f66dbf49","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b63a59659d20bc0c48057916","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-45c97c5c0196a5f658d98e57","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-447560a171b1628d87fba9a5","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4a68a9c8412cc135d5ec0696","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-456a8d259db66f299a0ddafd","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-56812a88ca17ae57cb967d77","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.2 - AI system impact assessment process\nB.6.1.2 - Objectives for responsible development of AI system\nB.6.1.3 - Processes for responsible design and development of AI systems\nB.6.2.4 - AI system verification and validation\nB.9.2 - Processes for responsible use of AI systems\nB.9.3 - Objectives for responsible use of AI system\nB.10.3 - Suppliers\nB.5.4 - Assessing AI system impact on individuals and groups of individuals","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f4f63f6f9c39820b35a72630","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5372a1f20598f0b6ae7fec22","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-76ef11021a25ecd06e92f23e","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d2cb4771dcd3be41b9a92919","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f1608486d4789a2201e88ebe","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.8.3\n6.4.2.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-02b72e41ddc5602d9628283a","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2\n4.3\n5.5\n6.1\n6.3\n6.5\n6.6.1\n6.7.2\n6.7.4\n6.7.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-790985d794a06231b5cf3200","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.18","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b9c409eb69234f703cacf449","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.AM-05\nID.RA-04\nID.RA-05\nID.RA-07\nDE.AE-04","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a37a09e601f2694babb69167","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-193346a42f295cabffd4a6a6","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bb935f77a7d38275e46161c9","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-975a6db220508e93a201f680","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c62fb45eb193d877a0adc5d5","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-78a239e360a2f85858b8524f","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c20dd957342adcf71e77af28","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-68384b2b418024ee2d4e973d","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.8.5 - Information for interested parties_x000D_\n7.4 - Communication_x000D_\n6.1.4 - AI system impact assessment_x000D_\nB.5.5 - Assessing societal impacts of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6b2d009c4b2a2188e204d0b4","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA requires public disclosure and notification to consumers when HRAIS (High Risk AI Systems) are used, so NIST builds transparency into system operation and consumer rights.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is implicit on where use or deployment of AI in a prohibited or high-risk context is banned or must be reported.\nUtah: AI Policy Act (2024): UAIPA requirement for mandatory GenAI disclosure at first interaction (regulated occupations and consumer settings) maps as NIST requires communication of AI system involvement and its risks​; UAIPA liability cannot be transferred to AI reinforces NIST's accountability even when AI is involved; legal responsibility must be maintained.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0fc7713422611a4f6525ccdc","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-83787832a239a1fd1d08ee65","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.4\n6.4\n7.2\n8.2\n8.4\n8.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5e0cdbf46c86cd614174a065","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0710d5c7e85efe8aac9278ac","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.15.3\n6.4.16.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8eb7350148ad26b3051306cf","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.7.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8f408b0831cde247a5e91fab","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.10\n5.15.4\n6.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0b6e174b5416b4704e765b11","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"RS.CO-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f6927401a12670f48d5430d5","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-82a1885f76ea146ee4818223","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1c8171d36e734760488cef16","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8a7117ca542ebf41f9b9f7b9","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-996a7debc8b9c8704a45f34f","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8f6678072e781c772ed3b7d3","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0e1beba2378744c1d91258ff","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ac9d78aed9f28a6d76049d7e","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users_x000D_\nB.8.3 - External reporting_x000D_\nB.8.4 - Communication of incidents_x000D_\nB.8.5 - Information for interested parties_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2b00ebd5d778c561f50841a0","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-23ef94d6d5baedf9fd33a05e","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5dd3cf4fedc06324965661f8","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.6\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-781d5a8b86c2081005275d59","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.5 - ISO 3100:2018\n6.2 - ISO 3100:2015","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0881e5026454f28f58310288","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n6.4.3.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-af7305c270729b05b3454aae","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n5.1\n5.2.3\n5.4\n5.5\n6.5\n6.7.2\nA.1.3\nA.1.4\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c7d86a1bf443aad625c2baea","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.11.4\n5.18\n8.6.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ba2f432e4588a382752e86bb","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"DE.AE-04","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-299020e7f1e97e2df2e6c002","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-867d8577f31924c9e58f6fe0","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c6c406fbc2f50dbf3be32606","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-53780a597df395b8370f0647","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-372edfb43756946a44660030","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0c35057d20889c9698b8c421","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8e3e811f25abe1dd6e13f589","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-546b3ed85d7fca04e38a41c6","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.10.4 - Customers_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.8.3 - External reporting","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-adf2800092c57f8b824b0616","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.\nUtah: AI Policy Act (2024): UAIPA establishes an Office of AI Policy, which institutionalizes stakeholder engagement and public sector governance for ongoing oversight.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-556aba3db771823055a20352","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.4.2\n9.10.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6242cd45dad66d3df928a988","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1\n8.4\n8.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4b071acbaa369b1b095f5693","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.5 - ISO 3100:2018\n6.2 - ISO 3100:2015","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3a77fb169aae4d4132cf3b92","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n5.3\n6.3.5.3\n6.4.5\n6.4.9.1\n6.4.12.3\n6.4.15.3\n6.4.16.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-080aed1e044c91034751b8c5","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2.3\n5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8544e95f2e1aa91ef87388bb","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.11.4\n5.18\n8.6.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c925ea8c9d8c62b83191e609","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"RS.CO-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-30ed6e657aa9133a4dd3c4c3","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d7a9ebc15c6af7bc4b06eba4","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-36b1e498bf8a3ed640892311","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-68cb7752086c1a088409ff27","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4434efe59c7ed84b35956879","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a5b3e7737a5494caba6bebd5","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-21b3e28c59518e0ebff163a2","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2dc9a0ca1d852ca9caa58e3c","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.8.3 - External reporting_x000D_\nB.10.4 - Customers_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-405053d57559269c4faa9094","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.\nUtah: AI Policy Act (2024): UAIPA establishes an Office of AI Policy, which institutionalizes stakeholder engagement and public sector governance for ongoing oversight.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-500991fea7b3944f6e7ec361","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a405ac17a49dab093ea7ef10","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-478411ca657f3f81992eb6d8","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-409a8d1a18b29899f4b8a0bb","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.5\n6.4\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-050f89b167a6e92d7f4335e1","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-13616d232bc7481d10db8bfb","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.SC-05","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-135689c520c059396828907e","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-14c0d937931c9272225f042d","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-27f0d89e9b5ff0b69758357f","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-74d7569f096c9f39b4ebf112","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-75866116160df922e4d3b4d3","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2e4e5f10a927ed427d1f67b4","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4a04837359c4c1b2df21f336","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d6a6d9010d5ccc0bb31900dd","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.10.2 - Allocating responsibilities_x000D_\nB.10.3 - Suppliers","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a6748e85f54bb52057fb8211","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a94fe9342b0ce7a7d2926e0c","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-518f74ee809054d55a83cb15","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-39f921dfe4cf40ba593b9bee","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c5adeaf03d3689e51cbe10c2","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.15.3\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2514abab1982c412912ba42f","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.7.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-49e97b9ff063f50cee46743b","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5c4ac4cc1b2afdc6b8ae1b3b","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.SC-10","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c1ca172469329e672fe57944","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-99924529fee5a75048073d5e","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-40a3c9778e8047cbec8b19b7","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a5dec590e89e9fcbc10f91e5","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-09d04fb4f21c7926582907d5","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-15334b46cca6d8e5c796b0a9","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eb92067fdaefd4619d08695c","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c0d9b564ad75f18230978b17","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.10.2 - Allocating responsibilities_x000D_\nB.10.3 - Suppliers","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cee7f68ecae69ae7537bc383","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-04ae8db128b06d260e832ec7","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8885ab09b3c4448b16cc9ff6","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3\n6.5.1\n6.5.5\n8.2\n8.5\n8.8\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a30cf2aa715fa3f1c4e120be","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.6\n6.5.2 - ISO 31000:2018\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fa41387bd63eeb7b95017c00","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2\n6.3.4.3\n6.4.2.1\n6.4.13.1\n6.4.15.3\n6.4.17.1\nA.2.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-14902808a0989a3b8ce6fbf5","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2\n4.3\n5.3\n6.4\n6.7.4\n6.7.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ed436cc2217605b0fd0b3399","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.13\n5.15.2\n5.16\n5.17\n6.2.2\n7.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6be3112725a9b1a6644c418c","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"PR.PS-06","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-63c980b776480ff8d737e94f","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e0dec11e7c984a46ef57188d","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4963a5d89d0bb83e545f2d7f","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-73d0c4420fbae0cf8689ffeb","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-32d0e599c2e576fe68b28178","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4aa7e586bd53733940fc3408","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e0db01f08b19fdc81e20f9c","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7be79551b13d7216159669a3","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.4 - AI system impact assessment_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-69b3e5b77dcd0c496586063b","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Arizona: Supreme Court uses AI avatars for judicial transparency (2025); laws against sexual and political deepfakes (2024); SB640 (2025) requires chatbot disclosure in consumer interactions.\nColorado: Colorado AI Act (2024): CAIA requires public disclosure and notification to consumers when HRAIS (High Risk AI Systems) are used, so NIST maps consequential use contexts and provides system knowledge boundaries.\nNevada: SB2203 requires AI company registration and misinformation frameworks; proposed synthetic media disclosure for elections (2025).\nNew Mexico: Proposed AI regulations to regulate child profiling (2024).\nNorth Dakota: HB1167 proposed AI election disclaimers (2025).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA requires clear disclosure, bans deployment for certain uses (e.g., behavioral manipulation, social scoring by government).\nUtah: AI Policy Act (2024): UAIPA is a context-specific law and ​mapping this disclosure requirement into the AI’s deployment context aligns with this subcategory relating to knowledge limits and human oversight of AI.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ae58752ca2832f78f7fa8f98","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a3b4cb045fdbc8d80639c68c","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n6.2.3.3\n6.2.4.1\n6.2.4.3\n6.2.6.1\n6.2.6.3\n6.4.9.4\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d334e2f8aab32d76db89a6c8","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"A.1.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-288be47815eb36a4b4bd77d2","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ac6241f5e2cb7869a32c7d9","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"PR.AT-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f6e0d0abec42c1f41aaf6d0e","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-02056c1fa1750124cb535adb","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f448e6814a10eeb3a784b8f9","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d24b0416ddf211fcf95a78b2","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c1627a84aaf3c547f54f8a8f","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f96b151172325f83c4c2f919","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-85051f0e354aab573bb72ad3","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-137ce8d1c5ed2df1d6067fd9","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.4.6 - Human resources_x000D_\n7.2 - Competence","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a3fe1024b0209b68a4ca6dbf","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Utah: AI Policy Act (2024): Requirement for prominent GenAI disclosure in professions requiring state licensure, such as healthcare, accounting, and law ties directly to disclosure of AI involvement and ensuring the user knows the limits of GenAI's role.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ec3c497e864092d84827e584","from":"TAIM-MAP-1.3@1e631023c1414ce6","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!23:23","fromKeys":["TAIM-MAP-1.3@1e631023c1414ce6"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8a464484052dfc14ecf59139","from":"TAIM-MAP-1.3@1e631023c1414ce6","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.1\n6.3\n7.6\n8.1\n8.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!23:23","fromKeys":["TAIM-MAP-1.3@1e631023c1414ce6"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ccfa796226af2972a26c0827","from":"TAIM-MAP-1.3@1e631023c1414ce6","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.1\n6.4.13.1\nA.2.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!23:23","fromKeys":["TAIM-MAP-1.3@1e631023c1414ce6"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3c2a3e8a516a0b5705b4fc1b","from":"TAIM-MAP-1.3@1e631023c1414ce6","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1\nA.1.1\nA.1.4\nA.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!23:23","fromKeys":["TAIM-MAP-1.3@1e631023c1414ce6"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ebe00b47833cafd3277fd008","from":"TAIM-MAP-1.3@1e631023c1414ce6","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!23:23","fromKeys":["TAIM-MAP-1.3@1e631023c1414ce6"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-17c2117859a2f8a7bc9c0a6f","from":"TAIM-MAP-1.3@1e631023c1414ce6","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1 - Understanding the organization and its context_x000D_\n5.2 - AI Policy_x000D_\n6.2 - AI objectives and planning to achieve them_x000D_\n7.5.3 - Control of documented information_x000D_\n7.3 - Awareness_x000D_\n7.4 - Communication","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!23:23","fromKeys":["TAIM-MAP-1.3@1e631023c1414ce6"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a7e081397946b5297fa6ea1a","from":"TAIM-MAP-1.4@576a9621f7b44f60","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2\n8.8.2.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!24:24","fromKeys":["TAIM-MAP-1.4@576a9621f7b44f60"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-36b5bcd5f0daf1a98b06deb4","from":"TAIM-MAP-1.4@576a9621f7b44f60","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.2\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!24:24","fromKeys":["TAIM-MAP-1.4@576a9621f7b44f60"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7ff58795b525c407fb2a071c","from":"TAIM-MAP-1.4@576a9621f7b44f60","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1\n5.4.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!24:24","fromKeys":["TAIM-MAP-1.4@576a9621f7b44f60"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bf6b03b99d74df61bd51be5b","from":"TAIM-MAP-1.4@576a9621f7b44f60","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.1.3\n6.2.3.3\n6.2.4.1\n6.3.2.1\n6.4.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!24:24","fromKeys":["TAIM-MAP-1.4@576a9621f7b44f60"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-26f52814141a8dd64b25e0db","from":"TAIM-MAP-1.4@576a9621f7b44f60","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4\nA.1.2\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!24:24","fromKeys":["TAIM-MAP-1.4@576a9621f7b44f60"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5f3b6163808056e04766f135","from":"TAIM-MAP-1.4@576a9621f7b44f60","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.10\n6.2.2\n7.1\n7.4.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!24:24","fromKeys":["TAIM-MAP-1.4@576a9621f7b44f60"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a71bca82429feb3d5993d4a1","from":"TAIM-MAP-1.4@576a9621f7b44f60","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1 - Leadership and commitment_x000D_\n4.1 - Understanding the organization and its context_x000D_\nB.2.2 - Customers_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.9.4 - Intended use of the AI system_x000D_\nB.6.2.2 - AI system requirements and specification","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!24:24","fromKeys":["TAIM-MAP-1.4@576a9621f7b44f60"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d84d9d9b785dadc1e7d3df07","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f6a299297d4c0d07f585b6e9","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-98a37471ac158c443f24a21c","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-92909e1cad81213252c429fb","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2\n4.3\n5.5\n6.6.1\n6.7.1\n6.7.2\n6.7.3\n6.7.5\nA.1.4\nA.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-91ffc1f9b429d87566f82a42","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.18\n6.1\n6.2.2\n6.2.3\n6.2.4\n6.2.5\n6.2.6\n6.2.7\n6.2.8\n9.4\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-801e8e248f01e6aade1cd610","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-da006698d2bdc4fa39505ecc","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d28212d70193d12922dfd29f","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-db324219d095f05e7743d72a","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1dbcc9b10a88dcf6a46285dc","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-62c6f43ed6c858d81d76f28d","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1d8d72465526304e3dd618a7","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-557691d71871282bcb51fec7","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-912ca34e3c3600a18e394d33","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.1 - Objective","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1f730cebc4ff08f8a6655d35","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-51a20dbab234794a55ed076b","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b7d00977be749ccebb386a0c","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5deecf41b0365090a0e56e4b","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3\n6.4.1.3\n6.4.3.3\n6.4.8.3\n6.4.17.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4904eb4891e728dc099c7236","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.4\n6.6.2\n6.7.2\n6.7.3\n6.7.5\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c6199024261973cbc129d2e9","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.11\n3.5.14\n3.5.15\n3.5.16\n5.15.8\n5.19\n6.2\n6.1\n6.2.2\n8.6.2\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e1141c702c00393330a2d2a0","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-19e6256c8451e58782082732","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-88befad8d42999f146a9a6b1","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-498cdfb7ac12b2e0f23123a1","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3f63bd928aeb47b4b188fc9d","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-937f531aa7265943c76de368","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5dbebee9262d9120e6a2dd0f","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1f5c511937fb046c2c07deb4","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bf9f958393f9e3e79cd3e624","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.2 - AI system requirements and specification_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ba80c4782b25cf342e909e72","from":"TAIM-MAP-2.1@4508ecde43a2dc95","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n9.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!27:27","fromKeys":["TAIM-MAP-2.1@4508ecde43a2dc95"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-98e266ccd8d017b08e3e3366","from":"TAIM-MAP-2.1@4508ecde43a2dc95","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2\n6.5.3.2.8\n6.5.5.1\n6.5.5.6\n7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!27:27","fromKeys":["TAIM-MAP-2.1@4508ecde43a2dc95"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c23551adbb4fab33be0b9b35","from":"TAIM-MAP-2.1@4508ecde43a2dc95","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n5.4.2\n6.1.1.3\n6.1.2.3\n6.2.3.3\n6.2.4.3\n6.2.5.3\n6.2.6.3\n6.3.1.3\n6.3.2.3\n6.3.3.3\n6.4.8.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!27:27","fromKeys":["TAIM-MAP-2.1@4508ecde43a2dc95"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-698bb03aa963a247914bf8ee","from":"TAIM-MAP-2.1@4508ecde43a2dc95","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.1\n5.2.1\n5.4\n6.3\nA.1.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!27:27","fromKeys":["TAIM-MAP-2.1@4508ecde43a2dc95"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e81aca14e4a5951a87c404f","from":"TAIM-MAP-2.1@4508ecde43a2dc95","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.14\n3.1.24\n3.1.29\n3.1.35\n5.1\n5.2\n5.5\n5.11.1\n5.19.5.1\n7.2\n8.2\n8.6.2\n8.7.2\n9.1\n9.2.2.1\n10.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!27:27","fromKeys":["TAIM-MAP-2.1@4508ecde43a2dc95"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ac65f5b9e1c3052d40653d88","from":"TAIM-MAP-2.1@4508ecde43a2dc95","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.3 - Documentation of AI system design and development_x000D_\nB.4.2 - Resource documentation_x000D_\nB.4.3 - Data resources_x000D_\nB.4.4 - Tooling resources_x000D_\nB.4.5 - System and computing resources_x000D_\nB.4.6 - Human resources","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!27:27","fromKeys":["TAIM-MAP-2.1@4508ecde43a2dc95"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d455dc5ca93201144d58ac8e","from":"TAIM-MAP-2.1@4508ecde43a2dc95","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!27:27","fromKeys":["TAIM-MAP-2.1@4508ecde43a2dc95"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-63de84a64ab2a0958a336edc","from":"TAIM-MAP-2.2@318e6e5f8367a840","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.11.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!28:28","fromKeys":["TAIM-MAP-2.2@318e6e5f8367a840"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-23a41507328fd26a3010c643","from":"TAIM-MAP-2.2@318e6e5f8367a840","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.3.2.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!28:28","fromKeys":["TAIM-MAP-2.2@318e6e5f8367a840"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-16cade650cdbd16eaeb4993e","from":"TAIM-MAP-2.2@318e6e5f8367a840","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!28:28","fromKeys":["TAIM-MAP-2.2@318e6e5f8367a840"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e307faa7d590435c68420773","from":"TAIM-MAP-2.2@318e6e5f8367a840","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n5.2.1\n5.2.3\n6.3\n6.5\n6.6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!28:28","fromKeys":["TAIM-MAP-2.2@318e6e5f8367a840"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-33c28f08987a4b0c516084b4","from":"TAIM-MAP-2.2@318e6e5f8367a840","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4\n5.15.8\n7.3\n8.1\n8.5.1\n8.5.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!28:28","fromKeys":["TAIM-MAP-2.2@318e6e5f8367a840"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d28de1491872984e542b1080","from":"TAIM-MAP-2.2@318e6e5f8367a840","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.7 - AI system technical documentation_x000D_\nB.9.3 - Objectives for responsible use of AI system_x000D_\nB.8.2 - System documentation and information for users","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!28:28","fromKeys":["TAIM-MAP-2.2@318e6e5f8367a840"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6195ac0bf979260e289a349b","from":"TAIM-MAP-2.2@318e6e5f8367a840","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA requires public disclosure and notification to consumers when HRAIS (High Risk AI Systems) are used, so NIST maps consequential use contexts and provides system knowledge boundaries.\nFlorida: Unlawful to possess AI-generated child pornography (2024); established tech modernization council to study and monitor the development and deployment of AI systems.\nHawaii: SB640 Chatbot disclosure mandates; prohibits discriminatory algorithmic eligibility determinations (2025).\nIowa: Sexual deepfake laws enacted in 2024; appropriated $2.8M to expand AI-related degree programs (SF2435).\nLouisiana: Laws against child sexual deepfakes (2023); created technology and cybersecurity committee AI impact study (2023).\nMassachusetts: Facial recognition technology restrictions for law enforcement (2020).\nVirginia: HB2094 Synthetic media disclaimer requirements for elections (2025); SB741 facial recognition technology legalization (2022).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.\nUtah: AI Policy Act (2024): UAIPA is a context-specific law and ​mapping this disclosure requirement into the AI’s deployment context aligns with this subcategory relating to knowledge limits and human oversight of AI.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!28:28","fromKeys":["TAIM-MAP-2.2@318e6e5f8367a840"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7ad7c976a74b4ec96df11ae3","from":"TAIM-MAP-2.3@595fdc3a6417dcba","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!29:29","fromKeys":["TAIM-MAP-2.3@595fdc3a6417dcba"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2c36bff6933d3f122d8067a2","from":"TAIM-MAP-2.3@595fdc3a6417dcba","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4\n6.5.3.1\n8.2\n8.4\n8.5\n8.6\n8.8\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!29:29","fromKeys":["TAIM-MAP-2.3@595fdc3a6417dcba"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a9e7628b4135389df14ae735","from":"TAIM-MAP-2.3@595fdc3a6417dcba","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.3.1.3\n6.4.13\n6.4.14\nA.2.5\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!29:29","fromKeys":["TAIM-MAP-2.3@595fdc3a6417dcba"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-da15441946398de6bc800179","from":"TAIM-MAP-2.3@595fdc3a6417dcba","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.6.1\n6.6.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!29:29","fromKeys":["TAIM-MAP-2.3@595fdc3a6417dcba"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-53431fba99437adf0500edff","from":"TAIM-MAP-2.3@595fdc3a6417dcba","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.17\n5.10\n5.11.9.2\n5.16\n6.1\n6.2.3\n6.2.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!29:29","fromKeys":["TAIM-MAP-2.3@595fdc3a6417dcba"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6b87df879f3efac329254c9a","from":"TAIM-MAP-2.3@595fdc3a6417dcba","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.7.2 - Data for development and enhancement of AI system_x000D_\nB.7.3 - Acquisition of data_x000D_\nB.7.4 - Quality of data for AI systems_x000D_\nB.7.5 - Data provenance_x000D_\nB.7.6 - Data preparation_x000D_\nB.6.2.4 - AI system verification and validation","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!29:29","fromKeys":["TAIM-MAP-2.3@595fdc3a6417dcba"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3197731fa6b2012c5ee9d15e","from":"TAIM-MAP-2.3@595fdc3a6417dcba","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!29:29","fromKeys":["TAIM-MAP-2.3@595fdc3a6417dcba"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d0daf968a6f0b09f1683a392","from":"TAIM-MAP-3.1@8cf079d1257ee929","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.4\n6.3\n6.4\n6.5.1\n6.5.3.1\n6.5.3.2\n6.5.5.6\n6.5.5.7\n6.5.5.8\n7.2\n7.4\n7.6\n8.2\n8.3\n8.4\n8.5\n8.7\n8.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!30:30","fromKeys":["TAIM-MAP-3.1@8cf079d1257ee929"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a772e5c71c286e6de3015910","from":"TAIM-MAP-3.1@8cf079d1257ee929","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!30:30","fromKeys":["TAIM-MAP-3.1@8cf079d1257ee929"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6fc61b6e710c319580ae2861","from":"TAIM-MAP-3.1@8cf079d1257ee929","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2.3\n5.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!30:30","fromKeys":["TAIM-MAP-3.1@8cf079d1257ee929"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-99c1dd17b8937bfef06adef0","from":"TAIM-MAP-3.1@8cf079d1257ee929","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.29\n3.5.9\n3.5.18\n5.13\n5.15.1\n5.15.2\n5.16\n5.17\n6.2.2\n7.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!30:30","fromKeys":["TAIM-MAP-3.1@8cf079d1257ee929"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-47551de4f2aec4d234c50d35","from":"TAIM-MAP-3.1@8cf079d1257ee929","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!30:30","fromKeys":["TAIM-MAP-3.1@8cf079d1257ee929"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c43384d3d142bda777d36a5f","from":"TAIM-MAP-3.1@8cf079d1257ee929","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!30:30","fromKeys":["TAIM-MAP-3.1@8cf079d1257ee929"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-afc1ef54e84868146ef7921e","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.10\n9.8\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4366b8f9111e705b2842600c","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.4.1\n6.5.4.2\n7.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ded3b178126e95c8cb8733f6","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a46f304ff21995b1dd0ea825","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3\n6.4.12.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6f26429dfd83942c69221d70","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2\n6.4\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-967c1695f8fcbceeb3a2a992","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.2\n6.2.6\n7.4.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0fa271e9876ea2f7e3d66c29","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\n8.2 - AI risk assessment_x000D_\n8.3 - AI risk treatment_x000D_\n8.4 - AI system impact assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bd625173a903f87d3b7f44d9","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-03679f3e96227c264302da86","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.3.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7d570d882a78f1abd250622d","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.3.2.1\n6.5.3.2.3.2\n8.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7b85ad0905aabae76d010385","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.2 - ISO 31000:2018\n6.3.3 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-204acff7bc73ad69d49387e4","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.2.3.3\n6.4.2.1\n6.4.12.1\n6.4.15.3\n6.4.16.1\nA.2.4\nA.2.7\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-45870555a6a42da664060101","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.5\n6.5\n6.6.2\n6.7.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e28b1120e161d6f975c4b40","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.7.1\n8.7.2\n9.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9846cf91fbf9aaa5d3f4b979","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3 - Determining the scope of the AI management system_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-35908c7fc94ba15af07fe56c","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e2692ab94f364c294ceeefb3","from":"TAIM-MAP-3.4@171bc4d2aa86131b","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!33:33","fromKeys":["TAIM-MAP-3.4@171bc4d2aa86131b"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c51f62c68f92eb5880ff945e","from":"TAIM-MAP-3.4@171bc4d2aa86131b","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!33:33","fromKeys":["TAIM-MAP-3.4@171bc4d2aa86131b"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ca82a1e2a0f5b4d791e214b","from":"TAIM-MAP-3.4@171bc4d2aa86131b","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.3.4.3\n6.4.11.1\n6.4.15.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!33:33","fromKeys":["TAIM-MAP-3.4@171bc4d2aa86131b"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-796aa1d9c932619814660464","from":"TAIM-MAP-3.4@171bc4d2aa86131b","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.6.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!33:33","fromKeys":["TAIM-MAP-3.4@171bc4d2aa86131b"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2d47c1e920fd32f5d692476c","from":"TAIM-MAP-3.4@171bc4d2aa86131b","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.1\n5.15.2\n5.19.5.4\n5.19.5.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!33:33","fromKeys":["TAIM-MAP-3.4@171bc4d2aa86131b"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-20b24da2574dde625c42954d","from":"TAIM-MAP-3.4@171bc4d2aa86131b","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.2 - Competence_x000D_\nB.4.6 - Human resources","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!33:33","fromKeys":["TAIM-MAP-3.4@171bc4d2aa86131b"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aed5dde91808b19fca9d8c9b","from":"TAIM-MAP-3.4@171bc4d2aa86131b","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!33:33","fromKeys":["TAIM-MAP-3.4@171bc4d2aa86131b"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-68ab7f1a52139fec1b1097b6","from":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!34:34","fromKeys":["TAIM-MAP-3.5@ff2d44ca4f9b3a50"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-32d610a3ffb5eb25331e808f","from":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.3 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!34:34","fromKeys":["TAIM-MAP-3.5@ff2d44ca4f9b3a50"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ed9a5f961a0b14478caf8e2f","from":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3\n6.4.3.3\n6.4.14.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!34:34","fromKeys":["TAIM-MAP-3.5@ff2d44ca4f9b3a50"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1f363bb9cac941a2293126cb","from":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.1\n4.3\n5.1\n5.3\n5.4\n5.5\n6.2\n6.3\n6.5\n6.7.3\nA.1.1\nA.1.3\nA.1.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!34:34","fromKeys":["TAIM-MAP-3.5@ff2d44ca4f9b3a50"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-49b249f8ea2a5b59cd69689c","from":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!34:34","fromKeys":["TAIM-MAP-3.5@ff2d44ca4f9b3a50"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0d09825846e1b133c3d3419d","from":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!34:34","fromKeys":["TAIM-MAP-3.5@ff2d44ca4f9b3a50"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9c5c86f959d3e50fe63e4647","from":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!34:34","fromKeys":["TAIM-MAP-3.5@ff2d44ca4f9b3a50"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5929bb0215b8a1888cd8ea14","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f8f2f6ae34f24d7be1bd8a0c","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018\n5.6 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-90fc96fa67c0cc35ee63aea6","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.1.3\n6.4.1.3\n6.4.3.3\n6.4.8.2\n6.4.8.3\n6.4.17.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e6cf2ac66e6b8f7da953ba3d","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.5\n6.4\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d05801e8f39e3a8d44f20c8f","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.1\n5.17","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c687b5f5d6fe296f69c095cc","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9a56641f36713aafb2834d2a","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2d66df26145f1f5f39e980a6","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0797db673708f17cfe0cfdaa","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c2a820b33bdb02ca920f3eae","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-633c3bf298c2fdc399c146b4","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0161bd3faf13b0513c13a7e1","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-36a85fc875a463684e4eff14","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c788ad002c55a2056327404e","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1 - Understanding the organization and its context_x000D_\nB.2.2 - AI policy_x000D_\nB.9.2 - Processes for responsible use of AI systems_x000D_\nB.9.4 - Intended use of the AI system","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dd71dff3f8956ce532bb06c0","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. Explicit in TRAIGA: biometric consent, privacy violation, unlawful discrimination, deepfake/child exploitation, etc.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4fa627e606619a78c231c2da","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e6e7e8ea374c3c9df1b03f9f","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f2b8b62ae1d8f049d7c65f78","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.8.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-620ebb726a1089d066524c50","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.7.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bfee2d41745ba7b1b2ee88ce","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aaf14422f6d778c925cf9c8b","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.RA-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4841006019f7ca75aec7c1f5","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7d32c24346a836fa7bc6697a","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0b0da92e078e8b9f1fb4bc10","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d05898201e2949986b0fc283","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-355ae21dd7d223dc578c7919","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4f4cde8929cfb75ac72ab87b","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-be0995b4956030d3537668ba","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4bf937ba90206d4349d918d0","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users_x000D_\nB.10.3 - Suppliers","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-345bb3c8705c0bd2bed4bb25","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.4.2\n9.10.5\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e06f680f6f5b86ef1ba7e802","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4 - ISO 31000:2018\n6.4.2.6\n6.4.3.2\n6.4.3.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4007816ba48ffc6f5a93e4c4","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.8.3\n6.4.2.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ae79881333a90e90de4ec7f3","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.2\n6.7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-24c10f558e29fd428ca89990","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.7\n5.18","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cb8a07fa942d403d5cf7ea92","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c450fddc78d3ea0520dc9c0c","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7f76c0c08717f7b3bc4897de","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2306b328eaab7b5f12ebc395","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0de941d20873b61ea17d5a92","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1c8668eaece8ce3d9dd6888b","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-35aeeee2cf1e20078a027c90","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bb8724563819cbecde3f829c","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d4378f4aac15cf04f6664612","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.2 - AI risk assessment_x000D_\nB.5.2 - AI system impact assessment process","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a5c95037223a86639225c599","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA prohibits algorithmic discrimination in high-risk areas (jobs, loans, housing, etc.) and NIST requires identification of group-level impacts and high-risk decision contexts.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA includes complaint process and AG assessment of harm where statutory lines crossed.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-139eb4ffd1e9d7e548d23a1e","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.4.2\n9.10.5\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-10a727e31587e581ed1af184","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ISO 31000:2018, Clause 4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7b32016808d1e2bc3d30e692","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.8.3\n6.4.1.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-24aa11c125f0da1617fbfb2b","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n5.1\n5.5\n6.7.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1cbb34f631d5d442b17fce62","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.18\n5.19","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-04d87a9780dd923c8bf8757a","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.RA-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-74339674cfa043f977f36666","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b315aabdd0408b1e4879fbbb","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-50fe54aca6582cb5a65121ae","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a49488c808a26224fd796ffa","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bc5e42487696b5af88d1f86e","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7444a539aebee09038b75b5d","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2d565cab61daf0ec65bb64ab","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cb208298371ebaef194404b5","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.8.3 - External reporting","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4c3d4fff1a03caaec8479e36","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. The Texas AI Council created under TRAIGA has a mandate to advise, review, and integrate feedback.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8dcfd5e12f83cf07c56c615b","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n5.4\n6.4\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2c592fe9d6d87c6a3fc8c08d","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-33f5a0e03f04924fbc512045","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-006a1c13c118900547a7dff5","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n5.5\n6.4\n6.6.2\n6.7.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ab4257d2c047f1709d5e5378","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.2\n6.2.2\n8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5f1e3d3261d891da92d46e27","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.RA-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7f46cb8e8ec0c7f0e432f1d5","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4282eb1dd43c59011718a1db","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-09c0c2adb51bf5fe27fb2580","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-778f5035dc4c0451ec98eb7c","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3cc6c803c1b8a97590256dcf","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fa229ff6e407d9a0e8a82df1","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3f7eec8cc1932cafe8cb034a","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f01797db18a68ab846c40378","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.1 - General_x000D_\n6.1.2 - AI risk assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d43eb7eceadf4935a29e0daf","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-12341a5798d7cdcad4e8c853","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-68d01ea4cb532094596ec9a5","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-37aa39a7e0ef9b36c9dc0b89","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.12.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-71295262cbeb0dc6e37983e5","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.1\n6.4\n6.7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-50a634409ef7d77a1f043557","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.2\n6.2.2\n8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6636d02bd0a56fb37df432ec","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OV-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-af2fef72601198d3c47d9fa6","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0710afc75303339b2c5d24c2","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4f875bc729d24b4ceeec4e64","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9774ec4352e579e161db10c2","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-23ce08ac7862e8faa5817762","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ce7bd71fb90450e0da06e374","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b326a6de7c21a8618d3954ad","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ab0c7f54008957f52c8be083","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.4 - AI system verification and validation_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.5 - Assessing societal impacts of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-48d0f7c0f0db956d4cebf5f0","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bc7c93e77ff6bd64304c13a7","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018\n6.4.1 - ISO 31000:2018\n6.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d281395f6bcda20e056e7bc2","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.7.1\n6.4.7.3\n6.4.9.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-362b59dc7f2b0d88d7225a93","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n5.2.3\n6.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ceb5fd5455e5c774dab68924","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.19.1\n5.19.5.1\n5.19.5.4\n6.2.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6afc90a1a6dc30f0d2ee6090","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.SC-07","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4c9b8ab85439f3bc5cca8ca0","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8dd1c6fb6900188b43c4fcfb","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8de696315e06189743f228d2","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de20d5c6808542afbef1571f","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-12e3045a2443cc0f79d48b2f","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0c78dbc6315c047ac2d1d359","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5fa137a17525628872c41db2","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cb7084aa4d2bd27a55f9253a","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.2 - AI risk assessment_x000D_\n9.2.2 - Internal audit programme_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6b9ac28e1af6833c253eb06e","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a4eb533a4a9f7f79b9473a3a","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c0afe3ae79617d3a8a5b908c","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5\n8.3\n8.8\nA.3.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cc5274b8a4ec4f435c709999","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-79e66852e57739ebadf650ed","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.11.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-21c047b50d7e9fe9ce616907","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.6.1\n6.6.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8c3a91cc54d2d0612eb8069d","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.15\n5.11.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d021a302bfa53bf5c650fe47","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.IM-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d6b43d083cf762ccbc30ce11","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-40bd31233cf0c6f7bec25efd","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fea662ffd6482bc5eefcbc22","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-07b51119555ae0c0e537e6a8","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-50544777187bbb9eb7f3e8e1","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7d0ff1527f1ccad7ff71526d","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-907a32569368ce0bb9a956d5","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f39dd5e839cca539ea7d42c7","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.8.4 - Communication of incidents_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.4.2 - Resource documentation","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-80253773821e4d5035f6ba6f","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b2aedb841647c0c73465d6b6","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a62e60667dfba15e9e65d715","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a9f21a1bf3a8ce11b04e754d","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f3468a1bfae949ffd6b8f994","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c9119fa3bd0eae97568ad0bb","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5f64cfab59d81ecf190df660","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.19.6.2\n6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9b189b492a7f607f103eed4d","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6d0c3b1321a83535ae8125a0","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-574e65fcad325ad7998e30f9","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a8e59d2d641fbb9f5975ce00","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cf2e292b9da00648b1092a14","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-af25fe20abb331cd494b09a4","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-737ccfef8c929dd2d7b133eb","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6cb5c70a6702eb2a2eb3147e","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-44eeeb758627801ded4ce092","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.4 - AI system verification and validation","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4fc98c6554f20fb09057b892","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1382c8d9e1e72fb1c5bdbe47","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6c27b214cd639118458a80f9","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-41316a4b49bf68e48b67c69e","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.6.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b78d7020d7776149980c79e5","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.25","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0c0f84bcd843e5a9e25de7f6","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OV-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c5fffcd3fe32c8b7c072c84e","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e975301e6f9c4f91a5dcb944","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7a4aef43fe8caa4e17d70bb0","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-81078f5054012f1b4c33e1df","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1d04eb5d00f52f186225ffb5","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-792e88ca38827df7a2cba195","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6ce9b59cbceb3af259aeac35","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6a5d383999735e6da6d69595","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.7.4 - Quality of data for AI systems_x000D_\nB.6.2.6 - AI system operation and monitoring","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-42a43447f51f24c0b0bb2236","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-21d990476e0c4930f26236cd","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.1\n8.8.3\n9.9","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5715b0ce1ed099f2c9fe7f81","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-88bc34d7606ff3383d3b053a","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c11d6c6c159faa74ce848f74","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f4b2d7b720ce0eb5354b5846","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.5\n5.16","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-045c88a18d447e2a9104a94c","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"RC.RP-04","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-df9fe50c7de8f57f8e58d8ca","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-698b2cec4b2d45665dd25e70","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-20203cabfc2aa6d6da411d20","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1e33547a4b64424ff2daa4a6","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dd64bd6f0d658147a8911240","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fa8055c4d5d3bf2fa293d40e","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-93b114e3325fbc646b40432e","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b5287a3414d2fb89ab3776f4","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.1 - Monitoring, measurement, analysis, and evaluation_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.8 - AI system recording of event logs","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7438b62c20358db8aaaa7202","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d3bcbf31398235422d294707","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.7\n9.11.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6ae8da715b9d87184bcac2b4","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n6.3.4.3\n6.4.11\n6.4.13\n6.4.14\nA.2.5\nA.3\n\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-50e11971270c0b2c7772c276","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-740a2d914c8aedd9768382a8","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.9\n3.5.16\n5.15.2\n5.15.3\n5.15.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cc40066f3684ccd5eb7ca5d3","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"PR.IR-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e450963d5cab5b8fc5b2733e","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c68380c4aae8461efdba2515","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-91587113f31361a6a3a4d4c9","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8898d73b15dedc3763f4fd85","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b8d6824d86c1216459b76adb","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-35d771c25c0799a7ac95527b","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-133b4f6eed2f486fe1fe46d5","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fe44e888cdc7d7821ecbd4ef","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.4 - AI system verification and validation_x000D_\nB.6.2.5 - AI system deployment_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1f4d8dd0e92f8f982094503d","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0d9c8ae08c2ff67bdd18f7ca","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.2\n9.9\n9.11.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-11b09b4e0642cc436ef3130c","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-127e2a017bdba2efd3a5e306","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.6 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f31c88451e235dcb888855e2","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e2b946d495f247761ffdb3ef","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.7.2\n6.7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f460a2f0997111c1ff9c6734","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Annex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d66ae142b53c646b693a0255","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d77b99275c096caaf3de58d4","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e1e7cbc01e7aae92af50b775","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-af027a4a08dc20252d1c2a57","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ad001ba15a444510811ec4a","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-314187786f46f602218936f9","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aa81b8db8fa76e84178c78df","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8bbe8caf596fa6ac7c75064a","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-660ff62ca234cad404a0811b","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.8 - AI system recording of event logs_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\n8.2 - AI risk assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-28a2a1064f39d17d67eeec04","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA is a comprehensive AI law addressing algorithmic discrimination (effective Feb 1, 2026); facial recognition guidelines for government use.\nMaine: Prohibits facial recognition technology use for law enforcement (2021).\nSouth Dakota: Sexual deepfake laws targeting child pornography (2024).\nTennessee: ELVIS Act (2024) against voice cloning; requires universities and local school boards to adopt AI-use policies by 2025.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA requires agencies (and in specific healthcare contexts) to prevent and detect prohibited/harmful use, and the AG can require removal/suspension of systems in violation.\nUtah: AI Policy Act (2024): Consumer protections; focus on vulnerable populations.\nWashington: Biometric consent laws (2017); political ad disclosure (2023); sexual deepfake law (2024).","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4a39e7bef5d6490be7720895","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.2\n9.7\n5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0d55d458f400576a610195d5","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-653442f0ef89ad12f49d8d19","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c3715d32a9caa73bb91fa3b8","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-86414bd0bcb0350b0ec66733","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n5.3\n6.4\n6.6.2\n6.7.2\n6.7.3\n6.7.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2ee5dcc3b2ea5e18848a21ca","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.10\n3.5.16\n5.15.2\n5.15.3\n5.15.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-192c9db6033ac8c898f3e20f","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-06","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-baa44885cc967311bb36bd3d","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1b6b1f74e0b9299e6cde6f54","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5b6a7c23537a2747950910a3","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ca6a12d78a8af0126dd603f5","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-24e82a45f399b8198a12ed69","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6c2db0f1e3c83e43d45a3593","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-30c20d114962ee9cb8120e3a","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5d17aadf23959bf87cffa60d","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.7.2 - Data for development and enhancement of AI system_x000D_\nB.3.2 - AI roles and responsibilities_x000D_\nB.2.3 - Alignment with other organizational policies_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.6.2.3 - Documentation of AI system design and development_x000D_\nB.9.3 - Objectives for responsible use of AI system","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6fb87bb1a0231a5e2a8f7dad","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA’s language on “intentional violations,” and AG’s power to require information about model/data/metrics in case of complaints.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-19b258d8e78e39f101c3bfa4","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.1\n9.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-58ff6f9349a66893530b46c5","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-18ece93ac6ab37428745d20c","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8be4658c90abba791fa1e6c9","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.3.4.3\n6.3.8.3\n6.4.3.3\n6.4.9.3\n6.4.14.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3e1b70d5481d0f9fc1fd5dea","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1\n4.2\n4.3\n5.3\n6.2\n6.3\n6.6.1\n6.7.2\n6.7.3\n6.7.4\nA.1.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9bd062bb16e0defca20a6319","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.2\n3.5.14\n3.5.15\n3.5.16\n5.15.8\n5.18\n6.1\n6.2.2\n7.4.1\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a6de798aa5981967f0380b0b","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RR-01","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7ce796de308e92c1f5fa58a5","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d3efb5ba977c37aee44961be","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9025c1c898d3298f13b09acd","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7af2c085bf5800ea41abd60b","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9a2850ab8bab856fcd6de5c9","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-506aa56eda2cb94b4b176012","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-67920dc0594f29656a0f3dda","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1449196b2de8606124714d41","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.7.2 - Data for development and enhancement of AI system_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.9.3 - Objectives for responsible use of AI system_x000D_\n6.1.2 - AI risk assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fc62c10f6c4e43f826f2389b","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA requires a duty to report algorithmic discrimination risk to Attorney General and NIST captures transparency/accountability risks and mandates traceable incident responses.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.\nUtah: AI Policy Act (2024): Requirement for prominent GenAI disclosure in professions requiring state licensure, such as healthcare, accounting, and law is part of this transparency/accountability dimension. Ensuring it's implemented and traceable fits this subcategory around evaluating transparency and accountability risks—whether disclosure mechanisms function correctly.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-80ce58943759d4ecbf53a3f2","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.3.4\n9.3.6\n9.10.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9ec7110b65566295fd5900be","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ccd6c89c8ed2af2d9b476bd3","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3\n6.4.9.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-321c4adfe9a7c059ef70c9b5","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2\n5.5\n6.4\n6.7.1\n6.7.3\n6.7.4\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-957ef013bf0f7e6e986107a4","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.7\n5.15.6\n6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b80e3062c4cdd5c76bb6debb","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RR-01","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4be697c4c24c4f0bd67fb1c5","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-68e8fac9c78599ad6993ec78","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-afd3e2748149d80aee268087","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-78942790e5a12fef1508b3a3","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-59c3e5d1292b731354e85132","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d976df537f96e6fcf91d9b5a","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c7aa7fed9befe1371135c0de","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e4d6a455d546d0a07203c41b","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.7.5 - Data provenance_x000D_\nB.6.2.5 - AI system deployment_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-843eb9cd910653063784a5fb","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b71989e75296390773b70f68","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.6\n9.10.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3085e8758e625a1dcc957af0","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-af29bc6d3ab35ac7ae93df50","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f3243dcbd6ac8e6daace656d","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n6.3.4.3\n6.4.1.3\n6.4.3.3\n6.4.8.3\n6.4.17.3\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f77f473297f9477e4e140450","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.4\n6.6.2\n6.7.2\n6.7.3\n6.7.5\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ef6fdd8b5540d07544d04862","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.19.6.2\n6.1\n6.2.2\n8.6.2\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ec2f36e955e0050d882e5d9","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-949d9d36454a229ec0fa693e","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c5be4a3a8eeee70dfb0316ff","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b1049874f0142dc9caea6beb","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f7eb1369dd9529162eed1c7e","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bce5f9bea2fd03fb0defa1fb","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7b311c34ea2bc1e48287d0ec","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-39ea3217a4481a13c3d6f15e","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bb6b91638263d34374e4c129","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.2 - AI system impact assessment process_x000D_\nB.7.2 - Data for development and enhancement of AI system_x000D_\nB.7.3 - Acquisition of data_x000D_\nB.2.3 - Alignment with other organizational policies","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a8a8d83c197c16893f5bb3da","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is explicitly required for biometric data and anti-discrimination; other forms encouraged as best practice.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-00de2a0ea3ad21a60c7bb04d","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-47027b0098b33a2222868129","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3\n8.1\n8.3\nA.2.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a9af4844ddd3c4a21e483bca","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bb6477300acf77dffd6c4c62","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n6.3.4.3\n6.3.8.3\n6.4.3.3\n6.4.14.3\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c17f28c1fbc13afe6626ef37","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2\n5.4\n6.4\n6.5\n6.7.2\n6.7.4\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2fc929fc4101064e7ce96bbc","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.2\n3.5.4\n5.10\n5.15.9\n7.4.1\nAnnex A\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0309fdc2137ccd46be81d5bc","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3bf5b56823f52fcbab6938c3","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-051a55696fa8205a0fafca1a","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-592fe3a6d3d44532128ba644","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-58dd78c6c1c4b39547df7433","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7dc0f5f3253943692c6e8a09","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-494b6484a6b0ca4d3b4e97de","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-efa42fff864eb678bf5509ca","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9aad0268b3f534deb9b7734b","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.5 - Assessing societal impacts of AI systems_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ae4ab60f16240df512582c18","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Georgia: Early sexual deepfake laws (2021 and 2024); considering AI profiling bills.\nIllinois: Biometric Information Privacy Act (2008); restricts AI use in hiring process; sexual deepfake laws (2023-2024).\nMichigan: Election deepfake laws (2023).\nNew York: Criminalized sexual deepfakes (2023); requires disclaimers for political deepfakes (2024).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is explicitly required for biometric data and anti-discrimination; other forms encouraged as best practice.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8c2b3d76ae633952ecad1132","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.5\n8.7\n9.10.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1e49a204635b0b82253c948c","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.7\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-78cd456803241acf1ef16873","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2\n6.4.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f80af666bf1504e945fc5bd7","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.3\n6.4.17.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1b593e358d04025d834d6e7f","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5\n6.7.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-115d1d36076591896b4fea76","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.2\n6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b4295237742f6259b17856bb","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4b33645eaf66fbb8cf076bbe","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-30c9c5053cc28535c024aa4d","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0e063dc23ac44dc77e648c45","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-23b2359957586146bb04971c","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0c832f5fce35e65193409499","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2661203643fbfae10ca232a8","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eecf93646ff30d463f7960cb","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ee750993d7221b6a258900d0","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.5 - Assessing societal impacts of AI systems_x000D_\nB.4.5 - System and computing resources","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b2d14c618910a043e0098575","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4790ac89862ea019310618f6","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.3\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1735a2ad241d68c9b8b0471f","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e09c52e8799db66cbff0f57d","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f6d5e7b58a4c189890f7ac14","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7c40c4a41cd4452a0e5a2dad","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.6.1\n6.6.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2fa4db907b2be1a6cc8c04cd","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-66b3b974238b4973ea9f34e6","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OV-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e915199806b2103102e7fd99","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d793a88bcc208eb7426c8d8a","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-10e1db2f07fc287116f81c30","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8f8a27f967263bf9d05c562c","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bb13df8a82d26f9dd35f8543","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eb315ae573ce156e269c725c","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0d109b5657c22001e137f54e","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-000ea1d46378121891debde0","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e0d5bc8f91c499442407d32e","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-db357f043f78e6f5fdad4966","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1bbfd2a6f23a88fdb2cf7b4a","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ca30a0566f2f62b1df0fc143","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3\n6.4.12.3\n6.4.13.3\n6.4.15.3\n6.4.16.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-85e47e3b2c22a9432b81b2f0","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-79be16dae8572ccae7340b3e","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.11\n5.18\n6.1\n6.2.2\n6.2.3\n6.2.4\n6.2.5\n6.2.6\n6.2.7\n6.2.8\n7.4.3\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3fb8579f70b4d4fb6012154f","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.IM-01\nID.IM-02\nID.IM-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-20c26042eea3d63451d6a341","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6889b72952eb88086252689b","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d50e651c34dbd03f2c1bb922","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-02eca0ad6fc2b036769d4a19","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-19200653eff8aac77d075f60","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cb2d647b722ea5ccb716fa68","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0ac1d86b6fd254059270deb2","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d56be73e4fc0164f1fcd2300","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.2 - AI risk assessment_x000D_\n4.4 - AI management system_x000D_\n8.4 - AI system impact assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3889436284a8d9c3d9c59bcf","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ea9ca425cf327c16e82597e8","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d2af09e789190255efc4db92","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3\n6.4.11.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fcadcc8fe41fd738c49ab376","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-20105941b937d76fb8054553","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.4\n6.2.6\n6.2.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-54916b32c21d5e1fe09fec4a","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.RA-06\nID.RA-07","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c25987dcc1dcfe504972516a","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f24bfc406f6c7c93b7a35fed","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-44df4aceeab9f65cd0827b43","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-14de4c6f41e8ae96cd98cc15","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9eda6e92763c1b34224457dc","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2dfefc9de68e39fdf5565ab6","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8ccd57cec9397543ea3aaa2a","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6d87283bdf12b9db61cc96b5","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.8 - AI system recording of event logs_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\n10.1 - Continual improvement","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f6a4583bbf7867dfb74ae545","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0a1b2b0ed974bd4f615edcff","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.4.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-41fa98d37398a1f6cefda88d","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4faf5f768c1780544e77de66","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.3\n6.4.15.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f538e999a69e81966d606540","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2.3\n5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ca48d8be4bc5d92c624f0cd7","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.19.6.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7ac0fd4f8d67b1f37a022bec","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8f59de46da71206f83671e42","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ca4b847aaa2c98ddaac0c38e","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7a48a2086b4cd97480d5e6e1","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-befa076298c941e5510762cf","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2424855dedfd546ded5ca41c","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-afa35d59d265673fdf49442e","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0570f1213abc6ea34a40bc81","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-03f1a38840d004d8c9beb2d5","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.8.2 - System documentation and information for users_x000D_\nB.8.4 - Communication of incidents_x000D_\nB.8.3 - External reporting","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d2550474e76d74f74b4f4686","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4747e8f76944fba61c8dedb0","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.4.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f730eb59924494ea47e1906f","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4f30fba4a900976b0795934b","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ca95fa80b5286a93ed9a0c43","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1\n4.3\n5.5\n6.1\n6.2\n6.4\n6.5\n6.6.1\n6.7.1\nA.1.3\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e122a71794f7dc798fc16818","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aabaa40bdaa93edaac40181e","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.RA-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-624b751cc5d3270deaa9a33a","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0cf5558d53be4f9aba32f9dc","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-10b7df9da93e53176d60130d","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5f827fcf040ff3c998249e60","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c82466288ebcfe59d5060d7c","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c58c0576461139e148441b04","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f538f461979a2cdaaa84e8e9","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-402ac8541183a707feb1d5aa","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.4 - AI system verification and validation_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\n9.1 - Monitoring, measurement, analysis, and evaluation","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a295e2980a033b15d84e5f9e","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bf7bb19de902b855f27c1e9a","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5e76d094e71ee496b9e3c3ba","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2249e1026685a1fd2515819f","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.7.1\n6.4.7.3\n6.4.9.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cbbfeb9d5a0f7d7f7ff3d05a","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1\n4.3\n5.5\n6.1\n6.2\n6.4\n6.5\n6.6.1\n6.7.1\nA.1.3\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-97c28c8bc8bb0ece68c22c4b","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c9a86a6c5148bce94a0f46a2","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.RA-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ac929fa78b40af8e91ec447d","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ee21ff465bb74c9d57106cd5","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e7be7b05fab305d1fb70d52b","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2c10118b919a43e5988f85af","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d717e5cf60d170cf0f77f720","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3faae01c857ede51b5b930d4","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-94765d5a4a4ae86d53250e3a","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3fcf621ed7545d375ecbfb20","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.1 - Monitoring, measurement, analysis, and evaluation_x000D_\nB.8.2 - System documentation and information for users_x000D_\n9.2.1 - General_x000D_\nB.8.3 - External reporting","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-26b87d1eb0e94d9b0ec9ff09","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-130a1c14d2d467f0ca7188c9","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6352be0d38aad597450b1d24","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.5 - ISO 31000:2018\n6.2 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4b3db76d01ca229d553e0fc2","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.5.3\n6.3.1.3\n6.3.5.3\n6.4.3.1\n6.4.3.3\n6.4.9.3\n6.4.12.3\n6.4.13.3\n6.4.14.1\n6.4.14.3\n6.4.15.1\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cd71996c2c694dffe3d359c3","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2c96d12b688423c6ebbf4cb0","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4a6b1c1298b56be978a800b3","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.RA-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0aed9b6c3342c642339260a1","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a0bed07dd432fd955fada79f","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5951f8b8e128761b019d7bcc","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-09b6c8d93dcfe904cfd8a7e8","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a24801735a2c3ba5a2760113","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a6f44e23b8371ca41c6b6d72","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5cd02e47bdab6983e5e3065b","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e3534023130a1046b120016","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.3.1 - General_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.7 - AI system technical documentation","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8678945a43c8afc508eb6370","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Delaware: Created AI Commission (2024); requires annual inventory of generative AI use and identification of high-risk areas.\nIndiana: Studying AI risks through Commerce and Economic Development Committee (2023).\nKentucky: Interim Committee briefing on AI bias and impact on jobs (2023).\nMaryland: HB1314 (2025): Prohibits AI denial of healthcare prior authorizations (effective Jan 1, 2026).\nMinnesota: Restricts AI use in entertainment industry (2025); drone facial recognition technology warrant requirements for law enforcement use (2020).\nNorth Carolina: Sexual deepfake laws (2024); $3.5M AI healthcare study funding.\nOregon: Political campaign AI disclosure (2024); facial recognition technology prohibition for police bodycams (2015).\nRhode Island: Lawmakers requires AI system review (2023).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.\nVermont: Moratorium on facial recognition technology expect for investigating child sexual exploitation (2019 and 2021); sexual deepfake laws (2024).\nWisconsin: AI workforce and election task forces (2023); political and sexual deepfake laws (2024).","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9bcd74bbdaabc7fe5a02f4d6","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.3.5\n7.6\n8.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-325f9eaf0d489244f7d12cc8","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.2\n6.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e4c6547d216f4d6e0b09fef9","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.13.1\n6.4.17.1\nA.2.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6686a0bf931fcdf98428e3a5","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2\n4.3\n5.3\n6.4\n6.7.4\n6.7.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5059ee3100034f18d425e9af","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.35\n5.3\n5.11.4\n5.14.3\n6.1\n6.2.8\n7.1\n8.2\n8.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2d8435dbbd91003eb544d344","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-04","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bfd5b126cfebfe02797b6710","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-13b26f38f714384f5c47cfe0","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-76bc52c00913198277d52053","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3a2d6663f548e2b02d42ce58","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-09aa205c18401a3abe01a2d6","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-288f0cd32773839e7be31278","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1f0ffab556c415010f9e4217","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-805ca61c20415c33ccbeb088","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.9.3 - Objectives for responsible use of AI system_x000D_\nB.9.2 - Processes for responsible use of AI systems_x000D_\nB.9.4 - Intended use of the AI system_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.4 - AI system verification and validation","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c035f0ed1202bc5ee459d115","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA requires impact assessments and risk management programs for deployers and NIST formalizes risk treatments and post-deployment monitoring.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-58f146d4b01e01b552f3e0c4","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-32e196da402905de0e11f639","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1 - ISO 31000:2018\n6.4.3.3\n6.5.1 - ISO 31000:2018\n6.5.2 - ISO 310008:2018\n6.5.3 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-84f302044558419a731914ac","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-78175d6c92a92b27b5f2f4f3","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4\n6.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9fbe4ff9a3cabb07675214c6","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.2\n6.2.3\n6.2.4\n6.2.5\n6.2.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6ff7e86dd2ef9ed68747d8bc","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-06","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4e3c51f8d9b199df466cd400","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dcc058662374f2a0e99499ae","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4fef9cf3786ac015afbfbfbf","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-89717075e8178cc24020f70d","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-463cc78f12807c63057d73ae","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0f7c37ed853750e1b7476897","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e4e9a61eb2a078afddea4c4d","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d1060ba774aa92669a3551b6","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.3.3 - Management review results_x000D_\n6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment_x000D_\n6.1.4 - AI system impact assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a5c8ecffc5b6030c6752c789","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d15ee8084ec9f7e95824a255","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4e2e8dce4b39b5eec02b6b8a","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-969ae84c81dde174b4f3e35a","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-08b5352a0b4877f4bc06cfd8","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5\n6.7.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-98bddbdad1b1e19465ea9efc","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Annex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9ed19504b167f86250d133fe","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-06","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e433e4b175038d6235050d39","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-70de1e243ff80e128e89edde","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-83fcd69dca86c7dd9a999854","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8e64aade62693132b77195fd","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f012d4e610383d4c8d3af362","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f4a418bd00e2ca99a1f8a505","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ed99ca633d21c984bad47d7d","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-37e1bdb2e594f8ae3dd79f8b","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.1 - General_x000D_\n6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment_x000D_\n6.1.4 - AI system impact assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-85ba6aca126a3ef03fabc214","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA requires remediation where prohibited activities are discovered (with notice/cure periods).\nUtah: AI Policy Act (2024): UAIPA establishes a Regulatory Sandbox (AI Learning Laboratory), which supports experimental testing with oversight; allows measured, temporary deviations from full compliance.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-75f73fdbb7d9bb206c7d9def","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-98870632a87446868a73ad4e","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4c4717c2ce46b7f32c64f026","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3\n6.4.1.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-89593dc442e354e4ad5b5567","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.2\n5.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3628d4edc406d272ee4803db","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.18","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fb0831e8ee03c857cced0d56","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-06","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b664dd1aabea94e052a336c1","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-36c6eb33989058c231f3aeb2","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-413f914b1633c5a522feb6e1","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e6363ded25aeb3678b372228","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9c7c02dc15aa5c008e2d6704","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b288d3d9534de0ebc13de657","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6dbe9b7da8291e65b8a4cc9d","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ae20cda19907c795f4104df8","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a8073de366ab88acdfcc4b62","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d57d6ff3b5e3ec073880f0a1","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-638270daad4d7d8a8047b9ca","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.3 - ISO 31000:2018\n5.4.4 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d17c463f4f9d0b82fd9a4758","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-79e95349879eaa3e768ef43c","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a9e96ae8a0e8f2e0978c44d1","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.18","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-98a97041a888227d43b4bd42","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-06","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7dee7e8a9fb91d6a4b835001","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c692a3b11089f8b10761ed4e","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-12583c0c3777cdae51d26bfc","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a67fbf655ae8c7db57997401","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a4ba540d0b4df05466c2daba","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e0d80b9265d0216c26d7652f","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-540da5231ff6fc63d12d04b0","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bcd44d98e0878f5362bd39e4","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.4.2 - Resource documentation_x000D_\n7.1 - Resources","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dd2e63a4fa2828003cd1d4ed","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA requires impact assessments and risk management programs for deployers and NIST formalizes risk treatments and post-deployment monitoring.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6a47e31ae312463bed7b2cef","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018\n6.4.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2d0e860710887424dd417c35","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.3\n6.4.13.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c3f20ce4abddb0ecb08c7ffc","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-918f6c3a49b90546dfbb57e3","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4f7e24c72bd49348b8566a92","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-06","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-454816607009232d173e2bfa","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9b3bbd5576d45d6d662f5290","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-23242f8861ce76bdec1f4342","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d47c4c75daec533e9f16747e","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-73992a45341b41d70ba4e2ac","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b52d2357296d9b16a3fb3935","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0030b53a6418aef86652a200","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-990c9e9a488959f9e5f06dfb","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.3.3 - Reporting of concerns_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.7.2 - Data for development and enhancement of AI system_x000D_\n7.1 - Resources_x000D_\n10.1 - Continual improvement","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2423713c7e4a7bf90a54df0f","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.\nUtah: AI Policy Act (2024): UAIPA establishes a Regulatory Sandbox (AI Learning Laboratory), which supports experimental testing with oversight; allows measured, temporary deviations from full compliance.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-11def8707d332d88168d679f","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2\n5.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bd4b8b0ec5bbf276ed22120a","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.15.3\n6.4.16.1\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-464924ed1b30c2abf3eac8b8","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dfc3ec731b3e823285dcd727","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.10\n5.15.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8334d3b2da2eb354f4cf19c4","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"RC.RP-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7452ce018625d40919666537","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5c5ca545257a33daed661d9c","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5e95d389138b5b6358fb7d57","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b38ef5387b6987246236f932","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-085816302f4e9bb28b899acc","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9701200d45bd30be00413aeb","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4c011372e3aa476f6695e679","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-da826d1857076b2083a625db","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"10.2 - Nonconformity and corrective action_x000D_\n6.1.1 - General_x000D_\n6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f2bb99f0ab658b364311bbed","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA states that if notified by AG, systems must be suspended or removed to avoid liability. AG has statutory removal/cure enforcement power.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3c99b438297db135e43acae7","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4 - ISO 31000:2018\n6.4.2.4\n6.4.2.5\n6.4.2.6\n6.5.2 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-673ba16a71ec787457850833","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.17.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-88f2d78376004f634603c01f","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.3\n6.7\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-98c3cffd7d43887e4f902a8a","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.22\n5.17\n6.1\n6.2.9\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-143780eb09c58a810d4a848b","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"RC.RP-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-682deb3922d7a24e6ba9f090","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9452891dd2fb8d5693bc3269","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8edb370c2362d3b7eab46b4b","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6c944bf6aace524436d2e915","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aa2e17fdad409b394889ee92","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e7680f3a576aa80403309838","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4138fd9091ba0b013e78e82e","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c490cfbd85baaf6de30e4fbe","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.9.4 - Intended use of the AI system_x000D_\nB.8.2 - System documentation and information for users_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-329b7d3c9858bd102b88e811","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA states that if notified by AG, systems must be suspended or removed to avoid liability. AG has statutory removal/cure enforcement power.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f810e3f38862735f19437191","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-19f1380c2f5c07c14bd1bf33","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9a26561c1bea1f42035c87b1","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.5.3\n6.3.8.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bebea65869c818e656e11a16","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.7.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-329cdb8a3b818536d30f7e87","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.4\n6.2.6\n6.2.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-01b30e2e6b926dc8e3386201","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.SC-07","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9a63fa8dd9cc864130712220","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-41c7b73e94306a2482359bdd","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-46af3b7cf01e392565738a21","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5b924fc122ea67e109c24267","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5e3d86ddb1c128e82c373e7f","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-81090bbd87d2deef79eeb06a","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-81f9076647531f2faf483b40","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-adc576c5999acb5ca7443cbc","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.10.3 - Suppliers_x000D_\nB.10.2 - Allocating responsibilities","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4c8d1b524c4bcbe4d4ace142","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA imposes statutory liability, including for deployers using third-party AI or datasets if laws are violated (biometric, child protection, unlawful discrimination, etc.).","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-34b0d6242eeeb9f181799154","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.3\n3.1.4\n6.2.1\n6.2.2\n6.3\n6.5.1\n6.5.3\n6.5.5\n7.2\n7.3\n7.4\n7.7\n8.4\n8.5\n8.6\n8.7\nA.2.2.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-86ba8563a1a3a946fbdb72d4","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.1.1.3\n6.3.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-77833678f155792674e48664","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"A.1.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-64b5f785787ed78561848a38","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.3.10\n3.3.14\n5.11.6\n5.11.7\n5.11.8\n5.11.9.1\n8.6.2\n10.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-09b33770de5d4292a65610a9","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.SC-07","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5424cc36acd520b7c0337392","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-143ed3932ced49cf0290714c","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5df71513758e1f58c9f055f7","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4b7d3ca6d3c012526231c7c2","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-926954d6fe812074f3f0dfef","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fc95fc329dc1ea5dae15ae47","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-43144daea3456c8fa3831716","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-283c953408f3d3673a6d4b7a","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.4.4 - Tooling resources_x000D_\nB.6.2.6 - AI system operation and monitoring","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-83884e764ccb91d48fc07ca7","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a7e3c9e2d7792eb181f1f128","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.2\n8.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-29c684e0cb7cfbefdae190ea","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.2\n6.6 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fdb021b8b29f3827d38e367e","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.15\n6.4.16","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d8a4cbc4f3d792ed7197aa23","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-043d75d5efe02bc134719c6b","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.9\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-edfd66d00f2af32e8aa48763","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.SC-07","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f22b55e5196ad8f660438bc8","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4b2f0f443c176686667a064b","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-24d9f9030409e3a42b8b3a35","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-98bb3745a66ae4abd38a1d70","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4965c62165c9a64b18012b48","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3b4c2ca1d68b4cb7400e1d83","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1148142e45188f3b9310ed8b","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c8d45ed1e97f362c8313cebb","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.2.1 - General_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.8.3 - External reporting_x000D_\nB.10.4 - Customers","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-33d8ab61adc10bc103044f57","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-312320a75684bc75ba0e72ae","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.4.1\n7.4\nA.3.2\nA.3.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0abbc19c8421ee8fdfb9a6bd","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.7.1 ISO 31000:2018\n5.7.2 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-49133ece9cbdb68aed5a0c31","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.2.3\n6.4.14","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cdb53d18bb3b6183bb9f626a","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2\n6.7.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5c1a58847db608fcc512ab1a","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-79e911608e7fcdec511c7fac","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.IM-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3efb98c6a258992e4bb52dd8","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5e4aed452a844a556a9ca799","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-04adb41c2ab5888e8db9a4e5","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-01262b63a6aa0c6cbe32d99b","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bbf4e693f5cb28f637d8a3b4","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a4820eaa3ff1a4349d49a0ea","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a097b762f6683f508b99f960","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ffa0551daaf0ed3d407aec6e","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.3.3 - Management review results_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ab7b7a58bb4e4cd925f029c7","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA requires impact assessments and risk management programs for deployers and NIST formalizes risk treatments and post-deployment monitoring.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-87bb3f403a8aa5994e3c0d60","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.4\nA.2.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-31d1b385129d07ef8560f6f4","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-067db869ef37bae7d68acf63","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3\n6.4.15.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d80b37de34a29ca80d4ee664","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.1\n6.4\n6.7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1bf6f773cc4f1e6811216968","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b6266cb7a62a81cd64c3df97","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"RC.CO-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-18c314366a7907d9880bddcc","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-45d8e980faa51824c49ccde2","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-35613f6fa1b2f0bb1850ca27","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d7cbb670cad1d3abc87dd406","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a3ba69c9cb90ffd27e7985cf","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8176904ee2415ccd896bb391","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-871435cdf9f44a3cfe37c022","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ac64a345484df38caa0f2a19","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.3.2 - Management review inputs_x000D_\nB.8.5 - Information for interested parties_x000D_\nB.6.2.6 - AI system operation and monitoring","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-666e1de6a48776a41af562c8","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2eb2e9519adea770e8045a35","from":"MS-POL-POL-01@49c4c01e6c0532bb","to":"MS-RULE-OP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!2:2","fromKeys":["MS-POL-POL-01@49c4c01e6c0532bb"],"toKeys":["MS-RULE-OP-09@ec587343b8220a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-983923bb82e9725254ae8108","from":"MS-POL-POL-01@49c4c01e6c0532bb","to":"MS-RULE-AU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!2:2","fromKeys":["MS-POL-POL-01@49c4c01e6c0532bb"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ee40793ed3bd8af1ca389f8e","from":"MS-POL-POL-01@49c4c01e6c0532bb","to":"MS-RULE-OP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!2:2","fromKeys":["MS-POL-POL-01@49c4c01e6c0532bb"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-57d89e7422fb38ce78cd1dbe","from":"MS-POL-POL-02@aa0847ee55585424","to":"MS-RULE-IN-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!3:3","fromKeys":["MS-POL-POL-02@aa0847ee55585424"],"toKeys":["MS-RULE-IN-07@31e317962beaeb5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4c35d0532c7ef6aa7669cd36","from":"MS-POL-POL-02@aa0847ee55585424","to":"MS-RULE-OU-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!3:3","fromKeys":["MS-POL-POL-02@aa0847ee55585424"],"toKeys":["MS-RULE-OU-06@ce0137df984ac601"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e0f7ee9e278724c50251fd8","from":"MS-POL-POL-02@aa0847ee55585424","to":"MS-RULE-OU-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!3:3","fromKeys":["MS-POL-POL-02@aa0847ee55585424"],"toKeys":["MS-RULE-OU-07@7d5bc203e83e95c9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f11acdebeee78da5f902c4e4","from":"MS-POL-POL-03@11c99e7398913f0f","to":"MS-RULE-AU-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!4:4","fromKeys":["MS-POL-POL-03@11c99e7398913f0f"],"toKeys":["MS-RULE-AU-01@32b7d4ac14b06f7b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-51f830724a690c2dcb82bbd8","from":"MS-POL-POL-03@11c99e7398913f0f","to":"MS-RULE-AU-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!4:4","fromKeys":["MS-POL-POL-03@11c99e7398913f0f"],"toKeys":["MS-RULE-AU-02@1a166eaeb8f7f1ad"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7b5a1a5e22edef94641b0d51","from":"MS-POL-POL-03@11c99e7398913f0f","to":"MS-RULE-AU-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!4:4","fromKeys":["MS-POL-POL-03@11c99e7398913f0f"],"toKeys":["MS-RULE-AU-08@4eda0a221f3ef380"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5ce89e28783a7b9d9809fc36","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de3f7ab467288176e169fc84","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-891241b4a0bc916145d652a4","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-03@4cbb47b109e98f4a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0b55ae4c5bfead640c41a1c0","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-04@13c6ba85197d9a69"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e8471e974d2af89c0b0f38e0","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ec99c302456bcfc26253fb23","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-06@af062b3863346b41"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ff3d8cee28e4eef55d575877","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-83b05e3ccd8572d861672dfd","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-af8b7dadb51c1e8a7bd2f460","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9b71d48e10e197f0ab71dd50","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b501ec28ae24eb3f75d677e7","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-644fe899354e5b8604b80526","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2683fe5dbb06688963471e0f","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-13","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-13@1299bbf89c50bd1a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d81b8738bada27351192bdc6","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-14","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-649cdbb0ba60a1736978207c","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-15","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-619563172b21cb8c2b028596","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-16","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-219a60682d835b844dfe151d","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-17","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-352bdfce28f529e141e69697","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-18","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-755faaecb6e334c6b15afe32","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-AU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9bcfb68d0af6b7b52c3003ea","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-AU-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!5:5","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b19d38e221b429483b063e34","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!6:6","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ecbe4476b8e0a6cd28270ad1","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!6:6","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-02@4965655028a3d485"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-341be195f51f3906b1cfe365","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!6:6","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1799336cde1a0e4a67bb52e5","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!6:6","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-be33ec1f007569876b08db3a","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!6:6","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2bb0a9a4b19542f71c506fb9","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!6:6","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-06@ce0137df984ac601"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9819428efc8d340b5bddbef8","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!6:6","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-07@7d5bc203e83e95c9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cc73298392672238176c13ab","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!6:6","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-08@4c7bb6dc00dfcbfd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a5cb13afec89227eac822a45","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!6:6","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-09@2ffb1322457172b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f9ca084900cbe016426806e5","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!6:6","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-10@2332653b89bcd331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-64ef0cb2e89fec362079f50e","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!6:6","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-11@0710643d8a955cf6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-01afc0eb33537eaad258270b","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!6:6","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3bcd271cb0d07ebdd5feba8f","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!7:7","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5bb17eb60cd61bb0c5943142","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!7:7","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-06@af062b3863346b41"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8d203813851f96f0048bc2d8","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!7:7","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c4e6491fa9f449fdce38ca84","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!7:7","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c46a888d6cd02a93c28c3cf0","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!7:7","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-03c8524209b89a6dd6f896d5","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!7:7","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-874d5dc5bde162a27cb13ad7","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!7:7","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ac17859b4f49a8e867679310","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-OU-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!7:7","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-OU-11@0710643d8a955cf6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e077d621fea4f197b036486f","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-IN-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!8:8","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-IN-01@e4fe11be1a20f12f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c9fa2f0959c998f411bf56f2","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-IN-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!8:8","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-IN-02@dbb47a84e8a96c05"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d334bfd6374159f4f9642642","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-IN-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!8:8","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b14d4de83e1686d37c848750","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-IN-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!8:8","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-IN-04@40341d186f0bd606"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-78b5445eb61475a97f49e2e9","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-IN-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!8:8","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-918546df2a578490ed7732cf","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-DP-15","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!8:8","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e60383a8743cd14ebe2299c0","from":"MS-POL-POL-08@ee4729bdeed9ad16","to":"MS-RULE-OU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!9:9","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-65d7e43c9d5a34ceef9d7b90","from":"MS-POL-POL-08@ee4729bdeed9ad16","to":"MS-RULE-OU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!9:9","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-557ca32de4981bebf83c6d35","from":"MS-POL-POL-08@ee4729bdeed9ad16","to":"MS-RULE-AG-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!9:9","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16"],"toKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-86083285ba7d9057fe02c53e","from":"MS-POL-POL-08@ee4729bdeed9ad16","to":"MS-RULE-AG-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!9:9","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16"],"toKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5ce463a69a1a4bc30fe786f7","from":"MS-POL-POL-08@ee4729bdeed9ad16","to":"MS-RULE-OP-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!9:9","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-69a1f6016393944e31168db6","from":"MS-POL-POL-09@30cd5cb249f58ae2","to":"MS-RULE-AU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!10:10","fromKeys":["MS-POL-POL-09@30cd5cb249f58ae2"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-51e61e40aa888e13b130f360","from":"MS-POL-POL-09@30cd5cb249f58ae2","to":"MS-RULE-OP-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!10:10","fromKeys":["MS-POL-POL-09@30cd5cb249f58ae2"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f2ff7930412cb5e34c1098ef","from":"MS-POL-POL-09@30cd5cb249f58ae2","to":"MS-RULE-OP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!10:10","fromKeys":["MS-POL-POL-09@30cd5cb249f58ae2"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3a18cb58ad1b437d856b3771","from":"MS-POL-POL-10@cce53ffd6ac04512","to":"MS-RULE-OP-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!11:11","fromKeys":["MS-POL-POL-10@cce53ffd6ac04512"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1591688df45a1f82fcdc23bb","from":"MS-POL-POL-10@cce53ffd6ac04512","to":"MS-RULE-OP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!11:11","fromKeys":["MS-POL-POL-10@cce53ffd6ac04512"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e9c973d3ed59b80a64f2b253","from":"MS-POL-POL-11@4cbd6ed56751cc97","to":"MS-RULE-OP-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!12:12","fromKeys":["MS-POL-POL-11@4cbd6ed56751cc97"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6d8f7aeb176b077a11091407","from":"MS-POL-POL-11@4cbd6ed56751cc97","to":"MS-RULE-OP-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!12:12","fromKeys":["MS-POL-POL-11@4cbd6ed56751cc97"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c113062a1b3c47050ef59879","from":"MS-POL-POL-11@4cbd6ed56751cc97","to":"MS-RULE-OP-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!12:12","fromKeys":["MS-POL-POL-11@4cbd6ed56751cc97"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2fdc29c07a869cf42ef798fe","from":"MS-POL-POL-12@2bcf920fc5a05e6b","to":"MS-RULE-OP-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!13:13","fromKeys":["MS-POL-POL-12@2bcf920fc5a05e6b"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9d86cf14a16d5aed720b6496","from":"MS-POL-POL-12@2bcf920fc5a05e6b","to":"MS-RULE-OP-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!13:13","fromKeys":["MS-POL-POL-12@2bcf920fc5a05e6b"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a54c859c15b508ab8c109ae2","from":"MS-POL-POL-13@e8a7e91b791104ce","to":"MS-RULE-AU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!14:14","fromKeys":["MS-POL-POL-13@e8a7e91b791104ce"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f7e6a78a1eb6af3235516f67","from":"MS-POL-POL-13@e8a7e91b791104ce","to":"MS-RULE-AU-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!14:14","fromKeys":["MS-POL-POL-13@e8a7e91b791104ce"],"toKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c352fc1dc567eb5465d6c122","from":"MS-POL-POL-13@e8a7e91b791104ce","to":"MS-RULE-OP-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!14:14","fromKeys":["MS-POL-POL-13@e8a7e91b791104ce"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bb2f0e88200b2960fac9998d","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!15:15","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-01@e6aee1767c267990"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-10cf1fa02764ef4dda72008e","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!15:15","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-02@d4d178c0433fd6d4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6a31f0a5787d8107bcfbe1ba","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!15:15","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-844799dcda90fdd12ef92329","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!15:15","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-759c558ab60464bd0c5d7560","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!15:15","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-05@8829d873310f18f9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-367c36a89ab2faeb88f0876b","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!15:15","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-06@6371f819b40b0d97"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a06e0850037fb8caac3abcac","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!15:15","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-07@c2fb36c556cb8a62"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4678959cd9b7cef1a9c251eb","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!15:15","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c034955f9bef9cf9b4d234aa","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!15:15","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-09@2bd07e82a72d4f2e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a8edf511e48bdec7d8c0ab4b","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-IN-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!15:15","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-IN-08@94324ccfd3a491ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5e10df2065f282f48ae3b9b2","from":"MS-POL-POL-15@66ce06439b6303c8","to":"MS-RULE-OU-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!16:16","fromKeys":["MS-POL-POL-15@66ce06439b6303c8"],"toKeys":["MS-RULE-OU-08@4c7bb6dc00dfcbfd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dc3303837fbfd339e4f8101f","from":"MS-POL-POL-15@66ce06439b6303c8","to":"MS-RULE-OU-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!16:16","fromKeys":["MS-POL-POL-15@66ce06439b6303c8"],"toKeys":["MS-RULE-OU-09@2ffb1322457172b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ab362384561f332a1e1df320","from":"MS-POL-POL-15@66ce06439b6303c8","to":"MS-RULE-OP-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!16:16","fromKeys":["MS-POL-POL-15@66ce06439b6303c8"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-92e7dd66981c7f55da4ffd9b","from":"MS-POL-POL-15@66ce06439b6303c8","to":"MS-RULE-OP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!16:16","fromKeys":["MS-POL-POL-15@66ce06439b6303c8"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c0df6003cee7c31ef90ff1ee","from":"MS-POL-POL-16@e96f7674899ecd20","to":"MS-RULE-OU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!17:17","fromKeys":["MS-POL-POL-16@e96f7674899ecd20"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cd9cac31f0ee7d6458a15288","from":"MS-POL-POL-17@fbd2f1193b92724a","to":"MS-RULE-OU-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!18:18","fromKeys":["MS-POL-POL-17@fbd2f1193b92724a"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-76fdfcd7bcfd4fd4f60cffbf","from":"MS-POL-POL-17@fbd2f1193b92724a","to":"MS-RULE-OU-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!18:18","fromKeys":["MS-POL-POL-17@fbd2f1193b92724a"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-01f4c7467cb1c4c8f2b5ac09","from":"MS-POL-POL-17@fbd2f1193b92724a","to":"MS-RULE-OP-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!18:18","fromKeys":["MS-POL-POL-17@fbd2f1193b92724a"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9ca65f88735e4a74e0c4f33b","from":"MS-POL-POL-18@97f5690fa7f7084e","to":"MS-RULE-DP-14","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!19:19","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d53b151a7574abc363320f34","from":"MS-POL-POL-18@97f5690fa7f7084e","to":"MS-RULE-DP-16","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!19:19","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8fb023174c7121b5f8dd6b27","from":"MS-POL-POL-18@97f5690fa7f7084e","to":"MS-RULE-DP-17","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!19:19","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eeed9aec633d4ad5d79f42fb","from":"MS-POL-POL-18@97f5690fa7f7084e","to":"MS-RULE-DP-18","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!19:19","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9b5c5577f7b583e04945561a","from":"MS-POL-POL-18@97f5690fa7f7084e","to":"MS-RULE-OU-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!19:19","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e"],"toKeys":["MS-RULE-OU-10@2332653b89bcd331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7ddc189730f18afbcf192a3f","from":"MS-POL-POL-20@ea163decd6c07a16","to":"MS-RULE-OP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!21:21","fromKeys":["MS-POL-POL-20@ea163decd6c07a16"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d1ecd2ed5c3c42edb9a390e1","from":"MS-POL-POL-20@ea163decd6c07a16","to":"MS-RULE-OP-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!21:21","fromKeys":["MS-POL-POL-20@ea163decd6c07a16"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d6c3eed1e92b8aa789091f08","from":"MS-POL-POL-21@9a99a10275e80192","to":"MS-RULE-OP-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!22:22","fromKeys":["MS-POL-POL-21@9a99a10275e80192"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e000aab58e9e4f190b05fcf3","from":"MS-POL-POL-22@7864cb607001d95d","to":"MS-RULE-IN-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!23:23","fromKeys":["MS-POL-POL-22@7864cb607001d95d"],"toKeys":["MS-RULE-IN-06@478a04da335c1e7f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2aeda35d4ac40015f14f0bb2","from":"MS-POL-POL-22@7864cb607001d95d","to":"MS-RULE-AG-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!23:23","fromKeys":["MS-POL-POL-22@7864cb607001d95d"],"toKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-41ef6cf8e1c66f85b44922b3","from":"MS-POL-POL-22@7864cb607001d95d","to":"MS-RULE-AG-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'04 Internal Policies'!23:23","fromKeys":["MS-POL-POL-22@7864cb607001d95d"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d8f701a3180c5cd85f6a2946","from":"MS-OVERLAY-CUS-01@ef016720fa4b77d5","to":"MS-RULE-DP-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!2:2","fromKeys":["MS-OVERLAY-CUS-01@ef016720fa4b77d5"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-94578e5d03eed1a8652c5ac8","from":"MS-OVERLAY-CUS-01@ef016720fa4b77d5","to":"MS-RULE-DP-09","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!2:2","fromKeys":["MS-OVERLAY-CUS-01@ef016720fa4b77d5"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ad9d32310770863cfb66117a","from":"MS-OVERLAY-CUS-02@2bdb2cb7097a15c7","to":"MS-RULE-DP-14","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!3:3","fromKeys":["MS-OVERLAY-CUS-02@2bdb2cb7097a15c7"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-07435b0cba299510ea9bb692","from":"MS-OVERLAY-CUS-02@2bdb2cb7097a15c7","to":"MS-RULE-DP-16","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!3:3","fromKeys":["MS-OVERLAY-CUS-02@2bdb2cb7097a15c7"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-515a484daacffafacbd8bb5b","from":"MS-OVERLAY-CUS-02@2bdb2cb7097a15c7","to":"MS-RULE-DP-18","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!3:3","fromKeys":["MS-OVERLAY-CUS-02@2bdb2cb7097a15c7"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-512a6c2468c22bdb0256b1d2","from":"MS-OVERLAY-CUS-03@9e0dd72cbcd36d06","to":"MS-RULE-AU-01","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!4:4","fromKeys":["MS-OVERLAY-CUS-03@9e0dd72cbcd36d06"],"toKeys":["MS-RULE-AU-01@32b7d4ac14b06f7b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7407c869f7676743e4001d84","from":"MS-OVERLAY-CUS-03@9e0dd72cbcd36d06","to":"MS-RULE-AG-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!4:4","fromKeys":["MS-OVERLAY-CUS-03@9e0dd72cbcd36d06"],"toKeys":["MS-RULE-AG-05@8829d873310f18f9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d8bc59282a76d6a1d5916a1c","from":"MS-OVERLAY-CUS-04@1f8a3af1c8e871ca","to":"MS-RULE-DP-14","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!5:5","fromKeys":["MS-OVERLAY-CUS-04@1f8a3af1c8e871ca"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7d9c9bb059aa7108e1c0bb7a","from":"MS-OVERLAY-CUS-04@1f8a3af1c8e871ca","to":"MS-RULE-DP-16","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!5:5","fromKeys":["MS-OVERLAY-CUS-04@1f8a3af1c8e871ca"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8288d0b8f5c70c905822991f","from":"MS-OVERLAY-CUS-05@312949a220d7aa56","to":"MS-RULE-AU-04","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!6:6","fromKeys":["MS-OVERLAY-CUS-05@312949a220d7aa56"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fbc6d0f5c23c6746c21220cb","from":"MS-OVERLAY-CUS-06@b76726eea76800fb","to":"MS-RULE-AU-02","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!7:7","fromKeys":["MS-OVERLAY-CUS-06@b76726eea76800fb"],"toKeys":["MS-RULE-AU-02@1a166eaeb8f7f1ad"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f03a9fd793a1414c4d8d3d0f","from":"MS-OVERLAY-CUS-06@b76726eea76800fb","to":"MS-RULE-AU-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!7:7","fromKeys":["MS-OVERLAY-CUS-06@b76726eea76800fb"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cbacc3cfbb02c41122334124","from":"MS-OVERLAY-CUS-06@b76726eea76800fb","to":"MS-RULE-AU-06","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!7:7","fromKeys":["MS-OVERLAY-CUS-06@b76726eea76800fb"],"toKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5b68baa7c00225e239bb00f5","from":"MS-OVERLAY-CUS-07@e7e1902f4641a2b9","to":"MS-RULE-OU-04","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!8:8","fromKeys":["MS-OVERLAY-CUS-07@e7e1902f4641a2b9"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-11149f77814e7c4e0d33eeb5","from":"MS-OVERLAY-CUS-07@e7e1902f4641a2b9","to":"MS-RULE-OU-12","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!8:8","fromKeys":["MS-OVERLAY-CUS-07@e7e1902f4641a2b9"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6fba15320aba95c86bdd53a3","from":"MS-OVERLAY-CUS-08@f2e9d1cd2e00bcf6","to":"MS-RULE-AG-07","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!9:9","fromKeys":["MS-OVERLAY-CUS-08@f2e9d1cd2e00bcf6"],"toKeys":["MS-RULE-AG-07@c2fb36c556cb8a62"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f6e52486b065b26cfb621a20","from":"MS-OVERLAY-CUS-09@fa0395a46d9792dd","to":"MS-RULE-AG-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!10:10","fromKeys":["MS-OVERLAY-CUS-09@fa0395a46d9792dd"],"toKeys":["MS-RULE-AG-05@8829d873310f18f9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-85f368e81c0d735267fb1acb","from":"MS-OVERLAY-CUS-10@d2a5b80a68088779","to":"MS-RULE-AG-01","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!11:11","fromKeys":["MS-OVERLAY-CUS-10@d2a5b80a68088779"],"toKeys":["MS-RULE-AG-01@e6aee1767c267990"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e783c8cb8303706b6f904f1d","from":"MS-OVERLAY-CUS-10@d2a5b80a68088779","to":"MS-RULE-AG-10","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!11:11","fromKeys":["MS-OVERLAY-CUS-10@d2a5b80a68088779"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b3ab466f68c2d040cc864704","from":"MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7","to":"MS-RULE-AU-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!12:12","fromKeys":["MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-43f632de089f64401ec9c7b3","from":"MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7","to":"MS-RULE-OP-11","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!12:12","fromKeys":["MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-89c6c547b83a2530946871a7","from":"MS-OVERLAY-CUS-12@b7241f443c6c3622","to":"MS-RULE-DP-01","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!13:13","fromKeys":["MS-OVERLAY-CUS-12@b7241f443c6c3622"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6059ac59ad371492806049c4","from":"MS-OVERLAY-CUS-12@b7241f443c6c3622","to":"MS-RULE-DP-15","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!13:13","fromKeys":["MS-OVERLAY-CUS-12@b7241f443c6c3622"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3cbb5bd96b078f288cd456be","from":"MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7","to":"MS-RULE-IN-03","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!14:14","fromKeys":["MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7"],"toKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-59c29420ace308de64d1b5c9","from":"MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7","to":"MS-RULE-IN-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!14:14","fromKeys":["MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7"],"toKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-59eec173e81f16029b1c9cd7","from":"MS-OVERLAY-CUS-14@360b13cad7621179","to":"MS-RULE-IN-07","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!15:15","fromKeys":["MS-OVERLAY-CUS-14@360b13cad7621179"],"toKeys":["MS-RULE-IN-07@31e317962beaeb5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a7758453e33ed382e4776d81","from":"MS-OVERLAY-CUS-14@360b13cad7621179","to":"MS-RULE-OU-04","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!15:15","fromKeys":["MS-OVERLAY-CUS-14@360b13cad7621179"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ea1ebacdd1f173ed1f64d69b","from":"MS-OVERLAY-CUS-15@bdd9abeff8cb9654","to":"MS-RULE-AG-03","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!16:16","fromKeys":["MS-OVERLAY-CUS-15@bdd9abeff8cb9654"],"toKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c54f37295650593ff6067d4b","from":"MS-OVERLAY-CUS-15@bdd9abeff8cb9654","to":"MS-RULE-AG-04","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!16:16","fromKeys":["MS-OVERLAY-CUS-15@bdd9abeff8cb9654"],"toKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6394df17d2362f917862ad1e","from":"MS-OVERLAY-CUS-15@bdd9abeff8cb9654","to":"MS-RULE-OP-08","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!16:16","fromKeys":["MS-OVERLAY-CUS-15@bdd9abeff8cb9654"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a5a6624f9149944589013920","from":"MS-OVERLAY-CUS-16@5dc4891c003c8c70","to":"MS-RULE-OU-01","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!17:17","fromKeys":["MS-OVERLAY-CUS-16@5dc4891c003c8c70"],"toKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ad331e767d1581c0e0cc608","from":"MS-OVERLAY-CUS-16@5dc4891c003c8c70","to":"MS-RULE-OU-02","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!17:17","fromKeys":["MS-OVERLAY-CUS-16@5dc4891c003c8c70"],"toKeys":["MS-RULE-OU-02@4965655028a3d485"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fff1018bcf704cbc41139ada","from":"MS-OVERLAY-CUS-16@5dc4891c003c8c70","to":"MS-RULE-AG-08","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!17:17","fromKeys":["MS-OVERLAY-CUS-16@5dc4891c003c8c70"],"toKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-96ca920d9d106d3d98beb79b","from":"MS-OVERLAY-CUS-17@3b8c3e6e3715795f","to":"MS-RULE-OU-03","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!18:18","fromKeys":["MS-OVERLAY-CUS-17@3b8c3e6e3715795f"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1038d5384f499157e78e38b6","from":"MS-OVERLAY-CUS-17@3b8c3e6e3715795f","to":"MS-RULE-OU-12","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!18:18","fromKeys":["MS-OVERLAY-CUS-17@3b8c3e6e3715795f"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4d7476068f6d89efff93d360","from":"MS-OVERLAY-CUS-17@3b8c3e6e3715795f","to":"MS-RULE-AG-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!18:18","fromKeys":["MS-OVERLAY-CUS-17@3b8c3e6e3715795f"],"toKeys":["MS-RULE-AG-05@8829d873310f18f9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-267704c83c69da91cc632bdc","from":"MS-OVERLAY-CUS-18@d7a54daf6d4edffb","to":"MS-RULE-OP-06","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!19:19","fromKeys":["MS-OVERLAY-CUS-18@d7a54daf6d4edffb"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b8ede38187b896a9edca60b2","from":"MS-OVERLAY-CUS-18@d7a54daf6d4edffb","to":"MS-RULE-OP-12","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-595d3cba580f5771@b7251cfa104f","locator":"'05 Custom Rules'!19:19","fromKeys":["MS-OVERLAY-CUS-18@d7a54daf6d4edffb"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4407a6bd8ee28af664735293","from":"MS-RULE-DP-01","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"IA-5; AC-4","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!5:5","fromKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f8efbc3a5565e046b1ab832d","from":"MS-RULE-DP-01","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"PR.AA; PR.DS","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!6:6","fromKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-13acd288751a9bf3e49ccc2d","from":"MS-RULE-DP-01","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM02 Sensitive Information Disclosure","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!7:7","fromKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-72bf9d3be8d7d6732f4fd1ec","from":"MS-RULE-DP-02","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"IA-5","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!8:8","fromKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-01894394f283599adca00261","from":"MS-RULE-DP-02","to":"FW-PCI-DSS","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Requirements 7–8","publisherUrl":"https://www.pcisecuritystandards.org/standards/pci-dss/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!9:9","fromKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"toKeys":["FW-PCI-DSS@26b432290466d636","FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b33f9f2abb7f345e4c05cbad","from":"MS-RULE-DP-02","to":"FW-GLBA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"16 CFR 314.4","publisherUrl":"https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!10:10","fromKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"toKeys":["FW-GLBA@ce5eb5a36e567a3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2f42c9794033f6e9398b22f3","from":"MS-RULE-DP-03","to":"FW-PCI-DSS","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Req. 3.4 and 4","publisherUrl":"https://www.pcisecuritystandards.org/standards/pci-dss/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!11:11","fromKeys":["MS-RULE-DP-03@4cbb47b109e98f4a"],"toKeys":["FW-PCI-DSS@26b432290466d636","FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-00e6a3e173682b6f1ac68d27","from":"MS-RULE-DP-03","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM02","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!12:12","fromKeys":["MS-RULE-DP-03@4cbb47b109e98f4a"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-24194cebe54cce8d686fdcdb","from":"MS-RULE-DP-04","to":"FW-PCI-DSS","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Req. 3.3.1","publisherUrl":"https://www.pcisecuritystandards.org/standards/pci-dss/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!13:13","fromKeys":["MS-RULE-DP-04@13c6ba85197d9a69"],"toKeys":["FW-PCI-DSS@26b432290466d636","FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-040e2434a47b212430d7eaa1","from":"MS-RULE-DP-04","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM02","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!14:14","fromKeys":["MS-RULE-DP-04@13c6ba85197d9a69"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ab52cee8a3a3ae51f6e44fc1","from":"MS-RULE-DP-05","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5, 25, 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!15:15","fromKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1847b1c55377f2b910c70758","from":"MS-RULE-DP-05","to":"FW-HIPAA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"45 CFR 164.514(b) identifiers","publisherUrl":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!16:16","fromKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"toKeys":["FW-HIPAA@024563eb5b7c33a6","FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-17c3c69264fee92517515489","from":"MS-RULE-DP-05","to":"FW-FERPA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"34 CFR 99.3","publisherUrl":"https://studentprivacy.ed.gov/ferpa","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!17:17","fromKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"toKeys":["FW-FERPA@adba7da3b8b49ee6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ae4e4b0cf4fb1187fd6fc61a","from":"MS-RULE-DP-06","to":"FW-GLBA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"16 CFR 314.4","publisherUrl":"https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!18:18","fromKeys":["MS-RULE-DP-06@af062b3863346b41"],"toKeys":["FW-GLBA@ce5eb5a36e567a3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-45ccee010e17cc16f8ed2bf7","from":"MS-RULE-DP-06","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5 and 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!19:19","fromKeys":["MS-RULE-DP-06@af062b3863346b41"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-36ee0e39f6f98f0462d0dfde","from":"MS-RULE-DP-07","to":"FW-HIPAA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"45 CFR 164.502; 164.308; 164.312","publisherUrl":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!20:20","fromKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"toKeys":["FW-HIPAA@024563eb5b7c33a6","FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9a55cdbe79347ebc14728e2b","from":"MS-RULE-DP-07","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Data Privacy risk actions","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!21:21","fromKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-318e823c46eddcd822e01a54","from":"MS-RULE-DP-08","to":"FW-FERPA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"34 CFR 99.30; 99.37","publisherUrl":"https://studentprivacy.ed.gov/ferpa","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!22:22","fromKeys":["MS-RULE-DP-08@f94b476097640eb3"],"toKeys":["FW-FERPA@adba7da3b8b49ee6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e006893e973133bc8c3212dc","from":"MS-RULE-DP-08","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Data Privacy","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!23:23","fromKeys":["MS-RULE-DP-08@f94b476097640eb3"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c4a12522828b92d8c618d6c5","from":"MS-RULE-DP-09","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5, 25, 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!24:24","fromKeys":["MS-RULE-DP-09@e32553c4840951b3"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b049625a1de9834a347649be","from":"MS-RULE-DP-09","to":"FW-CCPA-CPRA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Personal information; reasonable security","publisherUrl":"https://cppa.ca.gov/regulations/ccpa_updates.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!25:25","fromKeys":["MS-RULE-DP-09@e32553c4840951b3"],"toKeys":["FW-CCPA-CPRA@2726437e0cff599a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ef097034af188825848b514f","from":"MS-RULE-DP-09","to":"FW-HIPAA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"45 CFR 164.514(b)","publisherUrl":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!26:26","fromKeys":["MS-RULE-DP-09@e32553c4840951b3"],"toKeys":["FW-HIPAA@024563eb5b7c33a6","FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eb9089d8e2793562b58c8eab","from":"MS-RULE-DP-10","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 9, 25, 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!27:27","fromKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7616c0ca836f675c5e373430","from":"MS-RULE-DP-10","to":"FW-CCPA-CPRA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Sensitive personal information","publisherUrl":"https://cppa.ca.gov/regulations/ccpa_updates.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!28:28","fromKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"toKeys":["FW-CCPA-CPRA@2726437e0cff599a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2c2a6bbf1ff14b6525d3de80","from":"MS-RULE-DP-10","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5, 9, 10","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!29:29","fromKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-baf6493c39c3ec49f9179a6a","from":"MS-RULE-DP-11","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5, 25, 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!30:30","fromKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-983d1b1888a688a6a070dfb7","from":"MS-RULE-DP-11","to":"FW-CCPA-CPRA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Sensitive personal information","publisherUrl":"https://cppa.ca.gov/regulations/ccpa_updates.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!31:31","fromKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"toKeys":["FW-CCPA-CPRA@2726437e0cff599a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3fc3b488e16d472dea986c3f","from":"MS-RULE-DP-12","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AC-4; MP; SC families","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!32:32","fromKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ffe426f7cd4d49a1fe8b18c3","from":"MS-RULE-DP-12","to":"FW-FEDRAMP","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Information-flow and boundary controls","publisherUrl":"https://www.fedramp.gov/archive/2023-05-30-rev-5-baselines-have-been-approved-and-released/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!33:33","fromKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"toKeys":["FW-FEDRAMP@0431d549dd6dc7e6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a65d67ac3de5000efb9d6c5a","from":"MS-RULE-DP-13","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AC-4; PL-8","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!34:34","fromKeys":["MS-RULE-DP-13@1299bbf89c50bd1a"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-591d92e033f101a02824cab8","from":"MS-RULE-DP-13","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Agency risk management","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!35:35","fromKeys":["MS-RULE-DP-13@1299bbf89c50bd1a"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-85253abd1214ddb8456a8c5a","from":"MS-RULE-DP-14","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"C1.1 Confidentiality","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!36:36","fromKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1d6aae2b3b9cd88635a525a3","from":"MS-RULE-DP-14","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"PR.DS","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!37:37","fromKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-acb298191cbb14917404d101","from":"MS-RULE-DP-14","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM02","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!38:38","fromKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-04abf44e694b734711383f85","from":"MS-RULE-DP-15","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"ID.RA; PR.PS","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!39:39","fromKeys":["MS-RULE-DP-15@208a0f796d79405e"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c18158309ee7f33102564b03","from":"MS-RULE-DP-15","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"CM-8; RA-5; SC-7","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!40:40","fromKeys":["MS-RULE-DP-15@208a0f796d79405e"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-14b945efb1569d204d6bf4e3","from":"MS-RULE-DP-15","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"CC4.2; CC6","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!41:41","fromKeys":["MS-RULE-DP-15@208a0f796d79405e"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8756fa3253c99b0caec19fb6","from":"MS-RULE-DP-16","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"C1.1; P-series","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!42:42","fromKeys":["MS-RULE-DP-16@d0dca88853814a51"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f5f3431b4aee16ec7ff2bdc2","from":"MS-RULE-DP-16","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5 and 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!43:43","fromKeys":["MS-RULE-DP-16@d0dca88853814a51"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2f73dcec2e3ec5f6def6052f","from":"MS-RULE-DP-16","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Data Privacy","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!44:44","fromKeys":["MS-RULE-DP-16@d0dca88853814a51"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6c7b43845e374ce8f37e3a5c","from":"MS-RULE-DP-17","to":"FW-SOX","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Reporting integrity / ICFR","publisherUrl":"https://www.sec.gov/spotlight/sarbanes-oxley.htm","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!45:45","fromKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"toKeys":["FW-SOX@6b53f8d76c60deb9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-13864059a233c8e1045ea1ef","from":"MS-RULE-DP-17","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Confidentiality","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!46:46","fromKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ce9780e40779152051d54b4","from":"MS-RULE-DP-18","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"C1.1","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!47:47","fromKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6fd1e8c6db626ae5d3cdfc96","from":"MS-RULE-DP-18","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"PR.DS","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!48:48","fromKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a7a9827e966cfdf324957202","from":"MS-RULE-AU-01","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Approved GAI provider lists","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!49:49","fromKeys":["MS-RULE-AU-01@32b7d4ac14b06f7b"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a91575cbbd5f84ca9e618ebd","from":"MS-RULE-AU-01","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"GV.SC; ID.AM","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!50:50","fromKeys":["MS-RULE-AU-01@32b7d4ac14b06f7b"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-07b0979405266966c6f82ec8","from":"MS-RULE-AU-02","to":"FW-GLBA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"16 CFR 314.4; MFA","publisherUrl":"https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!51:51","fromKeys":["MS-RULE-AU-02@1a166eaeb8f7f1ad"],"toKeys":["FW-GLBA@ce5eb5a36e567a3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6277a16e0721b2d42bb656a0","from":"MS-RULE-AU-02","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"IA-2; IA-5","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!52:52","fromKeys":["MS-RULE-AU-02@1a166eaeb8f7f1ad"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6749cf36bfa61e24e8539795","from":"MS-RULE-AU-02","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"PR.AA","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!53:53","fromKeys":["MS-RULE-AU-02@1a166eaeb8f7f1ad"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-430ae64c94309801b451b28f","from":"MS-RULE-AU-03","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AC-2; AC-3; AC-6","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!54:54","fromKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ae52762c5b65330fd3ab35dd","from":"MS-RULE-AU-03","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"CC6.1","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!55:55","fromKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cd0f4ce8532a9cc435f9fdf8","from":"MS-RULE-AU-04","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 9 and 26","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!56:56","fromKeys":["MS-RULE-AU-04@d51101a040857487"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d887fd6190533f2ca1f9f6b5","from":"MS-RULE-AU-04","to":"FW-ISO-42005","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AI impact assessment","publisherUrl":"https://www.iso.org/standard/42005","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!57:57","fromKeys":["MS-RULE-AU-04@d51101a040857487"],"toKeys":["FW-ISO-42005@b02139bf544ce4bf"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6d3ec65f369ae6852aea0237","from":"MS-RULE-AU-04","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"High-impact AI practices","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!58:58","fromKeys":["MS-RULE-AU-04@d51101a040857487"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-515a9172c03315fb371865bd","from":"MS-RULE-AU-05","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5, 25, 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!59:59","fromKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b45eed1ddb4b7373a97ef6c7","from":"MS-RULE-AU-05","to":"FW-OMB-M25-22","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Acquisition and data terms","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!60:60","fromKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"toKeys":["FW-OMB-M25-22@1dd0effe69b2dd83"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d747dd152960ce61bcb770a0","from":"MS-RULE-AU-06","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Third-party and value-chain actions","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!61:61","fromKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-46b0db7f16ddea421d006671","from":"MS-RULE-AU-06","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Confidentiality and privacy","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!62:62","fromKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-09b5b7c5651ac8ef28c49bc0","from":"MS-RULE-AU-06","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Purpose limitation","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!63:63","fromKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-63d61fdff13dc01430393b75","from":"MS-RULE-AU-07","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"IA-2; AC-2","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!64:64","fromKeys":["MS-RULE-AU-07@989c3a6787fc6689"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de59d72b594b433e5b1dba98","from":"MS-RULE-AU-07","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"CC6.1","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!65:65","fromKeys":["MS-RULE-AU-07@989c3a6787fc6689"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9cc7ef393b5215f4ab783f63","from":"MS-RULE-AU-08","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"ID.AM","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!66:66","fromKeys":["MS-RULE-AU-08@4eda0a221f3ef380"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dcae52a33d99d821f76ed119","from":"MS-RULE-AU-08","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Approved provider lists","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!67:67","fromKeys":["MS-RULE-AU-08@4eda0a221f3ef380"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7277b2a2b3a22541aac0a1f0","from":"MS-RULE-AU-08","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM04 Supply Chain","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!68:68","fromKeys":["MS-RULE-AU-08@4eda0a221f3ef380"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-64b19d955c4fed52b697e9d8","from":"MS-RULE-IN-01","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM01 Prompt Injection","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!69:69","fromKeys":["MS-RULE-IN-01@e4fe11be1a20f12f"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7fc2b0b4003db589fefabe8f","from":"MS-RULE-IN-01","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Information Security risk actions","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!70:70","fromKeys":["MS-RULE-IN-01@e4fe11be1a20f12f"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-32481cee384d31f5c8d4b2d0","from":"MS-RULE-IN-02","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM01","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!71:71","fromKeys":["MS-RULE-IN-02@dbb47a84e8a96c05"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4c16702e3b05659228259635","from":"MS-RULE-IN-02","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM08 Hidden Context Exposure","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!72:72","fromKeys":["MS-RULE-IN-02@dbb47a84e8a96c05"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-76081b22268159d543821a6a","from":"MS-RULE-IN-03","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM01","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!73:73","fromKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b3cf644cbae3a30a5998c749","from":"MS-RULE-IN-03","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Pre-deployment testing","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!74:74","fromKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4c1bd4b6713469cf364a6c2f","from":"MS-RULE-IN-04","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Information Security; Dangerous/Violent content","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!75:75","fromKeys":["MS-RULE-IN-04@40341d186f0bd606"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f18777acd791a5218c4e362d","from":"MS-RULE-IN-04","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM03 Excessive Agency","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!76:76","fromKeys":["MS-RULE-IN-04@40341d186f0bd606"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b063b33667c5b00b4ec3d8e2","from":"MS-RULE-IN-05","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"PR.DS; DE.CM","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!77:77","fromKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-db59b872270e80f8aa87cc33","from":"MS-RULE-IN-05","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM04 Supply Chain","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!78:78","fromKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-00c3c37d16e52e16855f4658","from":"MS-RULE-IN-06","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM05 Data and Model Poisoning","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!79:79","fromKeys":["MS-RULE-IN-06@478a04da335c1e7f"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9c6b6b607eeba7f86ab0bbdb","from":"MS-RULE-IN-06","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM09 Vector and Embedding Weaknesses","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!80:80","fromKeys":["MS-RULE-IN-06@478a04da335c1e7f"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-641a04ceea0c3e59212593b0","from":"MS-RULE-IN-06","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Data governance and testing","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!81:81","fromKeys":["MS-RULE-IN-06@478a04da335c1e7f"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b5734bee612394dd3ea0ac67","from":"MS-RULE-IN-07","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Acceptable-use policies","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!82:82","fromKeys":["MS-RULE-IN-07@31e317962beaeb5b"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e67eec9fd5cc32c33675b63a","from":"MS-RULE-IN-07","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 9, 13, 26","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!83:83","fromKeys":["MS-RULE-IN-07@31e317962beaeb5b"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ad23be0a28bb09f56f9ad80","from":"MS-RULE-IN-08","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM06 Unbounded Consumption","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!84:84","fromKeys":["MS-RULE-IN-08@94324ccfd3a491ef"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2ef08b36a31aafb69cbe6916","from":"MS-RULE-IN-08","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Operational monitoring","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!85:85","fromKeys":["MS-RULE-IN-08@94324ccfd3a491ef"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8b580175159003ddd97b9bc8","from":"MS-RULE-OU-01","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM02","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!86:86","fromKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d078778a82fd05537c87f73e","from":"MS-RULE-OU-01","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Detect PII in outputs","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!87:87","fromKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c481cbb3e941cdb8bcd484cd","from":"MS-RULE-OU-01","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 25 and 32","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!88:88","fromKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-06ad3b18bd90de72f7242686","from":"MS-RULE-OU-02","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM08 Hidden Context Exposure","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!89:89","fromKeys":["MS-RULE-OU-02@4965655028a3d485"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-35bddfc1090a53c4099a4b0a","from":"MS-RULE-OU-02","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM02","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!90:90","fromKeys":["MS-RULE-OU-02@4965655028a3d485"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-79855c3b4b259a7a19805000","from":"MS-RULE-OU-03","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM07 Misinformation","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!91:91","fromKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1f30e99f3ec77c3eaee96baf","from":"MS-RULE-OU-03","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Confabulation; source/citation review","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!92:92","fromKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3bbecd79ba32849a75705a57","from":"MS-RULE-OU-04","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 14 and 26","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!93:93","fromKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-537b45c71188f3ec5d71ea86","from":"MS-RULE-OU-04","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Art. 22","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!94:94","fromKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5e924726b93bbdd87e80f3ed","from":"MS-RULE-OU-04","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Human oversight and fail-safe","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!95:95","fromKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-168fa6d7bbc0592c19994b24","from":"MS-RULE-OU-05","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 9, 10, 15","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!96:96","fromKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fdf57a48d08e59971df3dd13","from":"MS-RULE-OU-05","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Harmful Bias and Homogenization","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!97:97","fromKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c6c089ff998bc617666e4b86","from":"MS-RULE-OU-05","to":"FW-CO-AI","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"High-risk AI governance","publisherUrl":"https://coag.gov/ai/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!98:98","fromKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"toKeys":["FW-CO-AI@dc656cacb5cb1e38"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-739e2bf00d8872f083fc3310","from":"MS-RULE-OU-06","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Harmful Bias; Human-AI Configuration","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!99:99","fromKeys":["MS-RULE-OU-06@ce0137df984ac601"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fe09974a6b537f583044f2f1","from":"MS-RULE-OU-07","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Dangerous/Violent or Hateful Content; CBRN","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!100:100","fromKeys":["MS-RULE-OU-07@7d5bc203e83e95c9"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e720d468d19d06624802dc8c","from":"MS-RULE-OU-07","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Art. 5 where applicable","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!101:101","fromKeys":["MS-RULE-OU-07@7d5bc203e83e95c9"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bd3af79743ecb7d31fede572","from":"MS-RULE-OU-08","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM10 Improper Output Handling","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!102:102","fromKeys":["MS-RULE-OU-08@4c7bb6dc00dfcbfd"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-873038aa40b965a6b9e43a58","from":"MS-RULE-OU-08","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"PR.PS","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!103:103","fromKeys":["MS-RULE-OU-08@4c7bb6dc00dfcbfd"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-678018907c4a46eb40a5cace","from":"MS-RULE-OU-09","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM10 Improper Output Handling","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!104:104","fromKeys":["MS-RULE-OU-09@2ffb1322457172b3"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-84a047dcdf3a5b33fb6cc4ea","from":"MS-RULE-OU-09","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Information Security","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!105:105","fromKeys":["MS-RULE-OU-09@2ffb1322457172b3"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-168aa42fb9da726c9f87d15e","from":"MS-RULE-OU-10","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Intellectual Property","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!106:106","fromKeys":["MS-RULE-OU-10@2332653b89bcd331"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1476cef2dbf2051d12212a23","from":"MS-RULE-OU-10","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"GPAI transparency obligations","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!107:107","fromKeys":["MS-RULE-OU-10@2332653b89bcd331"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7643e371e616aca025c7ab54","from":"MS-RULE-OU-11","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5, 25, 32, 35","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!108:108","fromKeys":["MS-RULE-OU-11@0710643d8a955cf6"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1bbe240b9e1bbaf2a376daa1","from":"MS-RULE-OU-11","to":"FW-HIPAA","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"45 CFR 164.514","publisherUrl":"https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!109:109","fromKeys":["MS-RULE-OU-11@0710643d8a955cf6"],"toKeys":["FW-HIPAA@024563eb5b7c33a6","FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ac256c8830d75b4f93244036","from":"MS-RULE-OU-12","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Art. 50","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!110:110","fromKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cd1892e932e4b1b70b078c05","from":"MS-RULE-OU-12","to":"FW-CO-AI","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Chatbot and AI disclosures","publisherUrl":"https://coag.gov/ai/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!111:111","fromKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"toKeys":["FW-CO-AI@dc656cacb5cb1e38"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-caf376503f0daf0357129319","from":"MS-RULE-OU-12","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Content provenance","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!112:112","fromKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ce712d6d15628723071c0075","from":"MS-RULE-AG-01","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM03 Excessive Agency","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!113:113","fromKeys":["MS-RULE-AG-01@e6aee1767c267990"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-694375e17cb2792656777c04","from":"MS-RULE-AG-01","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM04 Supply Chain","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!114:114","fromKeys":["MS-RULE-AG-01@e6aee1767c267990"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e26b076a78d5578265fd208a","from":"MS-RULE-AG-02","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AC-6; IA-5","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!115:115","fromKeys":["MS-RULE-AG-02@d4d178c0433fd6d4"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-04078beacff4da849fe3edde","from":"MS-RULE-AG-02","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM03","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!116:116","fromKeys":["MS-RULE-AG-02@d4d178c0433fd6d4"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f4b30e0e86e20850afa15490","from":"MS-RULE-AG-03","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM03","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!117:117","fromKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f1476889faa78947c38f7840","from":"MS-RULE-AG-03","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Art. 14","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!118:118","fromKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-67d949dae0132e9be8f547bb","from":"MS-RULE-AG-03","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Human oversight and fail-safe","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!119:119","fromKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-698d23b8c0335e9dbf7367c4","from":"MS-RULE-AG-04","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Art. 22","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!120:120","fromKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a9f699a5fb5d2cd8da5a483a","from":"MS-RULE-AG-04","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 14 and 26","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!121:121","fromKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-df2ac3807703fae2217801df","from":"MS-RULE-AG-04","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"High-impact AI","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!122:122","fromKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-87ff75906078af8cf77b7a71","from":"MS-RULE-AG-05","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM03","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!123:123","fromKeys":["MS-RULE-AG-05@8829d873310f18f9"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d4035cd83d9f3b9d21b8f4b9","from":"MS-RULE-AG-05","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Human-AI Configuration","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!124:124","fromKeys":["MS-RULE-AG-05@8829d873310f18f9"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-55ea289fd152dda112f35feb","from":"MS-RULE-AG-06","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM03","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!125:125","fromKeys":["MS-RULE-AG-06@6371f819b40b0d97"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-18f99fc55acf31a668d65413","from":"MS-RULE-AG-06","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AC-3; CM-3","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!126:126","fromKeys":["MS-RULE-AG-06@6371f819b40b0d97"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-36fe31ffd242b6c4eddd4f5d","from":"MS-RULE-AG-07","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM03; LLM06","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!127:127","fromKeys":["MS-RULE-AG-07@c2fb36c556cb8a62"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f1f8a3c830899fd1a2d25160","from":"MS-RULE-AG-08","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM08; LLM09","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!128:128","fromKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-40a0181c3d6c2194d5c04867","from":"MS-RULE-AG-08","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"CC6; Confidentiality","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!129:129","fromKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6e9285a677c02bfecc9c60ee","from":"MS-RULE-AG-09","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM05; LLM08","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!130:130","fromKeys":["MS-RULE-AG-09@2bd07e82a72d4f2e"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6f46b0384bdb519e112defdd","from":"MS-RULE-AG-09","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5 and 25","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!131:131","fromKeys":["MS-RULE-AG-09@2bd07e82a72d4f2e"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d1e03978d05ea00bb56e458b","from":"MS-RULE-AG-10","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM04","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!132:132","fromKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c5563008b3a5463415bada36","from":"MS-RULE-AG-10","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"GV.SC; ID.RA","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!133:133","fromKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8862d6c4af65836fb938c331","from":"MS-RULE-OP-01","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Art. 12","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!134:134","fromKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dfbeadce0be07f0161a42cca","from":"MS-RULE-OP-01","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AU family","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!135:135","fromKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-29162198cb7cc12d300beff2","from":"MS-RULE-OP-01","to":"FW-SOC2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"CC7","publisherUrl":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!136:136","fromKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"toKeys":["FW-SOC2@db7c79c2dbfb20ed","FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-533b9cd76f1bba8ceb4a414c","from":"MS-RULE-OP-02","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Content provenance and source review","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!137:137","fromKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ef03030560630fb0f57b790","from":"MS-RULE-OP-02","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 13 and 50","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!138:138","fromKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9425861657e5b2297d81ae1a","from":"MS-RULE-OP-03","to":"FW-NIST-AI-RMF","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"MEASURE and MANAGE","publisherUrl":"https://www.nist.gov/itl/ai-risk-management-framework","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!139:139","fromKeys":["MS-RULE-OP-03@410599212edc432e"],"toKeys":["FW-NIST-AI-RMF@aba341d53497210b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-82f1d553f207690d96fc4604","from":"MS-RULE-OP-03","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Ongoing monitoring","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!140:140","fromKeys":["MS-RULE-OP-03@410599212edc432e"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-33ebe92046833d0bc8755738","from":"MS-RULE-OP-03","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 9 and 15","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!141:141","fromKeys":["MS-RULE-OP-03@410599212edc432e"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f240a45b05e97e4cdadcc076","from":"MS-RULE-OP-04","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"RS and RC","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!142:142","fromKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c72a888c00d805e3f73b41c4","from":"MS-RULE-OP-04","to":"FW-NIST-AI-RMF","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"MANAGE","publisherUrl":"https://www.nist.gov/itl/ai-risk-management-framework","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!143:143","fromKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"toKeys":["FW-NIST-AI-RMF@aba341d53497210b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-25c3c7ce7ac28ba7e09c410e","from":"MS-RULE-OP-05","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Fail-safe and discontinuation","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!144:144","fromKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e50c1a620552442c0b905406","from":"MS-RULE-OP-05","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Halt systems presenting unacceptable risk","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!145:145","fromKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-898592851b885228f8ab3c48","from":"MS-RULE-OP-05","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Art. 14","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!146:146","fromKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1e08fe24f6fe76d54db8bdec","from":"MS-RULE-OP-06","to":"FW-ISO-5338","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AI system lifecycle","publisherUrl":"https://www.iso.org/standard/81118.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!147:147","fromKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"toKeys":["FW-ISO-5338@5384b7599ab287e8","FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-291afdaf0d886138b8707551","from":"MS-RULE-OP-06","to":"FW-ISO-42005","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Impact reassessment","publisherUrl":"https://www.iso.org/standard/42005","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!148:148","fromKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"toKeys":["FW-ISO-42005@b02139bf544ce4bf"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5eee110f65bf20eeea3281ca","from":"MS-RULE-OP-06","to":"FW-NIST-AI-RMF","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"GOVERN/MANAGE","publisherUrl":"https://www.nist.gov/itl/ai-risk-management-framework","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!149:149","fromKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"toKeys":["FW-NIST-AI-RMF@aba341d53497210b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cb581e30e944b8a8bf0fba0b","from":"MS-RULE-OP-07","to":"FW-NIST-AI-RMF","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Risk treatment and accountability","publisherUrl":"https://www.nist.gov/itl/ai-risk-management-framework","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!150:150","fromKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"toKeys":["FW-NIST-AI-RMF@aba341d53497210b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-531a1db00e012f220ad698b4","from":"MS-RULE-OP-07","to":"FW-NIST-800-53","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"CA-5; risk acceptance context","publisherUrl":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!151:151","fromKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"toKeys":["FW-NIST-800-53@df620e4e08f309b9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f20521ab3c3d6a3c550e7f8f","from":"MS-RULE-OP-08","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Remedies and human review","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!152:152","fromKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-95bcfede761645bd341c2d84","from":"MS-RULE-OP-08","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 13–15 and 22","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!153:153","fromKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-59c5169e908f5fa640572755","from":"MS-RULE-OP-08","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Human oversight/transparency","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!154:154","fromKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9dbcf7a81d2edc7808c485f8","from":"MS-RULE-OP-09","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"ID.AM","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!155:155","fromKeys":["MS-RULE-OP-09@ec587343b8220a51"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-123cc757616c6363eba3f08c","from":"MS-RULE-OP-09","to":"FW-NIST-AI-RMF","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"GOVERN/MAP","publisherUrl":"https://www.nist.gov/itl/ai-risk-management-framework","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!156:156","fromKeys":["MS-RULE-OP-09@ec587343b8220a51"],"toKeys":["FW-NIST-AI-RMF@aba341d53497210b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f2bc85684ddf026e12c362d7","from":"MS-RULE-OP-09","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Annual AI use-case inventory","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!157:157","fromKeys":["MS-RULE-OP-09@ec587343b8220a51"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4d3c52604315c2731e6ba428","from":"MS-RULE-OP-10","to":"FW-OWASP-LLM-2026","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"LLM04","publisherUrl":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!158:158","fromKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"toKeys":["FW-OWASP-LLM-2026@44fda67005e1638f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-69168f4c447953b6eb02df7f","from":"MS-RULE-OP-10","to":"FW-NIST-CSF2","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"GV.SC","publisherUrl":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!159:159","fromKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"toKeys":["FW-NIST-CSF2@e2682aacee87a7d8","FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3e2e19216a46e8e85018995b","from":"MS-RULE-OP-10","to":"FW-OMB-M25-22","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"AI acquisition","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!160:160","fromKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"toKeys":["FW-OMB-M25-22@1dd0effe69b2dd83"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-10311f09038b8f8529d52294","from":"MS-RULE-OP-11","to":"FW-GDPR","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 5 and 17","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!161:161","fromKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"toKeys":["FW-GDPR@ee1443d6c0919bfd","FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-18e55923dedd6c1d99a2f257","from":"MS-RULE-OP-11","to":"FW-ISO-5338","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Lifecycle processes","publisherUrl":"https://www.iso.org/standard/81118.html","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!162:162","fromKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"toKeys":["FW-ISO-5338@5384b7599ab287e8","FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fc7b6bb218049b04ce42481b","from":"MS-RULE-OP-11","to":"FW-NIST-AI-RMF","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"MANAGE","publisherUrl":"https://www.nist.gov/itl/ai-risk-management-framework","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!163:163","fromKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"toKeys":["FW-NIST-AI-RMF@aba341d53497210b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-edca5024a1db68fbfed26ca2","from":"MS-RULE-OP-12","to":"FW-NIST-AI-600-1","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Pre-deployment testing; go/no-go thresholds","publisherUrl":"https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!164:164","fromKeys":["MS-RULE-OP-12@04d0287d10225094"],"toKeys":["FW-NIST-AI-600-1@91e5bc3b14f2a84b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dcb241413ab9fc69835bcf2b","from":"MS-RULE-OP-12","to":"FW-EU-AI-ACT","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Arts. 9 and 15","publisherUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27/eng","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!165:165","fromKeys":["MS-RULE-OP-12@04d0287d10225094"],"toKeys":["FW-EU-AI-ACT@46561a486a4c008b","FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9d9b0d0ed1015b0c06a77eac","from":"MS-RULE-OP-12","to":"FW-OMB-M25-21","kind":"RULE_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedRelationship":"Direct","locator":"Pre-deployment testing and independent review","publisherUrl":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","caveat":"Validate applicability, jurisdiction, role (provider/deployer/user), and exact obligation before asserting compliance.","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'06 Rule Framework Map'!166:166","fromKeys":["MS-RULE-OP-12@04d0287d10225094"],"toKeys":["FW-OMB-M25-21@02c619879520c6e4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f95a6d1f6c54e01098e83813","from":"TAIM-GOVERN-1.1@35b911ad2aa6f0f1","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!5:5","fromKeys":["TAIM-GOVERN-1.1@35b911ad2aa6f0f1"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-25e8b82cf159feb7ce82a2db","from":"TAIM-GOVERN-1.1@35b911ad2aa6f0f1","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!5:5","fromKeys":["TAIM-GOVERN-1.1@35b911ad2aa6f0f1"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-daa48af3bace83f23903d6c8","from":"TAIM-GOVERN-1.3@6129b834f8908bde","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!7:7","fromKeys":["TAIM-GOVERN-1.3@6129b834f8908bde"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6a0bce3590993a0be6888617","from":"TAIM-GOVERN-1.3@6129b834f8908bde","to":"MS-RULE-OP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!7:7","fromKeys":["TAIM-GOVERN-1.3@6129b834f8908bde"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f1d95c46c65f4d5dc884db7f","from":"TAIM-GOVERN-1.4@2cf04928037dcfee","to":"MS-RULE-OU-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!8:8","fromKeys":["TAIM-GOVERN-1.4@2cf04928037dcfee"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7b255933d6158263f5816e52","from":"TAIM-GOVERN-1.4@2cf04928037dcfee","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!8:8","fromKeys":["TAIM-GOVERN-1.4@2cf04928037dcfee"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a7c139494682a8f06bd1d46c","from":"TAIM-GOVERN-1.4@2cf04928037dcfee","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!8:8","fromKeys":["TAIM-GOVERN-1.4@2cf04928037dcfee"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-560be40fc410b03279e3ccb8","from":"TAIM-GOVERN-1.4@2cf04928037dcfee","to":"MS-RULE-OP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!8:8","fromKeys":["TAIM-GOVERN-1.4@2cf04928037dcfee"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a3c2435e6119c067163cae42","from":"TAIM-GOVERN-1.5@92357b32e10b5e02","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!9:9","fromKeys":["TAIM-GOVERN-1.5@92357b32e10b5e02"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9c72ab0bfdc01c9597c12c8f","from":"TAIM-GOVERN-1.5@92357b32e10b5e02","to":"MS-RULE-AU-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!9:9","fromKeys":["TAIM-GOVERN-1.5@92357b32e10b5e02"],"toKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-020f2d302c36edae2f759597","from":"TAIM-GOVERN-1.6@382c72c8bff29604","to":"MS-RULE-OP-09","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!10:10","fromKeys":["TAIM-GOVERN-1.6@382c72c8bff29604"],"toKeys":["MS-RULE-OP-09@ec587343b8220a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-26076f83e465a8a4f5fbd0c9","from":"TAIM-GOVERN-1.6@382c72c8bff29604","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!10:10","fromKeys":["TAIM-GOVERN-1.6@382c72c8bff29604"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3f4079b4e29370af21aa06da","from":"TAIM-GOVERN-1.6@382c72c8bff29604","to":"MS-RULE-OP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!10:10","fromKeys":["TAIM-GOVERN-1.6@382c72c8bff29604"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eef61672cd7c52968c77bcd7","from":"TAIM-GOVERN-1.7@198eee5654f91ae3","to":"MS-RULE-OP-11","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!11:11","fromKeys":["TAIM-GOVERN-1.7@198eee5654f91ae3"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b26505b32b3679bff5dfc238","from":"TAIM-GOVERN-1.7@198eee5654f91ae3","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!11:11","fromKeys":["TAIM-GOVERN-1.7@198eee5654f91ae3"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f82cc7e0faf7d953e87a6e47","from":"TAIM-GOVERN-2.1@198893140402361c","to":"MS-RULE-AU-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!12:12","fromKeys":["TAIM-GOVERN-2.1@198893140402361c"],"toKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1aa460ab3cb82f0adcb22e55","from":"TAIM-GOVERN-2.1@198893140402361c","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!12:12","fromKeys":["TAIM-GOVERN-2.1@198893140402361c"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eb15ea08b818cd2fcc24e868","from":"TAIM-GOVERN-2.1@198893140402361c","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!12:12","fromKeys":["TAIM-GOVERN-2.1@198893140402361c"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eb890b0bde713303df9caed8","from":"TAIM-GOVERN-2.2@9b46d32788988ef2","to":"MS-RULE-AU-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!13:13","fromKeys":["TAIM-GOVERN-2.2@9b46d32788988ef2"],"toKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c6db9af8df8aabfe9180086c","from":"TAIM-GOVERN-2.3@e28fde83a8cc90e1","to":"MS-RULE-AU-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!14:14","fromKeys":["TAIM-GOVERN-2.3@e28fde83a8cc90e1"],"toKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8e84d693e55cd892d036cca5","from":"TAIM-GOVERN-3.1@2427dcd86ebd4f7b","to":"MS-RULE-OP-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!15:15","fromKeys":["TAIM-GOVERN-3.1@2427dcd86ebd4f7b"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-390400f018002d89661b1497","from":"TAIM-GOVERN-3.2@9c41c08d8d6c9ac6","to":"MS-RULE-AU-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!16:16","fromKeys":["TAIM-GOVERN-3.2@9c41c08d8d6c9ac6"],"toKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cb3455ea7609a35ab0f436fb","from":"TAIM-GOVERN-4.2@c1e4d61854eedbe8","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!18:18","fromKeys":["TAIM-GOVERN-4.2@c1e4d61854eedbe8"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e1ff6a60304d80f0db611bb7","from":"TAIM-GOVERN-4.2@c1e4d61854eedbe8","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!18:18","fromKeys":["TAIM-GOVERN-4.2@c1e4d61854eedbe8"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-99a10134d43c4d69ff6e8601","from":"TAIM-GOVERN-4.2@c1e4d61854eedbe8","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!18:18","fromKeys":["TAIM-GOVERN-4.2@c1e4d61854eedbe8"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aed887d796871edc6f3ace83","from":"TAIM-GOVERN-4.2@c1e4d61854eedbe8","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!18:18","fromKeys":["TAIM-GOVERN-4.2@c1e4d61854eedbe8"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9e788070666b980d74d7d231","from":"TAIM-GOVERN-4.3@6c63b10d0830b670","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!19:19","fromKeys":["TAIM-GOVERN-4.3@6c63b10d0830b670"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9933f01529ec2a62fbfceaf5","from":"TAIM-GOVERN-4.3@6c63b10d0830b670","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!19:19","fromKeys":["TAIM-GOVERN-4.3@6c63b10d0830b670"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b2670e6cb38a800c1d2e216f","from":"TAIM-GOVERN-4.3@6c63b10d0830b670","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!19:19","fromKeys":["TAIM-GOVERN-4.3@6c63b10d0830b670"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-311d69564298bd1863760392","from":"TAIM-GOVERN-4.3@6c63b10d0830b670","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!19:19","fromKeys":["TAIM-GOVERN-4.3@6c63b10d0830b670"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-941901bf7f57e5f3c2ad96fa","from":"TAIM-GOVERN-5.1@68f585618af89993","to":"MS-RULE-OP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!20:20","fromKeys":["TAIM-GOVERN-5.1@68f585618af89993"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-af7e0827425c32556a33a9f6","from":"TAIM-GOVERN-5.2@fe8607850f8d2ca6","to":"MS-RULE-OP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!21:21","fromKeys":["TAIM-GOVERN-5.2@fe8607850f8d2ca6"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5b18126436f36908c168aeeb","from":"TAIM-GOVERN-6.1@b8216e0b6ff98607","to":"MS-RULE-OP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!22:22","fromKeys":["TAIM-GOVERN-6.1@b8216e0b6ff98607"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ebab1538803a600d43853e95","from":"TAIM-GOVERN-6.1@b8216e0b6ff98607","to":"MS-RULE-AG-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!22:22","fromKeys":["TAIM-GOVERN-6.1@b8216e0b6ff98607"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-28046a6beba2f2549aa70937","from":"TAIM-GOVERN-6.2@054b3cd3c85b2f5d","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!23:23","fromKeys":["TAIM-GOVERN-6.2@054b3cd3c85b2f5d"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bd6fa36373a4e21ed5099a3b","from":"TAIM-GOVERN-6.2@054b3cd3c85b2f5d","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!23:23","fromKeys":["TAIM-GOVERN-6.2@054b3cd3c85b2f5d"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6a93c2f95099cd7f380240f9","from":"TAIM-GOVERN-6.2@054b3cd3c85b2f5d","to":"MS-RULE-OP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!23:23","fromKeys":["TAIM-GOVERN-6.2@054b3cd3c85b2f5d"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0d9bdad2d2b32e75a2336d22","from":"TAIM-GOVERN-6.2@054b3cd3c85b2f5d","to":"MS-RULE-AG-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!23:23","fromKeys":["TAIM-GOVERN-6.2@054b3cd3c85b2f5d"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dad54f3cb420a4af076fbc1e","from":"TAIM-MAP-1.1@f7aec3e0fde77d65","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!24:24","fromKeys":["TAIM-MAP-1.1@f7aec3e0fde77d65"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7423b0ddfdadc50027c48240","from":"TAIM-MAP-1.1@f7aec3e0fde77d65","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!24:24","fromKeys":["TAIM-MAP-1.1@f7aec3e0fde77d65"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-315e17ecf4f50b517d912540","from":"TAIM-MAP-1.1@f7aec3e0fde77d65","to":"MS-RULE-OP-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!24:24","fromKeys":["TAIM-MAP-1.1@f7aec3e0fde77d65"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-367bd00c1b21ff7422a8aa97","from":"TAIM-MAP-1.1@f7aec3e0fde77d65","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!24:24","fromKeys":["TAIM-MAP-1.1@f7aec3e0fde77d65"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a40f621004103041d32a6db9","from":"TAIM-MAP-1.1@f7aec3e0fde77d65","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!24:24","fromKeys":["TAIM-MAP-1.1@f7aec3e0fde77d65"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b62e109897c1591a7929e4a9","from":"TAIM-MAP-1.2@93024a692d8324ff","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!25:25","fromKeys":["TAIM-MAP-1.2@93024a692d8324ff"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-22dbb30f05725783ac5b55f5","from":"TAIM-MAP-1.2@93024a692d8324ff","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!25:25","fromKeys":["TAIM-MAP-1.2@93024a692d8324ff"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cd8a5d0abc218e43ecf7f154","from":"TAIM-MAP-1.3@405b97af733bc900","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!26:26","fromKeys":["TAIM-MAP-1.3@405b97af733bc900"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cf4fe4fe66a83a7e8b62c242","from":"TAIM-MAP-1.3@405b97af733bc900","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!26:26","fromKeys":["TAIM-MAP-1.3@405b97af733bc900"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a841e4565b4105619716e225","from":"TAIM-MAP-1.4@867a4ceeddb4119d","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!27:27","fromKeys":["TAIM-MAP-1.4@867a4ceeddb4119d"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d764be869d6c18387f266354","from":"TAIM-MAP-1.4@867a4ceeddb4119d","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!27:27","fromKeys":["TAIM-MAP-1.4@867a4ceeddb4119d"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-21f0011b6f7b6799e374c1ad","from":"TAIM-MAP-1.5@7b28c9d1495f3a89","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!28:28","fromKeys":["TAIM-MAP-1.5@7b28c9d1495f3a89"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9d1d9869158720c7f92194e0","from":"TAIM-MAP-1.5@7b28c9d1495f3a89","to":"MS-RULE-OP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!28:28","fromKeys":["TAIM-MAP-1.5@7b28c9d1495f3a89"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d2bbfa8f2a3936b31fa7ffed","from":"TAIM-MAP-1.5@7b28c9d1495f3a89","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!28:28","fromKeys":["TAIM-MAP-1.5@7b28c9d1495f3a89"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-977c8a3265b179c4f9834899","from":"TAIM-MAP-1.5@7b28c9d1495f3a89","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!28:28","fromKeys":["TAIM-MAP-1.5@7b28c9d1495f3a89"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4e3fd5d8447afc684daf5242","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f26849307f81f3408b373201","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f80ac29308682b00a844ba41","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-09","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-41b32f74f74199b83f437dd6","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de3373a187acc541739c041d","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-11","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e5b73393793d05a67117fb7b","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8fea3465e45f9f9ce8e2b366","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-13","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-13@1299bbf89c50bd1a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6e80bfad6dccdd59b9fd3faf","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-14","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-17558713790971cd7040d7ae","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-15","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-838ba7d9710c6a6827574941","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-16","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4500ecd4302f55ee83f4899d","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-17","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e32525801c73182736a4c5ea","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-DP-18","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a66a674da1f6997b946f3a9f","from":"TAIM-MAP-1.6@0ca81605dd8ee088","to":"MS-RULE-OU-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!29:29","fromKeys":["TAIM-MAP-1.6@0ca81605dd8ee088"],"toKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-082f69e52f0c4f59525b3586","from":"TAIM-MAP-2.2@c9b1594e914d9478","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!31:31","fromKeys":["TAIM-MAP-2.2@c9b1594e914d9478"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-69b52d391f266a88c29fa4da","from":"TAIM-MAP-2.2@c9b1594e914d9478","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!31:31","fromKeys":["TAIM-MAP-2.2@c9b1594e914d9478"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-158c45cc40aa667d878291de","from":"TAIM-MAP-2.3@98b8065b9500c2b5","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!32:32","fromKeys":["TAIM-MAP-2.3@98b8065b9500c2b5"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8bd8dd4b24003c37d2d7c830","from":"TAIM-MAP-2.3@98b8065b9500c2b5","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!32:32","fromKeys":["TAIM-MAP-2.3@98b8065b9500c2b5"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bc869b8e5abb24c0c8af0934","from":"TAIM-MAP-2.3@98b8065b9500c2b5","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!32:32","fromKeys":["TAIM-MAP-2.3@98b8065b9500c2b5"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-699fad2e2420df316fce4d28","from":"TAIM-MAP-2.3@98b8065b9500c2b5","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!32:32","fromKeys":["TAIM-MAP-2.3@98b8065b9500c2b5"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0dec9f668ad6adc5698f7548","from":"TAIM-MAP-3.1@5aadf0f832148043","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!33:33","fromKeys":["TAIM-MAP-3.1@5aadf0f832148043"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-60542b1eb1f56733c0630632","from":"TAIM-MAP-3.1@5aadf0f832148043","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!33:33","fromKeys":["TAIM-MAP-3.1@5aadf0f832148043"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8202078ae5724471de1f80f1","from":"TAIM-MAP-3.1@5aadf0f832148043","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!33:33","fromKeys":["TAIM-MAP-3.1@5aadf0f832148043"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d98476dd019a3a704306d184","from":"TAIM-MAP-3.1@5aadf0f832148043","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!33:33","fromKeys":["TAIM-MAP-3.1@5aadf0f832148043"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d3b424f1cb0294a1afd4d1c8","from":"TAIM-MAP-3.2@68f17d5dab909a30","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!34:34","fromKeys":["TAIM-MAP-3.2@68f17d5dab909a30"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c7c8702645612cf1bae96744","from":"TAIM-MAP-3.2@68f17d5dab909a30","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!34:34","fromKeys":["TAIM-MAP-3.2@68f17d5dab909a30"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-44fb8f132c37ebb4cad85f4a","from":"TAIM-MAP-3.2@68f17d5dab909a30","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!34:34","fromKeys":["TAIM-MAP-3.2@68f17d5dab909a30"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-17c876c3d9dd89a5f9738835","from":"TAIM-MAP-3.2@68f17d5dab909a30","to":"MS-RULE-OP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!34:34","fromKeys":["TAIM-MAP-3.2@68f17d5dab909a30"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-37ae533454a71ac6e60902df","from":"TAIM-MAP-3.2@68f17d5dab909a30","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!34:34","fromKeys":["TAIM-MAP-3.2@68f17d5dab909a30"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0e2d69845f5780158526172f","from":"TAIM-MAP-3.3@2dcbe4ab43aa4492","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!35:35","fromKeys":["TAIM-MAP-3.3@2dcbe4ab43aa4492"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-07c8986c29ce77e9bd560d96","from":"TAIM-MAP-3.3@2dcbe4ab43aa4492","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!35:35","fromKeys":["TAIM-MAP-3.3@2dcbe4ab43aa4492"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9fa107fbf9b8eae8f0797384","from":"TAIM-MAP-3.4@e310d1f6e2a1ea35","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!36:36","fromKeys":["TAIM-MAP-3.4@e310d1f6e2a1ea35"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-35bc4d856ef7a7ce455b6d86","from":"TAIM-MAP-3.4@e310d1f6e2a1ea35","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!36:36","fromKeys":["TAIM-MAP-3.4@e310d1f6e2a1ea35"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-89543f84a0488b4eae24b507","from":"TAIM-MAP-3.4@e310d1f6e2a1ea35","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!36:36","fromKeys":["TAIM-MAP-3.4@e310d1f6e2a1ea35"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8c1bc28791b59585a017ab23","from":"TAIM-MAP-3.4@e310d1f6e2a1ea35","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!36:36","fromKeys":["TAIM-MAP-3.4@e310d1f6e2a1ea35"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1b45c0861d521f9aed43dee4","from":"TAIM-MAP-3.5@03aad24c9f287fab","to":"MS-RULE-OU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!37:37","fromKeys":["TAIM-MAP-3.5@03aad24c9f287fab"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9fe8483c85f274f722fb6476","from":"TAIM-MAP-3.5@03aad24c9f287fab","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!37:37","fromKeys":["TAIM-MAP-3.5@03aad24c9f287fab"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-15165f8ce7c10969e18b7d58","from":"TAIM-MAP-3.5@03aad24c9f287fab","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!37:37","fromKeys":["TAIM-MAP-3.5@03aad24c9f287fab"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-76e47c7c865dcbecd654b80b","from":"TAIM-MAP-3.5@03aad24c9f287fab","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!37:37","fromKeys":["TAIM-MAP-3.5@03aad24c9f287fab"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0f5bab727286cc02106e775b","from":"TAIM-MAP-4.1@47a77b8622793a72","to":"MS-RULE-OP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!38:38","fromKeys":["TAIM-MAP-4.1@47a77b8622793a72"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0f3740bc1d571e2a376fc40d","from":"TAIM-MAP-4.1@47a77b8622793a72","to":"MS-RULE-AG-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!38:38","fromKeys":["TAIM-MAP-4.1@47a77b8622793a72"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ee8132da4d70a522732d6bdf","from":"TAIM-MAP-4.1@47a77b8622793a72","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!38:38","fromKeys":["TAIM-MAP-4.1@47a77b8622793a72"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-257a5c61c39fcc31832213f8","from":"TAIM-MAP-4.1@47a77b8622793a72","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!38:38","fromKeys":["TAIM-MAP-4.1@47a77b8622793a72"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-94e8af317e92b12ba97f881e","from":"TAIM-MAP-4.2@ba7614350b99a7d0","to":"MS-RULE-OP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!39:39","fromKeys":["TAIM-MAP-4.2@ba7614350b99a7d0"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4bff5a18a6cca12a3690835c","from":"TAIM-MAP-4.2@ba7614350b99a7d0","to":"MS-RULE-AG-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!39:39","fromKeys":["TAIM-MAP-4.2@ba7614350b99a7d0"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c58f0da2be33456505ebeb63","from":"TAIM-MAP-4.2@ba7614350b99a7d0","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!39:39","fromKeys":["TAIM-MAP-4.2@ba7614350b99a7d0"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d30adcc8932c8aab8bb5bac2","from":"TAIM-MAP-4.2@ba7614350b99a7d0","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!39:39","fromKeys":["TAIM-MAP-4.2@ba7614350b99a7d0"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cbf4e1ce3b9b3cf68b1d11c4","from":"TAIM-MAP-5.1@4170d53e4eea6a66","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!40:40","fromKeys":["TAIM-MAP-5.1@4170d53e4eea6a66"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c205db1d8f42a8fd04d5bdbd","from":"TAIM-MAP-5.1@4170d53e4eea6a66","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!40:40","fromKeys":["TAIM-MAP-5.1@4170d53e4eea6a66"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ed40260fb58134650f5a9f6c","from":"TAIM-MAP-5.1@4170d53e4eea6a66","to":"MS-RULE-OP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!40:40","fromKeys":["TAIM-MAP-5.1@4170d53e4eea6a66"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-826b4acc836ce39fd79b1124","from":"TAIM-MAP-5.1@4170d53e4eea6a66","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!40:40","fromKeys":["TAIM-MAP-5.1@4170d53e4eea6a66"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0c4a108cb2c3c549a779421e","from":"TAIM-MAP-5.1@4170d53e4eea6a66","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!40:40","fromKeys":["TAIM-MAP-5.1@4170d53e4eea6a66"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d40b452f1c369b9429737893","from":"TAIM-MAP-5.2@4fe1fea3a40c08e0","to":"MS-RULE-OP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!41:41","fromKeys":["TAIM-MAP-5.2@4fe1fea3a40c08e0"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fc2d52c84433f15e5fe253e4","from":"TAIM-MAP-5.2@4fe1fea3a40c08e0","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!41:41","fromKeys":["TAIM-MAP-5.2@4fe1fea3a40c08e0"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-acaa5fb45adafe8927784e31","from":"TAIM-MAP-5.2@4fe1fea3a40c08e0","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!41:41","fromKeys":["TAIM-MAP-5.2@4fe1fea3a40c08e0"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a118f3982fd8fd149da2d84d","from":"TAIM-MEASURE-1.1@80d658f30e1d4e80","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!42:42","fromKeys":["TAIM-MEASURE-1.1@80d658f30e1d4e80"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e8dda0f3bb492273a28dca1c","from":"TAIM-MEASURE-1.1@80d658f30e1d4e80","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!42:42","fromKeys":["TAIM-MEASURE-1.1@80d658f30e1d4e80"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-32aa826c72657c52d43ac078","from":"TAIM-MEASURE-1.1@80d658f30e1d4e80","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!42:42","fromKeys":["TAIM-MEASURE-1.1@80d658f30e1d4e80"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-48368c6d1eaa291326856343","from":"TAIM-MEASURE-1.2@b5c24007b17017b3","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!43:43","fromKeys":["TAIM-MEASURE-1.2@b5c24007b17017b3"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-25ff6ef121038b0b5ceea485","from":"TAIM-MEASURE-1.2@b5c24007b17017b3","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!43:43","fromKeys":["TAIM-MEASURE-1.2@b5c24007b17017b3"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-44a9849703a5a9ac174379ce","from":"TAIM-MEASURE-1.2@b5c24007b17017b3","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!43:43","fromKeys":["TAIM-MEASURE-1.2@b5c24007b17017b3"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-78fc2ceb7de5610140411f67","from":"TAIM-MEASURE-1.2@b5c24007b17017b3","to":"MS-RULE-OP-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!43:43","fromKeys":["TAIM-MEASURE-1.2@b5c24007b17017b3"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3130c1aa5007ef47bda05e8f","from":"TAIM-MEASURE-1.3@438e7613521eceac","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!44:44","fromKeys":["TAIM-MEASURE-1.3@438e7613521eceac"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ebb7d50d41a8073011b0fc7d","from":"TAIM-MEASURE-1.3@438e7613521eceac","to":"MS-RULE-OP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!44:44","fromKeys":["TAIM-MEASURE-1.3@438e7613521eceac"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-14e869d02858d3208034c9c8","from":"TAIM-MEASURE-1.3@438e7613521eceac","to":"MS-RULE-OP-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!44:44","fromKeys":["TAIM-MEASURE-1.3@438e7613521eceac"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c4a7ce44e9b3e9711f120f9c","from":"TAIM-MEASURE-2.1@bfec014736abe868","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!45:45","fromKeys":["TAIM-MEASURE-2.1@bfec014736abe868"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3bd2116706fbd1503a39cf5d","from":"TAIM-MEASURE-2.1@bfec014736abe868","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!45:45","fromKeys":["TAIM-MEASURE-2.1@bfec014736abe868"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f689e3d925c4b56be7f6bd7b","from":"TAIM-MEASURE-2.1@bfec014736abe868","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!45:45","fromKeys":["TAIM-MEASURE-2.1@bfec014736abe868"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3b87468454e05b00dab24580","from":"TAIM-MEASURE-2.1@bfec014736abe868","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!45:45","fromKeys":["TAIM-MEASURE-2.1@bfec014736abe868"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-30d7ef25801d895156bdde83","from":"TAIM-MEASURE-2.2@f1b91c01b8b926be","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!46:46","fromKeys":["TAIM-MEASURE-2.2@f1b91c01b8b926be"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f73cc369e9355b307047104b","from":"TAIM-MEASURE-2.2@f1b91c01b8b926be","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!46:46","fromKeys":["TAIM-MEASURE-2.2@f1b91c01b8b926be"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d4150b63cb02eece8356e353","from":"TAIM-MEASURE-2.3@f396bee25387e21c","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!47:47","fromKeys":["TAIM-MEASURE-2.3@f396bee25387e21c"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c7d8b095a629729191b28fff","from":"TAIM-MEASURE-2.3@f396bee25387e21c","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!47:47","fromKeys":["TAIM-MEASURE-2.3@f396bee25387e21c"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dc912e481000207a587804b7","from":"TAIM-MEASURE-2.3@f396bee25387e21c","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!47:47","fromKeys":["TAIM-MEASURE-2.3@f396bee25387e21c"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-204a0dc0ac418b875c11293f","from":"TAIM-MEASURE-2.3@f396bee25387e21c","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!47:47","fromKeys":["TAIM-MEASURE-2.3@f396bee25387e21c"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e9f950e66d9042c807617c4c","from":"TAIM-MEASURE-2.4@30416b6b4c6068dd","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!48:48","fromKeys":["TAIM-MEASURE-2.4@30416b6b4c6068dd"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e6b8c3a118258caaefb9fe61","from":"TAIM-MEASURE-2.5@f17bf250e010d494","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!49:49","fromKeys":["TAIM-MEASURE-2.5@f17bf250e010d494"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2d8ac6883b3a5d2e608443ec","from":"TAIM-MEASURE-2.5@f17bf250e010d494","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!49:49","fromKeys":["TAIM-MEASURE-2.5@f17bf250e010d494"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b25f2a39231feb1c9565989e","from":"TAIM-MEASURE-2.5@f17bf250e010d494","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!49:49","fromKeys":["TAIM-MEASURE-2.5@f17bf250e010d494"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d28f04513b7700ec405752a4","from":"TAIM-MEASURE-2.5@f17bf250e010d494","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!49:49","fromKeys":["TAIM-MEASURE-2.5@f17bf250e010d494"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9c4061d263f1f5c38b81b7b4","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d312a769e941481cb335207f","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-IN-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-IN-01@e4fe11be1a20f12f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fea69f6b9a3f68b5d8d598c9","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-IN-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-IN-02@dbb47a84e8a96c05"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-98e041f96c1d6e1b7f0f09aa","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-IN-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1926956bd4d4dc3a993af110","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-IN-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-IN-04@40341d186f0bd606"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-23a2dfe27658b0d060d63b70","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-IN-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-11547e51bdfefab80e5fa766","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-IN-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-IN-06@478a04da335c1e7f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-32ece8e6da4f319b9f068d35","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c8afe7773f86b01b8cceaf62","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-416278419f04395e4df38b01","from":"TAIM-MEASURE-2.6@6c6a748c4eb801b3","to":"MS-RULE-OP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!50:50","fromKeys":["TAIM-MEASURE-2.6@6c6a748c4eb801b3"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f29e846caf5dee602b30192e","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-IN-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-IN-01@e4fe11be1a20f12f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f04ab34ccabd412928dfaf16","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-IN-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-IN-02@dbb47a84e8a96c05"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c6efd85dfbbe33912b1b8174","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-IN-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8323ac0c498bce194d22d49b","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-IN-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-IN-04@40341d186f0bd606"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fbb6c73f32ca8897c26a1966","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-IN-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9db98db0c773feb978e5dedf","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-IN-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-IN-06@478a04da335c1e7f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5b778314df8246e5e78a9ae2","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-603fb570a4a552217ea9a43a","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-20823f1c9a886033fbad7932","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-01ce661280a12551c8b84dfd","from":"TAIM-MEASURE-2.7@4fefc7d979469953","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!51:51","fromKeys":["TAIM-MEASURE-2.7@4fefc7d979469953"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1f96fde06ecb8d1e405a069e","from":"TAIM-MEASURE-2.8@927b0554749a76e0","to":"MS-RULE-OU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!52:52","fromKeys":["TAIM-MEASURE-2.8@927b0554749a76e0"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dbb77187e65e348b663ad815","from":"TAIM-MEASURE-2.8@927b0554749a76e0","to":"MS-RULE-AU-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!52:52","fromKeys":["TAIM-MEASURE-2.8@927b0554749a76e0"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c4bfbecd22d98ae35bd2a9f7","from":"TAIM-MEASURE-2.8@927b0554749a76e0","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!52:52","fromKeys":["TAIM-MEASURE-2.8@927b0554749a76e0"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-138f2f1d79fa42622caf1291","from":"TAIM-MEASURE-2.8@927b0554749a76e0","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!52:52","fromKeys":["TAIM-MEASURE-2.8@927b0554749a76e0"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cd888a32d4e1b3d0279fc589","from":"TAIM-MEASURE-2.9@3e99c99461743bec","to":"MS-RULE-OU-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!53:53","fromKeys":["TAIM-MEASURE-2.9@3e99c99461743bec"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-484dc00133f27858acc7344b","from":"TAIM-MEASURE-2.9@3e99c99461743bec","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!53:53","fromKeys":["TAIM-MEASURE-2.9@3e99c99461743bec"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4bbeef2655b1a59cde823a50","from":"TAIM-MEASURE-2.9@3e99c99461743bec","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!53:53","fromKeys":["TAIM-MEASURE-2.9@3e99c99461743bec"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f492ff4e6729b3911f2d2b3a","from":"TAIM-MEASURE-2.9@3e99c99461743bec","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!53:53","fromKeys":["TAIM-MEASURE-2.9@3e99c99461743bec"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-56d1eeebca04ac761fb32377","from":"TAIM-MEASURE-2.9@3e99c99461743bec","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!53:53","fromKeys":["TAIM-MEASURE-2.9@3e99c99461743bec"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-09ca19f114f34372eff9d535","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-07","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-16e4286579eae03325c0a209","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9f9e69569ffa549e004e81ec","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-09","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-007dee51bcabf0230c07b7b9","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7fa714b2f2c6529730ac6b28","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-11","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c1a3f11b5c2d57d5a7725e85","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1b8fabc9fc176cfea5f152f8","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-13","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-13@1299bbf89c50bd1a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c08e08de541107b21bcd43ad","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-14","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bff8486d33a5d9cfb08bb977","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-15","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-14be91960d14f5afb447af05","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-16","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c5503e63f5aa2b52a41ebc4b","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-17","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dd927251a701bd131aa93fec","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-DP-18","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ca372778583f6c387f782503","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-OU-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-38088a88321b67f63a765659","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ec7829cae561e64c69313999","from":"TAIM-MEASURE-2.10@6df5b5c790a49492","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!54:54","fromKeys":["TAIM-MEASURE-2.10@6df5b5c790a49492"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0e845da3cc0e361187119bc9","from":"TAIM-MEASURE-2.11@69c078796341cd3b","to":"MS-RULE-OU-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!55:55","fromKeys":["TAIM-MEASURE-2.11@69c078796341cd3b"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3b80b7566514ff373d5b1fff","from":"TAIM-MEASURE-2.11@69c078796341cd3b","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!55:55","fromKeys":["TAIM-MEASURE-2.11@69c078796341cd3b"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f7bfc888a0bd73d559a446c3","from":"TAIM-MEASURE-2.11@69c078796341cd3b","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!55:55","fromKeys":["TAIM-MEASURE-2.11@69c078796341cd3b"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9af67995f4c8344ad38db4e6","from":"TAIM-MEASURE-2.11@69c078796341cd3b","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!55:55","fromKeys":["TAIM-MEASURE-2.11@69c078796341cd3b"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-929c7ffd0f9842dabe7ec33c","from":"TAIM-MEASURE-2.11@69c078796341cd3b","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!55:55","fromKeys":["TAIM-MEASURE-2.11@69c078796341cd3b"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-646fe8a2a11a35fe72af019c","from":"TAIM-MEASURE-2.12@12d74b82b770347a","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!56:56","fromKeys":["TAIM-MEASURE-2.12@12d74b82b770347a"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f91a19a6e7a77499e0821fab","from":"TAIM-MEASURE-2.12@12d74b82b770347a","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!56:56","fromKeys":["TAIM-MEASURE-2.12@12d74b82b770347a"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-584055d58f72aefe1ad9cf30","from":"TAIM-MEASURE-2.13@12d2da14f2779af3","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!57:57","fromKeys":["TAIM-MEASURE-2.13@12d2da14f2779af3"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1d4975a6696e517e1472239a","from":"TAIM-MEASURE-2.13@12d2da14f2779af3","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!57:57","fromKeys":["TAIM-MEASURE-2.13@12d2da14f2779af3"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5718b1a71c604604ab41f80f","from":"TAIM-MEASURE-2.13@12d2da14f2779af3","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!57:57","fromKeys":["TAIM-MEASURE-2.13@12d2da14f2779af3"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-52c96dd83861fb55661a3c31","from":"TAIM-MEASURE-2.13@12d2da14f2779af3","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!57:57","fromKeys":["TAIM-MEASURE-2.13@12d2da14f2779af3"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-55088bb254e160a22c64662d","from":"TAIM-MEASURE-3.1@6a9415a16f00ace2","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!58:58","fromKeys":["TAIM-MEASURE-3.1@6a9415a16f00ace2"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2bd69a4c8343df2974b98c3f","from":"TAIM-MEASURE-3.1@6a9415a16f00ace2","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!58:58","fromKeys":["TAIM-MEASURE-3.1@6a9415a16f00ace2"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fa25228e4c0566d7d051f6b6","from":"TAIM-MEASURE-3.1@6a9415a16f00ace2","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!58:58","fromKeys":["TAIM-MEASURE-3.1@6a9415a16f00ace2"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-80e4b07d6bdc4e8f8cef6ebd","from":"TAIM-MEASURE-3.1@6a9415a16f00ace2","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!58:58","fromKeys":["TAIM-MEASURE-3.1@6a9415a16f00ace2"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6b6f67b5ac90963c0b640fee","from":"TAIM-MEASURE-3.2@0a3eca3853caf2e2","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!59:59","fromKeys":["TAIM-MEASURE-3.2@0a3eca3853caf2e2"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-30237169ddd510ef8b2ef7dd","from":"TAIM-MEASURE-3.3@6a5560394079e008","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!60:60","fromKeys":["TAIM-MEASURE-3.3@6a5560394079e008"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-39c11d6c14ba3453970c4001","from":"TAIM-MEASURE-3.3@6a5560394079e008","to":"MS-RULE-OP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!60:60","fromKeys":["TAIM-MEASURE-3.3@6a5560394079e008"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-117011a5cbac011a37e32c0d","from":"TAIM-MEASURE-3.3@6a5560394079e008","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!60:60","fromKeys":["TAIM-MEASURE-3.3@6a5560394079e008"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-25c48762f469e095be75bf78","from":"TAIM-MEASURE-4.1@87efb87b60ce14d1","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!61:61","fromKeys":["TAIM-MEASURE-4.1@87efb87b60ce14d1"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-52d41a7313bd88748a522178","from":"TAIM-MEASURE-4.1@87efb87b60ce14d1","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!61:61","fromKeys":["TAIM-MEASURE-4.1@87efb87b60ce14d1"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-25474fdca9a0bec0a1a2a3de","from":"TAIM-MEASURE-4.2@441148e8e1148dbe","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!62:62","fromKeys":["TAIM-MEASURE-4.2@441148e8e1148dbe"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9dab3c5f4540daeb3289a7f0","from":"TAIM-MEASURE-4.2@441148e8e1148dbe","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!62:62","fromKeys":["TAIM-MEASURE-4.2@441148e8e1148dbe"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a1d4bee02721a75bd62d13d0","from":"TAIM-MEASURE-4.2@441148e8e1148dbe","to":"MS-RULE-OP-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!62:62","fromKeys":["TAIM-MEASURE-4.2@441148e8e1148dbe"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6caa22e1a2cc4194cd2d56a6","from":"TAIM-MEASURE-4.2@441148e8e1148dbe","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!62:62","fromKeys":["TAIM-MEASURE-4.2@441148e8e1148dbe"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fb72fd288a2dcb98578ea833","from":"TAIM-MEASURE-4.2@441148e8e1148dbe","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!62:62","fromKeys":["TAIM-MEASURE-4.2@441148e8e1148dbe"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f83c057b73bbfe19f47fb98a","from":"TAIM-MEASURE-4.3@759303d11da3ea95","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!63:63","fromKeys":["TAIM-MEASURE-4.3@759303d11da3ea95"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-91cb1a077aa66f21d3578115","from":"TAIM-MEASURE-4.3@759303d11da3ea95","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!63:63","fromKeys":["TAIM-MEASURE-4.3@759303d11da3ea95"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b336f88cd32720310fda8c5e","from":"TAIM-MEASURE-4.3@759303d11da3ea95","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!63:63","fromKeys":["TAIM-MEASURE-4.3@759303d11da3ea95"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4af6a6d1a663a67769d73312","from":"TAIM-MEASURE-4.3@759303d11da3ea95","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!63:63","fromKeys":["TAIM-MEASURE-4.3@759303d11da3ea95"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-109ab8e2d04e4bac72668464","from":"TAIM-MANAGE-1.2@725fe00a61b98e10","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!65:65","fromKeys":["TAIM-MANAGE-1.2@725fe00a61b98e10"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3cf02eacfa83f1d03223c68a","from":"TAIM-MANAGE-1.2@725fe00a61b98e10","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!65:65","fromKeys":["TAIM-MANAGE-1.2@725fe00a61b98e10"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ab6c234e3a310e8699800f12","from":"TAIM-MANAGE-1.3@113dba8419d60368","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!66:66","fromKeys":["TAIM-MANAGE-1.3@113dba8419d60368"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-adea4036a2bb4b92c560860d","from":"TAIM-MANAGE-1.3@113dba8419d60368","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!66:66","fromKeys":["TAIM-MANAGE-1.3@113dba8419d60368"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d7b2c2958c8fbb809c410c06","from":"TAIM-MANAGE-1.4@706dd15eb7c4daeb","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!67:67","fromKeys":["TAIM-MANAGE-1.4@706dd15eb7c4daeb"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b890dd5f3f3386d28670e261","from":"TAIM-MANAGE-1.4@706dd15eb7c4daeb","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!67:67","fromKeys":["TAIM-MANAGE-1.4@706dd15eb7c4daeb"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-573d2c93165af8a7f667a5a8","from":"TAIM-MANAGE-2.3@f69713d6045063b5","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!70:70","fromKeys":["TAIM-MANAGE-2.3@f69713d6045063b5"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2f8a966edb2c81689f322f60","from":"TAIM-MANAGE-2.3@f69713d6045063b5","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!70:70","fromKeys":["TAIM-MANAGE-2.3@f69713d6045063b5"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a4d5fbd7c55e9e01c9609c23","from":"TAIM-MANAGE-2.4@4c58d159afdc4362","to":"MS-RULE-OP-11","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!71:71","fromKeys":["TAIM-MANAGE-2.4@4c58d159afdc4362"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-493cd9ee5cd3ced884415357","from":"TAIM-MANAGE-2.4@4c58d159afdc4362","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!71:71","fromKeys":["TAIM-MANAGE-2.4@4c58d159afdc4362"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7d8eace843086a58f4150aad","from":"TAIM-MANAGE-2.4@4c58d159afdc4362","to":"MS-RULE-OP-12","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!71:71","fromKeys":["TAIM-MANAGE-2.4@4c58d159afdc4362"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aac4d31b5634b54b5951719a","from":"TAIM-MANAGE-2.4@4c58d159afdc4362","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!71:71","fromKeys":["TAIM-MANAGE-2.4@4c58d159afdc4362"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0267895fca2aeb41376069dd","from":"TAIM-MANAGE-2.4@4c58d159afdc4362","to":"MS-RULE-AU-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!71:71","fromKeys":["TAIM-MANAGE-2.4@4c58d159afdc4362"],"toKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-01552d3def094833e28fddab","from":"TAIM-MANAGE-3.1@fa0c648cdd610fd5","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!72:72","fromKeys":["TAIM-MANAGE-3.1@fa0c648cdd610fd5"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-adf86835513dc2f02824183f","from":"TAIM-MANAGE-3.1@fa0c648cdd610fd5","to":"MS-RULE-OP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!72:72","fromKeys":["TAIM-MANAGE-3.1@fa0c648cdd610fd5"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-00546591f1a2efd1001dadcb","from":"TAIM-MANAGE-3.1@fa0c648cdd610fd5","to":"MS-RULE-AG-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!72:72","fromKeys":["TAIM-MANAGE-3.1@fa0c648cdd610fd5"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ec0f2d0875a63c0e7be3381","from":"TAIM-MANAGE-3.1@fa0c648cdd610fd5","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!72:72","fromKeys":["TAIM-MANAGE-3.1@fa0c648cdd610fd5"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7b62197965e5437d8f834120","from":"TAIM-MANAGE-3.1@fa0c648cdd610fd5","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!72:72","fromKeys":["TAIM-MANAGE-3.1@fa0c648cdd610fd5"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a05969ad11b26e0b8a75ce61","from":"TAIM-MANAGE-3.2@72d098f451a97bfc","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!73:73","fromKeys":["TAIM-MANAGE-3.2@72d098f451a97bfc"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6b884909553d12abb1a273a7","from":"TAIM-MANAGE-3.2@72d098f451a97bfc","to":"MS-RULE-OP-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!73:73","fromKeys":["TAIM-MANAGE-3.2@72d098f451a97bfc"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d1ea5ee4c8b0d9f0384ae45a","from":"TAIM-MANAGE-3.2@72d098f451a97bfc","to":"MS-RULE-AG-10","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!73:73","fromKeys":["TAIM-MANAGE-3.2@72d098f451a97bfc"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4a971ddab95ac8c0a1433968","from":"TAIM-MANAGE-4.1@ba6d42802623e508","to":"MS-RULE-OP-11","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!74:74","fromKeys":["TAIM-MANAGE-4.1@ba6d42802623e508"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e5bf0f43ba3af5cc66765615","from":"TAIM-MANAGE-4.1@ba6d42802623e508","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!74:74","fromKeys":["TAIM-MANAGE-4.1@ba6d42802623e508"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6534afd3f65245c9fa1c9dd3","from":"TAIM-MANAGE-4.1@ba6d42802623e508","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!74:74","fromKeys":["TAIM-MANAGE-4.1@ba6d42802623e508"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-119ce4555b660112c130b9dd","from":"TAIM-MANAGE-4.1@ba6d42802623e508","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!74:74","fromKeys":["TAIM-MANAGE-4.1@ba6d42802623e508"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9425406c240d7e4d8c491c12","from":"TAIM-MANAGE-4.1@ba6d42802623e508","to":"MS-RULE-OP-08","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!74:74","fromKeys":["TAIM-MANAGE-4.1@ba6d42802623e508"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-be9e705e7f7045b80adcba6c","from":"TAIM-MANAGE-4.2@6622b89a3cfef575","to":"MS-RULE-OP-03","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!75:75","fromKeys":["TAIM-MANAGE-4.2@6622b89a3cfef575"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-63d2bf0fe89a67927dab1c5f","from":"TAIM-MANAGE-4.2@6622b89a3cfef575","to":"MS-RULE-OP-06","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!75:75","fromKeys":["TAIM-MANAGE-4.2@6622b89a3cfef575"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a1504da02216ccf980f25183","from":"TAIM-MANAGE-4.3@6d72e9f28c581992","to":"MS-RULE-OP-04","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!76:76","fromKeys":["TAIM-MANAGE-4.3@6d72e9f28c581992"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7834becba4271e3bfa1d0f1b","from":"TAIM-MANAGE-4.3@6d72e9f28c581992","to":"MS-RULE-OP-05","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!76:76","fromKeys":["TAIM-MANAGE-4.3@6d72e9f28c581992"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-82620d5de557649641a03112","from":"TAIM-MANAGE-4.3@6d72e9f28c581992","to":"MS-RULE-OP-01","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!76:76","fromKeys":["TAIM-MANAGE-4.3@6d72e9f28c581992"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ce55aae5ee749a65153667f9","from":"TAIM-MANAGE-4.3@6d72e9f28c581992","to":"MS-RULE-OP-02","kind":"CANDIDATE_RULE_IMPLEMENTATION","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'07 TAIM Control Map'!76:76","fromKeys":["TAIM-MANAGE-4.3@6d72e9f28c581992"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fb02ccfa1aef1d54fcd2a33b","from":"MS-POL-POL-01@49c4c01e6c0532bb","to":"MS-RULE-OP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!5:5","fromKeys":["MS-POL-POL-01@49c4c01e6c0532bb"],"toKeys":["MS-RULE-OP-09@ec587343b8220a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-382ca58d5ca69d7c24abab5d","from":"MS-POL-POL-01@49c4c01e6c0532bb","to":"MS-RULE-AU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!5:5","fromKeys":["MS-POL-POL-01@49c4c01e6c0532bb"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cf1d0922f2d6c4c98f4a94f5","from":"MS-POL-POL-01@49c4c01e6c0532bb","to":"MS-RULE-OP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!5:5","fromKeys":["MS-POL-POL-01@49c4c01e6c0532bb"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f9f1dfb72b438829b05adc39","from":"MS-POL-POL-02@aa0847ee55585424","to":"MS-RULE-IN-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!6:6","fromKeys":["MS-POL-POL-02@aa0847ee55585424"],"toKeys":["MS-RULE-IN-07@31e317962beaeb5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e9439e5a90b9511b409d6a10","from":"MS-POL-POL-02@aa0847ee55585424","to":"MS-RULE-OU-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!6:6","fromKeys":["MS-POL-POL-02@aa0847ee55585424"],"toKeys":["MS-RULE-OU-06@ce0137df984ac601"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-68abb68b64e7513c2cef5c1a","from":"MS-POL-POL-02@aa0847ee55585424","to":"MS-RULE-OU-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!6:6","fromKeys":["MS-POL-POL-02@aa0847ee55585424"],"toKeys":["MS-RULE-OU-07@7d5bc203e83e95c9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9822fc8034ad5d49d9a907ef","from":"MS-POL-POL-03@11c99e7398913f0f","to":"MS-RULE-AU-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!7:7","fromKeys":["MS-POL-POL-03@11c99e7398913f0f"],"toKeys":["MS-RULE-AU-01@32b7d4ac14b06f7b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-65174949faba55d7cc3885d0","from":"MS-POL-POL-03@11c99e7398913f0f","to":"MS-RULE-AU-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!7:7","fromKeys":["MS-POL-POL-03@11c99e7398913f0f"],"toKeys":["MS-RULE-AU-02@1a166eaeb8f7f1ad"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fb016405d6211fbf7638eb3a","from":"MS-POL-POL-03@11c99e7398913f0f","to":"MS-RULE-AU-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!7:7","fromKeys":["MS-POL-POL-03@11c99e7398913f0f"],"toKeys":["MS-RULE-AU-08@4eda0a221f3ef380"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-94f99b176aa2d35e124a30df","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-73d5da6abb999cc0ea7d785d","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-17626ed696b4ef3db710b048","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-03@4cbb47b109e98f4a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-06c4204fe791008ec0e925d4","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-04@13c6ba85197d9a69"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2b58a3e5831042c09d5b974d","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-31affdd7d5f0f91a5134477e","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-06@af062b3863346b41"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b6716d7a036e064408b1272b","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ee8de1fbd09286ce68cacfe9","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7b722413231bbc8f450a8b07","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9a8e0b0f54650380a13b1b57","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ce1b2016565679454a0bff4","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2a412d5801370d7627972dd8","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eb49ac5a3d7d4fc7fb87d9ad","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-13","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-13@1299bbf89c50bd1a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-afe49f6b8573ed616f797585","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-14","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-34c2662ef7c26b06a96aea2f","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-15","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cf22ba482c111390b8c93de9","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-16","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-56447804aa4529f661b234b6","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-17","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-71b3c6d94b210ce40aa4f6fb","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-DP-18","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-31f074b7c534083c216bffa3","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-AU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cc4524a797a2d87ba6fc2e80","from":"MS-POL-POL-04@44f05efa6918df27","to":"MS-RULE-AU-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!8:8","fromKeys":["MS-POL-POL-04@44f05efa6918df27"],"toKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-208e7885466731bf416de756","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-011ea910f5e1b21e595d1450","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-02@4965655028a3d485"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e796f2c04f0edbe0d2615cff","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d9b1e1073e2ee47f5b0b228a","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0ba4212b7407aa81cee2048c","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dd82c9d54a7953651501f849","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-06@ce0137df984ac601"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-68d2daf0bf0e18bf97b6e2b9","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-07@7d5bc203e83e95c9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e73f46cb2db700b757e70ff1","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-08@4c7bb6dc00dfcbfd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4e37f21b64132e01eea7bd83","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-09@2ffb1322457172b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ebd14f4fd5d8cfaa0293049","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-10@2332653b89bcd331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-446fa7d9f35d110da71ec0e9","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-11@0710643d8a955cf6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c9bea722e2d0cdb271af022d","from":"MS-POL-POL-05@9c8c386d8437959c","to":"MS-RULE-OU-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!9:9","fromKeys":["MS-POL-POL-05@9c8c386d8437959c"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2b020a66d8193c62bb317141","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-93c726dc42d16607cb0054c4","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-06@af062b3863346b41"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2899865dcb57f75beeee43b4","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7093475a3a5913e921afc73c","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c44d48a65268bae674213d26","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c5cec5e194a68b8d9be24e8b","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a877cc62311a0d21cd53dde0","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-DP-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-306ef5f5a7eb5d32624b99a7","from":"MS-POL-POL-06@8603eff3ea33a61f","to":"MS-RULE-OU-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!10:10","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f"],"toKeys":["MS-RULE-OU-11@0710643d8a955cf6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-621014e5e6c56b8612a09a73","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-IN-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!11:11","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-IN-01@e4fe11be1a20f12f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-93a356c01121c3bf35466221","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-IN-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!11:11","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-IN-02@dbb47a84e8a96c05"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3e6af52e00b8ec66f28fa9f8","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-IN-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!11:11","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2b1f15131c108f6f0a838f58","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-IN-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!11:11","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-IN-04@40341d186f0bd606"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f61fd2e9981380e6ea219be0","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-IN-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!11:11","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e8196e676566f194a25ee5eb","from":"MS-POL-POL-07@a1b6f11dcbba27b5","to":"MS-RULE-DP-15","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!11:11","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0cb65a925f07fc668dc4356f","from":"MS-POL-POL-08@ee4729bdeed9ad16","to":"MS-RULE-OU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!12:12","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-01bee3ba4a372959d4bd0750","from":"MS-POL-POL-08@ee4729bdeed9ad16","to":"MS-RULE-OU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!12:12","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b61cc633de9ea82c176c496d","from":"MS-POL-POL-08@ee4729bdeed9ad16","to":"MS-RULE-AG-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!12:12","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16"],"toKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f6980ed3fb7a2c8c5d979d05","from":"MS-POL-POL-08@ee4729bdeed9ad16","to":"MS-RULE-AG-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!12:12","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16"],"toKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-343cbc696f566f70bc67f343","from":"MS-POL-POL-08@ee4729bdeed9ad16","to":"MS-RULE-OP-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!12:12","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-36e5284ba3b8ca77f4c6fe43","from":"MS-POL-POL-09@30cd5cb249f58ae2","to":"MS-RULE-AU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!13:13","fromKeys":["MS-POL-POL-09@30cd5cb249f58ae2"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3c60d72b5742f8dece688376","from":"MS-POL-POL-09@30cd5cb249f58ae2","to":"MS-RULE-OP-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!13:13","fromKeys":["MS-POL-POL-09@30cd5cb249f58ae2"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b6d2f471fe7a64b695e17462","from":"MS-POL-POL-09@30cd5cb249f58ae2","to":"MS-RULE-OP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!13:13","fromKeys":["MS-POL-POL-09@30cd5cb249f58ae2"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-acb794aff5fa04deb8f4daae","from":"MS-POL-POL-10@cce53ffd6ac04512","to":"MS-RULE-OP-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!14:14","fromKeys":["MS-POL-POL-10@cce53ffd6ac04512"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1c0d3eb21c57bcc11cb247f8","from":"MS-POL-POL-10@cce53ffd6ac04512","to":"MS-RULE-OP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!14:14","fromKeys":["MS-POL-POL-10@cce53ffd6ac04512"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f6d3af889fb0cefd2f7e748c","from":"MS-POL-POL-11@4cbd6ed56751cc97","to":"MS-RULE-OP-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!15:15","fromKeys":["MS-POL-POL-11@4cbd6ed56751cc97"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-80ad44942507e00e2e73ca8e","from":"MS-POL-POL-11@4cbd6ed56751cc97","to":"MS-RULE-OP-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!15:15","fromKeys":["MS-POL-POL-11@4cbd6ed56751cc97"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f56604fd3d20a1454de8b906","from":"MS-POL-POL-11@4cbd6ed56751cc97","to":"MS-RULE-OP-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!15:15","fromKeys":["MS-POL-POL-11@4cbd6ed56751cc97"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c160a905f299b3d27d72a001","from":"MS-POL-POL-12@2bcf920fc5a05e6b","to":"MS-RULE-OP-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!16:16","fromKeys":["MS-POL-POL-12@2bcf920fc5a05e6b"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6885593b8e01c8bf4929e69e","from":"MS-POL-POL-12@2bcf920fc5a05e6b","to":"MS-RULE-OP-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!16:16","fromKeys":["MS-POL-POL-12@2bcf920fc5a05e6b"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8583fc741b17808b7b647589","from":"MS-POL-POL-13@e8a7e91b791104ce","to":"MS-RULE-AU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!17:17","fromKeys":["MS-POL-POL-13@e8a7e91b791104ce"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-00c5450261aa577999932fbb","from":"MS-POL-POL-13@e8a7e91b791104ce","to":"MS-RULE-AU-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!17:17","fromKeys":["MS-POL-POL-13@e8a7e91b791104ce"],"toKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d14325518e74823d44eeace4","from":"MS-POL-POL-13@e8a7e91b791104ce","to":"MS-RULE-OP-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!17:17","fromKeys":["MS-POL-POL-13@e8a7e91b791104ce"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e736baa667f0b2fd4db875f5","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-01@e6aee1767c267990"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aa09ae9045f22345068f4b86","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-02@d4d178c0433fd6d4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-daabc73c494b01faebae4ea1","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2545bc3b6d525e9616e06053","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d1a6a85703da10cbca7d5c89","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-05@8829d873310f18f9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-783556ff78f6e72fc6e0336b","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-06@6371f819b40b0d97"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-067a89e0bad42529eef2ef42","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-07@c2fb36c556cb8a62"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f893fd17c153a41eba97030c","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c70aa07f0e386bc9417b970e","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-AG-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-AG-09@2bd07e82a72d4f2e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b9870130f1d759f9e60edd77","from":"MS-POL-POL-14@aa241dc1520b8ab5","to":"MS-RULE-IN-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!18:18","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5"],"toKeys":["MS-RULE-IN-08@94324ccfd3a491ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-479cfe402650d2befa8f3669","from":"MS-POL-POL-15@66ce06439b6303c8","to":"MS-RULE-OU-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!19:19","fromKeys":["MS-POL-POL-15@66ce06439b6303c8"],"toKeys":["MS-RULE-OU-08@4c7bb6dc00dfcbfd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4d52a769c9bd94f86c2ef489","from":"MS-POL-POL-15@66ce06439b6303c8","to":"MS-RULE-OU-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!19:19","fromKeys":["MS-POL-POL-15@66ce06439b6303c8"],"toKeys":["MS-RULE-OU-09@2ffb1322457172b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-10d3fe308736ef52dee2c677","from":"MS-POL-POL-15@66ce06439b6303c8","to":"MS-RULE-OP-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!19:19","fromKeys":["MS-POL-POL-15@66ce06439b6303c8"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-40436baace5a9776cddac99c","from":"MS-POL-POL-15@66ce06439b6303c8","to":"MS-RULE-OP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!19:19","fromKeys":["MS-POL-POL-15@66ce06439b6303c8"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4908373c3af63f17835d6764","from":"MS-POL-POL-16@e96f7674899ecd20","to":"MS-RULE-OU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!20:20","fromKeys":["MS-POL-POL-16@e96f7674899ecd20"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-864e56e2529e6bbd6d20896d","from":"MS-POL-POL-17@fbd2f1193b92724a","to":"MS-RULE-OU-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!21:21","fromKeys":["MS-POL-POL-17@fbd2f1193b92724a"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-44eaa08511770aa161282a67","from":"MS-POL-POL-17@fbd2f1193b92724a","to":"MS-RULE-OU-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!21:21","fromKeys":["MS-POL-POL-17@fbd2f1193b92724a"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8db307b18e0378737414e9f8","from":"MS-POL-POL-17@fbd2f1193b92724a","to":"MS-RULE-OP-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!21:21","fromKeys":["MS-POL-POL-17@fbd2f1193b92724a"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-46667757d24ea04de6871b93","from":"MS-POL-POL-18@97f5690fa7f7084e","to":"MS-RULE-DP-14","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!22:22","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ad7c95dec60db8914dd98cd0","from":"MS-POL-POL-18@97f5690fa7f7084e","to":"MS-RULE-DP-16","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!22:22","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4e25d22b344a3ae11d9c604e","from":"MS-POL-POL-18@97f5690fa7f7084e","to":"MS-RULE-DP-17","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!22:22","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0d01901a55043a181b5f23df","from":"MS-POL-POL-18@97f5690fa7f7084e","to":"MS-RULE-DP-18","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!22:22","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9fca31e7f6d374bb7fcb1de9","from":"MS-POL-POL-18@97f5690fa7f7084e","to":"MS-RULE-OU-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!22:22","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e"],"toKeys":["MS-RULE-OU-10@2332653b89bcd331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-be56c87ee0722a9d31093bcd","from":"MS-POL-POL-20@ea163decd6c07a16","to":"MS-RULE-OP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!24:24","fromKeys":["MS-POL-POL-20@ea163decd6c07a16"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-882bb0494ddb7780c6da6bb3","from":"MS-POL-POL-20@ea163decd6c07a16","to":"MS-RULE-OP-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!24:24","fromKeys":["MS-POL-POL-20@ea163decd6c07a16"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3d4c73ec3e79a640167b68d8","from":"MS-POL-POL-21@9a99a10275e80192","to":"MS-RULE-OP-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!25:25","fromKeys":["MS-POL-POL-21@9a99a10275e80192"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-68b3eb98b755e30bb369bd2f","from":"MS-POL-POL-22@7864cb607001d95d","to":"MS-RULE-IN-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!26:26","fromKeys":["MS-POL-POL-22@7864cb607001d95d"],"toKeys":["MS-RULE-IN-06@478a04da335c1e7f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2d9f4e12b4f687198a56a7d2","from":"MS-POL-POL-22@7864cb607001d95d","to":"MS-RULE-AG-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!26:26","fromKeys":["MS-POL-POL-22@7864cb607001d95d"],"toKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0fdd498943f0cff70c188cb1","from":"MS-POL-POL-22@7864cb607001d95d","to":"MS-RULE-AG-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!26:26","fromKeys":["MS-POL-POL-22@7864cb607001d95d"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0b0c702eaf1de2316f25098f","from":"MS-POL-POL-23@daaad9ef8b33a963","to":"MS-RULE-OP-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!27:27","fromKeys":["MS-POL-POL-23@daaad9ef8b33a963"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9e8a57074a847aa8f3c0d966","from":"MS-POL-POL-23@daaad9ef8b33a963","to":"MS-RULE-OP-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!27:27","fromKeys":["MS-POL-POL-23@daaad9ef8b33a963"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-16256f849d254969533bf3e4","from":"MS-POL-POL-23@daaad9ef8b33a963","to":"MS-RULE-OP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!27:27","fromKeys":["MS-POL-POL-23@daaad9ef8b33a963"],"toKeys":["MS-RULE-OP-09@ec587343b8220a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-20d114f605dea643d689f1e8","from":"MS-POL-POL-23@daaad9ef8b33a963","to":"MS-RULE-OP-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!27:27","fromKeys":["MS-POL-POL-23@daaad9ef8b33a963"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7971194ca03d668fb65aedd4","from":"MS-POL-POL-23@daaad9ef8b33a963","to":"MS-RULE-DP-18","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!27:27","fromKeys":["MS-POL-POL-23@daaad9ef8b33a963"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-37b359da7c4b4de23a048484","from":"MS-POL-POL-23@daaad9ef8b33a963","to":"MS-RULE-OP-13","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!27:27","fromKeys":["MS-POL-POL-23@daaad9ef8b33a963"],"toKeys":["MS-RULE-OP-13@d9a7b8a98719c7c2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fcc01539f5c78e778b9d94aa","from":"MS-POL-POL-24@3ac8bb46b53fea08","to":"MS-RULE-OU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!28:28","fromKeys":["MS-POL-POL-24@3ac8bb46b53fea08"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d44fae9c69d4c5c0fbf8b3bb","from":"MS-POL-POL-24@3ac8bb46b53fea08","to":"MS-RULE-OU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!28:28","fromKeys":["MS-POL-POL-24@3ac8bb46b53fea08"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-40a4b31b7903937bea3071d2","from":"MS-POL-POL-24@3ac8bb46b53fea08","to":"MS-RULE-OU-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!28:28","fromKeys":["MS-POL-POL-24@3ac8bb46b53fea08"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-79526e3093d2c031c0ffd569","from":"MS-POL-POL-24@3ac8bb46b53fea08","to":"MS-RULE-OP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!28:28","fromKeys":["MS-POL-POL-24@3ac8bb46b53fea08"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-07fa99a200dad1d3dfe8da96","from":"MS-POL-POL-24@3ac8bb46b53fea08","to":"MS-RULE-OU-13","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!28:28","fromKeys":["MS-POL-POL-24@3ac8bb46b53fea08"],"toKeys":["MS-RULE-OU-13@1eb7cb01e3cf473f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-20f367df1ca2e623171be1b7","from":"MS-POL-POL-25@cbf2a67c65532b7d","to":"MS-RULE-OU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!29:29","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bb1156b8e370c9781b8a075a","from":"MS-POL-POL-25@cbf2a67c65532b7d","to":"MS-RULE-OU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!29:29","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3995586101649d1d71c39cbb","from":"MS-POL-POL-25@cbf2a67c65532b7d","to":"MS-RULE-OU-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!29:29","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c917a264af62d98630da9be8","from":"MS-POL-POL-25@cbf2a67c65532b7d","to":"MS-RULE-OP-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!29:29","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6875382df009d95d8293bdb4","from":"MS-POL-POL-25@cbf2a67c65532b7d","to":"MS-RULE-OP-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!29:29","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c62ab7d0e1f8c7bdddaf52be","from":"MS-POL-POL-25@cbf2a67c65532b7d","to":"MS-RULE-OP-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!29:29","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7922caa41cd96a98f055265e","from":"MS-POL-POL-25@cbf2a67c65532b7d","to":"MS-RULE-OP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!29:29","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c7a8af8287b9a6d8202ec0a1","from":"MS-POL-POL-25@cbf2a67c65532b7d","to":"MS-RULE-OP-14","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!29:29","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d"],"toKeys":["MS-RULE-OP-14@b102df5650885781"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4b16c2ea6c3b0ea8324e846e","from":"MS-POL-POL-25@cbf2a67c65532b7d","to":"MS-RULE-OU-14","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!29:29","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d"],"toKeys":["MS-RULE-OU-14@ae9d5f3f618c9838"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eb052c76a812a5e11ec22e50","from":"MS-POL-POL-25@cbf2a67c65532b7d","to":"MS-RULE-OP-18","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!29:29","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d"],"toKeys":["MS-RULE-OP-18@1df03547863d8288"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-45961c08eac9e15df6d0f8c9","from":"MS-POL-POL-26@306487f686bd6069","to":"MS-RULE-OU-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!30:30","fromKeys":["MS-POL-POL-26@306487f686bd6069"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6cb2fc4e947f407310890042","from":"MS-POL-POL-26@306487f686bd6069","to":"MS-RULE-OU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!30:30","fromKeys":["MS-POL-POL-26@306487f686bd6069"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d6440b1c1c5f623583d01c9b","from":"MS-POL-POL-26@306487f686bd6069","to":"MS-RULE-OU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!30:30","fromKeys":["MS-POL-POL-26@306487f686bd6069"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b1cc428d64e7005b8b48e25a","from":"MS-POL-POL-26@306487f686bd6069","to":"MS-RULE-OP-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!30:30","fromKeys":["MS-POL-POL-26@306487f686bd6069"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3177e07ee9d87ddfd8de9092","from":"MS-POL-POL-26@306487f686bd6069","to":"MS-RULE-OP-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!30:30","fromKeys":["MS-POL-POL-26@306487f686bd6069"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-002da61ac67da33256ea4231","from":"MS-POL-POL-26@306487f686bd6069","to":"MS-RULE-OP-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!30:30","fromKeys":["MS-POL-POL-26@306487f686bd6069"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-45546c6e3c278796a852d5ad","from":"MS-POL-POL-26@306487f686bd6069","to":"MS-RULE-OP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!30:30","fromKeys":["MS-POL-POL-26@306487f686bd6069"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5bfd688c75275cca74405b2f","from":"MS-POL-POL-26@306487f686bd6069","to":"MS-RULE-OU-14","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!30:30","fromKeys":["MS-POL-POL-26@306487f686bd6069"],"toKeys":["MS-RULE-OU-14@ae9d5f3f618c9838"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4923d7775a78d906bf8c5c60","from":"MS-POL-POL-26@306487f686bd6069","to":"MS-RULE-OP-17","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!30:30","fromKeys":["MS-POL-POL-26@306487f686bd6069"],"toKeys":["MS-RULE-OP-17@6b311b898e8dc850"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dd201e823430906ae205479c","from":"MS-POL-POL-27@24ccacabdf3df91b","to":"MS-RULE-DP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!31:31","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bf772f7572026a2bc297a52a","from":"MS-POL-POL-27@24ccacabdf3df91b","to":"MS-RULE-OU-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!31:31","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a1dbe3b8db5c5bbfbad88cf5","from":"MS-POL-POL-27@24ccacabdf3df91b","to":"MS-RULE-OU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!31:31","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4478d78db6d45ea91961f587","from":"MS-POL-POL-27@24ccacabdf3df91b","to":"MS-RULE-OU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!31:31","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c2983daea7e4f9666c274829","from":"MS-POL-POL-27@24ccacabdf3df91b","to":"MS-RULE-OP-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!31:31","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-518dbed068f76ab7400d4511","from":"MS-POL-POL-27@24ccacabdf3df91b","to":"MS-RULE-OP-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!31:31","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-07bb2eab0497657a32518d74","from":"MS-POL-POL-27@24ccacabdf3df91b","to":"MS-RULE-OP-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!31:31","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8f1383b60947b1ec55a76a19","from":"MS-POL-POL-27@24ccacabdf3df91b","to":"MS-RULE-OP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!31:31","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-431ac3a77d3fdd7e7ab42930","from":"MS-POL-POL-27@24ccacabdf3df91b","to":"MS-RULE-OP-15","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!31:31","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b"],"toKeys":["MS-RULE-OP-15@bab74c0be8fc582d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-63296d01fc1e0f8a138e2582","from":"MS-POL-POL-28@d850b62ebf5806ef","to":"MS-RULE-DP-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!32:32","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-209d1800a8ed8ef082c69e15","from":"MS-POL-POL-28@d850b62ebf5806ef","to":"MS-RULE-DP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!32:32","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5bf3d699e8683ff4257c998f","from":"MS-POL-POL-28@d850b62ebf5806ef","to":"MS-RULE-DP-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!32:32","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9658b053edacfccbd07b9992","from":"MS-POL-POL-28@d850b62ebf5806ef","to":"MS-RULE-DP-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!32:32","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7624fbe223ec1578b3286eb9","from":"MS-POL-POL-28@d850b62ebf5806ef","to":"MS-RULE-OU-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!32:32","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef"],"toKeys":["MS-RULE-OU-06@ce0137df984ac601"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6285ce623969221f87b36c67","from":"MS-POL-POL-28@d850b62ebf5806ef","to":"MS-RULE-OU-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!32:32","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef"],"toKeys":["MS-RULE-OU-07@7d5bc203e83e95c9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c9584f67a0a1e86eb59579f1","from":"MS-POL-POL-28@d850b62ebf5806ef","to":"MS-RULE-OU-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!32:32","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9f194448553ae99871ef91a7","from":"MS-POL-POL-28@d850b62ebf5806ef","to":"MS-RULE-OP-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!32:32","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e7d97e5c066420c3459941e5","from":"MS-POL-POL-28@d850b62ebf5806ef","to":"MS-RULE-DP-19","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!32:32","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef"],"toKeys":["MS-RULE-DP-19@40fb41ffda35d9a3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e0f155be6a2b47589906ab08","from":"MS-POL-POL-28@d850b62ebf5806ef","to":"MS-RULE-OU-15","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!32:32","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef"],"toKeys":["MS-RULE-OU-15@17dad38dad581076"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bad7381ebdc95bc4343f73e7","from":"MS-POL-POL-29@15da853e19e2751a","to":"MS-RULE-OU-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!33:33","fromKeys":["MS-POL-POL-29@15da853e19e2751a"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0bc473c3e913f980ab41133f","from":"MS-POL-POL-29@15da853e19e2751a","to":"MS-RULE-OU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!33:33","fromKeys":["MS-POL-POL-29@15da853e19e2751a"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f7e9bf1b1e15e9b1cf779206","from":"MS-POL-POL-29@15da853e19e2751a","to":"MS-RULE-OU-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!33:33","fromKeys":["MS-POL-POL-29@15da853e19e2751a"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3a4553804af15a44f402928a","from":"MS-POL-POL-29@15da853e19e2751a","to":"MS-RULE-AG-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!33:33","fromKeys":["MS-POL-POL-29@15da853e19e2751a"],"toKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3b6becaf2192fc886dbf5b82","from":"MS-POL-POL-29@15da853e19e2751a","to":"MS-RULE-AG-04","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!33:33","fromKeys":["MS-POL-POL-29@15da853e19e2751a"],"toKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8728ffd1befbf95d7607de89","from":"MS-POL-POL-29@15da853e19e2751a","to":"MS-RULE-OP-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!33:33","fromKeys":["MS-POL-POL-29@15da853e19e2751a"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b9802dbfe37ecfc838aa7236","from":"MS-POL-POL-29@15da853e19e2751a","to":"MS-RULE-OP-08","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!33:33","fromKeys":["MS-POL-POL-29@15da853e19e2751a"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7feff4dfdfbef62bd2d46a02","from":"MS-POL-POL-29@15da853e19e2751a","to":"MS-RULE-OP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!33:33","fromKeys":["MS-POL-POL-29@15da853e19e2751a"],"toKeys":["MS-RULE-OP-09@ec587343b8220a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e7220f77f8d7c405c0440cca","from":"MS-POL-POL-29@15da853e19e2751a","to":"MS-RULE-OP-16","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!33:33","fromKeys":["MS-POL-POL-29@15da853e19e2751a"],"toKeys":["MS-RULE-OP-16@277159bc0f54c27c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aca52a7946f29bc1658bcb6c","from":"MS-POL-POL-29@15da853e19e2751a","to":"MS-RULE-AG-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!33:33","fromKeys":["MS-POL-POL-29@15da853e19e2751a"],"toKeys":["MS-RULE-AG-11@f9288b5977523607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9d5a48295181d8aa4fb267a8","from":"MS-POL-POL-29@15da853e19e2751a","to":"MS-RULE-OP-18","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!33:33","fromKeys":["MS-POL-POL-29@15da853e19e2751a"],"toKeys":["MS-RULE-OP-18@1df03547863d8288"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-622096b635c1ebb32ee0a188","from":"MS-POL-POL-30@09fcec49716e93c1","to":"MS-RULE-DP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!34:34","fromKeys":["MS-POL-POL-30@09fcec49716e93c1"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1dd8f5f43d3665ddd4a884df","from":"MS-POL-POL-30@09fcec49716e93c1","to":"MS-RULE-DP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!34:34","fromKeys":["MS-POL-POL-30@09fcec49716e93c1"],"toKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a65f1761dac164318b2dc29e","from":"MS-POL-POL-30@09fcec49716e93c1","to":"MS-RULE-DP-13","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!34:34","fromKeys":["MS-POL-POL-30@09fcec49716e93c1"],"toKeys":["MS-RULE-DP-13@1299bbf89c50bd1a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a2829d59792d07fe94214e58","from":"MS-POL-POL-30@09fcec49716e93c1","to":"MS-RULE-AU-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!34:34","fromKeys":["MS-POL-POL-30@09fcec49716e93c1"],"toKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c6d3aa140a13b35195da5ffe","from":"MS-POL-POL-30@09fcec49716e93c1","to":"MS-RULE-AU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!34:34","fromKeys":["MS-POL-POL-30@09fcec49716e93c1"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-72671404800663af19d9680c","from":"MS-POL-POL-30@09fcec49716e93c1","to":"MS-RULE-OP-01","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!34:34","fromKeys":["MS-POL-POL-30@09fcec49716e93c1"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0f35141dd4c86f7a9ff0434a","from":"MS-POL-POL-30@09fcec49716e93c1","to":"MS-RULE-OP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!34:34","fromKeys":["MS-POL-POL-30@09fcec49716e93c1"],"toKeys":["MS-RULE-OP-09@ec587343b8220a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-85de085fbde7b14bd1c3347d","from":"MS-POL-POL-30@09fcec49716e93c1","to":"MS-RULE-OP-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!34:34","fromKeys":["MS-POL-POL-30@09fcec49716e93c1"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0fc1035c5270c5520f7a32c0","from":"MS-POL-POL-30@09fcec49716e93c1","to":"MS-RULE-AU-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!34:34","fromKeys":["MS-POL-POL-30@09fcec49716e93c1"],"toKeys":["MS-RULE-AU-09@204573caad930259"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-26a6b416b327f3a170d2bc32","from":"MS-POL-POL-31@1e5f7eb3de495c93","to":"MS-RULE-OU-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!35:35","fromKeys":["MS-POL-POL-31@1e5f7eb3de495c93"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-88e626ff7892d84cd24a07dd","from":"MS-POL-POL-31@1e5f7eb3de495c93","to":"MS-RULE-OU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!35:35","fromKeys":["MS-POL-POL-31@1e5f7eb3de495c93"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aba0597581849c968f77c2ce","from":"MS-POL-POL-31@1e5f7eb3de495c93","to":"MS-RULE-OP-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!35:35","fromKeys":["MS-POL-POL-31@1e5f7eb3de495c93"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-001ac994616c4810aa91a3f0","from":"MS-POL-POL-31@1e5f7eb3de495c93","to":"MS-RULE-OP-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!35:35","fromKeys":["MS-POL-POL-31@1e5f7eb3de495c93"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-59513a2c09d9eb3e851d9b97","from":"MS-POL-POL-31@1e5f7eb3de495c93","to":"MS-RULE-OP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!35:35","fromKeys":["MS-POL-POL-31@1e5f7eb3de495c93"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6bdf4014e86fd2f007ba08b8","from":"MS-POL-POL-31@1e5f7eb3de495c93","to":"MS-RULE-OP-17","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!35:35","fromKeys":["MS-POL-POL-31@1e5f7eb3de495c93"],"toKeys":["MS-RULE-OP-17@6b311b898e8dc850"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ed3054ec5d6d9790a29a2b58","from":"MS-POL-POL-32@9422d7fab14d948a","to":"MS-RULE-AU-05","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!36:36","fromKeys":["MS-POL-POL-32@9422d7fab14d948a"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-396c6ec20cd56b3d141315ac","from":"MS-POL-POL-32@9422d7fab14d948a","to":"MS-RULE-AU-06","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!36:36","fromKeys":["MS-POL-POL-32@9422d7fab14d948a"],"toKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-441cd59a39cc6afad7b7e920","from":"MS-POL-POL-32@9422d7fab14d948a","to":"MS-RULE-DP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!36:36","fromKeys":["MS-POL-POL-32@9422d7fab14d948a"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-372821f47c936b2151810f36","from":"MS-POL-POL-32@9422d7fab14d948a","to":"MS-RULE-DP-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!36:36","fromKeys":["MS-POL-POL-32@9422d7fab14d948a"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fde6abd3ac167e76c654ffb3","from":"MS-POL-POL-32@9422d7fab14d948a","to":"MS-RULE-DP-11","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!36:36","fromKeys":["MS-POL-POL-32@9422d7fab14d948a"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c8dc82da96dcf6e530407467","from":"MS-POL-POL-32@9422d7fab14d948a","to":"MS-RULE-OP-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!36:36","fromKeys":["MS-POL-POL-32@9422d7fab14d948a"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8560035b07121e761bc11b76","from":"MS-POL-POL-32@9422d7fab14d948a","to":"MS-RULE-AU-10","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!36:36","fromKeys":["MS-POL-POL-32@9422d7fab14d948a"],"toKeys":["MS-RULE-AU-10@7f425f52b685ce44"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f208d8ba9d253ab4c4cc3cc1","from":"MS-POL-POL-33@2173f98ce3d3e4e6","to":"MS-RULE-OU-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!37:37","fromKeys":["MS-POL-POL-33@2173f98ce3d3e4e6"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f2317414c1eeb66c557f5301","from":"MS-POL-POL-33@2173f98ce3d3e4e6","to":"MS-RULE-OP-02","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!37:37","fromKeys":["MS-POL-POL-33@2173f98ce3d3e4e6"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9350402da9676f84a91a9d98","from":"MS-POL-POL-33@2173f98ce3d3e4e6","to":"MS-RULE-OP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!37:37","fromKeys":["MS-POL-POL-33@2173f98ce3d3e4e6"],"toKeys":["MS-RULE-OP-09@ec587343b8220a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-36bfb5114e8580abf4133b63","from":"MS-POL-POL-33@2173f98ce3d3e4e6","to":"MS-RULE-OP-18","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!37:37","fromKeys":["MS-POL-POL-33@2173f98ce3d3e4e6"],"toKeys":["MS-RULE-OP-18@1df03547863d8288"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c63614b4a3f0e539ebcdbb14","from":"MS-POL-POL-34@93db44d68b4d6aaf","to":"MS-RULE-DP-07","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!38:38","fromKeys":["MS-POL-POL-34@93db44d68b4d6aaf"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d6fd74bcd36ec639b809d469","from":"MS-POL-POL-34@93db44d68b4d6aaf","to":"MS-RULE-DP-09","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!38:38","fromKeys":["MS-POL-POL-34@93db44d68b4d6aaf"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e52c63b4d7a5b0c5e48dcc1","from":"MS-POL-POL-34@93db44d68b4d6aaf","to":"MS-RULE-OU-03","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!38:38","fromKeys":["MS-POL-POL-34@93db44d68b4d6aaf"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f1fb406afa8f126ec1665453","from":"MS-POL-POL-34@93db44d68b4d6aaf","to":"MS-RULE-OP-12","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!38:38","fromKeys":["MS-POL-POL-34@93db44d68b4d6aaf"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d06e5fa931fdd302aabc4e17","from":"MS-POL-POL-34@93db44d68b4d6aaf","to":"MS-RULE-OP-19","kind":"POLICY_USES_RULE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'08 Internal Policies'!38:38","fromKeys":["MS-POL-POL-34@93db44d68b4d6aaf"],"toKeys":["MS-RULE-OP-19@744dc9983a3098ac"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c4b5020e199ecd59dff96750","from":"MS-OVERLAY-CUS-01@ef016720fa4b77d5","to":"MS-RULE-DP-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!5:5","fromKeys":["MS-OVERLAY-CUS-01@ef016720fa4b77d5"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-36c23dfc07b1e7b445f03186","from":"MS-OVERLAY-CUS-01@ef016720fa4b77d5","to":"MS-RULE-DP-09","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!5:5","fromKeys":["MS-OVERLAY-CUS-01@ef016720fa4b77d5"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7d3fa1f7517db9d66ed5ba30","from":"MS-OVERLAY-CUS-02@2bdb2cb7097a15c7","to":"MS-RULE-DP-14","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!6:6","fromKeys":["MS-OVERLAY-CUS-02@2bdb2cb7097a15c7"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-76edaec0630466ff0893ddfc","from":"MS-OVERLAY-CUS-02@2bdb2cb7097a15c7","to":"MS-RULE-DP-16","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!6:6","fromKeys":["MS-OVERLAY-CUS-02@2bdb2cb7097a15c7"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e6b29b7dce20052fad82579f","from":"MS-OVERLAY-CUS-02@2bdb2cb7097a15c7","to":"MS-RULE-DP-18","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!6:6","fromKeys":["MS-OVERLAY-CUS-02@2bdb2cb7097a15c7"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e9794cb489c91b479a86bb4b","from":"MS-OVERLAY-CUS-03@9e0dd72cbcd36d06","to":"MS-RULE-AU-01","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!7:7","fromKeys":["MS-OVERLAY-CUS-03@9e0dd72cbcd36d06"],"toKeys":["MS-RULE-AU-01@32b7d4ac14b06f7b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9f5047a417b21e7ad5bff231","from":"MS-OVERLAY-CUS-03@9e0dd72cbcd36d06","to":"MS-RULE-AG-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!7:7","fromKeys":["MS-OVERLAY-CUS-03@9e0dd72cbcd36d06"],"toKeys":["MS-RULE-AG-05@8829d873310f18f9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-47351a3af6901fe03be838f1","from":"MS-OVERLAY-CUS-04@1f8a3af1c8e871ca","to":"MS-RULE-DP-14","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!8:8","fromKeys":["MS-OVERLAY-CUS-04@1f8a3af1c8e871ca"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a48cd78ba85308ce62cc1e3d","from":"MS-OVERLAY-CUS-04@1f8a3af1c8e871ca","to":"MS-RULE-DP-16","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!8:8","fromKeys":["MS-OVERLAY-CUS-04@1f8a3af1c8e871ca"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b247f01eab8d9fcf76c908db","from":"MS-OVERLAY-CUS-05@312949a220d7aa56","to":"MS-RULE-AU-04","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!9:9","fromKeys":["MS-OVERLAY-CUS-05@312949a220d7aa56"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f8215b32e87785a3f8fae7bb","from":"MS-OVERLAY-CUS-06@b76726eea76800fb","to":"MS-RULE-AU-02","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!10:10","fromKeys":["MS-OVERLAY-CUS-06@b76726eea76800fb"],"toKeys":["MS-RULE-AU-02@1a166eaeb8f7f1ad"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-25ba7f600bb63242b765224e","from":"MS-OVERLAY-CUS-06@b76726eea76800fb","to":"MS-RULE-AU-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!10:10","fromKeys":["MS-OVERLAY-CUS-06@b76726eea76800fb"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0f5a455815dc7c071cd4ba16","from":"MS-OVERLAY-CUS-06@b76726eea76800fb","to":"MS-RULE-AU-06","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!10:10","fromKeys":["MS-OVERLAY-CUS-06@b76726eea76800fb"],"toKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ede608fe29aeff3439e19464","from":"MS-OVERLAY-CUS-07@e7e1902f4641a2b9","to":"MS-RULE-OU-04","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!11:11","fromKeys":["MS-OVERLAY-CUS-07@e7e1902f4641a2b9"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5d882ddf906cdc6c53a53225","from":"MS-OVERLAY-CUS-07@e7e1902f4641a2b9","to":"MS-RULE-OU-12","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!11:11","fromKeys":["MS-OVERLAY-CUS-07@e7e1902f4641a2b9"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1b2509ddd368a7c27fc94595","from":"MS-OVERLAY-CUS-08@f2e9d1cd2e00bcf6","to":"MS-RULE-AG-07","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!12:12","fromKeys":["MS-OVERLAY-CUS-08@f2e9d1cd2e00bcf6"],"toKeys":["MS-RULE-AG-07@c2fb36c556cb8a62"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b69b573ee32a69542093f681","from":"MS-OVERLAY-CUS-09@fa0395a46d9792dd","to":"MS-RULE-AG-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!13:13","fromKeys":["MS-OVERLAY-CUS-09@fa0395a46d9792dd"],"toKeys":["MS-RULE-AG-05@8829d873310f18f9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-146359d4575928e0bb7c7a2f","from":"MS-OVERLAY-CUS-10@d2a5b80a68088779","to":"MS-RULE-AG-01","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!14:14","fromKeys":["MS-OVERLAY-CUS-10@d2a5b80a68088779"],"toKeys":["MS-RULE-AG-01@e6aee1767c267990"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-adf4509c378972fdf0ae29d7","from":"MS-OVERLAY-CUS-10@d2a5b80a68088779","to":"MS-RULE-AG-10","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!14:14","fromKeys":["MS-OVERLAY-CUS-10@d2a5b80a68088779"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-86812c8261c859bdc0cedf3a","from":"MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7","to":"MS-RULE-AU-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!15:15","fromKeys":["MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-285facff6c7e85bdbfeffba4","from":"MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7","to":"MS-RULE-OP-11","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!15:15","fromKeys":["MS-OVERLAY-CUS-11@3ce1dbae9eca1ae7"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-baad7cc419f13a865c44aa27","from":"MS-OVERLAY-CUS-12@b7241f443c6c3622","to":"MS-RULE-DP-01","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!16:16","fromKeys":["MS-OVERLAY-CUS-12@b7241f443c6c3622"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9896242827c92d3624c99854","from":"MS-OVERLAY-CUS-12@b7241f443c6c3622","to":"MS-RULE-DP-15","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!16:16","fromKeys":["MS-OVERLAY-CUS-12@b7241f443c6c3622"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dc46f61c55dcda4106382dc7","from":"MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7","to":"MS-RULE-IN-03","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!17:17","fromKeys":["MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7"],"toKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e9efad6d266c259dca4d05c0","from":"MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7","to":"MS-RULE-IN-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!17:17","fromKeys":["MS-OVERLAY-CUS-13@7fdb1363b6e1eaa7"],"toKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ba3d98abaaef75e483688028","from":"MS-OVERLAY-CUS-14@360b13cad7621179","to":"MS-RULE-IN-07","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!18:18","fromKeys":["MS-OVERLAY-CUS-14@360b13cad7621179"],"toKeys":["MS-RULE-IN-07@31e317962beaeb5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-773d4c8e12f5c31ceb361a8e","from":"MS-OVERLAY-CUS-14@360b13cad7621179","to":"MS-RULE-OU-04","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!18:18","fromKeys":["MS-OVERLAY-CUS-14@360b13cad7621179"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1fdd7682f80ced75f348262a","from":"MS-OVERLAY-CUS-15@bdd9abeff8cb9654","to":"MS-RULE-AG-03","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!19:19","fromKeys":["MS-OVERLAY-CUS-15@bdd9abeff8cb9654"],"toKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8fe67c9004c6d93ae9a7705a","from":"MS-OVERLAY-CUS-15@bdd9abeff8cb9654","to":"MS-RULE-AG-04","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!19:19","fromKeys":["MS-OVERLAY-CUS-15@bdd9abeff8cb9654"],"toKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-289afa0a146b02a71be464c7","from":"MS-OVERLAY-CUS-15@bdd9abeff8cb9654","to":"MS-RULE-OP-08","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!19:19","fromKeys":["MS-OVERLAY-CUS-15@bdd9abeff8cb9654"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dba3cd6dbbbb9bbb27d79185","from":"MS-OVERLAY-CUS-16@5dc4891c003c8c70","to":"MS-RULE-OU-01","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!20:20","fromKeys":["MS-OVERLAY-CUS-16@5dc4891c003c8c70"],"toKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1940fa2b0991cdfecea44f2e","from":"MS-OVERLAY-CUS-16@5dc4891c003c8c70","to":"MS-RULE-OU-02","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!20:20","fromKeys":["MS-OVERLAY-CUS-16@5dc4891c003c8c70"],"toKeys":["MS-RULE-OU-02@4965655028a3d485"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7fbce12bd4526fd4e884429e","from":"MS-OVERLAY-CUS-16@5dc4891c003c8c70","to":"MS-RULE-AG-08","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!20:20","fromKeys":["MS-OVERLAY-CUS-16@5dc4891c003c8c70"],"toKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-354d5da6b483bd50e5b8c36c","from":"MS-OVERLAY-CUS-17@3b8c3e6e3715795f","to":"MS-RULE-OU-03","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!21:21","fromKeys":["MS-OVERLAY-CUS-17@3b8c3e6e3715795f"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f8a5dcb9c43bf9b7719275b5","from":"MS-OVERLAY-CUS-17@3b8c3e6e3715795f","to":"MS-RULE-OU-12","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!21:21","fromKeys":["MS-OVERLAY-CUS-17@3b8c3e6e3715795f"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5673abacf15e30005f33c51b","from":"MS-OVERLAY-CUS-17@3b8c3e6e3715795f","to":"MS-RULE-AG-05","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!21:21","fromKeys":["MS-OVERLAY-CUS-17@3b8c3e6e3715795f"],"toKeys":["MS-RULE-AG-05@8829d873310f18f9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1077b9b50f13c39041ffcd62","from":"MS-OVERLAY-CUS-18@d7a54daf6d4edffb","to":"MS-RULE-OP-06","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!22:22","fromKeys":["MS-OVERLAY-CUS-18@d7a54daf6d4edffb"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ef7958874be73cce16bd0034","from":"MS-OVERLAY-CUS-18@d7a54daf6d4edffb","to":"MS-RULE-OP-12","kind":"OVERLAY_OF","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'09 Custom Rule Backlog'!22:22","fromKeys":["MS-OVERLAY-CUS-18@d7a54daf6d4edffb"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-87c397fd629a38c0161d92b5","from":"MS-SEED-fc49123874e83c92@1ed210287f703b82","to":"MS-RULE-DP-01","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-csf-2","frameworkTitle":"NIST CSF","locator":"PR.AA — Identity Management & Access Control","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!5:5","fromKeys":["MS-SEED-fc49123874e83c92@1ed210287f703b82"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-89c0c03e185f1b7c209f7959","from":"MS-SEED-fc49123874e83c92@1ed210287f703b82","to":"MS-RULE-DP-02","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-csf-2","frameworkTitle":"NIST CSF","locator":"PR.AA — Identity Management & Access Control","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!5:5","fromKeys":["MS-SEED-fc49123874e83c92@1ed210287f703b82"],"toKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-12a4bb6d0a393d01e7a38e03","from":"MS-SEED-98c36050538db5d1@65ffe1e6e8668a51","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-csf-2","frameworkTitle":"NIST CSF","locator":"PR.IR — Technology Infrastructure Resilience","suggestedCanonical":"DP-15"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!6:6","fromKeys":["MS-SEED-98c36050538db5d1@65ffe1e6e8668a51"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a9795361ed1e7913dcb645c1","from":"MS-SEED-ea7497b6cbeba00e@7470eaf94aa87c41","to":"MS-RULE-OP-04","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-csf-2","frameworkTitle":"NIST CSF","locator":"RS.CO — Incident Response Communication","suggestedCanonical":"OP-04"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!7:7","fromKeys":["MS-SEED-ea7497b6cbeba00e@7470eaf94aa87c41"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a91ea8fd4c6e91930dd3c724","from":"MS-SEED-ad9fe38d530f8f1e@d7fcddbdb30bd016","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-csf-2","frameworkTitle":"NIST CSF","locator":"ID.RA — Risk Assessment","suggestedCanonical":"DP-15"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!8:8","fromKeys":["MS-SEED-ad9fe38d530f8f1e@d7fcddbdb30bd016"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d5778e9c75b89f2053f21806","from":"MS-SEED-3c262146dff584d9@65146e1683c930ec","to":"MS-RULE-DP-01","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-800-53","frameworkTitle":"NIST 800-53","locator":"IA-5 — Authenticator Management","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!9:9","fromKeys":["MS-SEED-3c262146dff584d9@65146e1683c930ec"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1372ea1def7fc2417a04f753","from":"MS-SEED-3c262146dff584d9@65146e1683c930ec","to":"MS-RULE-DP-02","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-800-53","frameworkTitle":"NIST 800-53","locator":"IA-5 — Authenticator Management","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!9:9","fromKeys":["MS-SEED-3c262146dff584d9@65146e1683c930ec"],"toKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8e2f9d9ac150bc58b4e091ba","from":"MS-SEED-71dcb43d4ab69039@2cb8ac94477f4fc1","to":"MS-RULE-DP-05","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-800-53","frameworkTitle":"NIST 800-53","locator":"PT-2 / SI-19 — PII Processing & De-identification","suggestedCanonical":"DP-05"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!10:10","fromKeys":["MS-SEED-71dcb43d4ab69039@2cb8ac94477f4fc1"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-36864e675abc4ed1cedf177d","from":"MS-SEED-189bbb416d04da7a@9eca359a04a266eb","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-800-53","frameworkTitle":"NIST 800-53","locator":"CM-8 / SC-7 — System Inventory & Boundary Protection","suggestedCanonical":"DP-15"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!11:11","fromKeys":["MS-SEED-189bbb416d04da7a@9eca359a04a266eb"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-46484097d8011afd0a8a81f3","from":"MS-SEED-fa17b2e8b13c54ec@c3bb1f47e455b596","to":"MS-RULE-DP-12","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"nist-800-53","frameworkTitle":"NIST 800-53","locator":"AC-4 — Information Flow Enforcement","suggestedCanonical":"DP-12"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!12:12","fromKeys":["MS-SEED-fa17b2e8b13c54ec@c3bb1f47e455b596"],"toKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5e92c702b5f5937e3de83721","from":"MS-SEED-0d5943f602c4e0c6@0b72544338892151","to":"MS-RULE-DP-16","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"soc2","frameworkTitle":"SOC 2","locator":"CC6.1 / C1.1 — Logical Access & Confidentiality","suggestedCanonical":"DP-16"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!13:13","fromKeys":["MS-SEED-0d5943f602c4e0c6@0b72544338892151"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fb1a738f401514a8e3edd269","from":"MS-SEED-fabd8a5fa3829b34@a1173a790d6af788","to":"MS-RULE-DP-01","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"soc2","frameworkTitle":"SOC 2","locator":"CC6.1 — Logical & Physical Access Controls","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!14:14","fromKeys":["MS-SEED-fabd8a5fa3829b34@a1173a790d6af788"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-19dd26cf3a96fb18ce7e7a1d","from":"MS-SEED-fabd8a5fa3829b34@a1173a790d6af788","to":"MS-RULE-DP-02","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"soc2","frameworkTitle":"SOC 2","locator":"CC6.1 — Logical & Physical Access Controls","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!14:14","fromKeys":["MS-SEED-fabd8a5fa3829b34@a1173a790d6af788"],"toKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8ac2679f770e7765002d9b08","from":"MS-SEED-18fc98793e3aa932@1b1b44969e446920","to":"MS-RULE-DP-09","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"soc2","frameworkTitle":"SOC 2","locator":"C1.1 — Confidential Information Identification","suggestedCanonical":"DP-09"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!15:15","fromKeys":["MS-SEED-18fc98793e3aa932@1b1b44969e446920"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-91d9806f72c3600c68640f22","from":"MS-SEED-68e6b67355afdda4@2380ad816add7da2","to":"MS-RULE-DP-18","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"soc2","frameworkTitle":"SOC 2","locator":"CC4.2 — Internal Control Evaluations","suggestedCanonical":"DP-18 / DP-15"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!16:16","fromKeys":["MS-SEED-68e6b67355afdda4@2380ad816add7da2"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d34b8a1e87aaf1ee02628ad4","from":"MS-SEED-68e6b67355afdda4@2380ad816add7da2","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"soc2","frameworkTitle":"SOC 2","locator":"CC4.2 — Internal Control Evaluations","suggestedCanonical":"DP-18 / DP-15"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!16:16","fromKeys":["MS-SEED-68e6b67355afdda4@2380ad816add7da2"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-576639a4b3015242480ac229","from":"MS-SEED-1362e1ef9da30d6a@a69019f699a9743e","to":"MS-RULE-DP-05","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"hipaa","frameworkTitle":"HIPAA","locator":"45 CFR §164.514(b) — De-identification","suggestedCanonical":"DP-05"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!17:17","fromKeys":["MS-SEED-1362e1ef9da30d6a@a69019f699a9743e"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-624ecaf2d6ea8b032d5422c0","from":"MS-SEED-fc55d1561526efc3@99d4d53f8b22179d","to":"MS-RULE-DP-07","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"hipaa","frameworkTitle":"HIPAA","locator":"45 CFR §164.514(b)(2) — Identifiers","suggestedCanonical":"DP-07"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!18:18","fromKeys":["MS-SEED-fc55d1561526efc3@99d4d53f8b22179d"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ba63deb9de1690dad54679b7","from":"MS-SEED-273c936c3ac5a321@609ed6ce29a693b3","to":"MS-RULE-DP-07","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"hipaa","frameworkTitle":"HIPAA","locator":"45 CFR §164.514(b)(2) — Identifiers","suggestedCanonical":"DP-07"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!19:19","fromKeys":["MS-SEED-273c936c3ac5a321@609ed6ce29a693b3"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-235b0473e5a0510d2cd08314","from":"MS-SEED-38a0f0c058b76861@f7e97b882e8d03d9","to":"MS-RULE-DP-07","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"hipaa","frameworkTitle":"HIPAA","locator":"45 CFR §164.502 — Uses & Disclosures of PHI","suggestedCanonical":"DP-07"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!20:20","fromKeys":["MS-SEED-38a0f0c058b76861@f7e97b882e8d03d9"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-90eee87244723d31c36a1174","from":"MS-SEED-59116351fad45b18@cef308c28bb05b77","to":"MS-RULE-DP-03","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"pci-dss-4","frameworkTitle":"PCI DSS","locator":"Req. 3.4 — PAN Rendered Unreadable","suggestedCanonical":"DP-03"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!21:21","fromKeys":["MS-SEED-59116351fad45b18@cef308c28bb05b77"],"toKeys":["MS-RULE-DP-03@4cbb47b109e98f4a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3ee22ee45fc194905a7ce0a7","from":"MS-SEED-c3235745be75933b@c2946015ae62bccb","to":"MS-RULE-DP-04","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"pci-dss-4","frameworkTitle":"PCI DSS","locator":"Req. 3.3.1 — Sensitive Authentication Data","suggestedCanonical":"DP-04"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!22:22","fromKeys":["MS-SEED-c3235745be75933b@c2946015ae62bccb"],"toKeys":["MS-RULE-DP-04@13c6ba85197d9a69"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-564ce1cd5e1d711e1b3eb810","from":"MS-SEED-7c38f47e89353be2@c668276dcce2c02c","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"pci-dss-4","frameworkTitle":"PCI DSS","locator":"Req. 1.2 — Network Security Controls","suggestedCanonical":"DP-15"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!23:23","fromKeys":["MS-SEED-7c38f47e89353be2@c668276dcce2c02c"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a92c65f138582eab92b32b55","from":"MS-SEED-3545abaedc039060@41f9aeca34965328","to":"MS-RULE-DP-09","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"ccpa","frameworkTitle":"CCPA","locator":"Cal. Civ. Code §1798.140(v) — Personal Information","suggestedCanonical":"DP-09"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!24:24","fromKeys":["MS-SEED-3545abaedc039060@41f9aeca34965328"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b8e0675151037fd18b0b71da","from":"MS-SEED-f14ef687ebdcf6dd@e868935a9f5522b7","to":"MS-RULE-DP-09","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"ccpa","frameworkTitle":"CCPA","locator":"Cal. Civ. Code §1798.140(v) — Personal Information","suggestedCanonical":"DP-09"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!25:25","fromKeys":["MS-SEED-f14ef687ebdcf6dd@e868935a9f5522b7"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-24471ea4a2fe0fdf067c09b7","from":"MS-SEED-f24cc8315666f56b@0b522650197658e0","to":"MS-RULE-DP-05","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"ccpa","frameworkTitle":"CCPA","locator":"Cal. Civ. Code §1798.81.5 — Reasonable Security","suggestedCanonical":"DP-05"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!27:27","fromKeys":["MS-SEED-f24cc8315666f56b@0b522650197658e0"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-83ad83486972c67e934fd200","from":"MS-SEED-af63591ae8a0d1d3@cf9fcbd0c3f96907","to":"MS-RULE-DP-06","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"glba","frameworkTitle":"GLBA","locator":"Safeguards Rule, 16 CFR 314.4","suggestedCanonical":"DP-06"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!28:28","fromKeys":["MS-SEED-af63591ae8a0d1d3@cf9fcbd0c3f96907"],"toKeys":["MS-RULE-DP-06@af062b3863346b41"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-775e77b48fc6611321b1d1b2","from":"MS-SEED-9b9cda9c97338d12@ceb60bcac22b5550","to":"MS-RULE-DP-03","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"glba","frameworkTitle":"GLBA","locator":"Safeguards Rule, 16 CFR 314.4","suggestedCanonical":"DP-03"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!29:29","fromKeys":["MS-SEED-9b9cda9c97338d12@ceb60bcac22b5550"],"toKeys":["MS-RULE-DP-03@4cbb47b109e98f4a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-884b6370cee10275f9a1e352","from":"MS-SEED-45c0aa82a09ceac4@b7de303ed373dc1e","to":"MS-RULE-DP-06","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"glba","frameworkTitle":"GLBA","locator":"Privacy Rule, 16 CFR 313.10","suggestedCanonical":"DP-06"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!30:30","fromKeys":["MS-SEED-45c0aa82a09ceac4@b7de303ed373dc1e"],"toKeys":["MS-RULE-DP-06@af062b3863346b41"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-616296f1d2d91cf9d8823aca","from":"MS-SEED-6962f396beb2c752@af6c264d193e2846","to":"MS-RULE-DP-17","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"sox","frameworkTitle":"SOX","locator":"§409 — Real-Time Issuer Disclosures / Reg FD","suggestedCanonical":"DP-17"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!31:31","fromKeys":["MS-SEED-6962f396beb2c752@af6c264d193e2846"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c2fc077cadb082889ef804c2","from":"MS-SEED-274a1827288fe0cb@596d8feb02101b0a","to":"MS-RULE-DP-17","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"sox","frameworkTitle":"SOX","locator":"§302 — Corporate Responsibility for Reports","suggestedCanonical":"DP-17"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!32:32","fromKeys":["MS-SEED-274a1827288fe0cb@596d8feb02101b0a"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2224aa102b38d4cec17e8c7b","from":"MS-SEED-af6d2822af49aa78@15cfcad58c3a6910","to":"MS-RULE-DP-18","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"sox","frameworkTitle":"SOX","locator":"§802 — Records Retention","suggestedCanonical":"DP-18 / DP-15"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!33:33","fromKeys":["MS-SEED-af6d2822af49aa78@15cfcad58c3a6910"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-76afd2d390438e6dbe5e6875","from":"MS-SEED-af6d2822af49aa78@15cfcad58c3a6910","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"sox","frameworkTitle":"SOX","locator":"§802 — Records Retention","suggestedCanonical":"DP-18 / DP-15"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!33:33","fromKeys":["MS-SEED-af6d2822af49aa78@15cfcad58c3a6910"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9eceb0d2baf14a096740f221","from":"MS-SEED-773a80bd6da7f832@fbd7a85624f21c94","to":"MS-RULE-DP-01","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"fedramp","frameworkTitle":"FedRAMP","locator":"IA-5 — Authenticator Management","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!34:34","fromKeys":["MS-SEED-773a80bd6da7f832@fbd7a85624f21c94"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6b32ad81255175a047d98a8a","from":"MS-SEED-773a80bd6da7f832@fbd7a85624f21c94","to":"MS-RULE-DP-02","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"fedramp","frameworkTitle":"FedRAMP","locator":"IA-5 — Authenticator Management","suggestedCanonical":"DP-01 / DP-02"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!34:34","fromKeys":["MS-SEED-773a80bd6da7f832@fbd7a85624f21c94"],"toKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c863eed4b6a798a86c324377","from":"MS-SEED-db227e3fca1cbc72@ad3e673390385458","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"fedramp","frameworkTitle":"FedRAMP","locator":"CA-3 — Information Exchange","suggestedCanonical":"DP-15"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!35:35","fromKeys":["MS-SEED-db227e3fca1cbc72@ad3e673390385458"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4a51ed8451bf94fa5b56a55f","from":"MS-SEED-3b2df0684d924bea@d76862e507e52a9e","to":"MS-RULE-DP-15","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"fedramp","frameworkTitle":"FedRAMP","locator":"SC-7 — Boundary Protection","suggestedCanonical":"DP-15"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!36:36","fromKeys":["MS-SEED-3b2df0684d924bea@d76862e507e52a9e"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f17b7476e1ba84d360ba14fa","from":"MS-SEED-3a800d0a422ff4cf@bb27bd955ce6ac5b","to":"MS-RULE-DP-08","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"ferpa","frameworkTitle":"FERPA","locator":"34 CFR §99.30 — Prior Consent to Disclose","suggestedCanonical":"DP-08"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!37:37","fromKeys":["MS-SEED-3a800d0a422ff4cf@bb27bd955ce6ac5b"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e6b1b0b6d03ddf72616e92b2","from":"MS-SEED-e7da922c47d356c8@a8f292c00608d481","to":"MS-RULE-DP-05","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"ferpa","frameworkTitle":"FERPA","locator":"34 CFR §99.3 — Personally Identifiable Information","suggestedCanonical":"DP-05"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!38:38","fromKeys":["MS-SEED-e7da922c47d356c8@a8f292c00608d481"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-814a0fac16ad311c7da718ef","from":"MS-SEED-0318ca8123595a60@ce3f096f7c803475","to":"MS-RULE-DP-08","kind":"SUGGESTED_CANONICAL_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"frameworkCode":"ferpa","frameworkTitle":"FERPA","locator":"34 CFR §99.37 — Directory Information","suggestedCanonical":"DP-08"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'12 Code Seed Crosswalk'!39:39","fromKeys":["MS-SEED-0318ca8123595a60@ce3f096f7c803475"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-64d23bf9af84c525763d1f23","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.1\n8.7\n9.11.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1289f06485ef85c11f59d97c","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018\n5.4.2 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a3468e4b98f56ebcca32c50f","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.1.3\n6.3.4.3\n6.3.8.3\n6.4.1.3\n6.4.2.3\n6.4.3.3\n6.4.8.2\n6.4.8.3\n6.4.17\n6.4.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b7d5f676c2be23fd6b836985","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n5.5\n6.1\n6.4\n6.6.1\n6.7.3\nA.1.2\nA.1.3\nA.1.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ac7b094e08282af8c741b0dc","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.2\n5.15.1\n5.15.5\n5.17\n5.18\n5.19.5.4\n5.19.7.3\n6.2.2\n8.1\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cbc3bc985f7a76a6e7e5cdf1","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-79c33986184082a75cc08c16","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-310d3a096fcf39e531b96d58","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4f0eed18c5769d4a821a4ef7","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-38b8eaddebf9f6809a64f035","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-628f6ca09c3dd20b8fb196e9","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fa01bcba7404475171442566","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9e81dbff2f6a2b8e4b23cdba","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a1dfd81b642a37693e0d7617","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1 - Understanding the organization and its context\n6.2 - AI objectives and planning to achieve them\nB.2.2 - AI policy\nB.2.4 - Review of the AI policy","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9f193ccdf3a02484e38b96a1","from":"TAIM-GOVERN-1.1@26b8d9618cddf058","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Alabama: Enacted facial recognition restrictions (2022) and laws against sexual and political deepfakes (2024).\nAlaska: No significant AI-specific legislation enacted as of April 2025.\nArkansas: Proposed bills (HB127, SB59) to criminalize deceptive deepfakes in elections and require AI chatbot disclosures.\nCalifornia: Deepfake regulations (electoral and sexual), chatbot disclosures, bias audits for criminal justice agencies; vetoed AI safety bill (Sept 2024); exploring AI avatars for court rulings.\nIdaho: Bill introduced that requires AI chatbot disclosures in consumer transactions (2025).\nKansas: No significant AI-specific legislation enacted as of April 2025.\nMississippi: Enacted political and sexual deepfake laws (2024).\nMissouri: No significant AI-specific legislation enacted as of April 2025.\nMontana: No significant AI-specific legislation enacted as of April 2025.\nNebraska: No significant AI-specific legislation enacted as of April 2025.\nNew Hampshire: Prohibits Department of Motor Vehicles use of Facial recognition technology (2014/2016); sexual deepfake and election fraud laws (2024).\nOhio: No significant AI-specific legislation enacted as of April 2025.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA establishes many new statutory requirements for legal compliance in use, deployment, and prohibited uses of AI (e.g., manipulation, discrimination, certain biometrics).\nUtah: AI Policy Act (2024): UAIPA liability cannot be transferred to AI reinforces NIST's accountability even when AI is involved; legal responsibility must be maintained.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!2:2","fromKeys":["TAIM-GOVERN-1.1@26b8d9618cddf058"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a0330ccf286adab4500d3f7b","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.2\n9.3\n9.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-51d8d255a2b7694144bd0dad","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.3.3\n6.5.5.1\n6.5.5.5\n8.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-979d9a831e59129f8cc94926","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-392848753fea7d72b5469758","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n5.2\n6.3.8.3\n6.4.2.3\n6.4.3.1\n6.4.11.1\nA.2.3\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-96d9d5f5711f0b23cac71e4a","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ef383fce06c2a85496f1e11e","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1f988374ac7b948bb23e3531","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RR-03\nGV.SC-01\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4a3c6ad91614ebb50e6894be","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-be02818984c37df0e0765ce1","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2427d67c6948743bcad4616b","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-02a5971ef51304b218f51352","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ded4337ad266d1096dedf548","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de2e63684894f3257228fdf0","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8b263be90927d63e30be3691","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cb84e06a4474617dae5cda07","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.9.3 - Objectives for responsible use of AI system\nB.6.1.2 - Objectives for responsible development of AI system\nB.6.1.3 - Processes for responsible design and development of AI systems\nB.10.3 - Suppliers\nB.2.2 - AI policy\n4.4 - AI management system\n5.2 - AI Policy","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eed41d133d9773128eba9356","from":"TAIM-GOVERN-1.2@91a9127ceb89507e","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA requires alignment with NIST AI RMF and ISO 42001, which codifies adherence to trustworthy AI characteristics and risk frameworks.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!3:3","fromKeys":["TAIM-GOVERN-1.2@91a9127ceb89507e"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-80cf07198c006b794ead4219","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-11cb612a981ec7f717d56189","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f42149273121044bb114b6fd","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.2 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-13aa7c76b5cf1cfd9b821bd5","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.3.4\n6.4.3.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a27b2f159a0d7b93257ed8ea","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-431a3dab9b4ed49dbf24158a","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.2\n6.2.5\n6.2.6\n6.2.7\n9.4\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-92dc6d271723f0f0000bc0d1","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d1ad51cdd2b173cff90ca216","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b4d9201e2db8528537221e8b","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-79e62be6fd3a1951d0bc31eb","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d94c1f517e85de53bbd3cdde","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-08e7ef934835d09cd11f21ff","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c6de2657930e1dd1e6918130","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0a15127a60f1fef853ad2870","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6a84370cab6a2b7788770d1a","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.2 - AI risk assessment_x000D_\n6.1.1 - General_x000D_\n6.1.3 - AI risk treatment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e5a4969203d846f7ca3525f6","from":"TAIM-GOVERN-1.3@d61a82d09de245d3","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!4:4","fromKeys":["TAIM-GOVERN-1.3@d61a82d09de245d3"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8536c6d5ea046e48bed17828","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dc9527c1e24f06e67846fb97","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3b28fbb673074ea60611295c","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5471abd6250da40407a5a55f","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.3.4\n6.3.5.3\n6.4.3.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1a3127c7f7eca798abf5a778","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d8f3d363339b95ea6a0228b6","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f92a2149c7b0aa14eb0901d5","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.PO-01","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-457df75d569f656097d06b40","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a34ce0b6c9aed0287063e184","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-30e15e301771e6dbcf92be17","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b4a35070ad1a9ee98fec15d4","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c474a6f9a0c955ef327c5ab8","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a0ee7df2a3df7f76272a590c","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-699f8ec52d63ee37c1f72122","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ab3686a8b9cbfa9df95d340","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment_x000D_\n8.3 - AI risk treatment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7a21aadadda610ab75a53b94","from":"TAIM-GOVERN-1.4@a744d71de8e42bb8","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA applies to government and covered healthcare disclosure, prohibits dark patterns, mandates transparency when AI is in use.\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!5:5","fromKeys":["TAIM-GOVERN-1.4@a744d71de8e42bb8"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-771da0f40e64b95582c60763","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-21588ca8cb7b7dde61947e65","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3\n8.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-00ad1fd3ffd7be1ff73d0be5","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.6 - ISO 31000:2018\n5.4.3 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ac5a8612e71ca334b0ba54c0","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1\n5.4.3\n6.1.1.2\n6.1.2\n6.2.1\n6.2.2\n6.2.3.2\n6.2.4.2\n6.2.5.2\n6.2.6.2\n6.3.1.2\n6.3.2.2\n6.3.3.2\n6.3.4.2\n6.3.5.2\n6.3.6.2\n6.3.7\n6.3.8.2\n6.4.1.2\n6.4.2.2\n6.4.3.2\n6.4.4\n6.4.5\n6.4.6\n6.4.7.2\n6.4.8.2\n6.4.9.2\n6.4.10\n6.4.11.2\n6.4.12.2\n6.4.14.2\n6.4.15.2\n6.4.16.2\n6.4.17.2\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b9e134d3ba04d01e5cf14eeb","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2\n6.3\n6.5\n6.7.1\n6.7.2\n6.7.3\nA.1.3\nA.1.4\nA.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9c584cfa0d8bdfa055ceee63","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.19","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8457f99a74af4295f8074a4a","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OV-01","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-63028dcbf744ec661b6faa51","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d4520a119ed4f9e57a8e8ffb","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a5cc1b112f914bad4c18753c","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dcf77719a8e0d398af955f93","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d65155be7964a322ecefd4ec","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d8f9b2acd5f510464f4ab519","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ef60ba6b8fa5c62baea7b135","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-142de42c3d219233653efab5","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.2 - AI risk assessment_x000D_\n8.3 - AI risk treatment_x000D_\n8.4 - AI system impact assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c2e2c22421a8b4ae9f36aa21","from":"TAIM-GOVERN-1.5@e6be6927d32f915f","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!6:6","fromKeys":["TAIM-GOVERN-1.5@e6be6927d32f915f"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5c6a35b9e6b08f5c80144859","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f4b156f7b7e3e9b79a61329d","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d55e858c08722c69ff48254b","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n6.2.3.3\n6.2.4.1\n6.2.4.3\n6.2.6.3\n6.3.1.1\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-43693d6be13603c206215cd2","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n5.3\n6.3\n6.7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c0fe265e9da53a13be38223b","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-63423d5f3d8efe6ef3623d5d","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.AM-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d16ad7022691cb3b51476081","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0fd7b3232d06462cd24ba96f","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-35e4eca56edd3f50f8f5df7d","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-908a096378888c9a78a0db4a","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-da5755caaa7900213c5f53a0","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ef462578f5fc2c7e42c34ec","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4739ab806c92c37fea57096b","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f9bfaed958488846ae06887a","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.4.5 - System and computing resources_x000D_\nB.4.3 - Data resources_x000D_\nB.4.4 - Tooling resources_x000D_\nB.4.6 - Human resources_x000D_\nB.4.2 - Resource documentation","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e6cd968087d018a98d73f6da","from":"TAIM-GOVERN-1.6@26f041bc196d2f20","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Connecticut: Established AI Task Force (2023); developing \"AI Bill of Rights\"; mandates annual inventory of state AI systems.\nNew Jersey: Governor's AI Task Force to study impact (2023).\nOklahoma: Governor's AI task force to study and develop policy recommendations (2023).\nPennsylvania: Generative AI Governing Board to guide policy, use, and deployment (2023).\nSouth Carolina: House AI study special committee (2024).\nWest Virginia: 2023 supply chain and AI hearing.\nWyoming: Select committee discussing synthetic media regulations (2023).","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!7:7","fromKeys":["TAIM-GOVERN-1.6@26f041bc196d2f20"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e445e5f115fc37d522eb6b43","from":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!8:8","fromKeys":["TAIM-GOVERN-1.7@a55511fa1ec1c70a"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-feb3863d4578aea39797dc90","from":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.3.3.3\n6.4.8.2\n6.4.8.3\n6.4.17.1\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!8:8","fromKeys":["TAIM-GOVERN-1.7@a55511fa1ec1c70a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d48f7656e1d2410557ca61e3","from":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n5.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!8:8","fromKeys":["TAIM-GOVERN-1.7@a55511fa1ec1c70a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c503def8a9e869290e35a921","from":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.9","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!8:8","fromKeys":["TAIM-GOVERN-1.7@a55511fa1ec1c70a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-284b12d6a8c4b8aeebb5926e","from":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.6 - AI system operation and monitoring","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!8:8","fromKeys":["TAIM-GOVERN-1.7@a55511fa1ec1c70a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0d214f3a26c81cecbb25ebaa","from":"TAIM-GOVERN-1.7@a55511fa1ec1c70a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!8:8","fromKeys":["TAIM-GOVERN-1.7@a55511fa1ec1c70a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9d4d1b90708f34a780d8bd5a","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-37896a24e53f174c9f0f5e76","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0897687d2e442b599d19c435","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.5 - ISO 3100:2018\n6.2 ISO 3100:2015","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7da2c967e08f0eb8be5f9849","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.4.3\n6.4.2.3\n6.4.7.3\n6.4.9.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-617f9c9c810bb755838f07bd","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1\n6.2\n6.3\n6.7.1\n6.7.3\nA2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-399d39188bd00a1480ec30be","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.19","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5b6be2bae3151aa7c3fa861d","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.1 - Monitoring, measurement, analysis, and evaluation\n5.3 - Roles, responsibilities and authorities\n7.1 - Resources\n7.2 - Competence\n7.3 - Awareness\n7.4 - Communication\nB.3.2 - AI roles and responsibilities","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-06f7edb6d053bf787665faa5","from":"TAIM-GOVERN-2.1@677e9c1589774ef7","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA establishes AG enforcement, complaints portal, and state advisory council with defined statutory responsibilities.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!9:9","fromKeys":["TAIM-GOVERN-2.1@677e9c1589774ef7"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f9152262d6b939e448ff5871","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-90a8d46ce4ebcb39ac55b476","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5fc5c5afd0aa708915dad20e","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.12.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4da4638a2b8db39d865c700b","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1\n4.3\n5.1\n6.7.2\n6.7.5\nA.1.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-802e3f40f90b0c0b7eecc86d","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2015700ad87a1a62b65bb015","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"PR.AT-01\nPR.AT-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b93d8c43d54fbd58bd503100","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-812ab940ee8051429c79ba69","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fe3559eb905ac3bd807f4d55","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a6f43e0c7ced43db79e961bf","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9a9f9b7fc976358b88d8ad6e","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1870a24d34213d1b1dcdd2ad","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-49ae936bb8bca657e5bb8adf","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ea39a94301f388701db1a323","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.2 - Competence","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-97e2b4d2ada1ef7f0f10d7bc","from":"TAIM-GOVERN-2.2@212a87832b3bc07a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!10:10","fromKeys":["TAIM-GOVERN-2.2@212a87832b3bc07a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1718ed59166360463ff41358","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"A.2.2.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fe3f4944a11c94f809f026b8","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c0945a446d4c698565cda19d","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3\n6.4.3.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-67b21d4720a42e35974fce66","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8b3f2d318b2f99f5fdc7fbff","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6db046ac963e04ec5bc27ed9","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-04\nGV.RR-01","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2ecfee84643e7e9cf85d3a42","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b8848626495b368e1d5837ed","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ccaff8a5bfa963f6263b5f73","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9ea9b73428cc59612899988e","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6a224bdd4dd23229abf88dbf","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f70956e7d67ee2b3c57aca6d","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-06731a35ec5cc818d4f90758","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-07d9ff96cfe3e7e7bb3c52c6","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1 - Leadership and commitment\n9.3.1 - General\n9.3.2 - Management review inputs\n9.3.3 - Management review results\n5.2 - AI Policy\nB.2.2 - AI Policy","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-945d0233b3f38f7288fcc645","from":"TAIM-GOVERN-2.3@dcf6e30f1cfaf00a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!11:11","fromKeys":["TAIM-GOVERN-2.3@dcf6e30f1cfaf00a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-acdbcf447a90f1a30252c438","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a6f24285ea91a85260b51ad7","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0e616d8bdbb9d0b455a342e8","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c6fc9eef600dc1acfbd50610","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-55043be1b584bef1f3f442c0","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.3\n6.5\n6.7.1\n6.7.2\n6.7.3\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6bb0cd7b337a89edbc3e7754","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4da6155f6d704f57ef29237b","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.4.6 - Human resources_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9a5d6a61337bb166faf9ad98","from":"TAIM-GOVERN-3.1@0f38f1685d8ed670","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!12:12","fromKeys":["TAIM-GOVERN-3.1@0f38f1685d8ed670"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-25f0295c18b2e730197078a1","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e725dcf132a7ba9763dfa356","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e843735ca8dccc6fe146c79f","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.3 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5870d345257361bc91e9dcce","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5e5cd695a49d3c0985a0ce60","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.2\n6.6.2\n6.7.4\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-74e75ac170cd6d591559d2a0","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.5\n3.1.16\n3.3.3\n5.1\n5.13\n7.1\n7.4.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d529e66eff077f6d4a26dc4a","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.SC-01","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-da01b358b1f9f7e60075e89d","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d56588413ab1de1a2e6e0b6d","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c34d3b80b7e19ab2b54557e2","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dddaeb346cadbac0cb3c898f","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-93c2035f1977550e4d07d634","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5b999ec11f4e5f04ed0f22ec","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4a9d325e09189fd040c98b83","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3aa7c288f0879564c2274961","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.9.3 - Objectives for responsible use of AI system_x000D_\nB.4.6 - Human resources_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\n7.2 - Competence_x000D_\nB.3.2 - Management review inputs","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7cd1e3ed729f8fb881ab977f","from":"TAIM-GOVERN-3.2@c47019573b68992a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!13:13","fromKeys":["TAIM-GOVERN-3.2@c47019573b68992a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bce13933b166c83e4a783705","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a1a3cae11f6c0f8084d315c0","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-445df1bd276e37e685b8fb57","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.3\n6.4.2.6\n6.4.3.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-01b6ca62e9ce9f1565910894","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3\n6.4.3.3\n6.4.17.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8cf9bb2474e302724640fc44","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-45a408b1991fee14dfe1912f","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.16\n5.15.2\n5.15.3\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ef1fc59053cf7bd01dbc3fb2","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.AM-05\nID.RA-04\nID.RA-05\nID.RA-07\nDE.AE-04","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cb42bd5d8acfebe47a9089aa","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5cc9a9093a5117150f17da36","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e425f6dcb14bf7f376c8ce15","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6c8a38a7d44f0a75d90e6728","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-da14fd880e32ab5d1c62d4ab","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-84753c2fc1aa0bc218882de0","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bd767c4b398db5af2703caeb","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e52bfb592e95ed353884fed8","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.2 - AI system impact assessment process\nB.6.1.2 - Objectives for responsible development of AI system\nB.6.1.3 - Processes for responsible design and development of AI systems\nB.6.2.4 - AI system verification and validation\nB.9.2 - Processes for responsible use of AI systems\nB.9.3 - Objectives for responsible use of AI system\nB.10.3 - Suppliers\nB.5.4 - Assessing AI system impact on individuals and groups of individuals","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ec812f6b1fb04b6cd2b741f0","from":"TAIM-GOVERN-4.1@7578cf0aafb78c9f","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!14:14","fromKeys":["TAIM-GOVERN-4.1@7578cf0aafb78c9f"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-75d721ccbb0aa2b40416c8bb","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ecc493fb7190188d636152ee","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0b755791242aa8ce74af446e","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f78b2219f84885319acaef80","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.8.3\n6.4.2.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d37b831edf8253426f17acdd","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2\n4.3\n5.5\n6.1\n6.3\n6.5\n6.6.1\n6.7.2\n6.7.4\n6.7.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-faafe85f48970e36468dafe1","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.18","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6e5aefda79cf3def7e6bf467","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.AM-05\nID.RA-04\nID.RA-05\nID.RA-07\nDE.AE-04","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d41ced7d55d02e62257c462b","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-673a66845ba23cb9c67d1ec6","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-04e90aeb61cd88be24e2d1a6","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-524fda15388b58a4364a99f6","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-42dd58ca543358c7b8594dc4","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6e9318fb2f5b012509f91c5b","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e36c873898850a6d9bc51e8d","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3b2e457a16e38c533652208c","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.8.5 - Information for interested parties_x000D_\n7.4 - Communication_x000D_\n6.1.4 - AI system impact assessment_x000D_\nB.5.5 - Assessing societal impacts of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-82923666e694e31adc61d985","from":"TAIM-GOVERN-4.2@44e6aa7d11a0ed2b","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA requires public disclosure and notification to consumers when HRAIS (High Risk AI Systems) are used, so NIST builds transparency into system operation and consumer rights.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is implicit on where use or deployment of AI in a prohibited or high-risk context is banned or must be reported.\nUtah: AI Policy Act (2024): UAIPA requirement for mandatory GenAI disclosure at first interaction (regulated occupations and consumer settings) maps as NIST requires communication of AI system involvement and its risks​; UAIPA liability cannot be transferred to AI reinforces NIST's accountability even when AI is involved; legal responsibility must be maintained.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!15:15","fromKeys":["TAIM-GOVERN-4.2@44e6aa7d11a0ed2b"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-46346835bbf70faf78282bdc","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7b5c3636c66cedb187a28e74","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.4\n6.4\n7.2\n8.2\n8.4\n8.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-07adf44033409125c41deeac","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d42b1ae203b269868c6c450a","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.15.3\n6.4.16.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aaabd5b2f691bcc5c958a7a1","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.7.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6282e5d4dd8e36d9b14a9375","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.10\n5.15.4\n6.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-06c0503e326c000c435a0e60","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"RS.CO-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fcfa32bab6ffb5a0f806d99d","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-79dadc972cdc5e75a57992c1","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2ab9bb0f2591bd7b788ea8ab","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8c4b66ae9533aa549c4ff177","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ccfc319406f2794cfbbd4e3","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-52cf410cabb04ed29081a7c8","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3e1737b5cb83bdf8e71374d0","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8b4192ea67d1f2f7e84f6fc4","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users_x000D_\nB.8.3 - External reporting_x000D_\nB.8.4 - Communication of incidents_x000D_\nB.8.5 - Information for interested parties_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ade830c51d1eb94aea35a919","from":"TAIM-GOVERN-4.3@87ee4878e85c702a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!16:16","fromKeys":["TAIM-GOVERN-4.3@87ee4878e85c702a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c7a843ea135a220450424255","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-21c00a98c067d8aa48e4f01c","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.6\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-468798ce3e91a6e625dc13fd","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.5 - ISO 3100:2018\n6.2 - ISO 3100:2015","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ea47a183ef4bdc7c7add418a","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n6.4.3.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d055045ba60ab5725d657db1","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n5.1\n5.2.3\n5.4\n5.5\n6.5\n6.7.2\nA.1.3\nA.1.4\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8c97ecfe8ea6b9bd80c53395","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.11.4\n5.18\n8.6.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b8feae5c3489677721577543","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"DE.AE-04","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-873032d1a4848373c309e9ef","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d5b79d8472a4d4b0f71d54e0","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4c3397a0dcec7f4e50b4eb1b","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-45e8d6a0c6c15e6db056d010","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8b4fd1165dad6095a588c884","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1bd9481b15f4168f5fb22a5b","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-480052e6c42245c418bf9cb9","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-31a79406f459602bcd21b4c5","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.10.4 - Customers_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.8.3 - External reporting","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a9abce864c29951984b46718","from":"TAIM-GOVERN-5.1@79d104cee5d0ed7e","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.\nUtah: AI Policy Act (2024): UAIPA establishes an Office of AI Policy, which institutionalizes stakeholder engagement and public sector governance for ongoing oversight.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!17:17","fromKeys":["TAIM-GOVERN-5.1@79d104cee5d0ed7e"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-31e60e1cd81a110fc0eed9dd","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.4.2\n9.10.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ad5ad624162e347dc1e254e1","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1\n8.4\n8.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de187b038dcde7ce7d58b806","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.5 - ISO 3100:2018\n6.2 - ISO 3100:2015","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-667d70c26478eb48bdae0be6","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n5.3\n6.3.5.3\n6.4.5\n6.4.9.1\n6.4.12.3\n6.4.15.3\n6.4.16.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5cc945ca554953242b69770b","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2.3\n5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1d56bcbdec47c6f361ee03f2","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.11.4\n5.18\n8.6.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eb2ca13913b4c788b10b1e15","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"RS.CO-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a254ef8ac3d5b927bc0b8464","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2bfa7651b7093601471491a2","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eca52e155878c59eb003dce2","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-79fcd77c61f46eb57d0cf888","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-617b1e3b4f61f536d8983488","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d6a5dc688256af3b68324e60","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bac58c5cfeb86bf3c32fca10","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-47bb6b030790223a72652f3f","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.8.3 - External reporting_x000D_\nB.10.4 - Customers_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-06a33484abfe9d3827af212a","from":"TAIM-GOVERN-5.2@0c282eb98e0d233a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.\nUtah: AI Policy Act (2024): UAIPA establishes an Office of AI Policy, which institutionalizes stakeholder engagement and public sector governance for ongoing oversight.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!18:18","fromKeys":["TAIM-GOVERN-5.2@0c282eb98e0d233a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-487126ad4fe4069224260afc","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0ef0e32260642e327652e5f1","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d4325c82e59576489fa4e4e5","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0c8d66c7721efa9761e10aa3","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.5\n6.4\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f4a06bd9a4f6ee1819f4a21b","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-058291c29feed076112b4fc1","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.SC-05","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-764e9f66ec3889f8359af584","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f5af45cc400ba4393fe97649","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-30e2f44cc6c3cf4b26a0f631","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fe70b9a3f673336f13084522","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-47d28d1ef7fce12b79582bac","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-81cc7b01da18392eeee7ad1b","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ed65457dc110728a07689d81","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f66461945833820effaaa7dc","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.10.2 - Allocating responsibilities_x000D_\nB.10.3 - Suppliers","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f0d707ea4b147eb1a623380a","from":"TAIM-GOVERN-6.1@fc5e93781b104482","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!19:19","fromKeys":["TAIM-GOVERN-6.1@fc5e93781b104482"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ec8a69e584664e40cc630202","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9ffc7b8d1e7d2e5ef022aebd","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8c37e1928e0f3063bf0a15a9","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ef299064471ceee8bd12abfb","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.15.3\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-97f358be4aab09617b56b34d","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.7.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de2f1f9276ef13c3a9071eb3","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3f167f366da8fb6d5a08e930","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.SC-10","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-912944b34df261c9f995257f","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cdf07400dc57032d2bfe5333","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-960c15214fc99453e6dd2b83","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3796eb1b2242dade62435947","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-66110547032acc01857deb80","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ea606d91ecfe7d0c4b6c8a79","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-43bbc511bd7fe84aebfceb5c","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-45b2a4106ab22aa573c3afc6","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.10.2 - Allocating responsibilities_x000D_\nB.10.3 - Suppliers","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7c60bc5a4a107b190acb7cc2","from":"TAIM-GOVERN-6.2@bfdb82176b6f4825","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA here encourages this and it's achievable through “safe harbor” adoption of NIST AI RMF, but not required by statute.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!20:20","fromKeys":["TAIM-GOVERN-6.2@bfdb82176b6f4825"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c4a47b4be773df233566a533","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-78be8d2608b5ce3d9a11a880","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3\n6.5.1\n6.5.5\n8.2\n8.5\n8.8\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-702f562f99792843404d988b","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.6\n6.5.2 - ISO 31000:2018\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7615e9f9bd2ad445b5382487","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2\n6.3.4.3\n6.4.2.1\n6.4.13.1\n6.4.15.3\n6.4.17.1\nA.2.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3700d368f5f282d481760b52","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2\n4.3\n5.3\n6.4\n6.7.4\n6.7.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5a5d377d339e39120697b2e1","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.13\n5.15.2\n5.16\n5.17\n6.2.2\n7.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c9b8378923f02d6dc2b6aff9","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"PR.PS-06","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3d107e1e6b3f4d9ce2265968","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-589d7338535edfe6c9d76c19","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-622d8294b39ca1b44709dbfb","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9d9c21e9519d9966430a6bab","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0800f54560453c7963388479","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-52ccdea84616dfd8c80fb6d9","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-18862f19e0f503f1ee7e21d3","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-69687b568ed11b9ae3e6779a","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.4 - AI system impact assessment_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e5b2015a4aac28e5b27fa8f6","from":"TAIM-MAP-1.1@78b3fb055e68bb28","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Arizona: Supreme Court uses AI avatars for judicial transparency (2025); laws against sexual and political deepfakes (2024); SB640 (2025) requires chatbot disclosure in consumer interactions.\nColorado: Colorado AI Act (2024): CAIA requires public disclosure and notification to consumers when HRAIS (High Risk AI Systems) are used, so NIST maps consequential use contexts and provides system knowledge boundaries.\nNevada: SB2203 requires AI company registration and misinformation frameworks; proposed synthetic media disclosure for elections (2025).\nNew Mexico: Proposed AI regulations to regulate child profiling (2024).\nNorth Dakota: HB1167 proposed AI election disclaimers (2025).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA requires clear disclosure, bans deployment for certain uses (e.g., behavioral manipulation, social scoring by government).\nUtah: AI Policy Act (2024): UAIPA is a context-specific law and ​mapping this disclosure requirement into the AI’s deployment context aligns with this subcategory relating to knowledge limits and human oversight of AI.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!21:21","fromKeys":["TAIM-MAP-1.1@78b3fb055e68bb28"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b43924e3f2b8728e3b333f54","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2dd953a2dbeae39f212ae4ba","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n6.2.3.3\n6.2.4.1\n6.2.4.3\n6.2.6.1\n6.2.6.3\n6.4.9.4\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8a88766907aecfb1e2ffd2ed","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"A.1.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b65e306ba9cb013e5a4f8ed5","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-64f09b3d5eba6e79f4135495","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"PR.AT-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aa6183d4eb3a5f33f2fee4cd","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0b9c5a69977d2c6a1b3cc495","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-99e99e73dd9806d1a84495ec","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-09ab2d8298209236ba97f019","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-599310628560981b266fa7a5","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f0c10709bc024dcdadc80a93","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3773345f132bb0d328ded31b","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-61a6a2b9daf961be5d285117","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.4.6 - Human resources_x000D_\n7.2 - Competence","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f89dedff9f5cfcafe59f043d","from":"TAIM-MAP-1.2@88267d6e5486e9ff","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Utah: AI Policy Act (2024): Requirement for prominent GenAI disclosure in professions requiring state licensure, such as healthcare, accounting, and law ties directly to disclosure of AI involvement and ensuring the user knows the limits of GenAI's role.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!22:22","fromKeys":["TAIM-MAP-1.2@88267d6e5486e9ff"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7055b6ddf88a486ac7526e72","from":"TAIM-MAP-1.3@1e631023c1414ce6","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!23:23","fromKeys":["TAIM-MAP-1.3@1e631023c1414ce6"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-26032b274d713614cc224e84","from":"TAIM-MAP-1.3@1e631023c1414ce6","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.1\n6.3\n7.6\n8.1\n8.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!23:23","fromKeys":["TAIM-MAP-1.3@1e631023c1414ce6"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-72b54c94056145cd8fd5ccb5","from":"TAIM-MAP-1.3@1e631023c1414ce6","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.1\n6.4.13.1\nA.2.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!23:23","fromKeys":["TAIM-MAP-1.3@1e631023c1414ce6"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b95c2b94a782f9868dbed460","from":"TAIM-MAP-1.3@1e631023c1414ce6","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1\nA.1.1\nA.1.4\nA.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!23:23","fromKeys":["TAIM-MAP-1.3@1e631023c1414ce6"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-51c9a9c6440d58bf47411306","from":"TAIM-MAP-1.3@1e631023c1414ce6","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!23:23","fromKeys":["TAIM-MAP-1.3@1e631023c1414ce6"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d021169c93312f0038a494db","from":"TAIM-MAP-1.3@1e631023c1414ce6","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1 - Understanding the organization and its context_x000D_\n5.2 - AI Policy_x000D_\n6.2 - AI objectives and planning to achieve them_x000D_\n7.5.3 - Control of documented information_x000D_\n7.3 - Awareness_x000D_\n7.4 - Communication","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!23:23","fromKeys":["TAIM-MAP-1.3@1e631023c1414ce6"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a772a4481cd0d26e567dfc4b","from":"TAIM-MAP-1.4@576a9621f7b44f60","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2\n8.8.2.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!24:24","fromKeys":["TAIM-MAP-1.4@576a9621f7b44f60"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-168e28c1cca3429a7a9f6035","from":"TAIM-MAP-1.4@576a9621f7b44f60","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.2\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!24:24","fromKeys":["TAIM-MAP-1.4@576a9621f7b44f60"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-727f1952cf4b49d6afcda05e","from":"TAIM-MAP-1.4@576a9621f7b44f60","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1\n5.4.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!24:24","fromKeys":["TAIM-MAP-1.4@576a9621f7b44f60"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-26204fc3e3a91a85f91184f1","from":"TAIM-MAP-1.4@576a9621f7b44f60","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.1.3\n6.2.3.3\n6.2.4.1\n6.3.2.1\n6.4.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!24:24","fromKeys":["TAIM-MAP-1.4@576a9621f7b44f60"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9d3e1514d81109791980ada0","from":"TAIM-MAP-1.4@576a9621f7b44f60","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4\nA.1.2\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!24:24","fromKeys":["TAIM-MAP-1.4@576a9621f7b44f60"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7898b20f55fa2d456fb72d46","from":"TAIM-MAP-1.4@576a9621f7b44f60","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.10\n6.2.2\n7.1\n7.4.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!24:24","fromKeys":["TAIM-MAP-1.4@576a9621f7b44f60"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5e1eabf96c2d61b88a3b3f95","from":"TAIM-MAP-1.4@576a9621f7b44f60","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1 - Leadership and commitment_x000D_\n4.1 - Understanding the organization and its context_x000D_\nB.2.2 - Customers_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.9.4 - Intended use of the AI system_x000D_\nB.6.2.2 - AI system requirements and specification","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!24:24","fromKeys":["TAIM-MAP-1.4@576a9621f7b44f60"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2dd9398cbeb3d41676cca904","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a67bfa04f58a4189f745a8c0","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e8febf672e994c3f85b6d70c","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5f1be013b23e84990270573e","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2\n4.3\n5.5\n6.6.1\n6.7.1\n6.7.2\n6.7.3\n6.7.5\nA.1.4\nA.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-983760cedd99faaf6372d384","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.18\n6.1\n6.2.2\n6.2.3\n6.2.4\n6.2.5\n6.2.6\n6.2.7\n6.2.8\n9.4\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-59f95440c98cb4afb2214705","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1f9139539feeed47c0e92055","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-493d6ff9d01beb69640b40a9","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-468de265f21be0426635761d","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9d6189f2294330c59c6c1f82","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4880c0f1d3327989ec03820d","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c39f4cdc7b7883a2ec65d0b0","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7cc950e269b769dd68a1b05e","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f860d3aa831341c0d4f3bd4b","from":"TAIM-MAP-1.5@076d4983d14ef5a0","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.1 - Objective","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!25:25","fromKeys":["TAIM-MAP-1.5@076d4983d14ef5a0"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-94e5813b2583abc09f74a29f","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-10222c5409b0df653e9f9b3d","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e63a869dc2ffa10522164e9e","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-83de687ff3dcc3890fa57c6b","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3\n6.4.1.3\n6.4.3.3\n6.4.8.3\n6.4.17.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6b8cb774981a3e13b7770c5a","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.4\n6.6.2\n6.7.2\n6.7.3\n6.7.5\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cb7e8e2958750757a0d94876","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.11\n3.5.14\n3.5.15\n3.5.16\n5.15.8\n5.19\n6.2\n6.1\n6.2.2\n8.6.2\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-48b0fbe0a24a4b4553d9a8e9","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-913868a80a66691141f65191","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ddef96191abda2acb7db6ba9","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-16e85629f4f28a677e709048","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-42d3db5ec63acf7bda523341","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-91b7c4df308423cbf998a6a4","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f75833ee768374f1e259b63b","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-45029d80b4d8a9c506c19a55","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-052d81207b265176f77085f6","from":"TAIM-MAP-1.6@be58945d827b6db0","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.2 - AI system requirements and specification_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!26:26","fromKeys":["TAIM-MAP-1.6@be58945d827b6db0"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8f28acae5fbd976104bc3c98","from":"TAIM-MAP-2.1@4508ecde43a2dc95","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n9.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!27:27","fromKeys":["TAIM-MAP-2.1@4508ecde43a2dc95"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eb9d2c123a402c1afabe77df","from":"TAIM-MAP-2.1@4508ecde43a2dc95","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2\n6.5.3.2.8\n6.5.5.1\n6.5.5.6\n7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!27:27","fromKeys":["TAIM-MAP-2.1@4508ecde43a2dc95"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c99d5428b184a862c13f6337","from":"TAIM-MAP-2.1@4508ecde43a2dc95","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n5.4.2\n6.1.1.3\n6.1.2.3\n6.2.3.3\n6.2.4.3\n6.2.5.3\n6.2.6.3\n6.3.1.3\n6.3.2.3\n6.3.3.3\n6.4.8.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!27:27","fromKeys":["TAIM-MAP-2.1@4508ecde43a2dc95"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-69b0bcf1d806ea6afb0eaf0a","from":"TAIM-MAP-2.1@4508ecde43a2dc95","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.1\n5.2.1\n5.4\n6.3\nA.1.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!27:27","fromKeys":["TAIM-MAP-2.1@4508ecde43a2dc95"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cc23c61100e83e50873aa365","from":"TAIM-MAP-2.1@4508ecde43a2dc95","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.14\n3.1.24\n3.1.29\n3.1.35\n5.1\n5.2\n5.5\n5.11.1\n5.19.5.1\n7.2\n8.2\n8.6.2\n8.7.2\n9.1\n9.2.2.1\n10.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!27:27","fromKeys":["TAIM-MAP-2.1@4508ecde43a2dc95"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-15c527cf4362836478d22141","from":"TAIM-MAP-2.1@4508ecde43a2dc95","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.3 - Documentation of AI system design and development_x000D_\nB.4.2 - Resource documentation_x000D_\nB.4.3 - Data resources_x000D_\nB.4.4 - Tooling resources_x000D_\nB.4.5 - System and computing resources_x000D_\nB.4.6 - Human resources","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!27:27","fromKeys":["TAIM-MAP-2.1@4508ecde43a2dc95"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-429854f9482dac41b642e704","from":"TAIM-MAP-2.1@4508ecde43a2dc95","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!27:27","fromKeys":["TAIM-MAP-2.1@4508ecde43a2dc95"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-35836175f67f9fbe113084c8","from":"TAIM-MAP-2.2@318e6e5f8367a840","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.11.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!28:28","fromKeys":["TAIM-MAP-2.2@318e6e5f8367a840"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2c9e0ee26d550b1fd05ce794","from":"TAIM-MAP-2.2@318e6e5f8367a840","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.3.2.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!28:28","fromKeys":["TAIM-MAP-2.2@318e6e5f8367a840"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-49186eb3d2671bc3024b2783","from":"TAIM-MAP-2.2@318e6e5f8367a840","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!28:28","fromKeys":["TAIM-MAP-2.2@318e6e5f8367a840"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f725154acbaeb80298810a91","from":"TAIM-MAP-2.2@318e6e5f8367a840","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n5.2.1\n5.2.3\n6.3\n6.5\n6.6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!28:28","fromKeys":["TAIM-MAP-2.2@318e6e5f8367a840"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-905cc16474c360399ed1b39a","from":"TAIM-MAP-2.2@318e6e5f8367a840","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4\n5.15.8\n7.3\n8.1\n8.5.1\n8.5.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!28:28","fromKeys":["TAIM-MAP-2.2@318e6e5f8367a840"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5d56f37b4d4bff91863233ec","from":"TAIM-MAP-2.2@318e6e5f8367a840","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.7 - AI system technical documentation_x000D_\nB.9.3 - Objectives for responsible use of AI system_x000D_\nB.8.2 - System documentation and information for users","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!28:28","fromKeys":["TAIM-MAP-2.2@318e6e5f8367a840"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-65e633555259eae9a576469f","from":"TAIM-MAP-2.2@318e6e5f8367a840","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA requires public disclosure and notification to consumers when HRAIS (High Risk AI Systems) are used, so NIST maps consequential use contexts and provides system knowledge boundaries.\nFlorida: Unlawful to possess AI-generated child pornography (2024); established tech modernization council to study and monitor the development and deployment of AI systems.\nHawaii: SB640 Chatbot disclosure mandates; prohibits discriminatory algorithmic eligibility determinations (2025).\nIowa: Sexual deepfake laws enacted in 2024; appropriated $2.8M to expand AI-related degree programs (SF2435).\nLouisiana: Laws against child sexual deepfakes (2023); created technology and cybersecurity committee AI impact study (2023).\nMassachusetts: Facial recognition technology restrictions for law enforcement (2020).\nVirginia: HB2094 Synthetic media disclaimer requirements for elections (2025); SB741 facial recognition technology legalization (2022).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.\nUtah: AI Policy Act (2024): UAIPA is a context-specific law and ​mapping this disclosure requirement into the AI’s deployment context aligns with this subcategory relating to knowledge limits and human oversight of AI.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!28:28","fromKeys":["TAIM-MAP-2.2@318e6e5f8367a840"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dfe5c02e736a0b8818573598","from":"TAIM-MAP-2.3@595fdc3a6417dcba","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!29:29","fromKeys":["TAIM-MAP-2.3@595fdc3a6417dcba"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-48de39aab01385549e7235aa","from":"TAIM-MAP-2.3@595fdc3a6417dcba","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4\n6.5.3.1\n8.2\n8.4\n8.5\n8.6\n8.8\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!29:29","fromKeys":["TAIM-MAP-2.3@595fdc3a6417dcba"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-74752b6fae9ce05563d1ba32","from":"TAIM-MAP-2.3@595fdc3a6417dcba","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.3.1.3\n6.4.13\n6.4.14\nA.2.5\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!29:29","fromKeys":["TAIM-MAP-2.3@595fdc3a6417dcba"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fdb9cf0de72aa4b97ee5c12b","from":"TAIM-MAP-2.3@595fdc3a6417dcba","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.6.1\n6.6.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!29:29","fromKeys":["TAIM-MAP-2.3@595fdc3a6417dcba"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8ca600db7509902e4e12469f","from":"TAIM-MAP-2.3@595fdc3a6417dcba","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.17\n5.10\n5.11.9.2\n5.16\n6.1\n6.2.3\n6.2.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!29:29","fromKeys":["TAIM-MAP-2.3@595fdc3a6417dcba"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0a51407530eb1b2683293c40","from":"TAIM-MAP-2.3@595fdc3a6417dcba","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.7.2 - Data for development and enhancement of AI system_x000D_\nB.7.3 - Acquisition of data_x000D_\nB.7.4 - Quality of data for AI systems_x000D_\nB.7.5 - Data provenance_x000D_\nB.7.6 - Data preparation_x000D_\nB.6.2.4 - AI system verification and validation","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!29:29","fromKeys":["TAIM-MAP-2.3@595fdc3a6417dcba"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-702429302cad11a49bc14814","from":"TAIM-MAP-2.3@595fdc3a6417dcba","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!29:29","fromKeys":["TAIM-MAP-2.3@595fdc3a6417dcba"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-01a8f89d3b3441790ba31175","from":"TAIM-MAP-3.1@8cf079d1257ee929","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.4\n6.3\n6.4\n6.5.1\n6.5.3.1\n6.5.3.2\n6.5.5.6\n6.5.5.7\n6.5.5.8\n7.2\n7.4\n7.6\n8.2\n8.3\n8.4\n8.5\n8.7\n8.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!30:30","fromKeys":["TAIM-MAP-3.1@8cf079d1257ee929"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a0f582557a708f29c1495be3","from":"TAIM-MAP-3.1@8cf079d1257ee929","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!30:30","fromKeys":["TAIM-MAP-3.1@8cf079d1257ee929"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-727da232c1f7983d65919418","from":"TAIM-MAP-3.1@8cf079d1257ee929","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2.3\n5.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!30:30","fromKeys":["TAIM-MAP-3.1@8cf079d1257ee929"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-51980d2ef3a441b784387a55","from":"TAIM-MAP-3.1@8cf079d1257ee929","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.29\n3.5.9\n3.5.18\n5.13\n5.15.1\n5.15.2\n5.16\n5.17\n6.2.2\n7.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!30:30","fromKeys":["TAIM-MAP-3.1@8cf079d1257ee929"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-06abf339ab97ffeac7b439f3","from":"TAIM-MAP-3.1@8cf079d1257ee929","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!30:30","fromKeys":["TAIM-MAP-3.1@8cf079d1257ee929"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e6a48b61e9c296d5472b5f4d","from":"TAIM-MAP-3.1@8cf079d1257ee929","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!30:30","fromKeys":["TAIM-MAP-3.1@8cf079d1257ee929"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3ab704b4e589e76d5de6abca","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.10\n9.8\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ad20f2c5677620f5ba69a458","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.4.1\n6.5.4.2\n7.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6a9e4de2f2051b26fe4f8d42","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0d6a5f9f6452edd043b3635e","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3\n6.4.12.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-29237a28c677e8dcb728b49f","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2\n6.4\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6c9305d44673fe594d56b5e2","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.2\n6.2.6\n7.4.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-db3924e613931668cd28d0e0","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\n8.2 - AI risk assessment_x000D_\n8.3 - AI risk treatment_x000D_\n8.4 - AI system impact assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-385c29b1f76ace93bbe9b2b9","from":"TAIM-MAP-3.2@b4079d9aebeb395d","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!31:31","fromKeys":["TAIM-MAP-3.2@b4079d9aebeb395d"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cdfc3b800097ca5d1a677b89","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.3.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a333c55343bb64090c502ae1","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.3.2.1\n6.5.3.2.3.2\n8.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-59a40be448661757060c0eb3","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.2 - ISO 31000:2018\n6.3.3 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ecdd48513fba5ccf65cac24e","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.2.3.3\n6.4.2.1\n6.4.12.1\n6.4.15.3\n6.4.16.1\nA.2.4\nA.2.7\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c7c5aa446f2db2ab0d6739ba","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.5\n6.5\n6.6.2\n6.7.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ac89961a4a79ee9a632d81b","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.7.1\n8.7.2\n9.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2c013f7aeab41a640963a78a","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3 - Determining the scope of the AI management system_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2f2e7d6cb0ab5f05846671ed","from":"TAIM-MAP-3.3@db54472c934e7816","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!32:32","fromKeys":["TAIM-MAP-3.3@db54472c934e7816"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a0d39ab3df357c835b4d5848","from":"TAIM-MAP-3.4@171bc4d2aa86131b","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!33:33","fromKeys":["TAIM-MAP-3.4@171bc4d2aa86131b"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b8ecdba4a732dba806eb27e8","from":"TAIM-MAP-3.4@171bc4d2aa86131b","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!33:33","fromKeys":["TAIM-MAP-3.4@171bc4d2aa86131b"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f843cedf7f26a9c84860692b","from":"TAIM-MAP-3.4@171bc4d2aa86131b","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.3.4.3\n6.4.11.1\n6.4.15.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!33:33","fromKeys":["TAIM-MAP-3.4@171bc4d2aa86131b"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de424179dc27fbe8113e98d9","from":"TAIM-MAP-3.4@171bc4d2aa86131b","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.6.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!33:33","fromKeys":["TAIM-MAP-3.4@171bc4d2aa86131b"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5e4ca29ecf9101dc95ae82b0","from":"TAIM-MAP-3.4@171bc4d2aa86131b","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.1\n5.15.2\n5.19.5.4\n5.19.5.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!33:33","fromKeys":["TAIM-MAP-3.4@171bc4d2aa86131b"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ceb9ab08b2ec4b9dccf0c01","from":"TAIM-MAP-3.4@171bc4d2aa86131b","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.2 - Competence_x000D_\nB.4.6 - Human resources","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!33:33","fromKeys":["TAIM-MAP-3.4@171bc4d2aa86131b"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a66263ace47337460b167850","from":"TAIM-MAP-3.4@171bc4d2aa86131b","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!33:33","fromKeys":["TAIM-MAP-3.4@171bc4d2aa86131b"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9f89484753e9e0c67091560c","from":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!34:34","fromKeys":["TAIM-MAP-3.5@ff2d44ca4f9b3a50"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7d498d265c465235d3b11af9","from":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.3 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!34:34","fromKeys":["TAIM-MAP-3.5@ff2d44ca4f9b3a50"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-715ce066d698a21d1b45e48a","from":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3\n6.4.3.3\n6.4.14.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!34:34","fromKeys":["TAIM-MAP-3.5@ff2d44ca4f9b3a50"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8b7858495f4c98fac164c1ca","from":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.1\n4.3\n5.1\n5.3\n5.4\n5.5\n6.2\n6.3\n6.5\n6.7.3\nA.1.1\nA.1.3\nA.1.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!34:34","fromKeys":["TAIM-MAP-3.5@ff2d44ca4f9b3a50"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-afc0cf950212b2e32df48aa4","from":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!34:34","fromKeys":["TAIM-MAP-3.5@ff2d44ca4f9b3a50"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-73063e4744d7d201baa760de","from":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!34:34","fromKeys":["TAIM-MAP-3.5@ff2d44ca4f9b3a50"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a014dfd4e8c16d89672c5675","from":"TAIM-MAP-3.5@ff2d44ca4f9b3a50","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA does not require formal TEVV or scientific risk mapping documentation for all deployers, but government agencies and certain sectors (e.g., healthcare) must document and disclose intended uses and adverse AI impacts as part of mandatory notification or incident protocols.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!34:34","fromKeys":["TAIM-MAP-3.5@ff2d44ca4f9b3a50"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aee6eccebe5d31efde81a2c6","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-245275d07e430ec4a4cd1fb4","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018\n5.6 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fb207262badb7bd02e8f609a","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.1.3\n6.4.1.3\n6.4.3.3\n6.4.8.2\n6.4.8.3\n6.4.17.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-28d12d1d0f47ca8cd1b19de0","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.5\n6.4\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6617c11aaf8498b85acc400b","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.1\n5.17","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-676a93ce810fde2415a6a5bd","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7908503644759a58786e7337","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1affec2f5a61747641b1e2d3","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-973f1cb9b4e6e25dd3739bc6","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3c425d38f2f6be8aaac47954","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-96a67d7fccec29efa7306380","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b973486d425bc6d5d50a0535","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b74a00abdbd0ecf712f04432","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bc6ed1d1ede3ba6d6bcab223","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1 - Understanding the organization and its context_x000D_\nB.2.2 - AI policy_x000D_\nB.9.2 - Processes for responsible use of AI systems_x000D_\nB.9.4 - Intended use of the AI system","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5fea8603ae16c3b7e59df424","from":"TAIM-MAP-4.1@59a21bb34b454e39","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. Explicit in TRAIGA: biometric consent, privacy violation, unlawful discrimination, deepfake/child exploitation, etc.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!35:35","fromKeys":["TAIM-MAP-4.1@59a21bb34b454e39"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ebb4a87202632f9e7be23f97","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-967672981df1c78963ed6ea2","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5f933f4e32a44d0f11baf6b5","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.8.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2143abfbf68d3146260dd9bc","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.7.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5996534114fc5376490878f1","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-52b770a133608334737ae0cf","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.RA-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-20ac6c64495845c54b905f85","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fa6e7b4e2544ad6bdb3088ad","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e7ff7e91e1ae0c909b914ef6","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-29217f4a38a94533e7f6daf2","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-abc110b7ef5be7918d6b39b2","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eff2c776606b1d011276be26","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-83de3a74443037f58cfb2690","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-35d853247820bec101a01d43","from":"TAIM-MAP-4.2@0287d8ad2ea3574d","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users_x000D_\nB.10.3 - Suppliers","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!36:36","fromKeys":["TAIM-MAP-4.2@0287d8ad2ea3574d"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5108e6a5f0fdd6dea3eb2939","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.4.2\n9.10.5\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f1af78997f497d1b7a1c8ba5","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4 - ISO 31000:2018\n6.4.2.6\n6.4.3.2\n6.4.3.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eef5ffd941b64167a59ffb03","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.8.3\n6.4.2.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5f084f4e34b629a8514b7f28","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.2\n6.7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7361e60707329e024912219a","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.7\n5.18","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d7328239c13029675fd2906e","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-08082f3705e0734f49907604","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9a76dc0a8a1c99fee8e248d3","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f4fba19af3de362548b3aba0","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-431933ce82174fc6289b3881","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fec408ee46b5d97d27697a8e","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-35d187258fc8e4b656aa3c67","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-825c6265fa9989bfad6c18c8","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5aff4e4cbe31eee2a0d47b68","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.2 - AI risk assessment_x000D_\nB.5.2 - AI system impact assessment process","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-eebc2584059ba4ed2ea0d6d3","from":"TAIM-MAP-5.1@eeeb1c9210779883","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA prohibits algorithmic discrimination in high-risk areas (jobs, loans, housing, etc.) and NIST requires identification of group-level impacts and high-risk decision contexts.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA includes complaint process and AG assessment of harm where statutory lines crossed.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!37:37","fromKeys":["TAIM-MAP-5.1@eeeb1c9210779883"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4f403c330dfb384a608e393b","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.4.2\n9.10.5\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e61712bcf08f84a9861c9f7","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ISO 31000:2018, Clause 4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c487ec14540f89cebaf6c9a5","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.8.3\n6.4.1.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a1d948ca3f3e41d78de6edd5","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n5.1\n5.5\n6.7.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-54addaf130066e1703fb7496","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.18\n5.19","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-02464e691d17326c37bed255","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.RA-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f016f9d94e58ff763c169c4b","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ef53d3240f411dace6feea28","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e7bc8681a73de06f957befe","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a44c787078ed8e1a74154deb","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-32f4f4d7d4f435862bc17c3f","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0c78630dbd55ab0366dca8a1","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1debf2520c99356b815325f3","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8e6d237aa6ed0c3eea56c0ce","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.8.3 - External reporting","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ea5a55b98565ab3fec7bdfe8","from":"TAIM-MAP-5.2@d9cbb5e90cd723ff","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. The Texas AI Council created under TRAIGA has a mandate to advise, review, and integrate feedback.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!38:38","fromKeys":["TAIM-MAP-5.2@d9cbb5e90cd723ff"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-db5e314c9e8aeaafdab6c230","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n5.4\n6.4\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-15fac931dba1dd1832003636","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f377e20b5a7962946f524557","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-572084d9f714b3f311aeb228","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n5.5\n6.4\n6.6.2\n6.7.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2ff809615e10ba872f026f31","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.2\n6.2.2\n8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6e1d443ba151caf4504a59fc","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.RA-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c88b0c1f780256a209e21990","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-def8c7013b6e368a9cf7814e","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-791a89b217475cbd86a0c692","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dbebda11e418264266ad284d","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-be42a916c04bbf8eab957539","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0b96ccf8066abea1a21d12a8","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-94ba21832511a63d81988c72","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-31d45ba40cf320e76364afec","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.1 - General_x000D_\n6.1.2 - AI risk assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-56fdaf12e850f191ae0f4f64","from":"TAIM-MEASURE-1.1@06bafc72fb94bf95","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!39:39","fromKeys":["TAIM-MEASURE-1.1@06bafc72fb94bf95"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5bacd78be59bf700b548c306","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7c7aadadc87c2111581e9a89","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-444f55a28a482fabad5ddb65","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.12.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-45efddb7cfd1960d480c7cf2","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.1\n6.4\n6.7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e09c528b30349498f2d1571f","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.2\n6.2.2\n8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-707aaf6cc0c7c239b7d8d441","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OV-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-96b060a3a00703235e0c7799","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4c70a52b5dcbcef48073cdd6","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-81dd494d6a0bd2803c1c485d","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-40ba3934569f4be4df0c3bb8","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f5a40194b3010307d8cabd1d","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7d640d6823a5e37aec4d5386","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-02dcb37c6208f00c86e97fff","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b6b01351938dd7cf5ec68949","from":"TAIM-MEASURE-1.2@6a15ee51fbe22034","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.4 - AI system verification and validation_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.5 - Assessing societal impacts of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!40:40","fromKeys":["TAIM-MEASURE-1.2@6a15ee51fbe22034"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ccc1c72e58ad2e8063fdd51e","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7161c11284113fdb9ed5356a","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018\n6.4.1 - ISO 31000:2018\n6.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d0e649f9a16c1ac166bd8b98","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.7.1\n6.4.7.3\n6.4.9.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b3de66b4619d51d0758f5182","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n5.2.3\n6.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-60ec924804275c4cebcab56b","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.19.1\n5.19.5.1\n5.19.5.4\n6.2.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-965e011694f776de30b8f20f","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.SC-07","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-44d0d90ebf297f8e70c48225","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-89d79dd8d884de3310c6ed59","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-215a573ade117799e1e7c3ef","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5bc593f17b9985d8e4a5b6a7","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f53d482aef98ceb9e674b6bd","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6915b395c5fbe2ea1755dd4f","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e5c0c0d38c1c62fb8a369c9c","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f9fa7c509ea7a29b4795a0ed","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.2 - AI risk assessment_x000D_\n9.2.2 - Internal audit programme_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dd6909c2101faefc8179bd17","from":"TAIM-MEASURE-1.3@4da0283611f39f57","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!41:41","fromKeys":["TAIM-MEASURE-1.3@4da0283611f39f57"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9cee7786e41fceab1472ccd8","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f7583a9adc47dcde9f486d36","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5\n8.3\n8.8\nA.3.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-92718722d5059bac2fef4732","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-beb1790e6b820b101a5b53a1","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.11.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-972ace1c13bdb833d3a36fe7","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.6.1\n6.6.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e1af35f5c344983c2ab0dab2","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.15\n5.11.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f208fafa927c8f32069b75d3","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.IM-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6a3bb9a53636a5c07868cb4c","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-341f7753679d6f1e49431d48","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-61b670ba66f26d7d051a9129","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c8fe00a878540daff2bc22ca","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d22caa2d5cc930b807417117","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fb925dd599dc0dc4fdb354e9","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1c99dc7e9ba38f3f50057dc7","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c36e0c319aec446c4bba8167","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.8.4 - Communication of incidents_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.4.2 - Resource documentation","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fecff01d4a66fab5cddb025a","from":"TAIM-MEASURE-2.1@e9330844656a4ab1","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!42:42","fromKeys":["TAIM-MEASURE-2.1@e9330844656a4ab1"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8898e9919cf480189f1e41d5","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8df8a55dabc1cc4add419951","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d2a2e363cbeda82d1324e7fa","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3ddce0b47d4c86e60cd4c195","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e586f95a8075ef1e71d55e46","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c14c851a9f3547c0b6e1f3e0","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.19.6.2\n6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ae926ace0d3fd2e30f9b78d4","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7631f54cc6c55d22185387da","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-21cad99ca6d2580fdcf0efb7","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-101417753082713cad2b79e8","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6cba0c0550a2153cdf100657","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0c7fb11e7a70b0a067a69763","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ac6afa788f1d1e052964d88a","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bd48455a40d3ddde312eca81","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4c76f8d083f1b420a17146bd","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.4 - AI system verification and validation","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-25f7614870c5059194d92625","from":"TAIM-MEASURE-2.2@10cd0cb098928172","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!43:43","fromKeys":["TAIM-MEASURE-2.2@10cd0cb098928172"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-80e198e2c2acba0e091366eb","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-334b2a786f716171c49740e0","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7f3a21caab46ca1b0d1bf046","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.6.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f71fe809a049a6fdbd035a50","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.25","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-772035363907aa443402e6dc","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OV-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ef871fcba0b2afd49f371ab","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-079c8edd4ac6e5d798868015","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-75f6350c94935f2961b9f5e3","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-528481c3b26ce447e1955c30","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3025a435d6fcc03015e2f978","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3f62adf8f7a73f1fa7b93463","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a7c333215710f8a1e4b8e7ae","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b16d1aed3742faf65a236537","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.7.4 - Quality of data for AI systems_x000D_\nB.6.2.6 - AI system operation and monitoring","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-10b3df4b822810a38b595763","from":"TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!44:44","fromKeys":["TAIM-MEASURE-2.3@6bbc2ff3a1f7aad7"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2bf252df981da17c500d3821","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.1\n8.8.3\n9.9","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b0c7f40fe1414fd3c55858ea","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6a48cf7c4f5b50a33b647857","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c09ea22658ec940dc801db56","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-61530c4bd2a429c3ccf1397e","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.5\n5.16","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9590c9f2dafe6ec00cbfc686","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"RC.RP-04","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f8be1268c82aa03d033967dc","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-38a10833a557d59acf1024d7","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-47efe470cae243c89230c5b3","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dafafe4348925414b0f451b3","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-11cd9be3ffb79ad4d49dac2f","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fab4337a38e264f1b8eba0c2","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ff34bf3ceea440cd8d6f790","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ee8f7afbf07c6e945fb6786a","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.1 - Monitoring, measurement, analysis, and evaluation_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.8 - AI system recording of event logs","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8e1ad062378554d74ab53df5","from":"TAIM-MEASURE-2.4@4f759def92d244b2","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!45:45","fromKeys":["TAIM-MEASURE-2.4@4f759def92d244b2"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6c946a951d5508d6bd57672a","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.7\n9.11.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0309f28a5cbd79d2372a5dc1","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n6.3.4.3\n6.4.11\n6.4.13\n6.4.14\nA.2.5\nA.3\n\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f4136113af83d8876052ab7b","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6f5b9ab47f525cb25a13b371","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.9\n3.5.16\n5.15.2\n5.15.3\n5.15.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bfc426b05b538fa45dfcdec2","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"PR.IR-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b82c9bca0fb1f0aba7d8cfd4","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8e1539961016ed70b2723397","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4995f3e202e332fb26b8cf46","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3a58b509f60e652300d80a5d","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ffd6497f22394c48a17595bb","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f5daf8e177dfcfd6294c2060","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8fd96d85666191f04ff82831","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0e5ff0528cb0f30b95c0dacd","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.4 - AI system verification and validation_x000D_\nB.6.2.5 - AI system deployment_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dd15bcd8fe57f4c11337fb72","from":"TAIM-MEASURE-2.5@530446e7cdd7b14a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!46:46","fromKeys":["TAIM-MEASURE-2.5@530446e7cdd7b14a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-90e4e0cbb61a2084e2fa5bdc","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.2\n9.9\n9.11.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3905cb9c186521b29b5bd660","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d4d56cc4796a7d5bc142b6e6","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.6 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a37edbf0a9af596f566db28c","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6378522678a401366336d78e","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.7.2\n6.7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-890e027bc78cd758af171c3d","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Annex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7b5b5bfb1c86572c78bba19c","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-352c2a8262407223c0ae98f6","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-acf24118f9f572f85afdedc5","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-29355b09750c7aaccea02f7f","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-982f7e76138e03a016da47b6","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9cd300511219e3a95c1a98d8","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a03c80df398b39fc05dc44a1","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-da1ff59781d88eff43c031de","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ce55cfc15d06d466b05ca722","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.8 - AI system recording of event logs_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\n8.2 - AI risk assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-344deb17c7d1e3d084d2da69","from":"TAIM-MEASURE-2.6@36a069327f5d2611","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA is a comprehensive AI law addressing algorithmic discrimination (effective Feb 1, 2026); facial recognition guidelines for government use.\nMaine: Prohibits facial recognition technology use for law enforcement (2021).\nSouth Dakota: Sexual deepfake laws targeting child pornography (2024).\nTennessee: ELVIS Act (2024) against voice cloning; requires universities and local school boards to adopt AI-use policies by 2025.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA requires agencies (and in specific healthcare contexts) to prevent and detect prohibited/harmful use, and the AG can require removal/suspension of systems in violation.\nUtah: AI Policy Act (2024): Consumer protections; focus on vulnerable populations.\nWashington: Biometric consent laws (2017); political ad disclosure (2023); sexual deepfake law (2024).","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!47:47","fromKeys":["TAIM-MEASURE-2.6@36a069327f5d2611"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ebbf1475d62ceb9ef2371a30","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.2\n9.7\n5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-06dc9f86e727319a351e7cc6","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-556717d675b5ab1aaa7e83cf","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-356404626a774aa898df4561","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4bb8f41a1f33aa454dacd5ed","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n5.3\n6.4\n6.6.2\n6.7.2\n6.7.3\n6.7.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de15d374f5733f492a912074","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.10\n3.5.16\n5.15.2\n5.15.3\n5.15.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3f2129ea11805e8c8710b8a7","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-06","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-74e35a1e99f95a39973c093e","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-323858a6e7e26a87bdaddc94","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2d85df208d7ca4db5f384eb2","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9afeb7a5fc43ee4f84c15092","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-58da9f8243b36f8b6e27d092","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-da6c56204bc78fcc9d879bbf","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-276ed9e0a797831574db62f2","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5a05ace0eedda023738dad91","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.7.2 - Data for development and enhancement of AI system_x000D_\nB.3.2 - AI roles and responsibilities_x000D_\nB.2.3 - Alignment with other organizational policies_x000D_\nB.5.2 - AI system impact assessment process_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.6.2.3 - Documentation of AI system design and development_x000D_\nB.9.3 - Objectives for responsible use of AI system","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6903e087c939d7666cd48a1d","from":"TAIM-MEASURE-2.7@5b57e3e360c405ae","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA’s language on “intentional violations,” and AG’s power to require information about model/data/metrics in case of complaints.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!48:48","fromKeys":["TAIM-MEASURE-2.7@5b57e3e360c405ae"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-436c5bf30c49dab5aad4f1b7","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.1\n9.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2984796f404a902f527dbb48","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f0945c50f87f153698f2fc59","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b5c7be9aacad58bd96a53c8f","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.3.4.3\n6.3.8.3\n6.4.3.3\n6.4.9.3\n6.4.14.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3d751d83de8b59fda008d3d6","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1\n4.2\n4.3\n5.3\n6.2\n6.3\n6.6.1\n6.7.2\n6.7.3\n6.7.4\nA.1.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b7af22b0fd13c50e5e03cdea","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.2\n3.5.14\n3.5.15\n3.5.16\n5.15.8\n5.18\n6.1\n6.2.2\n7.4.1\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5da422b71bf10e2b0d36323b","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RR-01","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0fbaaa03f710ddf98055712f","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-82ae487401caf0045c818210","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-be3e47549ebbcdc387904c49","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e3c02dd664ebbb6050b676cf","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2372d684ce3cd398036b4c38","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e60c9fd16c73d7600b40faff","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0a38cf3bda3ef8ff55eb1b4b","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dcbd89b1a7a0ad709f404f17","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.7.2 - Data for development and enhancement of AI system_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.9.3 - Objectives for responsible use of AI system_x000D_\n6.1.2 - AI risk assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ca3850e6c9c3af08472ca97","from":"TAIM-MEASURE-2.8@263030dd27d71a53","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA requires a duty to report algorithmic discrimination risk to Attorney General and NIST captures transparency/accountability risks and mandates traceable incident responses.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.\nUtah: AI Policy Act (2024): Requirement for prominent GenAI disclosure in professions requiring state licensure, such as healthcare, accounting, and law is part of this transparency/accountability dimension. Ensuring it's implemented and traceable fits this subcategory around evaluating transparency and accountability risks—whether disclosure mechanisms function correctly.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!49:49","fromKeys":["TAIM-MEASURE-2.8@263030dd27d71a53"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e5a1040371f332877b1175b2","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.3.4\n9.3.6\n9.10.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7ac1a9768c0b78e062cb3928","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4704de8f53b63e1022cac57e","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3\n6.4.9.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de39321c4a680d1a3be355bf","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2\n5.5\n6.4\n6.7.1\n6.7.3\n6.7.4\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a53fcd3ac5974ba7d5299063","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.7\n5.15.6\n6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-deb7486be9687cf4826d965a","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RR-01","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-78eb449801f8ab324a2fd76f","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5f6407d52356c0d76c412349","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-faa93b777dc792eadc040f64","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4d13b39b065376770f4c3af2","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c35442b9e7864b36351ebf08","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-19a2bf6d55716e007f9046b7","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-85e4dc85cf514010f76cf004","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4788efba4501a95b80b975fe","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.7.5 - Data provenance_x000D_\nB.6.2.5 - AI system deployment_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-73335faa133c1c0ee6f04c3b","from":"TAIM-MEASURE-2.9@81925d68d826c01b","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!50:50","fromKeys":["TAIM-MEASURE-2.9@81925d68d826c01b"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1146165ae716ed8082013711","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.6\n9.10.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-36e3fee2d3e10ecbdd10b615","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6059533eaf3ba95aa3102b7f","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7b0bc412ac08c17f28f897ab","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n6.3.4.3\n6.4.1.3\n6.4.3.3\n6.4.8.3\n6.4.17.3\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-187072d88a58a78802c262b2","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.4\n6.6.2\n6.7.2\n6.7.3\n6.7.5\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-692ef4d2b5694ca6ee99505e","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.19.6.2\n6.1\n6.2.2\n8.6.2\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4fa259c62eaad06f580355e1","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-11d535ee7ca42ab0133147ec","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-df85405aadb792efc3a705b7","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c1e4020ab74cd9772b17fde7","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c5c87a73c2bef6a16e3d8010","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a53efb9d403709e9c26667af","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8b8420a9ba90dbb3ccb54ca1","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9b31b42a7ef5253ceb4b33ab","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1da757674d728bd50621d576","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.2 - AI system impact assessment process_x000D_\nB.7.2 - Data for development and enhancement of AI system_x000D_\nB.7.3 - Acquisition of data_x000D_\nB.2.3 - Alignment with other organizational policies","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dc55d286490d61d9bafc751c","from":"TAIM-MEASURE-2.10@00041240562d2f6b","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is explicitly required for biometric data and anti-discrimination; other forms encouraged as best practice.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!51:51","fromKeys":["TAIM-MEASURE-2.10@00041240562d2f6b"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c81141a3bacb27f04c0d8098","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-74626f091ee0de64bece6f9a","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3\n8.1\n8.3\nA.2.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ba264408505d73c0b1d3d535","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9a8c645c7022d75921bb736b","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.1\n6.3.4.3\n6.3.8.3\n6.4.3.3\n6.4.14.3\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8f99310ba4a909a3024a14d0","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2\n5.4\n6.4\n6.5\n6.7.2\n6.7.4\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c7f8823cc07706ed4f36a0f2","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.2\n3.5.4\n5.10\n5.15.9\n7.4.1\nAnnex A\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ab196fae6eecdc2b8b78f308","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fd8ce70f2d7ffcb70c179846","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9043134a391b851fb8ea562a","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f1f59341684215600d1d90a7","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-463cce02969eb6421ed9ea81","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-993d53df688fea2ab4862264","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e0ee9510c41f26beb12b9a08","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f2fb7150800f2a308661adc3","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b671892cca502f655f7f6c7b","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.5 - Assessing societal impacts of AI systems_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c70a97e0770278becd810be7","from":"TAIM-MEASURE-2.11@c547147a38410e2a","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Georgia: Early sexual deepfake laws (2021 and 2024); considering AI profiling bills.\nIllinois: Biometric Information Privacy Act (2008); restricts AI use in hiring process; sexual deepfake laws (2023-2024).\nMichigan: Election deepfake laws (2023).\nNew York: Criminalized sexual deepfakes (2023); requires disclaimers for political deepfakes (2024).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is explicitly required for biometric data and anti-discrimination; other forms encouraged as best practice.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!52:52","fromKeys":["TAIM-MEASURE-2.11@c547147a38410e2a"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d9320a437e16d5e28a19877a","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.5\n8.7\n9.10.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b02a42966901ca8fcd629d48","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.7\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0f4d82b3ceaf3a89328227c5","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2\n6.4.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b951d979c84688d62aad5f7b","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.3\n6.4.17.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cc219ea0ab97a39a919fae60","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5\n6.7.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-15b75d8c9285f1080592fcdc","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.2\n6.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7853eae99c588e6cd324eab1","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-36d19dca9be95c6994988779","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3bb70b11cf9600bc0a034609","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f4572712e6581404dbce45e1","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-45e772478bde50f13c230998","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b5449a022e6d7be50603a343","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4efe42659fa4d466d34b8c6c","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-825b223ab87b233ea58211d2","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2074df4dde9ca6931076f185","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.5 - Assessing societal impacts of AI systems_x000D_\nB.4.5 - System and computing resources","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5840963db1716b4cdd27b8dc","from":"TAIM-MEASURE-2.12@242501cce6559442","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!53:53","fromKeys":["TAIM-MEASURE-2.12@242501cce6559442"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8ca5b1f7c495c59728e98902","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.3\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dd89421e960031b16af5d154","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-64b5d83f98c476adf45e68ae","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4befee34a598b4169a9ed083","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-383770b4102259ae904908dc","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.6.1\n6.6.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-435a4e0f874976ca907e9bcf","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d0774f2e48d991378297b80f","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OV-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-69dbb2c383fc1fb3e98aeb6f","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-50bd96b9d72ca47143f18a8a","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3f9dd24b43a5b080abba1595","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5a0bb29122ed3ecae71d1b8b","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d523708cd643213818db678a","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f84a86239c9b7aad092b3319","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d9b0180712f17ac2318c9ba1","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-35b3522cceceacbea60559b2","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f9cc47910f5005026a0c1793","from":"TAIM-MEASURE-2.13@48fc4cc20ecff047","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!54:54","fromKeys":["TAIM-MEASURE-2.13@48fc4cc20ecff047"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3d2551ef15c7a1165fc376b2","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e8bbf1b2474dab5efa8860ac","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-78fb27caa7464684d9c28979","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3\n6.4.12.3\n6.4.13.3\n6.4.15.3\n6.4.16.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3a7bc7f9b104714cbff60aab","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ff92c0fce811c1db8d041296","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.11\n5.18\n6.1\n6.2.2\n6.2.3\n6.2.4\n6.2.5\n6.2.6\n6.2.7\n6.2.8\n7.4.3\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bb1b8d84a6bfb6e8df9c5e58","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.IM-01\nID.IM-02\nID.IM-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6ef7735dc5408d6789e3437d","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0550c1f6b53826c6af8c656d","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-564422f6d44bc09a8075db51","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-462fc805e6a5e096d418fcea","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cf5b50690002b155006310ae","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e67bb908e732732303b52c11","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f31c7e2873812a2fc5974f28","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ca7882419537db9568ef5674","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.2 - AI risk assessment_x000D_\n4.4 - AI management system_x000D_\n8.4 - AI system impact assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-be7027e2a1fa5fac0bf11631","from":"TAIM-MEASURE-3.1@1a8a34c7269bc006","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!55:55","fromKeys":["TAIM-MEASURE-3.1@1a8a34c7269bc006"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7979a804d9130b3af97c1bf9","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f0b13733434c756dc57ec73b","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3\n6.4.11.3\n6.4.13.3\n6.4.15.3\n6.4.16.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e6b6739dfa9fc45c9f94e925","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1e45a98fe3e74d02192987c1","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.4\n6.2.6\n6.2.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-efacbf6efc243692c82ced32","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.RA-06\nID.RA-07","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-29df65bf960c2381b1bea68d","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-14a0156591d89542553f91fe","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7bc4ca256a866429ce0a680d","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cf84f1838e6e3183056693bb","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5ed28256cd5c356c6465551e","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-95fa8abcef555de4a23827e9","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7d8620e4b24f2a9bdb0952e7","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4e848c0c99a4f4a1d8fa3718","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.8 - AI system recording of event logs_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\n10.1 - Continual improvement","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8f11c475b3f971f0b2ebee92","from":"TAIM-MEASURE-3.2@6f40134ebd7ed5cb","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!56:56","fromKeys":["TAIM-MEASURE-3.2@6f40134ebd7ed5cb"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e22a390e48b94a097624dee4","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.4.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1cb1fc3eef63b9cebbd4bc58","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-47c33210ac914081657ecdcb","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.3\n6.4.15.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b8cd093131934454a4bdcafc","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2.3\n5.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e363f24b63a2241fa4431f9","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.19.6.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6c64274e25d2845ae2aaa39a","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-19bda39637107b0aba00ebb7","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d826dcabbb9892fcbf4640fc","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-863839c2c6eacf3215968f3f","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-89f330ef23afbb9b3c14bd64","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b75622a250d60e8ca6c6f57b","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ba9244b97f0845a514f36767","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7b9d48a959e8a3e276f9234c","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-443eaeede876d3d10d0850c0","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.8.2 - System documentation and information for users_x000D_\nB.8.4 - Communication of incidents_x000D_\nB.8.3 - External reporting","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-65446024026104e72e0235a5","from":"TAIM-MEASURE-3.3@2bad1c9c0d1cd79c","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!57:57","fromKeys":["TAIM-MEASURE-3.3@2bad1c9c0d1cd79c"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-08ed5f92b0e2b11526093300","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.4.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6307ad0ef99ea6aa8b291ee9","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5afabf49a3ae8eebc9fe1825","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cb829c8dc2fbe9855b526b5f","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1\n4.3\n5.5\n6.1\n6.2\n6.4\n6.5\n6.6.1\n6.7.1\nA.1.3\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0a451a86d923d7fbcb40a131","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8e425194cf6b6e5f7cc022ea","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.RA-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6f5557a205ace4bbb3bbc9c3","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8e78fe61eda81ae0920c04a6","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e1e37a5575a95e9714092cbb","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-65d4c83f360f166bc32e7082","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-af1ae1654d1089d87c2b930b","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-31db71213dfd32b4d3a40d3f","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-31e2df930e7065083e9e18fe","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b59264bc83178544d5bb6eb0","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.6.2.4 - AI system verification and validation_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.5.5 - Assessing societal impacts of AI systems_x000D_\n9.1 - Monitoring, measurement, analysis, and evaluation","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7442e083e874acb389005cd5","from":"TAIM-MEASURE-4.1@40ef8aa2bd2594e6","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!58:58","fromKeys":["TAIM-MEASURE-4.1@40ef8aa2bd2594e6"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6d37a8eca6f2a7a62c02ce72","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-ISO-24028@8789b0ac6ed19775","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.10.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-ISO-24028@8789b0ac6ed19775"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-32dc10932d86f380023edda4","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aa06b61993e9c7346824cdc9","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.7.1\n6.4.7.3\n6.4.9.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c3d54002fe5202add3875cae","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1\n4.3\n5.5\n6.1\n6.2\n6.4\n6.5\n6.6.1\n6.7.1\nA.1.3\nA.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ff02db294d98973eb25a1484","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f588b2b7e84c35efcf66dc50","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.RA-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-69e9c826ef619d0157189705","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-30e7a597e404393577c3cfa9","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0a4653a0c712ae4869f46228","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-61dd32f62489f5309c327b2c","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1d3e46d7ca7f67af582992e9","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-26aeb6b77685818b4ef3d7ed","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8fc28dbbd21d14c2932f420e","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3bc6fe4151ef0660c0b60f08","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.1 - Monitoring, measurement, analysis, and evaluation_x000D_\nB.8.2 - System documentation and information for users_x000D_\n9.2.1 - General_x000D_\nB.8.3 - External reporting","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-36ec042f5356632db47bfb12","from":"TAIM-MEASURE-4.2@3880f07b20cefd80","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!59:59","fromKeys":["TAIM-MEASURE-4.2@3880f07b20cefd80"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fb2f141a354e884a8841eca7","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"7.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-22b4d80982bc7bfbc48203d1","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.5 - ISO 31000:2018\n6.2 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-49b53fbd2baa5e592e4ee18b","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.5.3\n6.3.1.3\n6.3.5.3\n6.4.3.1\n6.4.3.3\n6.4.9.3\n6.4.12.3\n6.4.13.3\n6.4.14.1\n6.4.14.3\n6.4.15.1\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4d6f3facc8794e33dcedb9d6","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-08a80ebe46bffc135ff13c30","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3a606b9f70424a8c5aa46d46","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.RA-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-897afd9231b9e4953d80daf6","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4d97261ecbb9a0f9515e5a70","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e817b1323cc941f90caa0174","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f7c6875a327ce4dce80c449c","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7c9441f3265b68a1173e7e24","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-75c8a4d449246db342a7f9e1","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b1a8458379fbb1fafa81451a","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0b331c491da05316b71585b0","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.3.1 - General_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.6.2.7 - AI system technical documentation","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fe8812ae6f84d69763ca3a30","from":"TAIM-MEASURE-4.3@0b263792260e087e","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Delaware: Created AI Commission (2024); requires annual inventory of generative AI use and identification of high-risk areas.\nIndiana: Studying AI risks through Commerce and Economic Development Committee (2023).\nKentucky: Interim Committee briefing on AI bias and impact on jobs (2023).\nMaryland: HB1314 (2025): Prohibits AI denial of healthcare prior authorizations (effective Jan 1, 2026).\nMinnesota: Restricts AI use in entertainment industry (2025); drone facial recognition technology warrant requirements for law enforcement use (2020).\nNorth Carolina: Sexual deepfake laws (2024); $3.5M AI healthcare study funding.\nOregon: Political campaign AI disclosure (2024); facial recognition technology prohibition for police bodycams (2015).\nRhode Island: Lawmakers requires AI system review (2023).\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for “demonstrating care” and may be required for sandbox participation or agency-specific enforcement but not generally imposed as blanket requirements.\nVermont: Moratorium on facial recognition technology expect for investigating child sexual exploitation (2019 and 2021); sexual deepfake laws (2024).\nWisconsin: AI workforce and election task forces (2023); political and sexual deepfake laws (2024).","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!60:60","fromKeys":["TAIM-MEASURE-4.3@0b263792260e087e"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9dc598fdc8637d345be23a3f","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.3.5\n7.6\n8.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3fbb74ca14236952935de61b","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.2\n6.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f2772402dedb95b6faf75777","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.13.1\n6.4.17.1\nA.2.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-389f478c0c44f709ccd2d90d","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2\n4.3\n5.3\n6.4\n6.7.4\n6.7.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ad008156bd71999f7c372297","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.35\n5.3\n5.11.4\n5.14.3\n6.1\n6.2.8\n7.1\n8.2\n8.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f0f2f9043188e4aac494e7fd","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.OC-04","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7a4fa08804edc0aa35edf1b7","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d8f57b7c0069b3c545ef05ca","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8d1eec87b04123127d852dd7","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b9cf898b9a420352ca8f21a4","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-190e43cd29a08a07c4e5e534","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-92473285a366853eb278fc7c","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cb7e237978a9e466d50c50c6","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6369de157f96e4fca18394ff","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.9.3 - Objectives for responsible use of AI system_x000D_\nB.9.2 - Processes for responsible use of AI systems_x000D_\nB.9.4 - Intended use of the AI system_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.4 - AI system verification and validation","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-22a9aaff43efdffaf4ebf02e","from":"TAIM-MANAGE-1.1@b474c5c19115a785","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA requires impact assessments and risk management programs for deployers and NIST formalizes risk treatments and post-deployment monitoring.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!61:61","fromKeys":["TAIM-MANAGE-1.1@b474c5c19115a785"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-93c20433e57a6c2d3034a20e","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-76466686fd7bb7a436041c87","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1 - ISO 31000:2018\n6.4.3.3\n6.5.1 - ISO 31000:2018\n6.5.2 - ISO 310008:2018\n6.5.3 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-47b37a53ae9e90a51e478b49","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-390a9832e7e100e01c706083","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4\n6.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-545188c3d0b7fdef4058ca55","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.2\n6.2.3\n6.2.4\n6.2.5\n6.2.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e27a4c0d1ddb78275ba25734","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-06","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-efd9f4df92fcc2fa71839b54","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c1b4fff0e1cf25d128cd481e","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-68300021b7116c22bb12d51d","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-adfcf125e5a821b65aaafe9b","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-972d0c57b856f961f2c11dec","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-692773f99270f63b7c2be709","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5f950138b24b0568beee0ab2","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-374d59fd94fb1a7021fd1367","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.3.3 - Management review results_x000D_\n6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment_x000D_\n6.1.4 - AI system impact assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9b6591bbe8dbb6b22b4368f1","from":"TAIM-MANAGE-1.2@a705fc2f096d2e46","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!62:62","fromKeys":["TAIM-MANAGE-1.2@a705fc2f096d2e46"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-647e7055bb076d11f24e8d36","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e48e578ee7757e6bb5dc6444","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fb89d1ef4a115eef27126855","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-68fe42f9a870b8215a39406d","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5\n6.7.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fca666130da4a7d2a735c1df","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Annex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9c0382dfe02602caa568d5ed","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-06","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4eb7648f1303d67d72dd2df9","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d934fd046fa361279e6c797b","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0158e96381c818b7204aaf27","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6101afdc8260613925adf748","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7351964b6bd0359820208deb","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e509c0157659dc6442f2ccd9","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-99cdc1e6d405535144797a09","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-81048ae901690bfc12756d17","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.1 - General_x000D_\n6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment_x000D_\n6.1.4 - AI system impact assessment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d119637c8c4dae9493aff4ae","from":"TAIM-MANAGE-1.3@76ff0f9ee6446d31","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA requires remediation where prohibited activities are discovered (with notice/cure periods).\nUtah: AI Policy Act (2024): UAIPA establishes a Regulatory Sandbox (AI Learning Laboratory), which supports experimental testing with oversight; allows measured, temporary deviations from full compliance.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!63:63","fromKeys":["TAIM-MANAGE-1.3@76ff0f9ee6446d31"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f8a9351790070b1be5b84cc7","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a053139814131c2dd5b15501","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1c776b4de710cf3ca5c350d2","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4.3\n6.4.1.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b5e1be5484566f100c6b9de7","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.2\n5.5","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-16e5fa8de57b83d3fdb5f508","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.18","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0cbfd9ac6542fc418fe4d402","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-06","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-65759899f3c3ddf829c22e41","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-06fcfbd4a0f8e57abe5a1fb3","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8b7d3302870020ff9ea6c24b","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f74db2c06d00d13cfc7f9968","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bd2f36c413fc296feff0afd4","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1d4939ffe76a95ef2d7031b9","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-04665d55dbc7f436119dc6cb","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-720d51f91031fb59fb33120a","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.5.3 - Documentation of AI system impact assessments_x000D_\nB.5.4 - Assessing AI system impact on individuals and groups of individuals_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.8.2 - System documentation and information for users","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cce2425fc5d6e51a8ef8b42c","from":"TAIM-MANAGE-1.4@614e57f0276eaccf","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!64:64","fromKeys":["TAIM-MANAGE-1.4@614e57f0276eaccf"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-12de447dd7b8d884b0aa8edc","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bfa588e202a101bcd5db3d2e","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.3 - ISO 31000:2018\n5.4.4 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fe6ced2e671650b13e827dd6","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-98fa8b1cac5bb496f2e4f4d5","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-817b910a9b0af1f72c6773a5","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.18","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6e5e95754309a03e0fea5a30","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-06","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c5468f45e06b914f5acaf123","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6b279b04a49b7e3d98771f06","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-451df82b75df5a73be6b243b","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2b2353a2b8ae8fffdbd55b7d","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b0a16aa3d04c3dd8bebc1d2b","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8b57e03582456de41fd2bbeb","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6c4fb85b1a3d495ab7d28140","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9accd0145d62720c2eb2f28d","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.4.2 - Resource documentation_x000D_\n7.1 - Resources","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aef03ba50b5a286e468cd415","from":"TAIM-MANAGE-2.1@aa163cc990ffc547","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA requires impact assessments and risk management programs for deployers and NIST formalizes risk treatments and post-deployment monitoring.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!65:65","fromKeys":["TAIM-MANAGE-2.1@aa163cc990ffc547"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-47eab7de7fc10023537e3c02","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1 - ISO 31000:2018\n6.4.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-24c1c2debbb88a53a61eca6a","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.2.3\n6.4.13.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-02721afed61be57ebc4ab719","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1f182e4e2b489882d3b85674","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.15.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8072c8ec3b8679c1ec14489e","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.RM-06","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ff2616b7f83cc96b739a502","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0b44d6c2c19fe3fc2869cfed","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5c0f280e36c64e83f1fe4794","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-46c40ae2e38620ed01221fe0","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-32194f6002db0eeb5aa98b1a","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-11d2f3bcbdc621306243391e","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-93253dcb7d82d22eff64a542","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-adb7be011e81c6d01dfd064a","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.3.3 - Reporting of concerns_x000D_\nB.6.1.2 - Objectives for responsible development of AI system_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.7.2 - Data for development and enhancement of AI system_x000D_\n7.1 - Resources_x000D_\n10.1 - Continual improvement","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b20cf4c6a4cd4788f751afb0","from":"TAIM-MANAGE-2.2@14538be506abb510","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.\nUtah: AI Policy Act (2024): UAIPA establishes a Regulatory Sandbox (AI Learning Laboratory), which supports experimental testing with oversight; allows measured, temporary deviations from full compliance.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!66:66","fromKeys":["TAIM-MANAGE-2.2@14538be506abb510"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-39b7717ef054922295cccdbc","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2\n5.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0c920475145afb514d930e45","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.15.3\n6.4.16.1\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-39bb95dc7461ac28c81f1029","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8451e42369edbbad6a9b85aa","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.5.10\n5.15.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c0dff09249047d5a257091d1","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"RC.RP-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3efe5624a5b6a70f6ea1bbc8","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1d110e58e3c6153a0fd22626","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f0b97f165b12439dea217776","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-27bc8c4bba79ad0d1839fcf6","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f96b982bc73c5955135b8723","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ef3e8507fc4e7afe952eb488","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f7cb018b8429100b1da82dd9","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ee9ef95741c8b0d9da5b1515","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"10.2 - Nonconformity and corrective action_x000D_\n6.1.1 - General_x000D_\n6.1.2 - AI risk assessment_x000D_\n6.1.3 - AI risk treatment","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-588d205da41959261a4b6885","from":"TAIM-MANAGE-2.3@438a1a9f5069b57c","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA states that if notified by AG, systems must be suspended or removed to avoid liability. AG has statutory removal/cure enforcement power.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!67:67","fromKeys":["TAIM-MANAGE-2.3@438a1a9f5069b57c"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-32bc39821ecb12f53d589ef6","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.4 - ISO 31000:2018\n6.4.2.4\n6.4.2.5\n6.4.2.6\n6.5.2 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dc635a6a17c4110b6880b712","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.17.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3490501ea7b07175cbb9ff3e","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.2.3\n6.7\n","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4aa5e2efce549083234c8e4b","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.22\n5.17\n6.1\n6.2.9\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ef8e1158153ce5c97b5c5069","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"RC.RP-02","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d82a11f50623af0e141a46f5","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1d5558d51e94cfed41ab876c","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-213607f4729bb0c226990dd8","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-96a167f7925b556e21d7d328","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6c71b38753b40138f669c637","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1e05870ffb6b7eef16b33062","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-136cd250b395f7f732c2290f","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fa14201351f300379002af23","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.9.4 - Intended use of the AI system_x000D_\nB.8.2 - System documentation and information for users_x000D_\nB.6.2.7 - AI system technical documentation_x000D_\nB.6.1.3 - Processes for responsible design and development of AI systems","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-77173003248fa1045ec648f0","from":"TAIM-MANAGE-2.4@7716c58006958476","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA states that if notified by AG, systems must be suspended or removed to avoid liability. AG has statutory removal/cure enforcement power.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!68:68","fromKeys":["TAIM-MANAGE-2.4@7716c58006958476"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0ce5d16394eba08264337f45","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-86a2d3e8fa1039c7af547a10","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.1","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-998cc2092bde88762a6b0e19","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.3.5.3\n6.3.8.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6186662f815e488c778cb927","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.7.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6cb1323f8e59dee8558225d1","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.4\n6.2.6\n6.2.8","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-be03914ede1f2acd58db10f9","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.SC-07","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2310912962c665b45052905d","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6ec1c4cdd9623e6b221089df","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fd78231129f5125eb2f2f718","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-300617e211ee4c928c84a49c","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1fe08c23b48e0d3525b8d7f7","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-96d77ef0c2cf07ad280eabd0","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-27dece7cf9b066123d08ecd2","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c837d7244407d74bf034d1a7","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.10.3 - Suppliers_x000D_\nB.10.2 - Allocating responsibilities","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-13b7b22a26f34da30a8319fa","from":"TAIM-MANAGE-3.1@019b36616e569086","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA imposes statutory liability, including for deployers using third-party AI or datasets if laws are violated (biometric, child protection, unlawful discrimination, etc.).","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!69:69","fromKeys":["TAIM-MANAGE-3.1@019b36616e569086"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-273eeb179953548b2872197d","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.3\n3.1.4\n6.2.1\n6.2.2\n6.3\n6.5.1\n6.5.3\n6.5.5\n7.2\n7.3\n7.4\n7.7\n8.4\n8.5\n8.6\n8.7\nA.2.2.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4f92214a5b251b72091844f7","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.3\n6.1.1.3\n6.3.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-78b20b1674537a4f646e5cda","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"A.1.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e3f933c8d35d56e0da7cf216","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.3.10\n3.3.14\n5.11.6\n5.11.7\n5.11.8\n5.11.9.1\n8.6.2\n10.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c564ee9a1557fd18df5cae84","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.SC-07","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-055c002c48f6e088bc3e9493","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-98cfc168c980d2eb64edcf3d","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-870e5e5d6662c01c30f6fb08","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-11a003cdc79119e90cf1d72d","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9f1721480cc0dea8203be06f","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c4dc912de8fbf3d9a4271f4e","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3e95db30acb12a788b928707","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e862a18e2b1839b68588b2e","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"B.4.4 - Tooling resources_x000D_\nB.6.2.6 - AI system operation and monitoring","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1f8f6bafbdc84e3b6a2a85d6","from":"TAIM-MANAGE-3.2@3a8b74098cc691a2","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!70:70","fromKeys":["TAIM-MANAGE-3.2@3a8b74098cc691a2"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-87a0c86d1ccbbbbdbced6f60","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"8.2\n8.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b40d86468a41c1d88836c20e","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.4.2\n6.6 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-73ad3659c23d1bcbe5ca39f0","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.15\n6.4.16","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a2800cd424f5c64e10035cbe","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.2.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f143511afe6d57955b410ec5","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.9\nAnnex A","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-943298704a3935d7a5d445e9","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"GV.SC-07","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8d08a0dc976aeaab401df7f9","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4935d3c6e5d7b8f92e0ddf91","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8b33fc9d6652421bc4b90e79","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-be9ea3bafa73c07bdaa7850a","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4450d857cdad7db2861341ea","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c19f2164323d62ea761cd618","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-77fc701b69d04602d3ef9d83","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8a2d08b8cef62a85e596feaf","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.2.1 - General_x000D_\nB.6.2.6 - AI system operation and monitoring_x000D_\nB.8.3 - External reporting_x000D_\nB.10.4 - Customers","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7a0cac0d900c458611ad0da9","from":"TAIM-MANAGE-4.1@46658ac358537223","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!71:71","fromKeys":["TAIM-MANAGE-4.1@46658ac358537223"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f46bc1c761edc22e09aa1249","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.4.1\n7.4\nA.3.2\nA.3.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-01a709eca5f14a71dc651ee4","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"5.7.1 ISO 31000:2018\n5.7.2 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a569e082ec831061ac485b97","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1.2.3\n6.4.14","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-078c86c5444c9d5d382203fe","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2\n6.7.4","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-af89040c552a94459b6d94fd","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.1\n6.2.7","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7758c286e7d1ce3efa5b5b0f","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"ID.IM-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3e01e672bdbf6be5f05163c6","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2e9db41a801803de51b5ce46","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6e765da5d408dd11c291fd1c","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-209c111836397b0558b026f8","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cbd867d5ff98ecb797e12f64","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2e20f5fe960dbe241ae5149e","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3349f771cdec6e1cd4e8627e","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-020c33fb932400c452ca6f39","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.3.3 - Management review results_x000D_\nB.6.2.4 - AI system verification and validation_x000D_\nB.6.2.6 - AI system operation and monitoring","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e51c1cef80fa6e9d8ea48fe3","from":"TAIM-MANAGE-4.2@c85453fdd5b795d2","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Colorado: Colorado AI Act (2024): CAIA requires impact assessments and risk management programs for deployers and NIST formalizes risk treatments and post-deployment monitoring.\nTexas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!72:72","fromKeys":["TAIM-MANAGE-4.2@c85453fdd5b795d2"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-594cc6a6affc22bff5a060af","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-ISO-23053@55bd3074feb4a00f","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"3.1.4\nA.2.2.2","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-ISO-23053@55bd3074feb4a00f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-41681ff11980170457fd5167","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-ISO-23894@cfadc45875112d5b","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.5.2 - ISO 31000:2018\n6.7 - ISO 31000:2018","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-ISO-23894@cfadc45875112d5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8fef27faff0f7192824e9bc1","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-ISO-5338@041ffb26c5d19cfa","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.4.3.3\n6.4.15.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-ISO-5338@041ffb26c5d19cfa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e724bda9d17b58be81f22b3","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-ISO-38507@7d77415d1c7cfe00","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"4.3\n6.1\n6.4\n6.7.3","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-ISO-38507@7d77415d1c7cfe00"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9b1fb1601760db5f6924da2b","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-ISO-22989@678e19f13815b3fc","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"6.2.6","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-ISO-22989@678e19f13815b3fc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-653df8d9c0808d014f76de2d","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-NIST-CSF2@467eb7f201efb93e","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"RC.CO-03","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-NIST-CSF2@467eb7f201efb93e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0e5a74a0c4bfd991cd52e97d","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-COBIT5@be354b207a896f92","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-COBIT5@be354b207a896f92"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7b55c6e2bdc9f82425386a1a","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-HIPAA@81492e1b5dcc743c","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-HIPAA@81492e1b5dcc743c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4576a30b3a3239d01f5899a9","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-PCI-DSS@77dc262ffef86dba","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-PCI-DSS@77dc262ffef86dba"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a1cca7763471e9d3fb0aa2bc","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-SOC2@bb1d3d369e5113d6","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-SOC2@bb1d3d369e5113d6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0778193bcf2e8dd99ede660e","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-EU-AI-ACT@b2877d95cb0be331","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-EU-AI-ACT@b2877d95cb0be331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2fe70720b993736a5e95cd9e","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-GDPR@620518a1daa19c81","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-GDPR@620518a1daa19c81"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-95a94c104cd3c37bb5d95349","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"✓","mappingPrecision":"presence-only","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-LEGACY-US-AI-BUNDLE@117740b358f70c6a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-31cd961bf1073282b788a6bb","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-ISO-42001@b588d95ea18aa2f8","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"9.3.2 - Management review inputs_x000D_\nB.8.5 - Information for interested parties_x000D_\nB.6.2.6 - AI system operation and monitoring","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-ISO-42001@b588d95ea18aa2f8"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-839825812da85414a4b62baf","from":"TAIM-MANAGE-4.3@86067afb96e12a89","to":"FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66","kind":"TAIM_FRAMEWORK_CROSSWALK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"locator":"Texas: Responsible Artificial Intelligence Governance Act (TRAIGA) - signed 06/22/2025; effective date 01/01/2026. The law applies to developers and deployers of AI systems conducting business in Texas, providing AI products or services used by Texas residents, or developing or deploying such systems within the state. TRAIGA is recommended for demonstrating substantial compliance and may apply in sandbox, but not statutorily required of all actors.","mappingPrecision":"workbook-locator","primarySourceVerified":false},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'99 TAIM Source'!73:73","fromKeys":["TAIM-MANAGE-4.3@86067afb96e12a89"],"toKeys":["FW-US-STATE-LAWS-BUNDLE@5c9e8ddf3b769a66"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-54e946bbc01e5a78960294a6","from":"MS-POL-POL-01","to":"MS-CTRL-POL-01-C01@b766250ab3daedc9","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Policy + charter + minutes","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!5:5","fromKeys":["MS-POL-POL-01@49c4c01e6c0532bb","MS-POL-POL-01@c04293698c8a9261"],"toKeys":["MS-CTRL-POL-01-C01@b766250ab3daedc9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c1b00c142e2eb0faa5b5b8cd","from":"MS-POL-POL-01","to":"MS-RULE-OP-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Detect / require","frameworkDrivers":"Core catalog crosswalk","evidence":"Inventory record + reconciliation","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!6:6","fromKeys":["MS-POL-POL-01@49c4c01e6c0532bb","MS-POL-POL-01@c04293698c8a9261"],"toKeys":["MS-RULE-OP-09@ec587343b8220a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0965e1bf61e2cbb0011319cc","from":"MS-POL-POL-01","to":"MS-RULE-AU-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / approve","frameworkDrivers":"Core catalog crosswalk","evidence":"Use-case approval + runtime context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!7:7","fromKeys":["MS-POL-POL-01@49c4c01e6c0532bb","MS-POL-POL-01@c04293698c8a9261"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ef7d07d0ee3693cdc2430b9b","from":"MS-POL-POL-01","to":"MS-RULE-OP-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Approve / expire","frameworkDrivers":"Core catalog crosswalk","evidence":"Exception record + expiry event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!8:8","fromKeys":["MS-POL-POL-01@49c4c01e6c0532bb","MS-POL-POL-01@c04293698c8a9261"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c049f8267dc191a257900128","from":"MS-POL-POL-02","to":"MS-CTRL-POL-02-C01@40fc29d45c4457f1","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Policy + attestation","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!9:9","fromKeys":["MS-POL-POL-02@aa0847ee55585424","MS-POL-POL-02@1d53076e8a906a49"],"toKeys":["MS-CTRL-POL-02-C01@40fc29d45c4457f1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b3fe6ac25fc1482278677a0e","from":"MS-POL-POL-02","to":"MS-RULE-IN-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Warn / block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + policy context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!10:10","fromKeys":["MS-POL-POL-02@aa0847ee55585424","MS-POL-POL-02@1d53076e8a906a49"],"toKeys":["MS-RULE-IN-07@31e317962beaeb5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-85d84d7c102a2a20484f7619","from":"MS-POL-POL-02","to":"MS-RULE-OU-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / transform","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + safety category","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!11:11","fromKeys":["MS-POL-POL-02@aa0847ee55585424","MS-POL-POL-02@1d53076e8a906a49"],"toKeys":["MS-RULE-OU-06@ce0137df984ac601"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-77ceb3f037ed541caa411af9","from":"MS-POL-POL-02","to":"MS-RULE-OU-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / route","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + escalation event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!12:12","fromKeys":["MS-POL-POL-02@aa0847ee55585424","MS-POL-POL-02@1d53076e8a906a49"],"toKeys":["MS-RULE-OU-07@7d5bc203e83e95c9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fd80021fcd3ce4f4f4bd74a3","from":"MS-POL-POL-03","to":"MS-CTRL-POL-03-C01@dbe46d341001eeb6","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Policy + inventory + egress logs","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!13:13","fromKeys":["MS-POL-POL-03@11c99e7398913f0f","MS-POL-POL-03@3cb30c5e249da778"],"toKeys":["MS-CTRL-POL-03-C01@dbe46d341001eeb6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ea745615c17e10d3fee922d","from":"MS-POL-POL-03","to":"MS-RULE-AU-01","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / redirect","frameworkDrivers":"Core catalog crosswalk","evidence":"Discovery and enforcement event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!14:14","fromKeys":["MS-POL-POL-03@11c99e7398913f0f","MS-POL-POL-03@3cb30c5e249da778"],"toKeys":["MS-RULE-AU-01@32b7d4ac14b06f7b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a05e7a7b8a7e1dd278ab580d","from":"MS-POL-POL-03","to":"MS-RULE-AU-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"IdP/config assertion + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!15:15","fromKeys":["MS-POL-POL-03@11c99e7398913f0f","MS-POL-POL-03@3cb30c5e249da778"],"toKeys":["MS-RULE-AU-02@1a166eaeb8f7f1ad"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-54881760c5429e8864fa5084","from":"MS-POL-POL-03","to":"MS-RULE-AU-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Detect / block","frameworkDrivers":"Core catalog crosswalk","evidence":"Inventory and alert","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!16:16","fromKeys":["MS-POL-POL-03@11c99e7398913f0f","MS-POL-POL-03@3cb30c5e249da778"],"toKeys":["MS-RULE-AU-08@4eda0a221f3ef380"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-82a67473d3c0ba781eba72a7","from":"MS-POL-POL-04","to":"MS-CTRL-POL-04-C01@386e3fe2d1f5246f","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Standard + decision matrix + DLP events","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!17:17","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-CTRL-POL-04-C01@386e3fe2d1f5246f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ef9e309eb8bbe380fb939c9b","from":"MS-POL-POL-04","to":"MS-RULE-DP-01","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log + redacted match","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!18:18","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ea3528c47ec41c9fb7744e8","from":"MS-POL-POL-04","to":"MS-RULE-DP-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log + redacted match","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!19:19","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ef92439b9bb40af7328d9eaf","from":"MS-POL-POL-04","to":"MS-RULE-DP-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / mask","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log + masked value","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!20:20","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-03@4cbb47b109e98f4a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-34ef3260e86ad713c06fb211","from":"MS-POL-POL-04","to":"MS-RULE-DP-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!21:21","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-04@13c6ba85197d9a69"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2c7202021e02cadb07c1c590","from":"MS-POL-POL-04","to":"MS-RULE-DP-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log + redacted match","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!22:22","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f4d1fc472cac5888c96462db","from":"MS-POL-POL-04","to":"MS-RULE-DP-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log + redacted match","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!23:23","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-06@af062b3863346b41"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-37b9263e93a4f2ab62cfbc78","from":"MS-POL-POL-04","to":"MS-RULE-DP-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + approved context + BAA evidence","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!24:24","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3b6f8289a4b68b3571e1cfca","from":"MS-POL-POL-04","to":"MS-RULE-DP-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + authorization record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!25:25","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a0d34d187a2ebcb28b01ef19","from":"MS-POL-POL-04","to":"MS-RULE-DP-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional warn/block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!26:26","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-786e12b075a7641959c8a726","from":"MS-POL-POL-04","to":"MS-RULE-DP-10","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!27:27","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a358f55f512fa8329788fae8","from":"MS-POL-POL-04","to":"MS-RULE-DP-11","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional warn/block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + approved purpose","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!28:28","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a6780b674d268ed7ecf45dbc","from":"MS-POL-POL-04","to":"MS-RULE-DP-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log + classification match","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!29:29","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fe1aa658ea765d4a1a1fa58d","from":"MS-POL-POL-04","to":"MS-RULE-DP-13","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + jurisdiction + authorization","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!30:30","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-13@1299bbf89c50bd1a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-765a0bb77a9976552a0f88ce","from":"MS-POL-POL-04","to":"MS-RULE-DP-14","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block/approve","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + repository/project context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!31:31","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ae30cff9dbfc049942db2c5c","from":"MS-POL-POL-04","to":"MS-RULE-DP-15","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional warn/block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + recipient/service context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!32:32","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b26fc09ad38b226455704025","from":"MS-POL-POL-04","to":"MS-RULE-DP-16","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block/approve","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + customer/tenant context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!33:33","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1d08dad047ad0e7b5728f4ab","from":"MS-POL-POL-04","to":"MS-RULE-DP-17","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + matter code","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!34:34","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3192308cc302106f8e0cff85","from":"MS-POL-POL-04","to":"MS-RULE-DP-18","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block/approve","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + matter authorization","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!35:35","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a6773b33e06c40c9240c33dc","from":"MS-POL-POL-04","to":"MS-RULE-AU-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / route","frameworkDrivers":"Core catalog crosswalk","evidence":"Routing decision + vendor configuration","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!36:36","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b56907a3f680cc4661e4bd43","from":"MS-POL-POL-04","to":"MS-RULE-AU-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Contract + configuration assertion","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!37:37","fromKeys":["MS-POL-POL-04@44f05efa6918df27","MS-POL-POL-04@879f79e7b7ac1d86"],"toKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0883eeb0b068f7b3021d4967","from":"MS-POL-POL-05","to":"MS-CTRL-POL-05-C01@ffefbbfc6f719437","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Policy + runtime events","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!38:38","fromKeys":["MS-POL-POL-05@9c8c386d8437959c","MS-POL-POL-05@50ff2ba2fff0e774"],"toKeys":["MS-CTRL-POL-05-C01@ffefbbfc6f719437"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c5a463e3da0ad198fbd5be8d","from":"MS-POL-POL-05","to":"MS-RULE-OU-01","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / redact","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + redacted output","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!39:39","fromKeys":["MS-POL-POL-05@9c8c386d8437959c","MS-POL-POL-05@50ff2ba2fff0e774"],"toKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-12ec02fb4e39d247c799db85","from":"MS-POL-POL-05","to":"MS-RULE-OU-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / redact","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + leakage class","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!40:40","fromKeys":["MS-POL-POL-05@9c8c386d8437959c","MS-POL-POL-05@50ff2ba2fff0e774"],"toKeys":["MS-RULE-OU-02@4965655028a3d485"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-19b4e27d77e46c30776532e8","from":"MS-POL-POL-05","to":"MS-RULE-OU-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Warn / hold","frameworkDrivers":"Core catalog crosswalk","evidence":"Claim-source links + verification result","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!41:41","fromKeys":["MS-POL-POL-05@9c8c386d8437959c","MS-POL-POL-05@50ff2ba2fff0e774"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1beabf791fb822665e77d68f","from":"MS-POL-POL-05","to":"MS-RULE-OU-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold for approval","frameworkDrivers":"Core catalog crosswalk","evidence":"Reviewer identity + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!42:42","fromKeys":["MS-POL-POL-05@9c8c386d8437959c","MS-POL-POL-05@50ff2ba2fff0e774"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a5bc0493af438f6cf0514cc9","from":"MS-POL-POL-05","to":"MS-RULE-OU-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold / alert","frameworkDrivers":"Core catalog crosswalk","evidence":"Fairness test + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!43:43","fromKeys":["MS-POL-POL-05@9c8c386d8437959c","MS-POL-POL-05@50ff2ba2fff0e774"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b9a252eaa7cc462fb2561978","from":"MS-POL-POL-05","to":"MS-RULE-OU-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / transform","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + safety category","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!44:44","fromKeys":["MS-POL-POL-05@9c8c386d8437959c","MS-POL-POL-05@50ff2ba2fff0e774"],"toKeys":["MS-RULE-OU-06@ce0137df984ac601"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ce4ac627d5170edcd0e3e430","from":"MS-POL-POL-05","to":"MS-RULE-OU-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / route","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + escalation event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!45:45","fromKeys":["MS-POL-POL-05@9c8c386d8437959c","MS-POL-POL-05@50ff2ba2fff0e774"],"toKeys":["MS-RULE-OU-07@7d5bc203e83e95c9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fe35ae781391cb362c5d240b","from":"MS-POL-POL-05","to":"MS-RULE-OU-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold / block","frameworkDrivers":"Core catalog crosswalk","evidence":"Scan findings + approval","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!46:46","fromKeys":["MS-POL-POL-05@9c8c386d8437959c","MS-POL-POL-05@50ff2ba2fff0e774"],"toKeys":["MS-RULE-OU-08@4c7bb6dc00dfcbfd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d44ded606a117dd7d589e422","from":"MS-POL-POL-05","to":"MS-RULE-OU-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Transform / block","frameworkDrivers":"Core catalog crosswalk","evidence":"Validation result + rejected payload","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!47:47","fromKeys":["MS-POL-POL-05@9c8c386d8437959c","MS-POL-POL-05@50ff2ba2fff0e774"],"toKeys":["MS-RULE-OU-09@2ffb1322457172b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b217c402a7b649c9eecb5032","from":"MS-POL-POL-05","to":"MS-RULE-OU-10","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Warn / hold","frameworkDrivers":"Core catalog crosswalk","evidence":"Similarity/license review record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!48:48","fromKeys":["MS-POL-POL-05@9c8c386d8437959c","MS-POL-POL-05@50ff2ba2fff0e774"],"toKeys":["MS-RULE-OU-10@2332653b89bcd331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fe12070bcfe7f618d8b54464","from":"MS-POL-POL-05","to":"MS-RULE-OU-11","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / hold","frameworkDrivers":"Core catalog crosswalk","evidence":"Privacy-risk result","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!49:49","fromKeys":["MS-POL-POL-05@9c8c386d8437959c","MS-POL-POL-05@50ff2ba2fff0e774"],"toKeys":["MS-RULE-OU-11@0710643d8a955cf6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ff89388e9c93d2dec30401a5","from":"MS-POL-POL-05","to":"MS-RULE-OU-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Transform / require disclosure","frameworkDrivers":"Core catalog crosswalk","evidence":"Label/provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!50:50","fromKeys":["MS-POL-POL-05@9c8c386d8437959c","MS-POL-POL-05@50ff2ba2fff0e774"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dcf879058d2d210df7aa7395","from":"MS-POL-POL-06","to":"MS-CTRL-POL-06-C01@7107ad18568fb35c","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Privacy policy + DPIA + configuration","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!51:51","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f","MS-POL-POL-06@3e3864614f0da24e"],"toKeys":["MS-CTRL-POL-06-C01@7107ad18568fb35c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-817502a2b60bfa0f3fe961e4","from":"MS-POL-POL-06","to":"MS-RULE-DP-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log + redacted match","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!52:52","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f","MS-POL-POL-06@3e3864614f0da24e"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0b854e05f1224c894e147d8d","from":"MS-POL-POL-06","to":"MS-RULE-DP-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log + redacted match","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!53:53","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f","MS-POL-POL-06@3e3864614f0da24e"],"toKeys":["MS-RULE-DP-06@af062b3863346b41"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-59c4c0bfce7684c90745111e","from":"MS-POL-POL-06","to":"MS-RULE-DP-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + approved context + BAA evidence","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!54:54","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f","MS-POL-POL-06@3e3864614f0da24e"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f079503678a862c82d7e81c3","from":"MS-POL-POL-06","to":"MS-RULE-DP-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + authorization record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!55:55","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f","MS-POL-POL-06@3e3864614f0da24e"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-469744701812af7848f8c6ed","from":"MS-POL-POL-06","to":"MS-RULE-DP-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional warn/block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!56:56","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f","MS-POL-POL-06@3e3864614f0da24e"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-831eaf152f5b4b83002b5278","from":"MS-POL-POL-06","to":"MS-RULE-DP-10","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!57:57","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f","MS-POL-POL-06@3e3864614f0da24e"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5fef5161fa0735f58b52d382","from":"MS-POL-POL-06","to":"MS-RULE-DP-11","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional warn/block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + approved purpose","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!58:58","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f","MS-POL-POL-06@3e3864614f0da24e"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-83620b67a637d0dfa58db647","from":"MS-POL-POL-06","to":"MS-RULE-OU-11","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / hold","frameworkDrivers":"Core catalog crosswalk","evidence":"Privacy-risk result","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!59:59","fromKeys":["MS-POL-POL-06@8603eff3ea33a61f","MS-POL-POL-06@3e3864614f0da24e"],"toKeys":["MS-RULE-OU-11@0710643d8a955cf6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ee35a777493dd14f88b950db","from":"MS-POL-POL-07","to":"MS-CTRL-POL-07-C01@92eeb3b18fd14237","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Security standard + tests + events","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!60:60","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5","MS-POL-POL-07@a95261fb9bd47400"],"toKeys":["MS-CTRL-POL-07-C01@92eeb3b18fd14237"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-605b62d8a3362601da52d47e","from":"MS-POL-POL-07","to":"MS-RULE-IN-01","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + attack class","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!61:61","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5","MS-POL-POL-07@a95261fb9bd47400"],"toKeys":["MS-RULE-IN-01@e4fe11be1a20f12f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e4f8aa6a69d91ddbb7f5a985","from":"MS-POL-POL-07","to":"MS-RULE-IN-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / isolate","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + source provenance","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!62:62","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5","MS-POL-POL-07@a95261fb9bd47400"],"toKeys":["MS-RULE-IN-02@dbb47a84e8a96c05"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a719b9db2998e8e8cd3b938c","from":"MS-POL-POL-07","to":"MS-RULE-IN-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / isolate","frameworkDrivers":"Core catalog crosswalk","evidence":"Normalization and decision log","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!63:63","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5","MS-POL-POL-07@a95261fb9bd47400"],"toKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8749cf70c62adb7868d8ca5c","from":"MS-POL-POL-07","to":"MS-RULE-IN-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + approved test context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!64:64","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5","MS-POL-POL-07@a95261fb9bd47400"],"toKeys":["MS-RULE-IN-04@40341d186f0bd606"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2a2beda589914c07730d35ad","from":"MS-POL-POL-07","to":"MS-RULE-IN-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / quarantine","frameworkDrivers":"Core catalog crosswalk","evidence":"Scan result + quarantine event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!65:65","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5","MS-POL-POL-07@a95261fb9bd47400"],"toKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-70d559d4be306442a2a2f84d","from":"MS-POL-POL-07","to":"MS-RULE-DP-15","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional warn/block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + recipient/service context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!66:66","fromKeys":["MS-POL-POL-07@a1b6f11dcbba27b5","MS-POL-POL-07@a95261fb9bd47400"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-687ac46fcb186cfe03a276ce","from":"MS-POL-POL-08","to":"MS-CTRL-POL-08-C01@9bdb77bb21f1278a","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Impact assessment + approval + logs","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!67:67","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16","MS-POL-POL-08@6b73225de437a7ac"],"toKeys":["MS-CTRL-POL-08-C01@9bdb77bb21f1278a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-31c03643689718cca42bd8ec","from":"MS-POL-POL-08","to":"MS-RULE-OU-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold for approval","frameworkDrivers":"Core catalog crosswalk","evidence":"Reviewer identity + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!68:68","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16","MS-POL-POL-08@6b73225de437a7ac"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-afd232f980602ecf3ae98457","from":"MS-POL-POL-08","to":"MS-RULE-OU-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold / alert","frameworkDrivers":"Core catalog crosswalk","evidence":"Fairness test + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!69:69","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16","MS-POL-POL-08@6b73225de437a7ac"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3e6ff73ab0cf2b001c6eec96","from":"MS-POL-POL-08","to":"MS-RULE-AG-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold for approval","frameworkDrivers":"Core catalog crosswalk","evidence":"Action preview + approver + result","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!70:70","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16","MS-POL-POL-08@6b73225de437a7ac"],"toKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c597f8115c4e3a991466fa9f","from":"MS-POL-POL-08","to":"MS-RULE-AG-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / hold","frameworkDrivers":"Core catalog crosswalk","evidence":"Human decision record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!71:71","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16","MS-POL-POL-08@6b73225de437a7ac"],"toKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a12d92f342c7469e30057d65","from":"MS-POL-POL-08","to":"MS-RULE-OP-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / disable","frameworkDrivers":"Core catalog crosswalk","evidence":"Kill event + authorization + recovery","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!72:72","fromKeys":["MS-POL-POL-08@ee4729bdeed9ad16","MS-POL-POL-08@6b73225de437a7ac"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fd00ee9bfc29446b6780de6e","from":"MS-POL-POL-09","to":"MS-CTRL-POL-09-C01@28bd04439eeb643f","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Assessment + approval","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!73:73","fromKeys":["MS-POL-POL-09@30cd5cb249f58ae2","MS-POL-POL-09@8c04be5259127986"],"toKeys":["MS-CTRL-POL-09-C01@28bd04439eeb643f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-67f28ad7d5dacd368e948bf4","from":"MS-POL-POL-09","to":"MS-RULE-AU-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / approve","frameworkDrivers":"Core catalog crosswalk","evidence":"Use-case approval + runtime context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!74:74","fromKeys":["MS-POL-POL-09@30cd5cb249f58ae2","MS-POL-POL-09@8c04be5259127986"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-49a02d2263fadd2c324b8171","from":"MS-POL-POL-09","to":"MS-RULE-OP-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold release","frameworkDrivers":"Core catalog crosswalk","evidence":"Change record + reassessment","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!75:75","fromKeys":["MS-POL-POL-09@30cd5cb249f58ae2","MS-POL-POL-09@8c04be5259127986"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-de9e7dab926b6bc494747d14","from":"MS-POL-POL-09","to":"MS-RULE-OP-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Approve / expire","frameworkDrivers":"Core catalog crosswalk","evidence":"Exception record + expiry event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!76:76","fromKeys":["MS-POL-POL-09@30cd5cb249f58ae2","MS-POL-POL-09@8c04be5259127986"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9f07465e9eb5f53dbf8256a6","from":"MS-POL-POL-10","to":"MS-CTRL-POL-10-C01@d6a7308768b38dd6","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Test evidence","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!77:77","fromKeys":["MS-POL-POL-10@cce53ffd6ac04512","MS-POL-POL-10@85ee73762e51641d"],"toKeys":["MS-CTRL-POL-10-C01@d6a7308768b38dd6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-942b33be5a858e67bb77757f","from":"MS-POL-POL-10","to":"MS-RULE-OP-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Monitor / gate","frameworkDrivers":"Core catalog crosswalk","evidence":"Metric series + threshold event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!78:78","fromKeys":["MS-POL-POL-10@cce53ffd6ac04512","MS-POL-POL-10@85ee73762e51641d"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-372e1c5b29cc75fd12b6ac5f","from":"MS-POL-POL-10","to":"MS-RULE-OP-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold release","frameworkDrivers":"Core catalog crosswalk","evidence":"Test report + release decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!79:79","fromKeys":["MS-POL-POL-10@cce53ffd6ac04512","MS-POL-POL-10@85ee73762e51641d"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f1222d6a054ef209e2d67b7d","from":"MS-POL-POL-11","to":"MS-CTRL-POL-11-C01@ba8f0f69896dbda0","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Logs + monitoring evidence","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!80:80","fromKeys":["MS-POL-POL-11@4cbd6ed56751cc97","MS-POL-POL-11@2c947637536e9be0"],"toKeys":["MS-CTRL-POL-11-C01@ba8f0f69896dbda0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1989a7dddda649d4a1b003b6","from":"MS-POL-POL-11","to":"MS-RULE-OP-01","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Log","frameworkDrivers":"Core catalog crosswalk","evidence":"Tamper-evident audit event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!81:81","fromKeys":["MS-POL-POL-11@4cbd6ed56751cc97","MS-POL-POL-11@2c947637536e9be0"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0b69d273c1e40a94eceb9423","from":"MS-POL-POL-11","to":"MS-RULE-OP-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Log / require","frameworkDrivers":"Core catalog crosswalk","evidence":"Provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!82:82","fromKeys":["MS-POL-POL-11@4cbd6ed56751cc97","MS-POL-POL-11@2c947637536e9be0"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-510734c4b00cb4d36d2415c9","from":"MS-POL-POL-11","to":"MS-RULE-OP-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Monitor / gate","frameworkDrivers":"Core catalog crosswalk","evidence":"Metric series + threshold event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!83:83","fromKeys":["MS-POL-POL-11@4cbd6ed56751cc97","MS-POL-POL-11@2c947637536e9be0"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b41d8aa97eae169e2514cb61","from":"MS-POL-POL-12","to":"MS-CTRL-POL-12-C01@328267f10538458f","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Plan + drill + incident evidence","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!84:84","fromKeys":["MS-POL-POL-12@2bcf920fc5a05e6b","MS-POL-POL-12@d890555e2ad21089"],"toKeys":["MS-CTRL-POL-12-C01@328267f10538458f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9048a7dc1db9290699ec7e7e","from":"MS-POL-POL-12","to":"MS-RULE-OP-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Alert / case","frameworkDrivers":"Core catalog crosswalk","evidence":"Incident/case record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!85:85","fromKeys":["MS-POL-POL-12@2bcf920fc5a05e6b","MS-POL-POL-12@d890555e2ad21089"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8a172ee830ace49ef53f4720","from":"MS-POL-POL-12","to":"MS-RULE-OP-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / disable","frameworkDrivers":"Core catalog crosswalk","evidence":"Kill event + authorization + recovery","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!86:86","fromKeys":["MS-POL-POL-12@2bcf920fc5a05e6b","MS-POL-POL-12@d890555e2ad21089"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ca8c850b93a34238a4c5cb88","from":"MS-POL-POL-13","to":"MS-CTRL-POL-13-C01@aa73ec05d68f5778","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Contract + assessment","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!87:87","fromKeys":["MS-POL-POL-13@e8a7e91b791104ce","MS-POL-POL-13@05690649552c9bb9"],"toKeys":["MS-CTRL-POL-13-C01@aa73ec05d68f5778"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c8b46416e38a3458f51a4d28","from":"MS-POL-POL-13","to":"MS-RULE-AU-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / route","frameworkDrivers":"Core catalog crosswalk","evidence":"Routing decision + vendor configuration","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!88:88","fromKeys":["MS-POL-POL-13@e8a7e91b791104ce","MS-POL-POL-13@05690649552c9bb9"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fa5eabda0f61404034f500b2","from":"MS-POL-POL-13","to":"MS-RULE-AU-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Contract + configuration assertion","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!89:89","fromKeys":["MS-POL-POL-13@e8a7e91b791104ce","MS-POL-POL-13@05690649552c9bb9"],"toKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bbcae8c55e05b32ab4932025","from":"MS-POL-POL-13","to":"MS-RULE-OP-10","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Monitor / gate","frameworkDrivers":"Core catalog crosswalk","evidence":"Vendor evidence + change event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!90:90","fromKeys":["MS-POL-POL-13@e8a7e91b791104ce","MS-POL-POL-13@05690649552c9bb9"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c5f71bb95801b8486011fedb","from":"MS-POL-POL-14","to":"MS-CTRL-POL-14-C01@d4d8e5f978ff6018","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Policy + tool logs + approvals","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!91:91","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5","MS-POL-POL-14@2a83e30bc6f88f8a"],"toKeys":["MS-CTRL-POL-14-C01@d4d8e5f978ff6018"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0eff70ac72c9ae4d0ce7f52e","from":"MS-POL-POL-14","to":"MS-RULE-AG-01","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Tool-policy decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!92:92","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5","MS-POL-POL-14@2a83e30bc6f88f8a"],"toKeys":["MS-RULE-AG-01@e6aee1767c267990"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-26bfb1d258647a212122f709","from":"MS-POL-POL-14","to":"MS-RULE-AG-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Credential scope + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!93:93","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5","MS-POL-POL-14@2a83e30bc6f88f8a"],"toKeys":["MS-RULE-AG-02@d4d178c0433fd6d4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-50318e2fa84b220cf54143d8","from":"MS-POL-POL-14","to":"MS-RULE-AG-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold for approval","frameworkDrivers":"Core catalog crosswalk","evidence":"Action preview + approver + result","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!94:94","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5","MS-POL-POL-14@2a83e30bc6f88f8a"],"toKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-72a39a2b15f6f0eb4dd6bddf","from":"MS-POL-POL-14","to":"MS-RULE-AG-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / hold","frameworkDrivers":"Core catalog crosswalk","evidence":"Human decision record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!95:95","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5","MS-POL-POL-14@2a83e30bc6f88f8a"],"toKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-af5805bb9e39c1236f938d7a","from":"MS-POL-POL-14","to":"MS-RULE-AG-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold for approval","frameworkDrivers":"Core catalog crosswalk","evidence":"Preview + approver + sent artifact","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!96:96","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5","MS-POL-POL-14@2a83e30bc6f88f8a"],"toKeys":["MS-RULE-AG-05@8829d873310f18f9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8f0c42d923ad7879c0b8c6c4","from":"MS-POL-POL-14","to":"MS-RULE-AG-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold / block","frameworkDrivers":"Core catalog crosswalk","evidence":"Diff/preview + approval + rollback reference","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!97:97","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5","MS-POL-POL-14@2a83e30bc6f88f8a"],"toKeys":["MS-RULE-AG-06@6371f819b40b0d97"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-627a9107fa3c7946ff2ac227","from":"MS-POL-POL-14","to":"MS-RULE-AG-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / throttle","frameworkDrivers":"Core catalog crosswalk","evidence":"Meter + limit decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!98:98","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5","MS-POL-POL-14@2a83e30bc6f88f8a"],"toKeys":["MS-RULE-AG-07@c2fb36c556cb8a62"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fba26cabec00ab4b23097eea","from":"MS-POL-POL-14","to":"MS-RULE-AG-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Isolation test + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!99:99","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5","MS-POL-POL-14@2a83e30bc6f88f8a"],"toKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f0a1655ed7c330acdbc0929b","from":"MS-POL-POL-14","to":"MS-RULE-AG-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / approve","frameworkDrivers":"Core catalog crosswalk","evidence":"Memory diff + provenance + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!100:100","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5","MS-POL-POL-14@2a83e30bc6f88f8a"],"toKeys":["MS-RULE-AG-09@2bd07e82a72d4f2e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-97155d3313d978facc97c4da","from":"MS-POL-POL-14","to":"MS-RULE-IN-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / throttle","frameworkDrivers":"Core catalog crosswalk","evidence":"Usage meter + throttle event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!101:101","fromKeys":["MS-POL-POL-14@aa241dc1520b8ab5","MS-POL-POL-14@2a83e30bc6f88f8a"],"toKeys":["MS-RULE-IN-08@94324ccfd3a491ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1f7acabc970a73057e980e0a","from":"MS-POL-POL-15","to":"MS-CTRL-POL-15-C01@bae38b8ddca62d09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"SDLC records + tests","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!102:102","fromKeys":["MS-POL-POL-15@66ce06439b6303c8","MS-POL-POL-15@92db373c77f25877"],"toKeys":["MS-CTRL-POL-15-C01@bae38b8ddca62d09"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-232daf74ebc39405c1474e9a","from":"MS-POL-POL-15","to":"MS-RULE-OU-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold / block","frameworkDrivers":"Core catalog crosswalk","evidence":"Scan findings + approval","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!103:103","fromKeys":["MS-POL-POL-15@66ce06439b6303c8","MS-POL-POL-15@92db373c77f25877"],"toKeys":["MS-RULE-OU-08@4c7bb6dc00dfcbfd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-54f5d8b72a8317988ffdd754","from":"MS-POL-POL-15","to":"MS-RULE-OU-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Transform / block","frameworkDrivers":"Core catalog crosswalk","evidence":"Validation result + rejected payload","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!104:104","fromKeys":["MS-POL-POL-15@66ce06439b6303c8","MS-POL-POL-15@92db373c77f25877"],"toKeys":["MS-RULE-OU-09@2ffb1322457172b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-493e2e7c28668c507ab6038b","from":"MS-POL-POL-15","to":"MS-RULE-OP-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold release","frameworkDrivers":"Core catalog crosswalk","evidence":"Change record + reassessment","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!105:105","fromKeys":["MS-POL-POL-15@66ce06439b6303c8","MS-POL-POL-15@92db373c77f25877"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b17999819e9ae2b07616081a","from":"MS-POL-POL-15","to":"MS-RULE-OP-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold release","frameworkDrivers":"Core catalog crosswalk","evidence":"Test report + release decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!106:106","fromKeys":["MS-POL-POL-15@66ce06439b6303c8","MS-POL-POL-15@92db373c77f25877"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3a6aeebc04ae9d465d701413","from":"MS-POL-POL-16","to":"MS-CTRL-POL-16-C01@4385dd308009dd40","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Fairness assessment + monitoring","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!107:107","fromKeys":["MS-POL-POL-16@e96f7674899ecd20","MS-POL-POL-16@ee0f7d2e98b800e9"],"toKeys":["MS-CTRL-POL-16-C01@4385dd308009dd40"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-34970347e8fac8c8df6db63f","from":"MS-POL-POL-16","to":"MS-RULE-OU-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold / alert","frameworkDrivers":"Core catalog crosswalk","evidence":"Fairness test + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!108:108","fromKeys":["MS-POL-POL-16@e96f7674899ecd20","MS-POL-POL-16@ee0f7d2e98b800e9"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-38e13751f402a46f447d9ef1","from":"MS-POL-POL-17","to":"MS-CTRL-POL-17-C01@a589870290e36ebc","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Notices + provenance logs","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!109:109","fromKeys":["MS-POL-POL-17@fbd2f1193b92724a","MS-POL-POL-17@ec7601a706961f3f"],"toKeys":["MS-CTRL-POL-17-C01@a589870290e36ebc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-68682d28c611b3403cb7b34d","from":"MS-POL-POL-17","to":"MS-RULE-OU-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Warn / hold","frameworkDrivers":"Core catalog crosswalk","evidence":"Claim-source links + verification result","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!110:110","fromKeys":["MS-POL-POL-17@fbd2f1193b92724a","MS-POL-POL-17@ec7601a706961f3f"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d81c8625d09344187dfb5506","from":"MS-POL-POL-17","to":"MS-RULE-OU-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Transform / require disclosure","frameworkDrivers":"Core catalog crosswalk","evidence":"Label/provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!111:111","fromKeys":["MS-POL-POL-17@fbd2f1193b92724a","MS-POL-POL-17@ec7601a706961f3f"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-feae2e1bfd8bfed1ab7ccddb","from":"MS-POL-POL-17","to":"MS-RULE-OP-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Log / require","frameworkDrivers":"Core catalog crosswalk","evidence":"Provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!112:112","fromKeys":["MS-POL-POL-17@fbd2f1193b92724a","MS-POL-POL-17@ec7601a706961f3f"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b4b9fae3b825316c7cde12ed","from":"MS-POL-POL-18","to":"MS-CTRL-POL-18-C01@353022021876b69f","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Policy + review records","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!113:113","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e","MS-POL-POL-18@ee2264a9b561bd1a"],"toKeys":["MS-CTRL-POL-18-C01@353022021876b69f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-476268d6bde7f5d2402603cc","from":"MS-POL-POL-18","to":"MS-RULE-DP-14","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block/approve","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + repository/project context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!114:114","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e","MS-POL-POL-18@ee2264a9b561bd1a"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b2f2b8de5ab80389a845479e","from":"MS-POL-POL-18","to":"MS-RULE-DP-16","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block/approve","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + customer/tenant context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!115:115","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e","MS-POL-POL-18@ee2264a9b561bd1a"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-02c9f5a8f9c6fa9b0168f8be","from":"MS-POL-POL-18","to":"MS-RULE-DP-17","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + matter code","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!116:116","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e","MS-POL-POL-18@ee2264a9b561bd1a"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c8d1b680f7ecc0e555afe086","from":"MS-POL-POL-18","to":"MS-RULE-DP-18","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block/approve","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + matter authorization","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!117:117","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e","MS-POL-POL-18@ee2264a9b561bd1a"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-982e9ce829c8aa146440ad20","from":"MS-POL-POL-18","to":"MS-RULE-OU-10","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Warn / hold","frameworkDrivers":"Core catalog crosswalk","evidence":"Similarity/license review record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!118:118","fromKeys":["MS-POL-POL-18@97f5690fa7f7084e","MS-POL-POL-18@ee2264a9b561bd1a"],"toKeys":["MS-RULE-OU-10@2332653b89bcd331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e86c532adc208cfd0c394146","from":"MS-POL-POL-19","to":"MS-CTRL-POL-19-C01@8b80f45de84ee486","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Completion + assessment","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!119:119","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-CTRL-POL-19-C01@8b80f45de84ee486"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5d02977dbe9b3627ce7f5a35","from":"MS-POL-POL-19","to":"MS-RULE-DP-01","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log + redacted match","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!120:120","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-01@82066dbd9b9a4f14"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fbf85fd4933a8f848a310948","from":"MS-POL-POL-19","to":"MS-RULE-DP-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log + redacted match","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!121:121","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-02@d20cd6810e42f858"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8a94b6cc7b55f67e5f82658d","from":"MS-POL-POL-19","to":"MS-RULE-DP-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / mask","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log + masked value","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!122:122","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-03@4cbb47b109e98f4a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6ead359e79965db06a3879c8","from":"MS-POL-POL-19","to":"MS-RULE-DP-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!123:123","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-04@13c6ba85197d9a69"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bb519218c40bef24766ec640","from":"MS-POL-POL-19","to":"MS-RULE-DP-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log + redacted match","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!124:124","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-05@30a7a6fc8d2d373f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b9cac94811af4437d803b4dd","from":"MS-POL-POL-19","to":"MS-RULE-DP-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log + redacted match","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!125:125","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-06@af062b3863346b41"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4a109d4fd17e62acfcb8b864","from":"MS-POL-POL-19","to":"MS-RULE-DP-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + approved context + BAA evidence","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!126:126","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-740c838cb14e55e63b69aa9a","from":"MS-POL-POL-19","to":"MS-RULE-DP-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + authorization record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!127:127","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c262be2e656eec655a5177b3","from":"MS-POL-POL-19","to":"MS-RULE-DP-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional warn/block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!128:128","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-008b083b0e05e11fd4952b81","from":"MS-POL-POL-19","to":"MS-RULE-DP-10","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!129:129","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c9fbfd493994d58565d74cbb","from":"MS-POL-POL-19","to":"MS-RULE-DP-11","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional warn/block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + approved purpose","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!130:130","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ac59af840532ab99d8370ea4","from":"MS-POL-POL-19","to":"MS-RULE-DP-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision log + classification match","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!131:131","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ff0612945ff88b2ab73f9939","from":"MS-POL-POL-19","to":"MS-RULE-DP-13","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + jurisdiction + authorization","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!132:132","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-13@1299bbf89c50bd1a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-31e24b7cd32607b73396ff9b","from":"MS-POL-POL-19","to":"MS-RULE-DP-14","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block/approve","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + repository/project context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!133:133","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-14@7b898303f53ec49b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ce04fe6df58b8d8167a3b25a","from":"MS-POL-POL-19","to":"MS-RULE-DP-15","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional warn/block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + recipient/service context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!134:134","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-15@208a0f796d79405e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7ad84a40ac5d31de9709827b","from":"MS-POL-POL-19","to":"MS-RULE-DP-16","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block/approve","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + customer/tenant context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!135:135","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-16@d0dca88853814a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9e26331017cc99549f7cfa97","from":"MS-POL-POL-19","to":"MS-RULE-DP-17","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + matter code","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!136:136","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-17@d1c8e0c542b0a6f6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e2a30d86828160d41507bc79","from":"MS-POL-POL-19","to":"MS-RULE-DP-18","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block/approve","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + matter authorization","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!137:137","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fdd1b40dd7a0d1bd38ed24ed","from":"MS-POL-POL-19","to":"MS-RULE-AU-01","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / redirect","frameworkDrivers":"Core catalog crosswalk","evidence":"Discovery and enforcement event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!138:138","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AU-01@32b7d4ac14b06f7b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1ff4c90c15da13b1f44c0f67","from":"MS-POL-POL-19","to":"MS-RULE-AU-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"IdP/config assertion + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!139:139","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AU-02@1a166eaeb8f7f1ad"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-706629bf1bcc49da8c2ff245","from":"MS-POL-POL-19","to":"MS-RULE-AU-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + entitlement snapshot","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!140:140","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-98664ddb9769d5d8768ec0bc","from":"MS-POL-POL-19","to":"MS-RULE-AU-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / approve","frameworkDrivers":"Core catalog crosswalk","evidence":"Use-case approval + runtime context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!141:141","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AU-04@d51101a040857487"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-095ae3cd808a692d24b41fac","from":"MS-POL-POL-19","to":"MS-RULE-AU-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / route","frameworkDrivers":"Core catalog crosswalk","evidence":"Routing decision + vendor configuration","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!142:142","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bbc535ae3951b0a508fa0e15","from":"MS-POL-POL-19","to":"MS-RULE-AU-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Contract + configuration assertion","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!143:143","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-389dc63020a0034f28732121","from":"MS-POL-POL-19","to":"MS-RULE-AU-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / alert","frameworkDrivers":"Core catalog crosswalk","evidence":"Authentication and anomaly event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!144:144","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AU-07@989c3a6787fc6689"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-70fcf117a19249700487ce49","from":"MS-POL-POL-19","to":"MS-RULE-AU-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Detect / block","frameworkDrivers":"Core catalog crosswalk","evidence":"Inventory and alert","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!145:145","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AU-08@4eda0a221f3ef380"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-339432f8d19ff3ac7b77ec0b","from":"MS-POL-POL-19","to":"MS-RULE-IN-01","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + attack class","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!146:146","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-IN-01@e4fe11be1a20f12f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3bdf00ea0ff304bf349c6a2e","from":"MS-POL-POL-19","to":"MS-RULE-IN-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / isolate","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + source provenance","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!147:147","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-IN-02@dbb47a84e8a96c05"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-dbacfcd05940f88522e18fd5","from":"MS-POL-POL-19","to":"MS-RULE-IN-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / isolate","frameworkDrivers":"Core catalog crosswalk","evidence":"Normalization and decision log","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!148:148","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-IN-03@900d1ac2806dab1c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-62c1b22190fcc5b987b594bd","from":"MS-POL-POL-19","to":"MS-RULE-IN-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + approved test context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!149:149","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-IN-04@40341d186f0bd606"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-30910295a218a98eb1e4c000","from":"MS-POL-POL-19","to":"MS-RULE-IN-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / quarantine","frameworkDrivers":"Core catalog crosswalk","evidence":"Scan result + quarantine event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!150:150","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-IN-05@8dff43ab30881e3f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-062ae5cde7c0bcdda5a2d8f6","from":"MS-POL-POL-19","to":"MS-RULE-IN-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / quarantine","frameworkDrivers":"Core catalog crosswalk","evidence":"Provenance + integrity + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!151:151","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-IN-06@478a04da335c1e7f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7a11d9b2999e26f43e321cf3","from":"MS-POL-POL-19","to":"MS-RULE-IN-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Warn / block","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + policy context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!152:152","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-IN-07@31e317962beaeb5b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-32fa31f7312244f577fab47b","from":"MS-POL-POL-19","to":"MS-RULE-IN-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / throttle","frameworkDrivers":"Core catalog crosswalk","evidence":"Usage meter + throttle event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!153:153","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-IN-08@94324ccfd3a491ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-acb88f265302aa71578a9722","from":"MS-POL-POL-19","to":"MS-RULE-OU-01","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / redact","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + redacted output","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!154:154","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OU-01@d0805195b855c7dd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7c0621e4af2912e48c3174e7","from":"MS-POL-POL-19","to":"MS-RULE-OU-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / redact","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + leakage class","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!155:155","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OU-02@4965655028a3d485"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ac47a891cf5761d8dfe79159","from":"MS-POL-POL-19","to":"MS-RULE-OU-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Warn / hold","frameworkDrivers":"Core catalog crosswalk","evidence":"Claim-source links + verification result","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!156:156","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-897416d74826d262fc88151d","from":"MS-POL-POL-19","to":"MS-RULE-OU-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold for approval","frameworkDrivers":"Core catalog crosswalk","evidence":"Reviewer identity + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!157:157","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-884d37cad7cd3452303d1014","from":"MS-POL-POL-19","to":"MS-RULE-OU-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold / alert","frameworkDrivers":"Core catalog crosswalk","evidence":"Fairness test + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!158:158","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9edd0e3889251c78c84bafb4","from":"MS-POL-POL-19","to":"MS-RULE-OU-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / transform","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + safety category","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!159:159","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OU-06@ce0137df984ac601"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5637dab81f7ba2f9404d7de8","from":"MS-POL-POL-19","to":"MS-RULE-OU-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / route","frameworkDrivers":"Core catalog crosswalk","evidence":"Decision + escalation event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!160:160","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OU-07@7d5bc203e83e95c9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-61627490dd125fa156cb778a","from":"MS-POL-POL-19","to":"MS-RULE-OU-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold / block","frameworkDrivers":"Core catalog crosswalk","evidence":"Scan findings + approval","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!161:161","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OU-08@4c7bb6dc00dfcbfd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ffe93dd0685c80540013f31","from":"MS-POL-POL-19","to":"MS-RULE-OU-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Transform / block","frameworkDrivers":"Core catalog crosswalk","evidence":"Validation result + rejected payload","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!162:162","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OU-09@2ffb1322457172b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-aedb03a5cf55435e6acf5310","from":"MS-POL-POL-19","to":"MS-RULE-OU-10","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Warn / hold","frameworkDrivers":"Core catalog crosswalk","evidence":"Similarity/license review record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!163:163","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OU-10@2332653b89bcd331"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-70529798fc7fb405c623c3dd","from":"MS-POL-POL-19","to":"MS-RULE-OU-11","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / hold","frameworkDrivers":"Core catalog crosswalk","evidence":"Privacy-risk result","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!164:164","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OU-11@0710643d8a955cf6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3c14ddc8b77aa00f8d84f7a3","from":"MS-POL-POL-19","to":"MS-RULE-OU-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Transform / require disclosure","frameworkDrivers":"Core catalog crosswalk","evidence":"Label/provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!165:165","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6d6326c2bd0aecda89bbd31e","from":"MS-POL-POL-19","to":"MS-RULE-AG-01","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Tool-policy decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!166:166","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AG-01@e6aee1767c267990"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-00eed0d286714b7094603603","from":"MS-POL-POL-19","to":"MS-RULE-AG-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Credential scope + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!167:167","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AG-02@d4d178c0433fd6d4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7bce9da2c3bdba657248ed9b","from":"MS-POL-POL-19","to":"MS-RULE-AG-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold for approval","frameworkDrivers":"Core catalog crosswalk","evidence":"Action preview + approver + result","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!168:168","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4e178c770d522c7946ded846","from":"MS-POL-POL-19","to":"MS-RULE-AG-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / hold","frameworkDrivers":"Core catalog crosswalk","evidence":"Human decision record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!169:169","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3c520203f1b6734096f43cfc","from":"MS-POL-POL-19","to":"MS-RULE-AG-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold for approval","frameworkDrivers":"Core catalog crosswalk","evidence":"Preview + approver + sent artifact","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!170:170","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AG-05@8829d873310f18f9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7f6f849347badf68f527a518","from":"MS-POL-POL-19","to":"MS-RULE-AG-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold / block","frameworkDrivers":"Core catalog crosswalk","evidence":"Diff/preview + approval + rollback reference","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!171:171","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AG-06@6371f819b40b0d97"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-50fc886f85c23ff40b7a296d","from":"MS-POL-POL-19","to":"MS-RULE-AG-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / throttle","frameworkDrivers":"Core catalog crosswalk","evidence":"Meter + limit decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!172:172","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AG-07@c2fb36c556cb8a62"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4b9b827ef17a389984f6b265","from":"MS-POL-POL-19","to":"MS-RULE-AG-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Isolation test + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!173:173","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-86e7728ff83ff7197d805c52","from":"MS-POL-POL-19","to":"MS-RULE-AG-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / approve","frameworkDrivers":"Core catalog crosswalk","evidence":"Memory diff + provenance + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!174:174","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AG-09@2bd07e82a72d4f2e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c302f1bf7acd3eba140143bd","from":"MS-POL-POL-19","to":"MS-RULE-AG-10","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / quarantine","frameworkDrivers":"Core catalog crosswalk","evidence":"SBOM/provenance + verification event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!175:175","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1e9629c1b7e3ffebed6f2a24","from":"MS-POL-POL-19","to":"MS-RULE-OP-01","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Log","frameworkDrivers":"Core catalog crosswalk","evidence":"Tamper-evident audit event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!176:176","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-582e3bd146032657926f0950","from":"MS-POL-POL-19","to":"MS-RULE-OP-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Log / require","frameworkDrivers":"Core catalog crosswalk","evidence":"Provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!177:177","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-797489f2a662c6a8f6ca741f","from":"MS-POL-POL-19","to":"MS-RULE-OP-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Monitor / gate","frameworkDrivers":"Core catalog crosswalk","evidence":"Metric series + threshold event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!178:178","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4ed48dc9113fcb390f802e03","from":"MS-POL-POL-19","to":"MS-RULE-OP-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Alert / case","frameworkDrivers":"Core catalog crosswalk","evidence":"Incident/case record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!179:179","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OP-04@63fbf478664e5e99"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e5b5f64ccab1a14d0ddbc2b2","from":"MS-POL-POL-19","to":"MS-RULE-OP-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / disable","frameworkDrivers":"Core catalog crosswalk","evidence":"Kill event + authorization + recovery","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!180:180","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6ee047db7f2674b2ce30e9fe","from":"MS-POL-POL-19","to":"MS-RULE-OP-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold release","frameworkDrivers":"Core catalog crosswalk","evidence":"Change record + reassessment","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!181:181","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ce04181700adab4bec10e2ab","from":"MS-POL-POL-19","to":"MS-RULE-OP-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Approve / expire","frameworkDrivers":"Core catalog crosswalk","evidence":"Exception record + expiry event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!182:182","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d253f4529d0cbabb69ada81c","from":"MS-POL-POL-19","to":"MS-RULE-OP-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Workflow","frameworkDrivers":"Core catalog crosswalk","evidence":"Appeal + resolution record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!183:183","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-98464b0f4810e949cf092d12","from":"MS-POL-POL-19","to":"MS-RULE-OP-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Detect / require","frameworkDrivers":"Core catalog crosswalk","evidence":"Inventory record + reconciliation","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!184:184","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OP-09@ec587343b8220a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7e21d7b14aa59d929a532560","from":"MS-POL-POL-19","to":"MS-RULE-OP-10","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Monitor / gate","frameworkDrivers":"Core catalog crosswalk","evidence":"Vendor evidence + change event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!185:185","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-34da22950465dcb8fcffab98","from":"MS-POL-POL-19","to":"MS-RULE-OP-11","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Automate / verify","frameworkDrivers":"Core catalog crosswalk","evidence":"Deletion certificate + access revocation","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!186:186","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8ec88fe17ea5c2856b2d0e74","from":"MS-POL-POL-19","to":"MS-RULE-OP-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold release","frameworkDrivers":"Core catalog crosswalk","evidence":"Test report + release decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!187:187","fromKeys":["MS-POL-POL-19@d6f23b7346439395","MS-POL-POL-19@aed1a48acd06ccbe"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-505e5134f019850f264a75bb","from":"MS-POL-POL-20","to":"MS-CTRL-POL-20-C01@f431b58ee095a892","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Workflow records","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!188:188","fromKeys":["MS-POL-POL-20@ea163decd6c07a16","MS-POL-POL-20@c9a396428183869a"],"toKeys":["MS-CTRL-POL-20-C01@f431b58ee095a892"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2307023f2d67917b96e1bf98","from":"MS-POL-POL-20","to":"MS-RULE-OP-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Approve / expire","frameworkDrivers":"Core catalog crosswalk","evidence":"Exception record + expiry event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!189:189","fromKeys":["MS-POL-POL-20@ea163decd6c07a16","MS-POL-POL-20@c9a396428183869a"],"toKeys":["MS-RULE-OP-07@f1df2cbcb724af3b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2dec8c4fc311eec33393952a","from":"MS-POL-POL-20","to":"MS-RULE-OP-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Workflow","frameworkDrivers":"Core catalog crosswalk","evidence":"Appeal + resolution record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!190:190","fromKeys":["MS-POL-POL-20@ea163decd6c07a16","MS-POL-POL-20@c9a396428183869a"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f924dc8a3b99df50864f75ee","from":"MS-POL-POL-21","to":"MS-CTRL-POL-21-C01@8b5135c5fa6c4d80","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Deletion and revocation evidence","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!191:191","fromKeys":["MS-POL-POL-21@9a99a10275e80192","MS-POL-POL-21@20a70c7870aa9b0a"],"toKeys":["MS-CTRL-POL-21-C01@8b5135c5fa6c4d80"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-129172f21321ea0fa7b513a3","from":"MS-POL-POL-21","to":"MS-RULE-OP-11","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Automate / verify","frameworkDrivers":"Core catalog crosswalk","evidence":"Deletion certificate + access revocation","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!192:192","fromKeys":["MS-POL-POL-21@9a99a10275e80192","MS-POL-POL-21@20a70c7870aa9b0a"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7f19df780e748944723dad32","from":"MS-POL-POL-22","to":"MS-CTRL-POL-22-C01@0008bb9b0a6ec78a","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Policy baseline control","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"Core enterprise baseline","evidence":"Provenance + test + SBOM evidence","reportedApproval":"Approved baseline design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!193:193","fromKeys":["MS-POL-POL-22@7864cb607001d95d","MS-POL-POL-22@e64fee0922267d4e"],"toKeys":["MS-CTRL-POL-22-C01@0008bb9b0a6ec78a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-05c79f6be0e6f11737f0398d","from":"MS-POL-POL-22","to":"MS-RULE-IN-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / quarantine","frameworkDrivers":"Core catalog crosswalk","evidence":"Provenance + integrity + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!194:194","fromKeys":["MS-POL-POL-22@7864cb607001d95d","MS-POL-POL-22@e64fee0922267d4e"],"toKeys":["MS-RULE-IN-06@478a04da335c1e7f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-94aa5333f0e1e0526526a963","from":"MS-POL-POL-22","to":"MS-RULE-AG-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"Core catalog crosswalk","evidence":"Isolation test + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!195:195","fromKeys":["MS-POL-POL-22@7864cb607001d95d","MS-POL-POL-22@e64fee0922267d4e"],"toKeys":["MS-RULE-AG-08@b98e349c6e27f319"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ba297dbbe74ca25f0cb98011","from":"MS-POL-POL-22","to":"MS-RULE-AG-10","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / quarantine","frameworkDrivers":"Core catalog crosswalk","evidence":"SBOM/provenance + verification event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!196:196","fromKeys":["MS-POL-POL-22@7864cb607001d95d","MS-POL-POL-22@e64fee0922267d4e"],"toKeys":["MS-RULE-AG-10@41b899de0bf0744b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b4a5e4ab60748e6fb196ba0c","from":"MS-POL-POL-23","to":"MS-CTRL-POL-23-C01@8177afebde7da07a","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Workflow / System Configuration","frameworkDrivers":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","evidence":"Schedule + retention configuration + hold record + deletion certificate","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!197:197","fromKeys":["MS-POL-POL-23@daaad9ef8b33a963","MS-POL-POL-23@f183914bbbf48a36"],"toKeys":["MS-CTRL-POL-23-C01@8177afebde7da07a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bff6e2afb7a8d8130d6c9cf8","from":"MS-POL-POL-23","to":"MS-CTRL-POL-23-C02@1bd8482b6b9bad6c","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"System Configuration","frameworkDrivers":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","evidence":"Schedule + retention configuration + hold record + deletion certificate","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!198:198","fromKeys":["MS-POL-POL-23@daaad9ef8b33a963","MS-POL-POL-23@f183914bbbf48a36"],"toKeys":["MS-CTRL-POL-23-C02@1bd8482b6b9bad6c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b1ea87bcf13372ec2e445c19","from":"MS-POL-POL-23","to":"MS-CTRL-POL-23-C03@1678ca94f02e1cbc","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Assurance / Testing","frameworkDrivers":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","evidence":"Schedule + retention configuration + hold record + deletion certificate","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!199:199","fromKeys":["MS-POL-POL-23@daaad9ef8b33a963","MS-POL-POL-23@f183914bbbf48a36"],"toKeys":["MS-CTRL-POL-23-C03@1678ca94f02e1cbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5a59fe2562ad01c01c28e481","from":"MS-POL-POL-23","to":"MS-RULE-OP-01","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Log","frameworkDrivers":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","evidence":"Tamper-evident audit event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!200:200","fromKeys":["MS-POL-POL-23@daaad9ef8b33a963","MS-POL-POL-23@f183914bbbf48a36"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fb24078f487da82a3264e305","from":"MS-POL-POL-23","to":"MS-RULE-OP-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Log / require","frameworkDrivers":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","evidence":"Provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!201:201","fromKeys":["MS-POL-POL-23@daaad9ef8b33a963","MS-POL-POL-23@f183914bbbf48a36"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-50f2c0be368f000d956dbe6b","from":"MS-POL-POL-23","to":"MS-RULE-OP-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Detect / require","frameworkDrivers":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","evidence":"Inventory record + reconciliation","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!202:202","fromKeys":["MS-POL-POL-23@daaad9ef8b33a963","MS-POL-POL-23@f183914bbbf48a36"],"toKeys":["MS-RULE-OP-09@ec587343b8220a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2efb908347875d7dfd27db9b","from":"MS-POL-POL-23","to":"MS-RULE-OP-11","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Automate / verify","frameworkDrivers":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","evidence":"Deletion certificate + access revocation","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!203:203","fromKeys":["MS-POL-POL-23@daaad9ef8b33a963","MS-POL-POL-23@f183914bbbf48a36"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-fb53d649139fd0d890ba3b43","from":"MS-POL-POL-23","to":"MS-RULE-DP-18","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block/approve","frameworkDrivers":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","evidence":"Decision + matter authorization","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!204:204","fromKeys":["MS-POL-POL-23@daaad9ef8b33a963","MS-POL-POL-23@f183914bbbf48a36"],"toKeys":["MS-RULE-DP-18@082a5a202e1a48ef"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c07785e7c4c0a0efe14a19e3","from":"MS-POL-POL-23","to":"MS-RULE-OP-13","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"SOX; OMB-M25-21; CJIS-6.1; IRS-1075; UK-DP-AI; GDPR","evidence":"Retention class + hold + deletion certificate","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!205:205","fromKeys":["MS-POL-POL-23@daaad9ef8b33a963","MS-POL-POL-23@f183914bbbf48a36"],"toKeys":["MS-RULE-OP-13@d9a7b8a98719c7c2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2558fb72f29ae0f127852197","from":"MS-POL-POL-24","to":"MS-CTRL-POL-24-C01@d5e684dfef1b2e9c","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Document / Policy","frameworkDrivers":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","evidence":"Accessibility requirements + ACR/VPAT + test results + exception record","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!206:206","fromKeys":["MS-POL-POL-24@3ac8bb46b53fea08","MS-POL-POL-24@1d7f4f0e0bd28468"],"toKeys":["MS-CTRL-POL-24-C01@d5e684dfef1b2e9c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-05b6ffce89f29a48258f2e02","from":"MS-POL-POL-24","to":"MS-CTRL-POL-24-C02@d918e2b22e350918","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Assurance / Testing","frameworkDrivers":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","evidence":"Accessibility requirements + ACR/VPAT + test results + exception record","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!207:207","fromKeys":["MS-POL-POL-24@3ac8bb46b53fea08","MS-POL-POL-24@1d7f4f0e0bd28468"],"toKeys":["MS-CTRL-POL-24-C02@d918e2b22e350918"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4d1067f308ca117593040ee3","from":"MS-POL-POL-24","to":"MS-CTRL-POL-24-C03@dbbd781e2afd0ee6","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Workflow / Process","frameworkDrivers":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","evidence":"Accessibility requirements + ACR/VPAT + test results + exception record","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!208:208","fromKeys":["MS-POL-POL-24@3ac8bb46b53fea08","MS-POL-POL-24@1d7f4f0e0bd28468"],"toKeys":["MS-CTRL-POL-24-C03@dbbd781e2afd0ee6"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-88b0d67517c10f264da7db18","from":"MS-POL-POL-24","to":"MS-RULE-OU-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold for approval","frameworkDrivers":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","evidence":"Reviewer identity + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!209:209","fromKeys":["MS-POL-POL-24@3ac8bb46b53fea08","MS-POL-POL-24@1d7f4f0e0bd28468"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9dac67657d25ad08ba14d251","from":"MS-POL-POL-24","to":"MS-RULE-OU-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold / alert","frameworkDrivers":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","evidence":"Fairness test + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!210:210","fromKeys":["MS-POL-POL-24@3ac8bb46b53fea08","MS-POL-POL-24@1d7f4f0e0bd28468"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8bcd1a7b99dd9e1a61120e5f","from":"MS-POL-POL-24","to":"MS-RULE-OU-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Transform / require disclosure","frameworkDrivers":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","evidence":"Label/provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!211:211","fromKeys":["MS-POL-POL-24@3ac8bb46b53fea08","MS-POL-POL-24@1d7f4f0e0bd28468"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8b59de85e36efeba4db32b44","from":"MS-POL-POL-24","to":"MS-RULE-OP-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold release","frameworkDrivers":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","evidence":"Test report + release decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!212:212","fromKeys":["MS-POL-POL-24@3ac8bb46b53fea08","MS-POL-POL-24@1d7f4f0e0bd28468"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-409f2fef28189a2dd02573ca","from":"MS-POL-POL-24","to":"MS-RULE-OU-13","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"SECTION-508; EU-AI-ACT; NIST-AI-RMF","evidence":"Accessibility test + conformance record","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!213:213","fromKeys":["MS-POL-POL-24@3ac8bb46b53fea08","MS-POL-POL-24@1d7f4f0e0bd28468"],"toKeys":["MS-RULE-OU-13@1eb7cb01e3cf473f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2262bc6dc6e5a982b13fe9a4","from":"MS-POL-POL-25","to":"MS-CTRL-POL-25-C01@f1c5ef468cf35b54","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Workflow / Process","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Use inventory + notice/consent + bias audit + publication + decision logs","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!214:214","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d","MS-POL-POL-25@597e30d9cfdaf3d4"],"toKeys":["MS-CTRL-POL-25-C01@f1c5ef468cf35b54"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-57fd854d5344f6846e1d0ea3","from":"MS-POL-POL-25","to":"MS-CTRL-POL-25-C02@65df3c955cab3391","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Transaction Warning / Approval","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Use inventory + notice/consent + bias audit + publication + decision logs","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!215:215","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d","MS-POL-POL-25@597e30d9cfdaf3d4"],"toKeys":["MS-CTRL-POL-25-C02@65df3c955cab3391"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3506e354b47f5159c34aadec","from":"MS-POL-POL-25","to":"MS-CTRL-POL-25-C03@4b08a537f8b2697c","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Assurance / Testing","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Use inventory + notice/consent + bias audit + publication + decision logs","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!216:216","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d","MS-POL-POL-25@597e30d9cfdaf3d4"],"toKeys":["MS-CTRL-POL-25-C03@4b08a537f8b2697c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6ef2acc9d76a317c0ac99a5b","from":"MS-POL-POL-25","to":"MS-RULE-OU-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold for approval","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Reviewer identity + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!217:217","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d","MS-POL-POL-25@597e30d9cfdaf3d4"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-14c42af0b803dc281571c71d","from":"MS-POL-POL-25","to":"MS-RULE-OU-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold / alert","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Fairness test + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!218:218","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d","MS-POL-POL-25@597e30d9cfdaf3d4"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-1a79e185388f6e9b732a1a19","from":"MS-POL-POL-25","to":"MS-RULE-OU-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Transform / require disclosure","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Label/provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!219:219","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d","MS-POL-POL-25@597e30d9cfdaf3d4"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a2d7d180fcc6b88703d7eb52","from":"MS-POL-POL-25","to":"MS-RULE-OP-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Log / require","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!220:220","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d","MS-POL-POL-25@597e30d9cfdaf3d4"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-52bca5f369e5fcdce9d74fe1","from":"MS-POL-POL-25","to":"MS-RULE-OP-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Monitor / gate","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Metric series + threshold event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!221:221","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d","MS-POL-POL-25@597e30d9cfdaf3d4"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0f0b66d92d0f49c141db450c","from":"MS-POL-POL-25","to":"MS-RULE-OP-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Workflow","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Appeal + resolution record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!222:222","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d","MS-POL-POL-25@597e30d9cfdaf3d4"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-921bbe75c5be05bd49b5a7a0","from":"MS-POL-POL-25","to":"MS-RULE-OP-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold release","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Test report + release decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!223:223","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d","MS-POL-POL-25@597e30d9cfdaf3d4"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-46d90c87e067d8a38cf8c76b","from":"MS-POL-POL-25","to":"MS-RULE-OP-14","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Audit + independence + publication + validity date","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!224:224","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d","MS-POL-POL-25@597e30d9cfdaf3d4"],"toKeys":["MS-RULE-OP-14@b102df5650885781"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-22a4a4fc2f6530d7cdbe368d","from":"MS-POL-POL-25","to":"MS-RULE-OU-14","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Decision factors + notice + delivery record","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!225:225","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d","MS-POL-POL-25@597e30d9cfdaf3d4"],"toKeys":["MS-RULE-OU-14@ae9d5f3f618c9838"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0138b3340209cd17df214df9","from":"MS-POL-POL-25","to":"MS-RULE-OP-18","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"NYC-LL144; IL-AIVIA; EU-AI-ACT; GDPR","evidence":"Registry record + disclosure artifact + timestamp","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!226:226","fromKeys":["MS-POL-POL-25@cbf2a67c65532b7d","MS-POL-POL-25@597e30d9cfdaf3d4"],"toKeys":["MS-RULE-OP-18@1df03547863d8288"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2892517da9350502a20eafab","from":"MS-POL-POL-26","to":"MS-CTRL-POL-26-C01@d2d8820db6d6a87e","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"System Configuration","frameworkDrivers":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","evidence":"Model documentation + validation + decision factors + notices + complaints","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!227:227","fromKeys":["MS-POL-POL-26@306487f686bd6069","MS-POL-POL-26@d4fc522de78b75ea"],"toKeys":["MS-CTRL-POL-26-C01@d2d8820db6d6a87e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-995b7a0e0c504c6fae2b481c","from":"MS-POL-POL-26","to":"MS-CTRL-POL-26-C02@e82d80b0d844beb1","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Transaction Prevention","frameworkDrivers":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","evidence":"Model documentation + validation + decision factors + notices + complaints","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!228:228","fromKeys":["MS-POL-POL-26@306487f686bd6069","MS-POL-POL-26@d4fc522de78b75ea"],"toKeys":["MS-CTRL-POL-26-C02@e82d80b0d844beb1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-07a9469e5e8808646f6e46ec","from":"MS-POL-POL-26","to":"MS-CTRL-POL-26-C03@e63178b9cd783908","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Assurance / Testing","frameworkDrivers":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","evidence":"Model documentation + validation + decision factors + notices + complaints","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!229:229","fromKeys":["MS-POL-POL-26@306487f686bd6069","MS-POL-POL-26@d4fc522de78b75ea"],"toKeys":["MS-CTRL-POL-26-C03@e63178b9cd783908"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-920e30ff657f91414998f6e1","from":"MS-POL-POL-26","to":"MS-RULE-OU-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Warn / hold","frameworkDrivers":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","evidence":"Claim-source links + verification result","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!230:230","fromKeys":["MS-POL-POL-26@306487f686bd6069","MS-POL-POL-26@d4fc522de78b75ea"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b9ef1a10be517e9e824e7b52","from":"MS-POL-POL-26","to":"MS-RULE-OU-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold for approval","frameworkDrivers":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","evidence":"Reviewer identity + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!231:231","fromKeys":["MS-POL-POL-26@306487f686bd6069","MS-POL-POL-26@d4fc522de78b75ea"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e452ea01712bd9fd532893aa","from":"MS-POL-POL-26","to":"MS-RULE-OU-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold / alert","frameworkDrivers":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","evidence":"Fairness test + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!232:232","fromKeys":["MS-POL-POL-26@306487f686bd6069","MS-POL-POL-26@d4fc522de78b75ea"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-47a670e4507628b4f17effc4","from":"MS-POL-POL-26","to":"MS-RULE-OP-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Log / require","frameworkDrivers":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","evidence":"Provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!233:233","fromKeys":["MS-POL-POL-26@306487f686bd6069","MS-POL-POL-26@d4fc522de78b75ea"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-838483f991f321f5171134fa","from":"MS-POL-POL-26","to":"MS-RULE-OP-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Monitor / gate","frameworkDrivers":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","evidence":"Metric series + threshold event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!234:234","fromKeys":["MS-POL-POL-26@306487f686bd6069","MS-POL-POL-26@d4fc522de78b75ea"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b468e47694998509f2b9cc28","from":"MS-POL-POL-26","to":"MS-RULE-OP-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Workflow","frameworkDrivers":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","evidence":"Appeal + resolution record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!235:235","fromKeys":["MS-POL-POL-26@306487f686bd6069","MS-POL-POL-26@d4fc522de78b75ea"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-176192964b1e4dd6e7a9d49f","from":"MS-POL-POL-26","to":"MS-RULE-OP-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold release","frameworkDrivers":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","evidence":"Test report + release decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!236:236","fromKeys":["MS-POL-POL-26@306487f686bd6069","MS-POL-POL-26@d4fc522de78b75ea"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-abafb4e9e39fd55cfd9b47eb","from":"MS-POL-POL-26","to":"MS-RULE-OU-14","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","evidence":"Decision factors + notice + delivery record","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!237:237","fromKeys":["MS-POL-POL-26@306487f686bd6069","MS-POL-POL-26@d4fc522de78b75ea"],"toKeys":["MS-RULE-OU-14@ae9d5f3f618c9838"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4c2f7861b6e1b6768670a9d2","from":"MS-POL-POL-26","to":"MS-RULE-OP-17","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"ECOA-REG-B; FRB-MRM-2026; GLBA; GDPR","evidence":"Validation + challenge + findings + approval","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!238:238","fromKeys":["MS-POL-POL-26@306487f686bd6069","MS-POL-POL-26@d4fc522de78b75ea"],"toKeys":["MS-RULE-OP-17@6b311b898e8dc850"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6e5029fda48efae56464676a","from":"MS-POL-POL-27","to":"MS-CTRL-POL-27-C01@f3fafd4f1eb871cc","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Workflow / Process","frameworkDrivers":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","evidence":"Intended-use statement + validation + reviewer logs + monitoring + safety events","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!239:239","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b","MS-POL-POL-27@68833138d9c86a50"],"toKeys":["MS-CTRL-POL-27-C01@f3fafd4f1eb871cc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b0962c598efa5fa93a4c937e","from":"MS-POL-POL-27","to":"MS-CTRL-POL-27-C02@95768538c03b23cf","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Transaction Prevention","frameworkDrivers":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","evidence":"Intended-use statement + validation + reviewer logs + monitoring + safety events","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!240:240","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b","MS-POL-POL-27@68833138d9c86a50"],"toKeys":["MS-CTRL-POL-27-C02@95768538c03b23cf"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0ac0a735bc2407d705668d29","from":"MS-POL-POL-27","to":"MS-CTRL-POL-27-C03@51941690c4ccdbbc","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Continuous Detection / Monitoring","frameworkDrivers":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","evidence":"Intended-use statement + validation + reviewer logs + monitoring + safety events","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!241:241","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b","MS-POL-POL-27@68833138d9c86a50"],"toKeys":["MS-CTRL-POL-27-C03@51941690c4ccdbbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-69fb37e1db360ae9fdf77dab","from":"MS-POL-POL-27","to":"MS-RULE-DP-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block","frameworkDrivers":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","evidence":"Decision + approved context + BAA evidence","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!242:242","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b","MS-POL-POL-27@68833138d9c86a50"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-58d3b7223fe27a82b2b1155e","from":"MS-POL-POL-27","to":"MS-RULE-OU-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Warn / hold","frameworkDrivers":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","evidence":"Claim-source links + verification result","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!243:243","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b","MS-POL-POL-27@68833138d9c86a50"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e86687829af38816846e43e0","from":"MS-POL-POL-27","to":"MS-RULE-OU-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold for approval","frameworkDrivers":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","evidence":"Reviewer identity + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!244:244","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b","MS-POL-POL-27@68833138d9c86a50"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0ceed3601f81e3154d7ce4a5","from":"MS-POL-POL-27","to":"MS-RULE-OU-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold / alert","frameworkDrivers":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","evidence":"Fairness test + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!245:245","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b","MS-POL-POL-27@68833138d9c86a50"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-10420d2237d453fce83bf438","from":"MS-POL-POL-27","to":"MS-RULE-OP-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Monitor / gate","frameworkDrivers":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","evidence":"Metric series + threshold event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!246:246","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b","MS-POL-POL-27@68833138d9c86a50"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-03d4e69eb6f5546102601a98","from":"MS-POL-POL-27","to":"MS-RULE-OP-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / disable","frameworkDrivers":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","evidence":"Kill event + authorization + recovery","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!247:247","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b","MS-POL-POL-27@68833138d9c86a50"],"toKeys":["MS-RULE-OP-05@98df9a80a2151ad4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-28eb7d8d259580d02838b037","from":"MS-POL-POL-27","to":"MS-RULE-OP-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold release","frameworkDrivers":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","evidence":"Change record + reassessment","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!248:248","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b","MS-POL-POL-27@68833138d9c86a50"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-23a0cf618c3292bbe5bee3e0","from":"MS-POL-POL-27","to":"MS-RULE-OP-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold release","frameworkDrivers":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","evidence":"Test report + release decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!249:249","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b","MS-POL-POL-27@68833138d9c86a50"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-12de0f879556497ca39e58d5","from":"MS-POL-POL-27","to":"MS-RULE-OP-15","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"HIPAA; HHS-PART2; ONC-HTI1; FDA-AI-MD","evidence":"Intended-use match + validation + reviewer decision","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!250:250","fromKeys":["MS-POL-POL-27@24ccacabdf3df91b","MS-POL-POL-27@68833138d9c86a50"],"toKeys":["MS-RULE-OP-15@bab74c0be8fc582d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c0719576f9c8beef902b4e08","from":"MS-POL-POL-28","to":"MS-CTRL-POL-28-C01@95cebd36e96c97aa","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Workflow / Process","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Age assessment + consent + data map + safety tests + deletion evidence","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!251:251","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef","MS-POL-POL-28@0647c4283f3dd806"],"toKeys":["MS-CTRL-POL-28-C01@95cebd36e96c97aa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f878fcc0fe28b41b74fc495a","from":"MS-POL-POL-28","to":"MS-CTRL-POL-28-C02@75a42ce5eb954451","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Transaction Prevention","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Age assessment + consent + data map + safety tests + deletion evidence","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!252:252","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef","MS-POL-POL-28@0647c4283f3dd806"],"toKeys":["MS-CTRL-POL-28-C02@75a42ce5eb954451"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-78b8b2384fdf4641f894be7c","from":"MS-POL-POL-28","to":"MS-CTRL-POL-28-C03@00038d1a54adc49c","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Transaction Warning / Approval","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Age assessment + consent + data map + safety tests + deletion evidence","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!253:253","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef","MS-POL-POL-28@0647c4283f3dd806"],"toKeys":["MS-CTRL-POL-28-C03@00038d1a54adc49c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b9b9c489bc6843b211d86abe","from":"MS-POL-POL-28","to":"MS-RULE-DP-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Decision + authorization record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!254:254","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef","MS-POL-POL-28@0647c4283f3dd806"],"toKeys":["MS-RULE-DP-08@f94b476097640eb3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5d4a8ea1a2435832e09e5d7c","from":"MS-POL-POL-28","to":"MS-RULE-DP-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional warn/block","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Decision + context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!255:255","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef","MS-POL-POL-28@0647c4283f3dd806"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-622beb716e7fb6425f06c7c6","from":"MS-POL-POL-28","to":"MS-RULE-DP-10","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Decision log","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!256:256","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef","MS-POL-POL-28@0647c4283f3dd806"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2b7f6327ea00af848bb7ad4c","from":"MS-POL-POL-28","to":"MS-RULE-DP-11","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional warn/block","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Decision + approved purpose","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!257:257","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef","MS-POL-POL-28@0647c4283f3dd806"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0d83a8758be5662ec21586d6","from":"MS-POL-POL-28","to":"MS-RULE-OU-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / transform","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Decision + safety category","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!258:258","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef","MS-POL-POL-28@0647c4283f3dd806"],"toKeys":["MS-RULE-OU-06@ce0137df984ac601"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-38c96f0300fad43e5cd5ee81","from":"MS-POL-POL-28","to":"MS-RULE-OU-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / route","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Decision + escalation event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!259:259","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef","MS-POL-POL-28@0647c4283f3dd806"],"toKeys":["MS-RULE-OU-07@7d5bc203e83e95c9"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f75e5f1313b1879c98490086","from":"MS-POL-POL-28","to":"MS-RULE-OU-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Transform / require disclosure","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Label/provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!260:260","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef","MS-POL-POL-28@0647c4283f3dd806"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-58f4e04bebb0efc1fac58aae","from":"MS-POL-POL-28","to":"MS-RULE-OP-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Workflow","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Appeal + resolution record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!261:261","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef","MS-POL-POL-28@0647c4283f3dd806"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a4060199158986a5f67f272e","from":"MS-POL-POL-28","to":"MS-RULE-DP-19","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Consent decision + age band + deletion event","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!262:262","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef","MS-POL-POL-28@0647c4283f3dd806"],"toKeys":["MS-RULE-DP-19@40fb41ffda35d9a3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-699dbb3dfbc49f3abf62c3b7","from":"MS-POL-POL-28","to":"MS-RULE-OU-15","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"COPPA; FERPA; EU-AI-ACT","evidence":"Age/context decision + response control + escalation","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!263:263","fromKeys":["MS-POL-POL-28@d850b62ebf5806ef","MS-POL-POL-28@0647c4283f3dd806"],"toKeys":["MS-RULE-OU-15@17dad38dad581076"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-c2ebe5150f66ae7330748ffe","from":"MS-POL-POL-29","to":"MS-CTRL-POL-29-C01@2a636b88495545f2","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Workflow / Process","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Impact assessment + notice + decision record + approvals + appeal outcomes","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!264:264","fromKeys":["MS-POL-POL-29@15da853e19e2751a","MS-POL-POL-29@0ed02484ce9e6aaa"],"toKeys":["MS-CTRL-POL-29-C01@2a636b88495545f2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7aa42883ee6dce81925be60c","from":"MS-POL-POL-29","to":"MS-CTRL-POL-29-C02@454e63540191c754","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Transaction Warning / Approval","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Impact assessment + notice + decision record + approvals + appeal outcomes","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!265:265","fromKeys":["MS-POL-POL-29@15da853e19e2751a","MS-POL-POL-29@0ed02484ce9e6aaa"],"toKeys":["MS-CTRL-POL-29-C02@454e63540191c754"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-741d8487e2ec116adbe507be","from":"MS-POL-POL-29","to":"MS-CTRL-POL-29-C03@9e8988e83061cf94","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Transaction Prevention","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Impact assessment + notice + decision record + approvals + appeal outcomes","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!266:266","fromKeys":["MS-POL-POL-29@15da853e19e2751a","MS-POL-POL-29@0ed02484ce9e6aaa"],"toKeys":["MS-CTRL-POL-29-C03@9e8988e83061cf94"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a33a8b62bd8dc2cf47d8b52b","from":"MS-POL-POL-29","to":"MS-RULE-OU-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold for approval","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Reviewer identity + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!267:267","fromKeys":["MS-POL-POL-29@15da853e19e2751a","MS-POL-POL-29@0ed02484ce9e6aaa"],"toKeys":["MS-RULE-OU-04@4f3b3444715b2744"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b5a62092a6c13566ccc1308d","from":"MS-POL-POL-29","to":"MS-RULE-OU-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold / alert","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Fairness test + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!268:268","fromKeys":["MS-POL-POL-29@15da853e19e2751a","MS-POL-POL-29@0ed02484ce9e6aaa"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a06f548753d9cf860ab74da0","from":"MS-POL-POL-29","to":"MS-RULE-OU-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Transform / require disclosure","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Label/provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!269:269","fromKeys":["MS-POL-POL-29@15da853e19e2751a","MS-POL-POL-29@0ed02484ce9e6aaa"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5a83551b4e9d6d50ed3873d5","from":"MS-POL-POL-29","to":"MS-RULE-AG-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold for approval","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Action preview + approver + result","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!270:270","fromKeys":["MS-POL-POL-29@15da853e19e2751a","MS-POL-POL-29@0ed02484ce9e6aaa"],"toKeys":["MS-RULE-AG-03@20aa3c90fa880f0d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6a5117d1825881542a304d9a","from":"MS-POL-POL-29","to":"MS-RULE-AG-04","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / hold","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Human decision record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!271:271","fromKeys":["MS-POL-POL-29@15da853e19e2751a","MS-POL-POL-29@0ed02484ce9e6aaa"],"toKeys":["MS-RULE-AG-04@c7af717b1d68045e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-157edd6447632ac5168a8385","from":"MS-POL-POL-29","to":"MS-RULE-OP-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Log / require","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!272:272","fromKeys":["MS-POL-POL-29@15da853e19e2751a","MS-POL-POL-29@0ed02484ce9e6aaa"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9da0854c070095b153e4eae8","from":"MS-POL-POL-29","to":"MS-RULE-OP-08","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Workflow","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Appeal + resolution record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!273:273","fromKeys":["MS-POL-POL-29@15da853e19e2751a","MS-POL-POL-29@0ed02484ce9e6aaa"],"toKeys":["MS-RULE-OP-08@a38dff87950aa40f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-4e182c8f4ca1ece4660be217","from":"MS-POL-POL-29","to":"MS-RULE-OP-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Detect / require","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Inventory record + reconciliation","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!274:274","fromKeys":["MS-POL-POL-29@15da853e19e2751a","MS-POL-POL-29@0ed02484ce9e6aaa"],"toKeys":["MS-RULE-OP-09@ec587343b8220a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a16a18a1880bb02e6906eb5e","from":"MS-POL-POL-29","to":"MS-RULE-OP-16","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Notice + rationale + reviewer + appeal record","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!275:275","fromKeys":["MS-POL-POL-29@15da853e19e2751a","MS-POL-POL-29@0ed02484ce9e6aaa"],"toKeys":["MS-RULE-OP-16@277159bc0f54c27c"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-86ec5a4e644691c8075de38f","from":"MS-POL-POL-29","to":"MS-RULE-AG-11","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Two approvals + action log + scope","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!276:276","fromKeys":["MS-POL-POL-29@15da853e19e2751a","MS-POL-POL-29@0ed02484ce9e6aaa"],"toKeys":["MS-RULE-AG-11@f9288b5977523607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9526d7b9c336594f1c6c9aa0","from":"MS-POL-POL-29","to":"MS-RULE-OP-18","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"OMB-M25-21; NIST-800-53; CJIS-6.1; SECTION-508; EU-AI-ACT","evidence":"Registry record + disclosure artifact + timestamp","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!277:277","fromKeys":["MS-POL-POL-29@15da853e19e2751a","MS-POL-POL-29@0ed02484ce9e6aaa"],"toKeys":["MS-RULE-OP-18@1df03547863d8288"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-b1ffbfbdd69d4f391711d967","from":"MS-POL-POL-30","to":"MS-CTRL-POL-30-C01@8d15ee1e0bb3ebf4","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"System Configuration","frameworkDrivers":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","evidence":"Handling matrix + labels + boundary config + access logs + inspections","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!278:278","fromKeys":["MS-POL-POL-30@09fcec49716e93c1","MS-POL-POL-30@83f7dac5a0008a83"],"toKeys":["MS-CTRL-POL-30-C01@8d15ee1e0bb3ebf4"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-5ce3977094b72553d507d16c","from":"MS-POL-POL-30","to":"MS-CTRL-POL-30-C02@2dd54d58131ceade","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Transaction Prevention","frameworkDrivers":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","evidence":"Handling matrix + labels + boundary config + access logs + inspections","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!279:279","fromKeys":["MS-POL-POL-30@09fcec49716e93c1","MS-POL-POL-30@83f7dac5a0008a83"],"toKeys":["MS-CTRL-POL-30-C02@2dd54d58131ceade"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0acc9c68cb94c63d7b07cb32","from":"MS-POL-POL-30","to":"MS-CTRL-POL-30-C03@ea04ae8a27c7247b","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Continuous Detection / Monitoring","frameworkDrivers":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","evidence":"Handling matrix + labels + boundary config + access logs + inspections","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!280:280","fromKeys":["MS-POL-POL-30@09fcec49716e93c1","MS-POL-POL-30@83f7dac5a0008a83"],"toKeys":["MS-CTRL-POL-30-C03@ea04ae8a27c7247b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0468478476efd591f407bc76","from":"MS-POL-POL-30","to":"MS-RULE-DP-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block","frameworkDrivers":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","evidence":"Decision + approved context + BAA evidence","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!281:281","fromKeys":["MS-POL-POL-30@09fcec49716e93c1","MS-POL-POL-30@83f7dac5a0008a83"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-41ea5ebf2c5e467e053437ba","from":"MS-POL-POL-30","to":"MS-RULE-DP-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","evidence":"Decision log + classification match","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!282:282","fromKeys":["MS-POL-POL-30@09fcec49716e93c1","MS-POL-POL-30@83f7dac5a0008a83"],"toKeys":["MS-RULE-DP-12@4ae51c2523134e28"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-04f730518a0ad9bf569a305c","from":"MS-POL-POL-30","to":"MS-RULE-DP-13","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block","frameworkDrivers":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","evidence":"Decision + jurisdiction + authorization","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!283:283","fromKeys":["MS-POL-POL-30@09fcec49716e93c1","MS-POL-POL-30@83f7dac5a0008a83"],"toKeys":["MS-RULE-DP-13@1299bbf89c50bd1a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-66b487492592cf4d5a66d853","from":"MS-POL-POL-30","to":"MS-RULE-AU-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","evidence":"Decision + entitlement snapshot","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!284:284","fromKeys":["MS-POL-POL-30@09fcec49716e93c1","MS-POL-POL-30@83f7dac5a0008a83"],"toKeys":["MS-RULE-AU-03@ece0c972ca2c62e1"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-46ed6a105b643eb443891e8c","from":"MS-POL-POL-30","to":"MS-RULE-AU-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / route","frameworkDrivers":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","evidence":"Routing decision + vendor configuration","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!285:285","fromKeys":["MS-POL-POL-30@09fcec49716e93c1","MS-POL-POL-30@83f7dac5a0008a83"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-e8bec4b18f422ecb87d90429","from":"MS-POL-POL-30","to":"MS-RULE-OP-01","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Log","frameworkDrivers":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","evidence":"Tamper-evident audit event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!286:286","fromKeys":["MS-POL-POL-30@09fcec49716e93c1","MS-POL-POL-30@83f7dac5a0008a83"],"toKeys":["MS-RULE-OP-01@ce84968e8045ef9e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7fd691bec398df5306420dd9","from":"MS-POL-POL-30","to":"MS-RULE-OP-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Detect / require","frameworkDrivers":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","evidence":"Inventory record + reconciliation","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!287:287","fromKeys":["MS-POL-POL-30@09fcec49716e93c1","MS-POL-POL-30@83f7dac5a0008a83"],"toKeys":["MS-RULE-OP-09@ec587343b8220a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6e97f0621edd214d2206c44a","from":"MS-POL-POL-30","to":"MS-RULE-OP-11","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Automate / verify","frameworkDrivers":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","evidence":"Deletion certificate + access revocation","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!288:288","fromKeys":["MS-POL-POL-30@09fcec49716e93c1","MS-POL-POL-30@83f7dac5a0008a83"],"toKeys":["MS-RULE-OP-11@a024a5509524bfa2"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-96575617a2a1e8eddc118ce2","from":"MS-POL-POL-30","to":"MS-RULE-AU-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"NIST-800-171; CMMC; CJIS-6.1; IRS-1075; HHS-PART2; EAR","evidence":"Authorization context + decision log","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!289:289","fromKeys":["MS-POL-POL-30@09fcec49716e93c1","MS-POL-POL-30@83f7dac5a0008a83"],"toKeys":["MS-RULE-AU-09@204573caad930259"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-799e26a4c62f6311a1ca6e79","from":"MS-POL-POL-31","to":"MS-CTRL-POL-31-C01@8ca08935ea227608","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Workflow / Process","frameworkDrivers":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","evidence":"Tiering + model inventory + validation + findings + approvals","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!290:290","fromKeys":["MS-POL-POL-31@1e5f7eb3de495c93","MS-POL-POL-31@0c25dadb14d3c446"],"toKeys":["MS-CTRL-POL-31-C01@8ca08935ea227608"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-3c0c7451f0b22e77074993c0","from":"MS-POL-POL-31","to":"MS-CTRL-POL-31-C02@85c34fafa98fabaf","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Assurance / Testing","frameworkDrivers":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","evidence":"Tiering + model inventory + validation + findings + approvals","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!291:291","fromKeys":["MS-POL-POL-31@1e5f7eb3de495c93","MS-POL-POL-31@0c25dadb14d3c446"],"toKeys":["MS-CTRL-POL-31-C02@85c34fafa98fabaf"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9104dd7b97ddef9207273ab0","from":"MS-POL-POL-31","to":"MS-CTRL-POL-31-C03@a6ef23abf5c5e42b","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Workflow / Process","frameworkDrivers":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","evidence":"Tiering + model inventory + validation + findings + approvals","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!292:292","fromKeys":["MS-POL-POL-31@1e5f7eb3de495c93","MS-POL-POL-31@0c25dadb14d3c446"],"toKeys":["MS-CTRL-POL-31-C03@a6ef23abf5c5e42b"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-66a3dc68d0c60ef69ca8c42b","from":"MS-POL-POL-31","to":"MS-RULE-OU-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Warn / hold","frameworkDrivers":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","evidence":"Claim-source links + verification result","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!293:293","fromKeys":["MS-POL-POL-31@1e5f7eb3de495c93","MS-POL-POL-31@0c25dadb14d3c446"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d6c9964e0678e95857d486df","from":"MS-POL-POL-31","to":"MS-RULE-OU-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold / alert","frameworkDrivers":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","evidence":"Fairness test + decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!294:294","fromKeys":["MS-POL-POL-31@1e5f7eb3de495c93","MS-POL-POL-31@0c25dadb14d3c446"],"toKeys":["MS-RULE-OU-05@cb5aeaa742fb4521"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-8129e9803244d99370dd2b00","from":"MS-POL-POL-31","to":"MS-RULE-OP-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Monitor / gate","frameworkDrivers":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","evidence":"Metric series + threshold event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!295:295","fromKeys":["MS-POL-POL-31@1e5f7eb3de495c93","MS-POL-POL-31@0c25dadb14d3c446"],"toKeys":["MS-RULE-OP-03@410599212edc432e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-0685941174c2ab60238f3284","from":"MS-POL-POL-31","to":"MS-RULE-OP-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold release","frameworkDrivers":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","evidence":"Change record + reassessment","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!296:296","fromKeys":["MS-POL-POL-31@1e5f7eb3de495c93","MS-POL-POL-31@0c25dadb14d3c446"],"toKeys":["MS-RULE-OP-06@6ecbeba4e14a59af"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7b5320cc7b1b18c6f45c76d4","from":"MS-POL-POL-31","to":"MS-RULE-OP-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold release","frameworkDrivers":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","evidence":"Test report + release decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!297:297","fromKeys":["MS-POL-POL-31@1e5f7eb3de495c93","MS-POL-POL-31@0c25dadb14d3c446"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9238f83cabf622ff0daa9720","from":"MS-POL-POL-31","to":"MS-RULE-OP-17","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"FRB-MRM-2026; NAIC-AI; ISO-42005; NIST-AI-RMF","evidence":"Validation + challenge + findings + approval","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!298:298","fromKeys":["MS-POL-POL-31@1e5f7eb3de495c93","MS-POL-POL-31@0c25dadb14d3c446"],"toKeys":["MS-RULE-OP-17@6b311b898e8dc850"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ca7deb2de96ed8a594d55bf4","from":"MS-POL-POL-32","to":"MS-CTRL-POL-32-C01@3fdcc01a28b621fa","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Workflow / Process","frameworkDrivers":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","evidence":"Data map + transfer assessment + screening + contracts + audit records","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!299:299","fromKeys":["MS-POL-POL-32@9422d7fab14d948a","MS-POL-POL-32@04591876ceb8b167"],"toKeys":["MS-CTRL-POL-32-C01@3fdcc01a28b621fa"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-cd82c45c0e50922450b95c8f","from":"MS-POL-POL-32","to":"MS-CTRL-POL-32-C02@ddde04a8d8ca4082","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Transaction Prevention","frameworkDrivers":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","evidence":"Data map + transfer assessment + screening + contracts + audit records","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!300:300","fromKeys":["MS-POL-POL-32@9422d7fab14d948a","MS-POL-POL-32@04591876ceb8b167"],"toKeys":["MS-CTRL-POL-32-C02@ddde04a8d8ca4082"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6820c1a9b248d40891bbcb24","from":"MS-POL-POL-32","to":"MS-CTRL-POL-32-C03@1de5a35b8a8c8fd0","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Continuous Detection / Monitoring","frameworkDrivers":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","evidence":"Data map + transfer assessment + screening + contracts + audit records","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!301:301","fromKeys":["MS-POL-POL-32@9422d7fab14d948a","MS-POL-POL-32@04591876ceb8b167"],"toKeys":["MS-CTRL-POL-32-C03@1de5a35b8a8c8fd0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-feeca7f335fe75cfc8cb37ce","from":"MS-POL-POL-32","to":"MS-RULE-AU-05","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block / route","frameworkDrivers":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","evidence":"Routing decision + vendor configuration","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!302:302","fromKeys":["MS-POL-POL-32@9422d7fab14d948a","MS-POL-POL-32@04591876ceb8b167"],"toKeys":["MS-RULE-AU-05@7c58fddd6817f607"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-9fcdfc8634cfa880853b4bd3","from":"MS-POL-POL-32","to":"MS-RULE-AU-06","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","evidence":"Contract + configuration assertion","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!303:303","fromKeys":["MS-POL-POL-32@9422d7fab14d948a","MS-POL-POL-32@04591876ceb8b167"],"toKeys":["MS-RULE-AU-06@e8c8f3b771054fbc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-87424928f7e282f1a394dc08","from":"MS-POL-POL-32","to":"MS-RULE-DP-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional warn/block","frameworkDrivers":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","evidence":"Decision + context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!304:304","fromKeys":["MS-POL-POL-32@9422d7fab14d948a","MS-POL-POL-32@04591876ceb8b167"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-7c5c9e0c3530299ed5735b2a","from":"MS-POL-POL-32","to":"MS-RULE-DP-10","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Block","frameworkDrivers":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","evidence":"Decision log","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!305:305","fromKeys":["MS-POL-POL-32@9422d7fab14d948a","MS-POL-POL-32@04591876ceb8b167"],"toKeys":["MS-RULE-DP-10@fc6f0a161d4f201f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-bd1df61d570d78a3850da698","from":"MS-POL-POL-32","to":"MS-RULE-DP-11","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional warn/block","frameworkDrivers":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","evidence":"Decision + approved purpose","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!306:306","fromKeys":["MS-POL-POL-32@9422d7fab14d948a","MS-POL-POL-32@04591876ceb8b167"],"toKeys":["MS-RULE-DP-11@b7d96f7e1501e4ed"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-adb11e1adc0d6eceb9047183","from":"MS-POL-POL-32","to":"MS-RULE-OP-10","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Monitor / gate","frameworkDrivers":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","evidence":"Vendor evidence + change event","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!307:307","fromKeys":["MS-POL-POL-32@9422d7fab14d948a","MS-POL-POL-32@04591876ceb8b167"],"toKeys":["MS-RULE-OP-10@8c831bc5659a4340"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-30ee94ea55b145099e404935","from":"MS-POL-POL-32","to":"MS-RULE-AU-10","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"GDPR; UK-DP-AI; BR-LGPD; AU-PRIVACY-AI; DOJ-DSP; EAR","evidence":"Screening + threshold calculation + transfer decision","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!308:308","fromKeys":["MS-POL-POL-32@9422d7fab14d948a","MS-POL-POL-32@04591876ceb8b167"],"toKeys":["MS-RULE-AU-10@7f425f52b685ce44"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-6b816d1d3126b4ffe7eac069","from":"MS-POL-POL-33","to":"MS-CTRL-POL-33-C01@e5ead432ece32c95","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Workflow / Process","frameworkDrivers":"EU-AI-ACT; ONC-HTI1; NYC-LL144; OMB-M25-21; CO-AI","evidence":"Registry + disclosures + approval + discovery/reconciliation logs","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!309:309","fromKeys":["MS-POL-POL-33@2173f98ce3d3e4e6","MS-POL-POL-33@2a0117a70af5164b"],"toKeys":["MS-CTRL-POL-33-C01@e5ead432ece32c95"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d128f9417ef5c9d31350c60e","from":"MS-POL-POL-33","to":"MS-CTRL-POL-33-C02@3921a2759f04839d","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Transaction Warning / Approval","frameworkDrivers":"EU-AI-ACT; ONC-HTI1; NYC-LL144; OMB-M25-21; CO-AI","evidence":"Registry + disclosures + approval + discovery/reconciliation logs","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!310:310","fromKeys":["MS-POL-POL-33@2173f98ce3d3e4e6","MS-POL-POL-33@2a0117a70af5164b"],"toKeys":["MS-CTRL-POL-33-C02@3921a2759f04839d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-229f03c19eba3bcbd20b5cf1","from":"MS-POL-POL-33","to":"MS-CTRL-POL-33-C03@8666fa9d9d46f7fb","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Continuous Detection / Monitoring","frameworkDrivers":"EU-AI-ACT; ONC-HTI1; NYC-LL144; OMB-M25-21; CO-AI","evidence":"Registry + disclosures + approval + discovery/reconciliation logs","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!311:311","fromKeys":["MS-POL-POL-33@2173f98ce3d3e4e6","MS-POL-POL-33@2a0117a70af5164b"],"toKeys":["MS-CTRL-POL-33-C03@8666fa9d9d46f7fb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2110e3e40edd1ba5ad79f6ee","from":"MS-POL-POL-33","to":"MS-RULE-OU-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Transform / require disclosure","frameworkDrivers":"EU-AI-ACT; ONC-HTI1; NYC-LL144; OMB-M25-21; CO-AI","evidence":"Label/provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!312:312","fromKeys":["MS-POL-POL-33@2173f98ce3d3e4e6","MS-POL-POL-33@2a0117a70af5164b"],"toKeys":["MS-RULE-OU-12@295cdecda41b8b55"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-2e22e6035448f1c5a5515097","from":"MS-POL-POL-33","to":"MS-RULE-OP-02","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Log / require","frameworkDrivers":"EU-AI-ACT; ONC-HTI1; NYC-LL144; OMB-M25-21; CO-AI","evidence":"Provenance record","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!313:313","fromKeys":["MS-POL-POL-33@2173f98ce3d3e4e6","MS-POL-POL-33@2a0117a70af5164b"],"toKeys":["MS-RULE-OP-02@7147e78f71e89fcb"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f7e46b9df1667b60121cdcbc","from":"MS-POL-POL-33","to":"MS-RULE-OP-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Detect / require","frameworkDrivers":"EU-AI-ACT; ONC-HTI1; NYC-LL144; OMB-M25-21; CO-AI","evidence":"Inventory record + reconciliation","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!314:314","fromKeys":["MS-POL-POL-33@2173f98ce3d3e4e6","MS-POL-POL-33@2a0117a70af5164b"],"toKeys":["MS-RULE-OP-09@ec587343b8220a51"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-faf177cd558db456531fc4f0","from":"MS-POL-POL-33","to":"MS-RULE-OP-18","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"EU-AI-ACT; ONC-HTI1; NYC-LL144; OMB-M25-21; CO-AI","evidence":"Registry record + disclosure artifact + timestamp","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!315:315","fromKeys":["MS-POL-POL-33@2173f98ce3d3e4e6","MS-POL-POL-33@2a0117a70af5164b"],"toKeys":["MS-RULE-OP-18@1df03547863d8288"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a7b8151ea21b0b2a3bfc67a7","from":"MS-POL-POL-34","to":"MS-CTRL-POL-34-C01@848d6f9bfc0f9229","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Workflow / Process","frameworkDrivers":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","evidence":"Protocol + ethics approval + consent + data authorization + reproducibility record","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!316:316","fromKeys":["MS-POL-POL-34@93db44d68b4d6aaf","MS-POL-POL-34@262ec774eaab089e"],"toKeys":["MS-CTRL-POL-34-C01@848d6f9bfc0f9229"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a6f1445e0cba9906bc4d366a","from":"MS-POL-POL-34","to":"MS-CTRL-POL-34-C02@818c4b275dcc2acd","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"System Configuration","frameworkDrivers":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","evidence":"Protocol + ethics approval + consent + data authorization + reproducibility record","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!317:317","fromKeys":["MS-POL-POL-34@93db44d68b4d6aaf","MS-POL-POL-34@262ec774eaab089e"],"toKeys":["MS-CTRL-POL-34-C02@818c4b275dcc2acd"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-f93827e2e3b23b816e26485a","from":"MS-POL-POL-34","to":"MS-CTRL-POL-34-C03@6de53a060d4995dc","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"New policy control / evidence","itemType":"Policy control","mechanism":"Assurance / Testing","frameworkDrivers":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","evidence":"Protocol + ethics approval + consent + data authorization + reproducibility record","reportedApproval":"Context-triggered design"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!318:318","fromKeys":["MS-POL-POL-34@93db44d68b4d6aaf","MS-POL-POL-34@262ec774eaab089e"],"toKeys":["MS-CTRL-POL-34-C03@6de53a060d4995dc"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-d181327a78c8a2e396fa0eb5","from":"MS-POL-POL-34","to":"MS-RULE-DP-07","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional block","frameworkDrivers":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","evidence":"Decision + approved context + BAA evidence","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!319:319","fromKeys":["MS-POL-POL-34@93db44d68b4d6aaf","MS-POL-POL-34@262ec774eaab089e"],"toKeys":["MS-RULE-DP-07@94c870d43e4286ab"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-494eb90cc0e9150dc9ec3b5c","from":"MS-POL-POL-34","to":"MS-RULE-DP-09","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Conditional warn/block","frameworkDrivers":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","evidence":"Decision + context","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!320:320","fromKeys":["MS-POL-POL-34@93db44d68b4d6aaf","MS-POL-POL-34@262ec774eaab089e"],"toKeys":["MS-RULE-DP-09@e32553c4840951b3"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-a2f0b3e0bcaa54d5d671be13","from":"MS-POL-POL-34","to":"MS-RULE-OU-03","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Warn / hold","frameworkDrivers":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","evidence":"Claim-source links + verification result","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!321:321","fromKeys":["MS-POL-POL-34@93db44d68b4d6aaf","MS-POL-POL-34@262ec774eaab089e"],"toKeys":["MS-RULE-OU-03@ce8e31e07eb4da96"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-ecd5b6da5431ae024680ecdf","from":"MS-POL-POL-34","to":"MS-RULE-OP-12","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Mapped existing canonical","itemType":"Existing canonical rule","mechanism":"Rule enforcement — Hold release","frameworkDrivers":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","evidence":"Test report + release decision","reportedApproval":"Approved canonical baseline"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!322:322","fromKeys":["MS-POL-POL-34@93db44d68b4d6aaf","MS-POL-POL-34@262ec774eaab089e"],"toKeys":["MS-RULE-OP-12@04d0287d10225094"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-27b4563b8bb7da07cb8df379","from":"MS-POL-POL-34","to":"MS-RULE-OP-19","kind":"POLICY_CONTROL_LINEAGE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"reportedDisposition":"Proposed new canonical","itemType":"Proposed canonical rule","mechanism":"Admission gate / runtime rule","frameworkDrivers":"HIPAA; HHS-PART2; FDA-AI-MD; GDPR","evidence":"Protocol + approval + consent + data authorization","reportedApproval":"Governance approval required"},"sourceKey":"workbook-90529719e3e3b5bc@943924618a78","locator":"'18 Policy Rule Lineage'!323:323","fromKeys":["MS-POL-POL-34@93db44d68b4d6aaf","MS-POL-POL-34@262ec774eaab089e"],"toKeys":["MS-RULE-OP-19@744dc9983a3098ac"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-40f6865fcfefe1c78544","from":"GUIDE-TAIMSCORE-7373e9ecec96@54237a430c639ac1","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"What TAIMScore Is","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 10–24","fromKeys":["GUIDE-TAIMSCORE-7373e9ecec96@54237a430c639ac1"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8ab6940c847e1ecbfe4e","from":"GUIDE-TAIMSCORE-2c232da2adbd@2bba1850a1b6b745","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"The 4 Functions","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 25–35","fromKeys":["GUIDE-TAIMSCORE-2c232da2adbd@2bba1850a1b6b745"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f0e048ac25b0b3175d91","from":"GUIDE-TAIMSCORE-5fcf17139776@97ae24c6b37d1df6","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"GOVERN Function (GV)","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 36–174","fromKeys":["GUIDE-TAIMSCORE-5fcf17139776@97ae24c6b37d1df6"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8f5f34e0bb70a523feef","from":"GUIDE-TAIMSCORE-2fb801c9fc14@8e1b366d53700130","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"GV-1: Policies, Processes, Procedures, and Practices","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 40–78","fromKeys":["GUIDE-TAIMSCORE-2fb801c9fc14@8e1b366d53700130"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-fc552282c54abf029992","from":"GUIDE-TAIMSCORE-8ac247cb874b@084933159965f0d5","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"GV-2: Accountability Structures","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 79–99","fromKeys":["GUIDE-TAIMSCORE-8ac247cb874b@084933159965f0d5"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e946016be80d2a2a6ffc","from":"GUIDE-TAIMSCORE-6879b220016e@456cd412309ec481","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"GV-3: Workforce Diversity, Equity, Inclusion, and Accessibility","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 100–122","fromKeys":["GUIDE-TAIMSCORE-6879b220016e@456cd412309ec481"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e19d4827dd686f9e2959","from":"GUIDE-TAIMSCORE-80ed04b7deed@8370d2982cfae971","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"GV-4: Organizational Teams Are Committed","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 123–140","fromKeys":["GUIDE-TAIMSCORE-80ed04b7deed@8370d2982cfae971"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-858ba6353278d734f9c8","from":"GUIDE-TAIMSCORE-2130b0d37ddb@c1549abbbeccd969","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"GV-5: Organizational Risk Strategy","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 141–157","fromKeys":["GUIDE-TAIMSCORE-2130b0d37ddb@c1549abbbeccd969"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ec03de340f1f87645d49","from":"GUIDE-TAIMSCORE-b403499ddae8@55ea6367216eb219","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"GV-6: Policies and Procedures","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 158–174","fromKeys":["GUIDE-TAIMSCORE-b403499ddae8@55ea6367216eb219"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d07b078e20dad09dc859","from":"GUIDE-TAIMSCORE-f8a4f7493775@a881da89dbaa2337","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MAP Function (MP)","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 175–300","fromKeys":["GUIDE-TAIMSCORE-f8a4f7493775@a881da89dbaa2337"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-9befc5f03f5742c13729","from":"GUIDE-TAIMSCORE-38782814f6d4@62b6df5ed655a7d4","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MP-1: Context Is Established","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 179–212","fromKeys":["GUIDE-TAIMSCORE-38782814f6d4@62b6df5ed655a7d4"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ad694b12daf0e517a76d","from":"GUIDE-TAIMSCORE-e7b8b8990fe3@3f324f97a6010437","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MP-2: Scientific Basis of AI Risk","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 213–234","fromKeys":["GUIDE-TAIMSCORE-e7b8b8990fe3@3f324f97a6010437"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f5b44e13241e4dba91fc","from":"GUIDE-TAIMSCORE-7819380f4108@b0b30c9338575829","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MP-3: AI Capabilities and Limitations","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 235–256","fromKeys":["GUIDE-TAIMSCORE-7819380f4108@b0b30c9338575829"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c022c6e7125bec886a48","from":"GUIDE-TAIMSCORE-249dc0c1e2d0@8172d54f33e1ad1c","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MP-4: Risks Are Prioritized","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 257–272","fromKeys":["GUIDE-TAIMSCORE-249dc0c1e2d0@8172d54f33e1ad1c"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ba26e24a00ca6ec3a125","from":"GUIDE-TAIMSCORE-0eff381f83ef@51ed2a746c92b9e0","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MP-5: Organizational Risk Management","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 273–300","fromKeys":["GUIDE-TAIMSCORE-0eff381f83ef@51ed2a746c92b9e0"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-97b034679abc914dedd1","from":"GUIDE-TAIMSCORE-72386903860b@e0f6769dbaf0778a","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MEASURE Function (MS)","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 301–396","fromKeys":["GUIDE-TAIMSCORE-72386903860b@e0f6769dbaf0778a"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d0ecb8a31a2bd377ee8e","from":"GUIDE-TAIMSCORE-45605fb5fe93@708cc67ec8a01c3b","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MS-1: Risk Metrics and Methods","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 305–324","fromKeys":["GUIDE-TAIMSCORE-45605fb5fe93@708cc67ec8a01c3b"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-26353357fe4b16d28fcb","from":"GUIDE-TAIMSCORE-88782766250f@07d9fe9c36eed563","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MS-2: Risk Analysis","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 325–356","fromKeys":["GUIDE-TAIMSCORE-88782766250f@07d9fe9c36eed563"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-42dbc1f948b253e4cfd2","from":"GUIDE-TAIMSCORE-5a4de5f38b1b@1d8df7b6391324bb","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MS-3: Performance Monitoring","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 357–380","fromKeys":["GUIDE-TAIMSCORE-5a4de5f38b1b@1d8df7b6391324bb"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-055554e904f5ea3929d5","from":"GUIDE-TAIMSCORE-ee606d117560@6af48156e0d04548","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MS-4: Feedback Integration","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 381–396","fromKeys":["GUIDE-TAIMSCORE-ee606d117560@6af48156e0d04548"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-89e141c4d22aec83a0c8","from":"GUIDE-TAIMSCORE-eb6cc3ec525c@559936d9d7d0351e","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MANAGE Function (MG)","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 397–493","fromKeys":["GUIDE-TAIMSCORE-eb6cc3ec525c@559936d9d7d0351e"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-afaabdc9a0fdea7553b1","from":"GUIDE-TAIMSCORE-cd0ce40680a4@b7f780cfda3b881d","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MG-1: Risk Response Plans","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 401–421","fromKeys":["GUIDE-TAIMSCORE-cd0ce40680a4@b7f780cfda3b881d"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-72cffce7e3fc9ebb21aa","from":"GUIDE-TAIMSCORE-d60b914f6dd6@c6c63571fab7605d","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MG-2: Risk Response Execution","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 422–445","fromKeys":["GUIDE-TAIMSCORE-d60b914f6dd6@c6c63571fab7605d"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a866019a1dfe5fba3365","from":"GUIDE-TAIMSCORE-2d7ec48f3fae@3a5adbc1cbd68835","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MG-3: Risk Treatment Feedback","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 446–469","fromKeys":["GUIDE-TAIMSCORE-2d7ec48f3fae@3a5adbc1cbd68835"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d8c228b3fd4a759b3d77","from":"GUIDE-TAIMSCORE-aa6d2eda81a0@30691f48ee9e09ba","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"MG-4: Risk Communication","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 470–493","fromKeys":["GUIDE-TAIMSCORE-aa6d2eda81a0@30691f48ee9e09ba"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-beffa97bc0c75cedeaa4","from":"GUIDE-TAIMSCORE-9f18b171a0c0@d05bb0e1866b5200","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"Scoring Methodology","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 494–537","fromKeys":["GUIDE-TAIMSCORE-9f18b171a0c0@d05bb0e1866b5200"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-3264b5ef630784b1de44","from":"GUIDE-TAIMSCORE-17ed47d69bd5@74597176329b3a92","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"Control-Level Scoring","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 496–507","fromKeys":["GUIDE-TAIMSCORE-17ed47d69bd5@74597176329b3a92"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7bf64c9d2c26893486a6","from":"GUIDE-TAIMSCORE-7c6f8ef8a701@8e28bd3d24809b08","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"Category Score","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 508–511","fromKeys":["GUIDE-TAIMSCORE-7c6f8ef8a701@8e28bd3d24809b08"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-6ebbe75978783f046ddf","from":"GUIDE-TAIMSCORE-ea449fed7451@540ba647e7400001","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"Function Score","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 512–523","fromKeys":["GUIDE-TAIMSCORE-ea449fed7451@540ba647e7400001"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-de533abf075fdcb1ba5e","from":"GUIDE-TAIMSCORE-8fe44c472096@eee14394e87f714b","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"TAIMScore™ Composite","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 524–537","fromKeys":["GUIDE-TAIMSCORE-8fe44c472096@eee14394e87f714b"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a05fc861c81b720f6f91","from":"GUIDE-TAIMSCORE-256e9d391809@2fa12dd681854989","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"NIST AI RMF Alignment","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 538–558","fromKeys":["GUIDE-TAIMSCORE-256e9d391809@2fa12dd681854989"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a48d172b70b2d88e1d06","from":"GUIDE-TAIMSCORE-e76ce119f90c@f66687dbfe6679aa","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"GOVERN Component Mapping","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 559–590","fromKeys":["GUIDE-TAIMSCORE-e76ce119f90c@f66687dbfe6679aa"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7183653c89c14a30cf38","from":"GUIDE-TAIMSCORE-3be8f011f4f8@fe3bbd42f3960f1a","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"Standards Alignment","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 591–637","fromKeys":["GUIDE-TAIMSCORE-3be8f011f4f8@fe3bbd42f3960f1a"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e3088ca629fdf4a603ae","from":"GUIDE-TAIMSCORE-12c4f1c01329@963980a8509e0f3c","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"NIST AI RMF 1.0 (NIST AI 100-1)","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 593–596","fromKeys":["GUIDE-TAIMSCORE-12c4f1c01329@963980a8509e0f3c"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-3320f43c57649f8f3d24","from":"GUIDE-TAIMSCORE-0ce93a3ddbe4@5efb25b53db84c35","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"ISO/IEC 42001:2023","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 597–608","fromKeys":["GUIDE-TAIMSCORE-0ce93a3ddbe4@5efb25b53db84c35"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-809122fb0ec1d30bc9e9","from":"GUIDE-TAIMSCORE-e5a52228ee60@3bdbf30b9ef74343","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"SOC 2 Type II","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 609–622","fromKeys":["GUIDE-TAIMSCORE-e5a52228ee60@3bdbf30b9ef74343"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-0ed417a0e430680bcc53","from":"GUIDE-TAIMSCORE-4ceafb318fc8@b3ff6accd8ac717f","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"EU AI Act (2024)","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 623–637","fromKeys":["GUIDE-TAIMSCORE-4ceafb318fc8@b3ff6accd8ac717f"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f960f29c650150097b95","from":"GUIDE-TAIMSCORE-c24d6381bc21@26ce2491fe9416f6","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","heading":"Assessment Workflow in GOVERN","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 638–651","fromKeys":["GUIDE-TAIMSCORE-c24d6381bc21@26ce2491fe9416f6"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-2822e83b101d383d93e8","from":"MD-CTRL-TAIMSCORE-GV-1.1@6e663e1f167b8156","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-1.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 46–51","fromKeys":["MD-CTRL-TAIMSCORE-GV-1.1@6e663e1f167b8156"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b1087c2e19acaddde0ce","from":"MD-CTRL-TAIMSCORE-GV-1.2@0d5ccdb59c43f67c","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-1.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 52–56","fromKeys":["MD-CTRL-TAIMSCORE-GV-1.2@0d5ccdb59c43f67c"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4df029fabb8b32cbb590","from":"MD-CTRL-TAIMSCORE-GV-1.3@a27b166c02aaa4c8","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-1.3","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 57–61","fromKeys":["MD-CTRL-TAIMSCORE-GV-1.3@a27b166c02aaa4c8"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-84f5db56fdf277fae6cc","from":"MD-CTRL-TAIMSCORE-GV-1.4@488e5873c755f8ab","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-1.4","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 62–66","fromKeys":["MD-CTRL-TAIMSCORE-GV-1.4@488e5873c755f8ab"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-984346e3baa6b284f0a3","from":"MD-CTRL-TAIMSCORE-GV-1.5@ff95c40e6e8afd0a","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-1.5","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 67–71","fromKeys":["MD-CTRL-TAIMSCORE-GV-1.5@ff95c40e6e8afd0a"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e9504e217a38df27a455","from":"MD-CTRL-TAIMSCORE-GV-1.6@e3506b0dd4dcada0","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-1.6","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 72–78","fromKeys":["MD-CTRL-TAIMSCORE-GV-1.6@e3506b0dd4dcada0"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d14948630de77fa75eed","from":"MD-CTRL-TAIMSCORE-GV-2.1@9aac291827958bcc","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-2.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 85–89","fromKeys":["MD-CTRL-TAIMSCORE-GV-2.1@9aac291827958bcc"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-20e97d8f6c3f357795be","from":"MD-CTRL-TAIMSCORE-GV-2.2@f6568a2a29410b49","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-2.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 90–93","fromKeys":["MD-CTRL-TAIMSCORE-GV-2.2@f6568a2a29410b49"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-60dbd9b941698e417a5a","from":"MD-CTRL-TAIMSCORE-GV-2.3@0a20efca2d26ce0b","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-2.3","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 94–99","fromKeys":["MD-CTRL-TAIMSCORE-GV-2.3@0a20efca2d26ce0b"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1d791190cb6bdc5801dd","from":"MD-CTRL-TAIMSCORE-GV-3.1@b037ccbc754dd889","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-3.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 106–110","fromKeys":["MD-CTRL-TAIMSCORE-GV-3.1@b037ccbc754dd889"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-dd62f33b64c1ff5d28b4","from":"MD-CTRL-TAIMSCORE-GV-3.2@d334db8c2a02abc6","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-3.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 111–115","fromKeys":["MD-CTRL-TAIMSCORE-GV-3.2@d334db8c2a02abc6"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-0a8692f3e88d2a9cb292","from":"MD-CTRL-TAIMSCORE-GV-3.3@61a4b460a66a359d","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-3.3","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 116–122","fromKeys":["MD-CTRL-TAIMSCORE-GV-3.3@61a4b460a66a359d"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e996437539b303545290","from":"MD-CTRL-TAIMSCORE-GV-4.1@d2118a7c50a2b41f","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-4.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 129–133","fromKeys":["MD-CTRL-TAIMSCORE-GV-4.1@d2118a7c50a2b41f"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-eadb062fc09714db06e7","from":"MD-CTRL-TAIMSCORE-GV-4.2@b8a13ffd5ef872bb","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-4.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 134–140","fromKeys":["MD-CTRL-TAIMSCORE-GV-4.2@b8a13ffd5ef872bb"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-978b93b77e0201cfb226","from":"MD-CTRL-TAIMSCORE-GV-5.1@4341729d33eff527","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-5.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 147–150","fromKeys":["MD-CTRL-TAIMSCORE-GV-5.1@4341729d33eff527"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d48af1dcea6cb8fcb167","from":"MD-CTRL-TAIMSCORE-GV-5.2@8048f6100c5be955","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-5.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 151–157","fromKeys":["MD-CTRL-TAIMSCORE-GV-5.2@8048f6100c5be955"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-047c98aec5137c173b69","from":"MD-CTRL-TAIMSCORE-GV-6.1@77b1a7bf47c9101a","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-6.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 164–168","fromKeys":["MD-CTRL-TAIMSCORE-GV-6.1@77b1a7bf47c9101a"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a61d227027b2a5c6ec23","from":"MD-CTRL-TAIMSCORE-GV-6.2@3baccaf3d3356bf8","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"GV-6.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 169–174","fromKeys":["MD-CTRL-TAIMSCORE-GV-6.2@3baccaf3d3356bf8"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-60cd553a67aaa44c62f5","from":"MD-CTRL-TAIMSCORE-MP-1.1@548c2c820b927f90","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-1.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 185–189","fromKeys":["MD-CTRL-TAIMSCORE-MP-1.1@548c2c820b927f90"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a6132bc43258a192875f","from":"MD-CTRL-TAIMSCORE-MP-1.2@f754d023d01e821f","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-1.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 190–193","fromKeys":["MD-CTRL-TAIMSCORE-MP-1.2@f754d023d01e821f"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-61895aff07c73760881d","from":"MD-CTRL-TAIMSCORE-MP-1.3@62501b520f91f1be","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-1.3","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 194–197","fromKeys":["MD-CTRL-TAIMSCORE-MP-1.3@62501b520f91f1be"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5770e1d4a033b39c53a3","from":"MD-CTRL-TAIMSCORE-MP-1.4@62d7db49c4279f76","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-1.4","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 198–202","fromKeys":["MD-CTRL-TAIMSCORE-MP-1.4@62d7db49c4279f76"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7f6afef30c6ce2b1d487","from":"MD-CTRL-TAIMSCORE-MP-1.5@4f2a419cd373ffa7","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-1.5","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 203–206","fromKeys":["MD-CTRL-TAIMSCORE-MP-1.5@4f2a419cd373ffa7"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-3c0ad88c4c5477249dbe","from":"MD-CTRL-TAIMSCORE-MP-1.6@ae953741bf4624c4","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-1.6","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 207–212","fromKeys":["MD-CTRL-TAIMSCORE-MP-1.6@ae953741bf4624c4"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-53ca778fa5bc48f9d006","from":"MD-CTRL-TAIMSCORE-MP-2.1@c7b548f567e35589","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-2.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 219–223","fromKeys":["MD-CTRL-TAIMSCORE-MP-2.1@c7b548f567e35589"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-55807f41720b4561623f","from":"MD-CTRL-TAIMSCORE-MP-2.2@6ba31f1d90581063","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-2.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 224–228","fromKeys":["MD-CTRL-TAIMSCORE-MP-2.2@6ba31f1d90581063"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f157a4c22076915f690b","from":"MD-CTRL-TAIMSCORE-MP-2.3@0e315ec0e8de8b8f","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-2.3","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 229–234","fromKeys":["MD-CTRL-TAIMSCORE-MP-2.3@0e315ec0e8de8b8f"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-162c7daf7760c4e6ca4e","from":"MD-CTRL-TAIMSCORE-MP-3.1@f5151dd4ddfa4905","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-3.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 241–245","fromKeys":["MD-CTRL-TAIMSCORE-MP-3.1@f5151dd4ddfa4905"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1900ac385ed5d351d358","from":"MD-CTRL-TAIMSCORE-MP-3.2@f6a9aead25c9a878","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-3.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 246–249","fromKeys":["MD-CTRL-TAIMSCORE-MP-3.2@f6a9aead25c9a878"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-cf4383d55a5d63e722cc","from":"MD-CTRL-TAIMSCORE-MP-3.3@e71a5f5b8757a1bb","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-3.3","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 250–256","fromKeys":["MD-CTRL-TAIMSCORE-MP-3.3@e71a5f5b8757a1bb"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-3743648a5b4cfe9d244e","from":"MD-CTRL-TAIMSCORE-MP-4.1@7650a9eae1489b67","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-4.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 263–266","fromKeys":["MD-CTRL-TAIMSCORE-MP-4.1@7650a9eae1489b67"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-dc43995116841e9990bc","from":"MD-CTRL-TAIMSCORE-MP-4.2@5e7e554a9d14d4f0","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-4.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 267–272","fromKeys":["MD-CTRL-TAIMSCORE-MP-4.2@5e7e554a9d14d4f0"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a70b8e430485333b3d6b","from":"MD-CTRL-TAIMSCORE-MP-5.1@21750de9cac00ac4","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-5.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 279–282","fromKeys":["MD-CTRL-TAIMSCORE-MP-5.1@21750de9cac00ac4"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-eb09091a249bae2212ee","from":"MD-CTRL-TAIMSCORE-MP-5.2@aae6d3aca3cefd9d","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-5.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 283–286","fromKeys":["MD-CTRL-TAIMSCORE-MP-5.2@aae6d3aca3cefd9d"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-40043d13162a2fe102e1","from":"MD-CTRL-TAIMSCORE-MP-5.3@d9ade20423d9fae1","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-5.3","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 287–290","fromKeys":["MD-CTRL-TAIMSCORE-MP-5.3@d9ade20423d9fae1"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-30b3b94a9432353116d1","from":"MD-CTRL-TAIMSCORE-MP-5.4@0f39b85d04a28ae5","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-5.4","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 291–294","fromKeys":["MD-CTRL-TAIMSCORE-MP-5.4@0f39b85d04a28ae5"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-438d8a23b1d677221483","from":"MD-CTRL-TAIMSCORE-MP-5.5@390a727740c13759","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MP-5.5","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 295–300","fromKeys":["MD-CTRL-TAIMSCORE-MP-5.5@390a727740c13759"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8c3d60b3e9510ddb1051","from":"MD-CTRL-TAIMSCORE-MS-1.1@8e4962befa85bc7b","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MS-1.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 311–314","fromKeys":["MD-CTRL-TAIMSCORE-MS-1.1@8e4962befa85bc7b"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-0b4f95ebae4ed7500ef6","from":"MD-CTRL-TAIMSCORE-MS-1.2@e5f7bc6811d1f568","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MS-1.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 315–318","fromKeys":["MD-CTRL-TAIMSCORE-MS-1.2@e5f7bc6811d1f568"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7611537d3f0066214331","from":"MD-CTRL-TAIMSCORE-MS-1.3@e0049f5a7a82e999","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MS-1.3","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 319–324","fromKeys":["MD-CTRL-TAIMSCORE-MS-1.3@e0049f5a7a82e999"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c93a3d58d37dc9977501","from":"MD-CTRL-TAIMSCORE-MS-2.1@129fa1e62d197c7b","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MS-2.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 331–334","fromKeys":["MD-CTRL-TAIMSCORE-MS-2.1@129fa1e62d197c7b"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-96b2ee16c71a7a5bc24b","from":"MD-CTRL-TAIMSCORE-MS-2.2@2437e8f60490ee90","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MS-2.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 335–338","fromKeys":["MD-CTRL-TAIMSCORE-MS-2.2@2437e8f60490ee90"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4c240c83b66dcb7c083b","from":"MD-CTRL-TAIMSCORE-MS-2.3@c2d234e5d46c6f5b","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MS-2.3","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 339–342","fromKeys":["MD-CTRL-TAIMSCORE-MS-2.3@c2d234e5d46c6f5b"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-2d9fa2df55725ec66f13","from":"MD-CTRL-TAIMSCORE-MS-2.4@455d8d7db1bd8cf6","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MS-2.4","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 343–346","fromKeys":["MD-CTRL-TAIMSCORE-MS-2.4@455d8d7db1bd8cf6"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f8f515417515e2bf2a6b","from":"MD-CTRL-TAIMSCORE-MS-2.5@9d6eb82ed7386a1e","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MS-2.5","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 347–350","fromKeys":["MD-CTRL-TAIMSCORE-MS-2.5@9d6eb82ed7386a1e"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-bb729f78bcf97f7c812b","from":"MD-CTRL-TAIMSCORE-MS-2.6@7161e37074ac4ae3","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MS-2.6","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 351–356","fromKeys":["MD-CTRL-TAIMSCORE-MS-2.6@7161e37074ac4ae3"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-009c0cd847311a4b759b","from":"MD-CTRL-TAIMSCORE-MS-3.1@5ad421ae77227683","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MS-3.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 363–366","fromKeys":["MD-CTRL-TAIMSCORE-MS-3.1@5ad421ae77227683"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b7edc1d2c707b957b62c","from":"MD-CTRL-TAIMSCORE-MS-3.2@db15d30d4ea169b5","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MS-3.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 367–370","fromKeys":["MD-CTRL-TAIMSCORE-MS-3.2@db15d30d4ea169b5"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a73714412a384a6a720b","from":"MD-CTRL-TAIMSCORE-MS-3.3@21c5310a7329281b","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MS-3.3","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 371–374","fromKeys":["MD-CTRL-TAIMSCORE-MS-3.3@21c5310a7329281b"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b9ee921517bdfff7c252","from":"MD-CTRL-TAIMSCORE-MS-3.4@1e808b6be39d30e1","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MS-3.4","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 375–380","fromKeys":["MD-CTRL-TAIMSCORE-MS-3.4@1e808b6be39d30e1"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-0ee235d33ceebd55bed2","from":"MD-CTRL-TAIMSCORE-MS-4.1@0d2eebf4c3c3c07c","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MS-4.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 387–390","fromKeys":["MD-CTRL-TAIMSCORE-MS-4.1@0d2eebf4c3c3c07c"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f0905f9e1880e5e56dab","from":"MD-CTRL-TAIMSCORE-MS-4.2@4d7bb36b38d271d5","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MS-4.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 391–396","fromKeys":["MD-CTRL-TAIMSCORE-MS-4.2@4d7bb36b38d271d5"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b9168e22e5cbe39800ef","from":"MD-CTRL-TAIMSCORE-MG-1.1@7e4f4e39ffc8450b","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MG-1.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 407–411","fromKeys":["MD-CTRL-TAIMSCORE-MG-1.1@7e4f4e39ffc8450b"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-0377a42ce679dc78d49a","from":"MD-CTRL-TAIMSCORE-MG-1.2@af82e47ced042dcc","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MG-1.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 412–415","fromKeys":["MD-CTRL-TAIMSCORE-MG-1.2@af82e47ced042dcc"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-33c4a85681eb175ff2fc","from":"MD-CTRL-TAIMSCORE-MG-1.3@57168fb27b39fa28","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MG-1.3","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 416–421","fromKeys":["MD-CTRL-TAIMSCORE-MG-1.3@57168fb27b39fa28"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b8276a33dab39d75b45f","from":"MD-CTRL-TAIMSCORE-MG-2.1@2e45b4a7ab5058a3","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MG-2.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 428–431","fromKeys":["MD-CTRL-TAIMSCORE-MG-2.1@2e45b4a7ab5058a3"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4b5b502e7c3876e69709","from":"MD-CTRL-TAIMSCORE-MG-2.2@8dd199083f138cef","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MG-2.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 432–435","fromKeys":["MD-CTRL-TAIMSCORE-MG-2.2@8dd199083f138cef"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5319d7c8179da3ce00fe","from":"MD-CTRL-TAIMSCORE-MG-2.3@386189a1c978c0cc","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MG-2.3","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 436–439","fromKeys":["MD-CTRL-TAIMSCORE-MG-2.3@386189a1c978c0cc"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8527c6229b078e34afa6","from":"MD-CTRL-TAIMSCORE-MG-2.4@4a39848a5d9ce83e","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MG-2.4","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 440–445","fromKeys":["MD-CTRL-TAIMSCORE-MG-2.4@4a39848a5d9ce83e"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a56f0709b90d8d1ab3fb","from":"MD-CTRL-TAIMSCORE-MG-3.1@a0afe931057f15cf","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MG-3.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 452–455","fromKeys":["MD-CTRL-TAIMSCORE-MG-3.1@a0afe931057f15cf"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-72a294601bedf3abbd46","from":"MD-CTRL-TAIMSCORE-MG-3.2@22aa2ad79e1a0bff","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MG-3.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 456–459","fromKeys":["MD-CTRL-TAIMSCORE-MG-3.2@22aa2ad79e1a0bff"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-6e72fc07eb65fc21e17f","from":"MD-CTRL-TAIMSCORE-MG-3.3@9720978dbac2bef4","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MG-3.3","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 460–463","fromKeys":["MD-CTRL-TAIMSCORE-MG-3.3@9720978dbac2bef4"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-30bed68ad1e6dd2bc461","from":"MD-CTRL-TAIMSCORE-MG-3.4@0813742729474653","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MG-3.4","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 464–469","fromKeys":["MD-CTRL-TAIMSCORE-MG-3.4@0813742729474653"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-143036648f4b72dc0171","from":"MD-CTRL-TAIMSCORE-MG-4.1@22bb5db4ed410c0e","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MG-4.1","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 476–479","fromKeys":["MD-CTRL-TAIMSCORE-MG-4.1@22bb5db4ed410c0e"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b5d4089b0bf35a613d60","from":"MD-CTRL-TAIMSCORE-MG-4.2@c4d7d793290763bc","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MG-4.2","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 480–483","fromKeys":["MD-CTRL-TAIMSCORE-MG-4.2@c4d7d793290763bc"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-cbefdfb7f0f3160f4fcd","from":"MD-CTRL-TAIMSCORE-MG-4.3@6f56070482b2b60a","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MG-4.3","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 484–487","fromKeys":["MD-CTRL-TAIMSCORE-MG-4.3@6f56070482b2b60a"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-04229df84fdda3ac37b3","from":"MD-CTRL-TAIMSCORE-MG-4.4@29a66fbbec9145a2","to":"FW-TAIMSCORE@70982b04fb51f0d0","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY.md","control":"MG-4.4","primarySourceVerified":false},"sourceKey":"policy-guide-taimscore@e8334126d25759e0","locator":"POLICY.md:lines 488–493","fromKeys":["MD-CTRL-TAIMSCORE-MG-4.4@29a66fbbec9145a2"],"toKeys":["FW-TAIMSCORE@70982b04fb51f0d0"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5253b67f70560b484bb5","from":"GUIDE-CHIRALITY-MATURITY-d4b1ea5708dd@0be56b6a3a8027cb","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"Overview","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 9–16","fromKeys":["GUIDE-CHIRALITY-MATURITY-d4b1ea5708dd@0be56b6a3a8027cb"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-0bd0226847e069d8edd0","from":"GUIDE-CHIRALITY-MATURITY-abdb5c7bfe9b@6e66767c34e7897b","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"The 5 Maturity Levels","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 17–151","fromKeys":["GUIDE-CHIRALITY-MATURITY-abdb5c7bfe9b@6e66767c34e7897b"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e05be32aed325bf08502","from":"GUIDE-CHIRALITY-MATURITY-cf07da813dc1@4427570cbc2ff37c","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"Level 1: Awareness","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 19–44","fromKeys":["GUIDE-CHIRALITY-MATURITY-cf07da813dc1@4427570cbc2ff37c"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-0959bef24910b9577aea","from":"GUIDE-CHIRALITY-MATURITY-cafe81f5497d@69dacf7fcfb9dd06","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"Level 2: Active","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 45–71","fromKeys":["GUIDE-CHIRALITY-MATURITY-cafe81f5497d@69dacf7fcfb9dd06"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-cfa25546127c2b9bb574","from":"GUIDE-CHIRALITY-MATURITY-b93219b67473@b112a497aaaa8808","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"Level 3: Operational","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 72–99","fromKeys":["GUIDE-CHIRALITY-MATURITY-b93219b67473@b112a497aaaa8808"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-274431a7f7bb2b39c49f","from":"GUIDE-CHIRALITY-MATURITY-d48f0279614e@64f11469a84dc970","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"Level 4: Systematic","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 100–128","fromKeys":["GUIDE-CHIRALITY-MATURITY-d48f0279614e@64f11469a84dc970"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f868333eda61c55f5647","from":"GUIDE-CHIRALITY-MATURITY-895a2cd07615@f5083bc7de73592c","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"Level 5: Transformational","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 129–151","fromKeys":["GUIDE-CHIRALITY-MATURITY-895a2cd07615@f5083bc7de73592c"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1df0bc00afc1028b2d98","from":"GUIDE-CHIRALITY-MATURITY-ba5a0b96e58f@0d78e3c4f1b21a2f","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"Foundation: Human-Centered Governance","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 152–165","fromKeys":["GUIDE-CHIRALITY-MATURITY-ba5a0b96e58f@0d78e3c4f1b21a2f"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-56afcab39f82eca9884c","from":"GUIDE-CHIRALITY-MATURITY-f1f90001419d@1f59a3bb902004a5","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"4 Maturity Dimensions","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 166–191","fromKeys":["GUIDE-CHIRALITY-MATURITY-f1f90001419d@1f59a3bb902004a5"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e9751ca65ed57c5e4f74","from":"GUIDE-CHIRALITY-MATURITY-f87f7452181f@71729a9bf4aaca9c","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"Dimension 1: Responsible & Equitable","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 170–174","fromKeys":["GUIDE-CHIRALITY-MATURITY-f87f7452181f@71729a9bf4aaca9c"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-0e062d06d3bb71bc48e0","from":"GUIDE-CHIRALITY-MATURITY-961bd0656a28@d22b2b16c1f9cff7","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"Dimension 2: Traceable & Reliable","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 175–179","fromKeys":["GUIDE-CHIRALITY-MATURITY-961bd0656a28@d22b2b16c1f9cff7"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4ec0ecb283cb069f4af7","from":"GUIDE-CHIRALITY-MATURITY-2dd1a154ecf8@e1bfaca3d3b7c44b","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"Dimension 3: Governable & Controlled","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 180–184","fromKeys":["GUIDE-CHIRALITY-MATURITY-2dd1a154ecf8@e1bfaca3d3b7c44b"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-05b91a8f17a2a59a22f5","from":"GUIDE-CHIRALITY-MATURITY-bd015120ee25@a6a0b44a60dccf23","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"Dimension 4: Human-Centric Outcomes","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 185–191","fromKeys":["GUIDE-CHIRALITY-MATURITY-bd015120ee25@a6a0b44a60dccf23"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-37c0bdbc02f5884daf48","from":"GUIDE-CHIRALITY-MATURITY-c7a76d91e0cf@7ede0ada71f780c5","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"How GOVERN Implements This","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 192–260","fromKeys":["GUIDE-CHIRALITY-MATURITY-c7a76d91e0cf@7ede0ada71f780c5"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-93dd913e92f72c2cd967","from":"GUIDE-CHIRALITY-MATURITY-f9e1250d6a89@5f84c6f50d3370f0","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"Maturity Assessment Feature","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 194–210","fromKeys":["GUIDE-CHIRALITY-MATURITY-f9e1250d6a89@5f84c6f50d3370f0"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5dcdea2bf6e7e8e817dd","from":"GUIDE-CHIRALITY-MATURITY-4371a48a5b8c@d5a88dec1626858a","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"Implementation in GOVERN Components","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 211–225","fromKeys":["GUIDE-CHIRALITY-MATURITY-4371a48a5b8c@d5a88dec1626858a"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f17eee5d417ca7fb9c7d","from":"GUIDE-CHIRALITY-MATURITY-acf51a8695dd@df15c458ec8f3ab3","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"Maturity Score Calculation","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 226–260","fromKeys":["GUIDE-CHIRALITY-MATURITY-acf51a8695dd@df15c458ec8f3ab3"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-90702ed775a8a3b3945e","from":"GUIDE-CHIRALITY-MATURITY-8ba0fa05d98b@0e6382cf8e05c03c","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"API Routes for Maturity Assessment","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 261–281","fromKeys":["GUIDE-CHIRALITY-MATURITY-8ba0fa05d98b@0e6382cf8e05c03c"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-2349c36de97ec46f3900","from":"GUIDE-CHIRALITY-MATURITY-cdf9ea9d2bc7@77e225c5ad7873dd","to":"FW-CHIRALITY-MATURITY@b72572b02ff8c621","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(1).md","heading":"Alignment to Other Frameworks","primarySourceVerified":false},"sourceKey":"policy-guide-chirality-maturity@9134743a099f1dc9","locator":"POLICY(1).md:lines 282–297","fromKeys":["GUIDE-CHIRALITY-MATURITY-cdf9ea9d2bc7@77e225c5ad7873dd"],"toKeys":["FW-CHIRALITY-MATURITY@b72572b02ff8c621"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a254e7a0c32cc1dc66db","from":"GUIDE-CMMC-d4b1ea5708dd@d3dfadb497795c66","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"Overview","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 10–17","fromKeys":["GUIDE-CMMC-d4b1ea5708dd@d3dfadb497795c66"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-dc947943f4aa0a9e70ee","from":"GUIDE-CMMC-33d9b34511c8@aff2acd402b3d285","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"CMMC Structure","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 18–43","fromKeys":["GUIDE-CMMC-33d9b34511c8@aff2acd402b3d285"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f8e8f0cadbd7c16d0c6a","from":"GUIDE-CMMC-c6687532e15e@674b4b2ae352bd8e","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"Three Certification Levels","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 20–43","fromKeys":["GUIDE-CMMC-c6687532e15e@674b4b2ae352bd8e"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a9cb73322da6acc6a2f9","from":"GUIDE-CMMC-b83ed29f205c@e559b351bf18297c","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"The 14 CMMC Domains","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 44–64","fromKeys":["GUIDE-CMMC-b83ed29f205c@e559b351bf18297c"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-dd5f16ab9a5cefd61403","from":"GUIDE-CMMC-ada412eeb3b1@0dd2eecf6a6a956e","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"AI-Relevant CMMC Controls","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 65–154","fromKeys":["GUIDE-CMMC-ada412eeb3b1@0dd2eecf6a6a956e"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-6959d437674586b0de11","from":"GUIDE-CMMC-4bd9687b3cff@cabdd6c26874911b","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"Access Control (AC)","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 67–80","fromKeys":["GUIDE-CMMC-4bd9687b3cff@cabdd6c26874911b"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7ebf633c4cdd9d4fb704","from":"GUIDE-CMMC-ad0f054d92b4@81ffa31e2fb287de","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"Audit and Accountability (AU)","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 81–94","fromKeys":["GUIDE-CMMC-ad0f054d92b4@81ffa31e2fb287de"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1c7302d02f7526416055","from":"GUIDE-CMMC-0c831209db16@bb87dee97482f573","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"Configuration Management (CM)","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 95–108","fromKeys":["GUIDE-CMMC-0c831209db16@bb87dee97482f573"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-dbbb372bb6b9a6b0b2b3","from":"GUIDE-CMMC-cc60a43f21c0@956063ee44d9a070","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"Incident Response (IR)","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 109–116","fromKeys":["GUIDE-CMMC-cc60a43f21c0@956063ee44d9a070"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-42b1531b486c74a8c154","from":"GUIDE-CMMC-2f8c723e0c37@e9a785003736fa38","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"Risk Assessment (RA)","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 117–130","fromKeys":["GUIDE-CMMC-2f8c723e0c37@e9a785003736fa38"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d67752f2f3efee3cfc5b","from":"GUIDE-CMMC-1391326987ed@dff889e5cb9c4047","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"System and Information Integrity (SI)","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 131–144","fromKeys":["GUIDE-CMMC-1391326987ed@dff889e5cb9c4047"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-bd5425421cef03cec7bf","from":"GUIDE-CMMC-3e211c704f63@61261076a2ba7e99","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"System and Communications Protection (SC)","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 145–154","fromKeys":["GUIDE-CMMC-3e211c704f63@61261076a2ba7e99"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-bd8c73d26e956198bbf1","from":"GUIDE-CMMC-718b8b70b5ca@581f8dcf597f942c","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"DIB (Defense Industrial Base) Requirements","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 155–173","fromKeys":["GUIDE-CMMC-718b8b70b5ca@581f8dcf597f942c"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-de48b758be0937928d6f","from":"GUIDE-CMMC-459cae2d094b@186772e1a2d6e19a","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"Contract Flow-Down","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 157–162","fromKeys":["GUIDE-CMMC-459cae2d094b@186772e1a2d6e19a"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e775cef73fa756315534","from":"GUIDE-CMMC-b82159a081aa@93605ce3bba5a4f2","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"AI Subcontractors","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 163–168","fromKeys":["GUIDE-CMMC-b82159a081aa@93605ce3bba5a4f2"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-db74ac9d9235a2250dbe","from":"GUIDE-CMMC-7f85880eb6fb@fb2395f08f67e2c1","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"Supplier Performance Risk System (SPRS)","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 169–173","fromKeys":["GUIDE-CMMC-7f85880eb6fb@fb2395f08f67e2c1"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-bbf9b17552a6b861102a","from":"GUIDE-CMMC-087615ecff08@33a56759bc286adb","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"GOVERN CMMC Assessment Workflow","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 174–202","fromKeys":["GUIDE-CMMC-087615ecff08@33a56759bc286adb"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-6ed951ff21cccb315f16","from":"GUIDE-CMMC-c1d741699694@4da6cf1269e31fd5","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"Step 1: Scoping","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 176–178","fromKeys":["GUIDE-CMMC-c1d741699694@4da6cf1269e31fd5"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5ffd5ef9676f5431ae4a","from":"GUIDE-CMMC-034391293cf6@b34e7d3ebbfe04a1","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"Step 2: Gap Analysis","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 179–181","fromKeys":["GUIDE-CMMC-034391293cf6@b34e7d3ebbfe04a1"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-de6b4e2f2af6227f81f3","from":"GUIDE-CMMC-99f48be3dbef@604b8c446900c8d9","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"Step 3: Evidence Collection","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 182–189","fromKeys":["GUIDE-CMMC-99f48be3dbef@604b8c446900c8d9"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-92bcb67e0a9d894d6d3e","from":"GUIDE-CMMC-e598890dbfd3@6cec6b707028e400","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"Step 4: Plan of Action and Milestones (POA&M)","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 190–197","fromKeys":["GUIDE-CMMC-e598890dbfd3@6cec6b707028e400"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-9fc58c9af25939a6a365","from":"GUIDE-CMMC-1387f8a40572@893d01436728a543","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"Step 5: Continuous Monitoring","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 198–202","fromKeys":["GUIDE-CMMC-1387f8a40572@893d01436728a543"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a2533743cc871cd2000d","from":"GUIDE-CMMC-c19e439ec559@6c77d26a45310237","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"CMMC Assessment Output Format","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 203–238","fromKeys":["GUIDE-CMMC-c19e439ec559@6c77d26a45310237"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-78458d44ef6be109aff8","from":"GUIDE-CMMC-69824d3b0e70@90f188fe81572ddd","to":"FW-CMMC@e968caf002b9348f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(2).md","heading":"References","primarySourceVerified":false},"sourceKey":"policy-guide-cmmc@41d1e97d020a97ab","locator":"POLICY(2).md:lines 239–246","fromKeys":["GUIDE-CMMC-69824d3b0e70@90f188fe81572ddd"],"toKeys":["FW-CMMC@e968caf002b9348f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-22401c9aa322ea1da3ad","from":"GUIDE-DOD-AI-ETHICS-d4b1ea5708dd@e697741088d4aa35","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"Overview","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 10–17","fromKeys":["GUIDE-DOD-AI-ETHICS-d4b1ea5708dd@e697741088d4aa35"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b05b84ad69fc74ef74e0","from":"GUIDE-DOD-AI-ETHICS-67738471d132@3bcc1bfe47146a3e","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"The Five DoD AI Ethics Principles","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 18–176","fromKeys":["GUIDE-DOD-AI-ETHICS-67738471d132@3bcc1bfe47146a3e"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5ad74180b9ebff1c743a","from":"GUIDE-DOD-AI-ETHICS-0a63fa35e0d7@d7b2494e16327226","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"Principle 1: Responsible","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 20–49","fromKeys":["GUIDE-DOD-AI-ETHICS-0a63fa35e0d7@d7b2494e16327226"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-9675c6ac603ce6e046fc","from":"GUIDE-DOD-AI-ETHICS-d91817ba2d50@2e8500aaa7d00a7f","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"Principle 2: Equitable","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 50–79","fromKeys":["GUIDE-DOD-AI-ETHICS-d91817ba2d50@2e8500aaa7d00a7f"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-bc66ab636042e6ec25b8","from":"GUIDE-DOD-AI-ETHICS-c0bd973d970a@7c8168964cc9244a","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"Principle 3: Traceable","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 80–110","fromKeys":["GUIDE-DOD-AI-ETHICS-c0bd973d970a@7c8168964cc9244a"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-faa87903f5924dfaedde","from":"GUIDE-DOD-AI-ETHICS-002d8967b767@7398b22ba2f1fe62","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"Principle 4: Reliable","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 111–143","fromKeys":["GUIDE-DOD-AI-ETHICS-002d8967b767@7398b22ba2f1fe62"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-969d48bb3e0b5ed1252e","from":"GUIDE-DOD-AI-ETHICS-ebad561d600c@c61890205c444dcd","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"Principle 5: Governable","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 144–176","fromKeys":["GUIDE-DOD-AI-ETHICS-ebad561d600c@c61890205c444dcd"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b8d39e2f257e56766867","from":"GUIDE-DOD-AI-ETHICS-5f31df376b61@eaac205009152159","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"DoD Directive 3000.09 — Autonomous Weapon Systems","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 177–193","fromKeys":["GUIDE-DOD-AI-ETHICS-5f31df376b61@eaac205009152159"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-318c327cc421d2522c3b","from":"GUIDE-DOD-AI-ETHICS-cbd5081a5641@675c2a91b174bcdf","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"Summary","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 179–181","fromKeys":["GUIDE-DOD-AI-ETHICS-cbd5081a5641@675c2a91b174bcdf"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-60acd418e02e5810fa0b","from":"GUIDE-DOD-AI-ETHICS-7d04a470c378@786b8655ec41dd12","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"Key Requirements","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 182–188","fromKeys":["GUIDE-DOD-AI-ETHICS-7d04a470c378@786b8655ec41dd12"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8c92ac999d2e37d737a3","from":"GUIDE-DOD-AI-ETHICS-abde8473193e@6d4b5df5befaa819","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"GOVERN Relevance for Defense AI","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 189–193","fromKeys":["GUIDE-DOD-AI-ETHICS-abde8473193e@6d4b5df5befaa819"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c14377f7158c2426c887","from":"GUIDE-DOD-AI-ETHICS-24b61af8c83d@c5dc309caff3a0aa","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"DoD AI Strategy (2023 Update)","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 194–210","fromKeys":["GUIDE-DOD-AI-ETHICS-24b61af8c83d@c5dc309caff3a0aa"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-94c673181cd28dfdd6d1","from":"GUIDE-DOD-AI-ETHICS-d322e01cdda7@225ed7b0a68d990a","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"Key Pillars","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 196–201","fromKeys":["GUIDE-DOD-AI-ETHICS-d322e01cdda7@225ed7b0a68d990a"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-931c5e7ac54806f98ae3","from":"GUIDE-DOD-AI-ETHICS-fa36254d0296@a337bf5877252774","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"Governance Requirements for Defense Contractors","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 202–210","fromKeys":["GUIDE-DOD-AI-ETHICS-fa36254d0296@a337bf5877252774"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-335df5455e77d8d1631b","from":"GUIDE-DOD-AI-ETHICS-a5e5db74c2c9@e24bf6ceafa4ee12","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"GOVERN Compliance Report: DoD AI Ethics","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 211–263","fromKeys":["GUIDE-DOD-AI-ETHICS-a5e5db74c2c9@e24bf6ceafa4ee12"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-533f6d6d6389d86a5293","from":"GUIDE-DOD-AI-ETHICS-e33f725b85e2@933b87edf14e4bc4","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"Assessment Output","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 213–263","fromKeys":["GUIDE-DOD-AI-ETHICS-e33f725b85e2@933b87edf14e4bc4"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-291d2e9fbd47cbb73878","from":"GUIDE-DOD-AI-ETHICS-69824d3b0e70@e883e8a0e46db5f1","to":"FW-DOD-AI-ETHICS@dce13385a4d1628e","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(3).md","heading":"References","primarySourceVerified":false},"sourceKey":"policy-guide-dod-ai-ethics@cea5aa820a0b3f1d","locator":"POLICY(3).md:lines 264–272","fromKeys":["GUIDE-DOD-AI-ETHICS-69824d3b0e70@e883e8a0e46db5f1"],"toKeys":["FW-DOD-AI-ETHICS@dce13385a4d1628e"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7a206e9def73894fbbe4","from":"GUIDE-EO-14110-7c6db84cd8c4@2e466342c9db5e04","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"What It Is","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 11–25","fromKeys":["GUIDE-EO-14110-7c6db84cd8c4@2e466342c9db5e04"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ead4be186bd7c2b4ee34","from":"GUIDE-EO-14110-62c3b372adb4@a848449af68e5d32","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"OMB Memorandum M-24-10","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 26–48","fromKeys":["GUIDE-EO-14110-62c3b372adb4@a848449af68e5d32"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c9a6d503ed05d7b190d1","from":"GUIDE-EO-14110-79d9626b044a@0d34707b3713dbcc","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Key Deadlines","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 49–65","fromKeys":["GUIDE-EO-14110-79d9626b044a@0d34707b3713dbcc"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5b88458f5e3b09a7ecc6","from":"GUIDE-EO-14110-5855cab863a5@b2750bc8370a9a1a","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Chief AI Officer (CAIO) Requirement","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 66–102","fromKeys":["GUIDE-EO-14110-5855cab863a5@b2750bc8370a9a1a"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b8b1733b86cc4cded04f","from":"GUIDE-EO-14110-6f3cb5e780de@b5cac6b8b48c8167","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"AI Use Case Inventory","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 103–148","fromKeys":["GUIDE-EO-14110-6f3cb5e780de@b5cac6b8b48c8167"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-bc5d8f1bbcdcdf84e614","from":"GUIDE-EO-14110-33e3ff3a6b96@319f7474b70540a5","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Rights-Impacting AI — Definition and Requirements","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 149–179","fromKeys":["GUIDE-EO-14110-33e3ff3a6b96@319f7474b70540a5"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a90832192047b0cd6b15","from":"GUIDE-EO-14110-5d591f9926b9@60a7582becf3d823","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Safety-Impacting AI — Definition and Requirements","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 180–212","fromKeys":["GUIDE-EO-14110-5d591f9926b9@60a7582becf3d823"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1755bd0cbff09ee613be","from":"GUIDE-EO-14110-04aecd8c33d5@87e34774782dbd75","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Minimum Risk Management Practices — Full Framework","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 213–242","fromKeys":["GUIDE-EO-14110-04aecd8c33d5@87e34774782dbd75"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a870c9cf1f08983054dd","from":"GUIDE-EO-14110-218eb1a5550c@c74532fb822fa4e6","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Section-by-Section Breakdown of Federal Agency Obligations","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 243–373","fromKeys":["GUIDE-EO-14110-218eb1a5550c@c74532fb822fa4e6"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-634c6d078dec3315672a","from":"GUIDE-EO-14110-2346c2f7aafa@54eaf61ecf770d0a","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Section 4 — Ensuring the Safety and Security of AI","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 245–273","fromKeys":["GUIDE-EO-14110-2346c2f7aafa@54eaf61ecf770d0a"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5f2d85b7f308d8c5a8e7","from":"GUIDE-EO-14110-b13eec9c47c3@21fee62d2e198d62","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Section 5 — Promoting Innovation and Competition","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 274–289","fromKeys":["GUIDE-EO-14110-b13eec9c47c3@21fee62d2e198d62"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-2e876dcb1f3540a937c1","from":"GUIDE-EO-14110-c130536e7d31@0992aee256490558","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Section 6 — Supporting Workers","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 290–298","fromKeys":["GUIDE-EO-14110-c130536e7d31@0992aee256490558"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-fae1283c59a65b96cafe","from":"GUIDE-EO-14110-34dcbc154365@4820ed3b3e2f177a","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Section 7 — Advancing Equity and Civil Rights","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 299–307","fromKeys":["GUIDE-EO-14110-34dcbc154365@4820ed3b3e2f177a"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-9229ad43b523f0baa099","from":"GUIDE-EO-14110-1112914dfbb4@e1794a8f9ac6eaf8","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Section 8 — Protecting Consumers, Patients, Passengers, and Students","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 308–328","fromKeys":["GUIDE-EO-14110-1112914dfbb4@e1794a8f9ac6eaf8"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-afba461464800b98f7af","from":"GUIDE-EO-14110-238ec1b1ea58@9dc39353c8c35513","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Section 9 — Protecting Privacy","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 329–338","fromKeys":["GUIDE-EO-14110-238ec1b1ea58@9dc39353c8c35513"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c64038e29fef6c19cbdf","from":"GUIDE-EO-14110-3b1e0132f5f0@df52392fa0f4489f","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Section 10 — Advancing Federal Government Use of AI","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 339–364","fromKeys":["GUIDE-EO-14110-3b1e0132f5f0@df52392fa0f4489f"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8175c169d170850ae974","from":"GUIDE-EO-14110-b3dcf85c3daa@9ca589583155671b","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Section 11 — Advancing American Leadership Abroad","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 365–373","fromKeys":["GUIDE-EO-14110-b3dcf85c3daa@9ca589583155671b"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1e982876202c3b79b678","from":"GUIDE-EO-14110-4dfdbc9caab6@00dea9ed7860b271","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"AI Inventory Report: How GOVERN Energy and Compliance Portal Generate This","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 374–416","fromKeys":["GUIDE-EO-14110-4dfdbc9caab6@00dea9ed7860b271"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-eff187ebe4f8f17a25ff","from":"GUIDE-EO-14110-c0b3ac29a78d@6538ae22c8da03d1","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"OMB Enforcement Mechanisms","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 417–438","fromKeys":["GUIDE-EO-14110-c0b3ac29a78d@6538ae22c8da03d1"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1b9a4c01386cd8fa29a1","from":"GUIDE-EO-14110-2aac512f087b@3646aa4cca032d89","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"GOVERN Automation of EO 14110 Compliance","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 439–463","fromKeys":["GUIDE-EO-14110-2aac512f087b@3646aa4cca032d89"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-3e24148dae36029a83be","from":"GUIDE-EO-14110-e1c5c4d65e56@edfaacd64e9b3c2f","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Interaction with Other US AI Policies","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 464–477","fromKeys":["GUIDE-EO-14110-e1c5c4d65e56@edfaacd64e9b3c2f"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-725f77ec9e6e006ff31d","from":"GUIDE-EO-14110-4b99227c823f@0b1e5df222956658","to":"FW-EO-14110@dfd56eb497a8628f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(4).md","heading":"Key Definitions from EO 14110 and M-24-10","primarySourceVerified":false},"sourceKey":"policy-guide-eo-14110@88d519cc9c305e1a","locator":"POLICY(4).md:lines 478–490","fromKeys":["GUIDE-EO-14110-4b99227c823f@0b1e5df222956658"],"toKeys":["FW-EO-14110@dfd56eb497a8628f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-cd44a71159d0fbd95637","from":"GUIDE-EU-AI-ACT-7c6db84cd8c4@3c8523cabd28a251","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"What It Is","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 9–18","fromKeys":["GUIDE-EU-AI-ACT-7c6db84cd8c4@3c8523cabd28a251"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-3f8e61f809ce88b4276d","from":"GUIDE-EU-AI-ACT-6033ed1cc88a@187d945afdc6aa35","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Enforcement Timeline","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 19–32","fromKeys":["GUIDE-EU-AI-ACT-6033ed1cc88a@187d945afdc6aa35"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a909c0eef181d2ac7d90","from":"GUIDE-EU-AI-ACT-8511d8d9ace9@baf7916daa66fbff","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Risk Classification System","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 33–81","fromKeys":["GUIDE-EU-AI-ACT-8511d8d9ace9@baf7916daa66fbff"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8fbacc889bef26a71f5c","from":"GUIDE-EU-AI-ACT-993a9445e7d4@d3611d629b800c5c","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Tier 1 — Unacceptable Risk (Prohibited)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 35–51","fromKeys":["GUIDE-EU-AI-ACT-993a9445e7d4@d3611d629b800c5c"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-79012e2c0b1946d0764d","from":"GUIDE-EU-AI-ACT-5540efc926b0@59be080686028180","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Tier 2 — High-Risk AI","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 52–60","fromKeys":["GUIDE-EU-AI-ACT-5540efc926b0@59be080686028180"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-59073327b2f992dd6623","from":"GUIDE-EU-AI-ACT-2244be543a17@6ba1ccc09baa6090","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Tier 3 — Limited Risk","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 61–71","fromKeys":["GUIDE-EU-AI-ACT-2244be543a17@6ba1ccc09baa6090"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c5323e57539c64d74278","from":"GUIDE-EU-AI-ACT-5150f5e2c204@d0d521be281a52cb","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Tier 4 — Minimal/No Risk","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 72–81","fromKeys":["GUIDE-EU-AI-ACT-5150f5e2c204@d0d521be281a52cb"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c0512a3ee05fb65b1848","from":"GUIDE-EU-AI-ACT-70f400ea3508@59c61f418f4e6713","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Article 6 — High-Risk AI Classification","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 82–111","fromKeys":["GUIDE-EU-AI-ACT-70f400ea3508@59c61f418f4e6713"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-9570b070ae15908423df","from":"GUIDE-EU-AI-ACT-a7847c271ab6@878fa9e01941c77b","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Annex III — High-Risk AI System Categories","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 112–165","fromKeys":["GUIDE-EU-AI-ACT-a7847c271ab6@878fa9e01941c77b"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e7f0748b7ca41199cd01","from":"GUIDE-EU-AI-ACT-ad2259d97b50@e1d2c8b03a935aad","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Article 9 — Risk Management System","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 166–193","fromKeys":["GUIDE-EU-AI-ACT-ad2259d97b50@e1d2c8b03a935aad"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-2ee07ee4fd06e2f20470","from":"GUIDE-EU-AI-ACT-6abf8bb7c8f9@e3fcfee6665a341f","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Article 10 — Data and Data Governance","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 194–216","fromKeys":["GUIDE-EU-AI-ACT-6abf8bb7c8f9@e3fcfee6665a341f"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a73351179b557daffdaa","from":"GUIDE-EU-AI-ACT-810b29b3574d@4ea902416e0ee643","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Article 13 — Transparency and Provision of Information to Deployers","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 217–246","fromKeys":["GUIDE-EU-AI-ACT-810b29b3574d@4ea902416e0ee643"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-231b330b270e348726e8","from":"GUIDE-EU-AI-ACT-3cd5968c04de@5b53a06a327fc041","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Article 14 — Human Oversight","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 247–269","fromKeys":["GUIDE-EU-AI-ACT-3cd5968c04de@5b53a06a327fc041"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-88020a8d29735109b234","from":"GUIDE-EU-AI-ACT-2bd7a097a3c3@d003fdb2ad7da7de","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Article 15 — Accuracy, Robustness, and Cybersecurity","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 270–290","fromKeys":["GUIDE-EU-AI-ACT-2bd7a097a3c3@d003fdb2ad7da7de"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-50a343073d946e5ddd92","from":"GUIDE-EU-AI-ACT-d1c940a3e06b@8d00dd6449e18a3b","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Article 52 — GPAI Model Obligations","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 291–317","fromKeys":["GUIDE-EU-AI-ACT-d1c940a3e06b@8d00dd6449e18a3b"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f8e401036e88e662715c","from":"GUIDE-EU-AI-ACT-be3f672a4b53@12b7627ee8a7046b","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Article 71 — Codes of Practice","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 318–342","fromKeys":["GUIDE-EU-AI-ACT-be3f672a4b53@12b7627ee8a7046b"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ff856923a0c98c839d49","from":"GUIDE-EU-AI-ACT-444206375e2a@9d26e40f2da6bb66","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Penalties","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 343–361","fromKeys":["GUIDE-EU-AI-ACT-444206375e2a@9d26e40f2da6bb66"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d9b31850f6a6a130b35b","from":"GUIDE-EU-AI-ACT-2d768359c990@fad023d9d5e2ab71","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Extraterritorial Application","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 362–382","fromKeys":["GUIDE-EU-AI-ACT-2d768359c990@fad023d9d5e2ab71"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e0471a82583791ef1989","from":"GUIDE-EU-AI-ACT-68fff543384e@0a377af95dbbf478","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"AI Inventory Requirement and How GOVERN Energy Discovers Systems","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 383–412","fromKeys":["GUIDE-EU-AI-ACT-68fff543384e@0a377af95dbbf478"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e9a77cf4edf379243910","from":"GUIDE-EU-AI-ACT-a56c0c13d733@928b9968948e8586","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"GOVERN Component Mapping to EU AI Act Articles","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 413–434","fromKeys":["GUIDE-EU-AI-ACT-a56c0c13d733@928b9968948e8586"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-25493a08dff0faf480f5","from":"GUIDE-EU-AI-ACT-406870edffeb@265482f748ccf455","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Key Definitions (Article 3)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 435–448","fromKeys":["GUIDE-EU-AI-ACT-406870edffeb@265482f748ccf455"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ff0dfc31f5edf8bc8df8","from":"GUIDE-EU-AI-ACT-be00b216fdaf@f65dd62b9929e8f1","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Compliance Checklist for Organizations Subject to EU AI Act","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 449–471","fromKeys":["GUIDE-EU-AI-ACT-be00b216fdaf@f65dd62b9929e8f1"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-dccf620bd7d4d35d0f49","from":"GUIDE-EU-AI-ACT-83b0bcc1cfbd@78f28c0b02969d19","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Immediate (February 2025)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 451–456","fromKeys":["GUIDE-EU-AI-ACT-83b0bcc1cfbd@78f28c0b02969d19"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-fcd1f9e5f2dc75588af2","from":"GUIDE-EU-AI-ACT-8dffffde2c70@027b6a04b4faad0e","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Near-term (August 2025)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 457–463","fromKeys":["GUIDE-EU-AI-ACT-8dffffde2c70@027b6a04b4faad0e"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1c676ff3dcf6dd05f837","from":"GUIDE-EU-AI-ACT-8e818ccb0fef@3b7abef3874e6f1c","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","heading":"Full compliance (August 2026)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 464–471","fromKeys":["GUIDE-EU-AI-ACT-8e818ccb0fef@3b7abef3874e6f1c"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1e6ddfeb0c31d2621d69","from":"MD-CTRL-EU-AI-ACT-9-1-@5bec8b894d92882b","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"9(1)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 172–173","fromKeys":["MD-CTRL-EU-AI-ACT-9-1-@5bec8b894d92882b"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-129d1ff84fecb61a5467","from":"MD-CTRL-EU-AI-ACT-9-2-@51c3f8ab111e3ef5","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"9(2)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 174–179","fromKeys":["MD-CTRL-EU-AI-ACT-9-2-@51c3f8ab111e3ef5"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e64cf01cc287ee5d1c62","from":"MD-CTRL-EU-AI-ACT-9-4-@e401d0abd504c8b1","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"9(4)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 180–181","fromKeys":["MD-CTRL-EU-AI-ACT-9-4-@e401d0abd504c8b1"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-62f389441699efb14bf9","from":"MD-CTRL-EU-AI-ACT-9-5-@fdc5560100fd6335","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"9(5)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 182–183","fromKeys":["MD-CTRL-EU-AI-ACT-9-5-@fdc5560100fd6335"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4682e03fbb02a577d992","from":"MD-CTRL-EU-AI-ACT-9-6-@a9ee456f4433d8fe","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"9(6)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 184–185","fromKeys":["MD-CTRL-EU-AI-ACT-9-6-@a9ee456f4433d8fe"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e387348b6af26bc67378","from":"MD-CTRL-EU-AI-ACT-9-7-@262fe538cb34eacc","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"9(7)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 186–187","fromKeys":["MD-CTRL-EU-AI-ACT-9-7-@262fe538cb34eacc"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7f7604e0d059ebe0204f","from":"MD-CTRL-EU-AI-ACT-9-8-@e3fa4515dc9c64e3","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"9(8)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 188–193","fromKeys":["MD-CTRL-EU-AI-ACT-9-8-@e3fa4515dc9c64e3"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-44a0961621ace8a27525","from":"MD-CTRL-EU-AI-ACT-10-2-@a7dce78116ce2014","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"10(2)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 198–206","fromKeys":["MD-CTRL-EU-AI-ACT-10-2-@a7dce78116ce2014"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-44e5158d0281671dc706","from":"MD-CTRL-EU-AI-ACT-10-3-@1ce76d7345575584","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"10(3)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 207–208","fromKeys":["MD-CTRL-EU-AI-ACT-10-3-@1ce76d7345575584"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4d57317c8f66f6878ebd","from":"MD-CTRL-EU-AI-ACT-10-4-@aa75ff3914ffc284","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"10(4)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 209–210","fromKeys":["MD-CTRL-EU-AI-ACT-10-4-@aa75ff3914ffc284"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8d2434d31af1189630ec","from":"MD-CTRL-EU-AI-ACT-10-5-@7e0bc0ba9d6d6412","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"10(5)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 211–216","fromKeys":["MD-CTRL-EU-AI-ACT-10-5-@7e0bc0ba9d6d6412"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-69c797b7fe25ce9b4a62","from":"MD-CTRL-EU-AI-ACT-13-1-@e4de22262c5355d6","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"13(1)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 221–222","fromKeys":["MD-CTRL-EU-AI-ACT-13-1-@e4de22262c5355d6"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-419c9ce235db44db5b04","from":"MD-CTRL-EU-AI-ACT-13-2-@ae3ce4bab942592a","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"13(2)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 223–235","fromKeys":["MD-CTRL-EU-AI-ACT-13-2-@ae3ce4bab942592a"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-cee833f23e9fcfc00f81","from":"MD-CTRL-EU-AI-ACT-13-3-@f228d898e674d933","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"13(3)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 236–246","fromKeys":["MD-CTRL-EU-AI-ACT-13-3-@f228d898e674d933"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-903f1a4ff70a8239d2f5","from":"MD-CTRL-EU-AI-ACT-14-1-@f52eff8120a90c2e","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"14(1)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 251–252","fromKeys":["MD-CTRL-EU-AI-ACT-14-1-@f52eff8120a90c2e"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1dd376bad4eccdd74d5f","from":"MD-CTRL-EU-AI-ACT-14-2-@5e8d41765cdf2e60","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"14(2)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 253–254","fromKeys":["MD-CTRL-EU-AI-ACT-14-2-@5e8d41765cdf2e60"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-aa021fabecf8cce4a97e","from":"MD-CTRL-EU-AI-ACT-14-3-@8f0eaa8f1c405ff4","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"14(3)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 255–261","fromKeys":["MD-CTRL-EU-AI-ACT-14-3-@8f0eaa8f1c405ff4"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a4c43bd65d687027f49d","from":"MD-CTRL-EU-AI-ACT-14-4-@ca77c391a877ecbb","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"14(4)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 262–263","fromKeys":["MD-CTRL-EU-AI-ACT-14-4-@ca77c391a877ecbb"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f8f7570c8bd087b6e65c","from":"MD-CTRL-EU-AI-ACT-14-5-@af795797cc364252","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"14(5)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 264–269","fromKeys":["MD-CTRL-EU-AI-ACT-14-5-@af795797cc364252"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f488a7cb1e7ff7383c76","from":"MD-CTRL-EU-AI-ACT-15-1-@b3e518f9d429b45e","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"15(1)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 272–273","fromKeys":["MD-CTRL-EU-AI-ACT-15-1-@b3e518f9d429b45e"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-bb6fb3e2790982f3d40b","from":"MD-CTRL-EU-AI-ACT-15-2-@503fca7940ba7748","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"15(2)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 274–275","fromKeys":["MD-CTRL-EU-AI-ACT-15-2-@503fca7940ba7748"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f65d95ba64bae01191b7","from":"MD-CTRL-EU-AI-ACT-15-3-@cf8a59d9043b2983","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"15(3)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 276–282","fromKeys":["MD-CTRL-EU-AI-ACT-15-3-@cf8a59d9043b2983"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-10fa312ebccf9bd30943","from":"MD-CTRL-EU-AI-ACT-15-4-@1e19ebf3d5aebd44","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"15(4)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 283–284","fromKeys":["MD-CTRL-EU-AI-ACT-15-4-@1e19ebf3d5aebd44"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-78fed73eb7c8d70fbd31","from":"MD-CTRL-EU-AI-ACT-15-5-@f5fb81f718cfe769","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"15(5)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 285–290","fromKeys":["MD-CTRL-EU-AI-ACT-15-5-@f5fb81f718cfe769"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c70d2ec9d625fa317434","from":"MD-CTRL-EU-AI-ACT-52-1-@058abb0e89a7813e","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"52(1)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 295–300","fromKeys":["MD-CTRL-EU-AI-ACT-52-1-@058abb0e89a7813e"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-77bd169ab72d9e9b38b8","from":"MD-CTRL-EU-AI-ACT-52-2-@fcd1dc217971ff35","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"52(2)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 301–311","fromKeys":["MD-CTRL-EU-AI-ACT-52-2-@fcd1dc217971ff35"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a58ed2f080106e3eb8ca","from":"MD-CTRL-EU-AI-ACT-52-5-@5a666ea0f8aca324","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"52(5)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 312–317","fromKeys":["MD-CTRL-EU-AI-ACT-52-5-@5a666ea0f8aca324"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f26bfbef727d0c9e1346","from":"MD-CTRL-EU-AI-ACT-71-1-@0bbab87f8356282e","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"71(1)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 322–323","fromKeys":["MD-CTRL-EU-AI-ACT-71-1-@0bbab87f8356282e"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c3a19227f0b2bfe991d2","from":"MD-CTRL-EU-AI-ACT-71-3-@e33680f9cc493c26","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"71(3)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 324–329","fromKeys":["MD-CTRL-EU-AI-ACT-71-3-@e33680f9cc493c26"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-0d01818e4033f23817a7","from":"MD-CTRL-EU-AI-ACT-71-4-@4821a27b7f16337b","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"71(4)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 330–331","fromKeys":["MD-CTRL-EU-AI-ACT-71-4-@4821a27b7f16337b"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-12e68205a76da80096e6","from":"MD-CTRL-EU-AI-ACT-71-7-@3d02e8cd9482f5bd","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"71(7)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 332–333","fromKeys":["MD-CTRL-EU-AI-ACT-71-7-@3d02e8cd9482f5bd"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-be9848482f7a10f42d46","from":"MD-CTRL-EU-AI-ACT-71-8-@dcf40a65d12e2da2","to":"FW-EU-AI-ACT@881f89c9d4bd5d35","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(5).md","control":"71(8)","primarySourceVerified":false},"sourceKey":"policy-guide-eu-ai-act@952eee7420eda0a8","locator":"POLICY(5).md:lines 334–342","fromKeys":["MD-CTRL-EU-AI-ACT-71-8-@dcf40a65d12e2da2"],"toKeys":["FW-EU-AI-ACT@881f89c9d4bd5d35"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d1cede097db602381c3a","from":"GUIDE-FEDRAMP-d4b1ea5708dd@d31094c30784f57d","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"Overview","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 10–17","fromKeys":["GUIDE-FEDRAMP-d4b1ea5708dd@d31094c30784f57d"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d22c0455fda7e1346719","from":"GUIDE-FEDRAMP-51bb5216f8b9@25e68f0c2fe84d00","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"Authorization Process","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 18–60","fromKeys":["GUIDE-FEDRAMP-51bb5216f8b9@25e68f0c2fe84d00"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d6fdae15eab7844e2b99","from":"GUIDE-FEDRAMP-7b5e5d2e0702@7164dd7c57b4745c","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"Three Authorization Pathways","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 20–46","fromKeys":["GUIDE-FEDRAMP-7b5e5d2e0702@7164dd7c57b4745c"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-3353cbdbbd1f3b27b3a0","from":"GUIDE-FEDRAMP-46d62dc73a79@5bf1de7bc74c6119","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"Authorization Steps (All Pathways)","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 47–60","fromKeys":["GUIDE-FEDRAMP-46d62dc73a79@5bf1de7bc74c6119"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a1eb95e789949a5570f9","from":"GUIDE-FEDRAMP-199c97ad51b8@b3d16adde1e130b6","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"Impact Levels","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 61–85","fromKeys":["GUIDE-FEDRAMP-199c97ad51b8@b3d16adde1e130b6"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d8133fafb4af69ddae75","from":"GUIDE-FEDRAMP-d74e11b26a06@db2e815847981854","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"Low Impact","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 65–70","fromKeys":["GUIDE-FEDRAMP-d74e11b26a06@db2e815847981854"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c8677391027ec0bf973b","from":"GUIDE-FEDRAMP-bd43d0eaaa5c@f9ec0f35d486ca95","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"Moderate Impact","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 71–77","fromKeys":["GUIDE-FEDRAMP-bd43d0eaaa5c@f9ec0f35d486ca95"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-93f9d5c5100c504217c1","from":"GUIDE-FEDRAMP-ce50169f05da@00aec29ece1369b0","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"High Impact","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 78–85","fromKeys":["GUIDE-FEDRAMP-ce50169f05da@00aec29ece1369b0"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-67b926e416813111c015","from":"GUIDE-FEDRAMP-fbbaed9d1fde@85c6285bd6d071d0","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"AI-Specific FedRAMP Requirements (2024-2026)","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 86–127","fromKeys":["GUIDE-FEDRAMP-fbbaed9d1fde@85c6285bd6d071d0"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a6b9b8c2749b5b1d8573","from":"GUIDE-FEDRAMP-6a88a9389a37@3fae9544f28a6763","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"OMB M-24-10 (March 2024) — AI Governance","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 88–96","fromKeys":["GUIDE-FEDRAMP-6a88a9389a37@3fae9544f28a6763"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a6f6068eefd14c05a9b5","from":"GUIDE-FEDRAMP-ce67e8b0224b@532339e68f110f40","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"FedRAMP AI Controls Supplement (2024)","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 97–117","fromKeys":["GUIDE-FEDRAMP-ce67e8b0224b@532339e68f110f40"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ca645a322e4ae8aa2ee5","from":"GUIDE-FEDRAMP-bfbc4e114dd3@f713ac52913cd56a","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"Executive Order 14110 (October 2023) — Safe AI","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 118–127","fromKeys":["GUIDE-FEDRAMP-bfbc4e114dd3@f713ac52913cd56a"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f08382322e5b24adb1fc","from":"GUIDE-FEDRAMP-f2ff23fc6f9f@99ecd0ee7e0dfd7a","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"FedRAMP 20x Program (AI Fast-Track)","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 128–165","fromKeys":["GUIDE-FEDRAMP-f2ff23fc6f9f@99ecd0ee7e0dfd7a"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ead82b6d5283c0715477","from":"GUIDE-FEDRAMP-258910ac2424@a2350d73e009ceed","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"Overview","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 130–134","fromKeys":["GUIDE-FEDRAMP-258910ac2424@a2350d73e009ceed"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b06bb601bc356e37a639","from":"GUIDE-FEDRAMP-8bbe6f991c6c@aaa1e49cb2d68ecf","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"20x Core Principles","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 135–151","fromKeys":["GUIDE-FEDRAMP-8bbe6f991c6c@aaa1e49cb2d68ecf"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4bedaac0b5dee65efae7","from":"GUIDE-FEDRAMP-666405d246b7@5c2f524a4ccebd9a","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"20x Timeline Target","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 152–156","fromKeys":["GUIDE-FEDRAMP-666405d246b7@5c2f524a4ccebd9a"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1995a0b4fa4a3a3d8434","from":"GUIDE-FEDRAMP-5f92b85aa101@c12c653121b33be0","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"GOVERN 20x Support","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 157–165","fromKeys":["GUIDE-FEDRAMP-5f92b85aa101@c12c653121b33be0"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-0d007e54b497f37241ec","from":"GUIDE-FEDRAMP-30ce4c9fff52@9e7d5e9bf16bff19","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"OSCAL Integration Requirements","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 166–214","fromKeys":["GUIDE-FEDRAMP-30ce4c9fff52@9e7d5e9bf16bff19"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a4f25ce5408369b74cbc","from":"GUIDE-FEDRAMP-65c138d5509f@80dee4cb5165a40e","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"What is OSCAL?","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 168–170","fromKeys":["GUIDE-FEDRAMP-65c138d5509f@80dee4cb5165a40e"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-01eaed6c89c2873fa013","from":"GUIDE-FEDRAMP-ca3304e28b24@3c5b0f46700bd588","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"GOVERN OSCAL Output","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 171–214","fromKeys":["GUIDE-FEDRAMP-ca3304e28b24@3c5b0f46700bd588"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8634844fd0753078459b","from":"GUIDE-FEDRAMP-0da62f354193@9a65fb444e7db7f3","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"How GOVERN Achieves FedRAMP Authorization","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 215–245","fromKeys":["GUIDE-FEDRAMP-0da62f354193@9a65fb444e7db7f3"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-042d8f35d14fe427050a","from":"GUIDE-FEDRAMP-0ea4e22d9287@435bae627e795c0e","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"GOVERN Authorization Approach","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 217–240","fromKeys":["GUIDE-FEDRAMP-0ea4e22d9287@435bae627e795c0e"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c1250ffd44f936d2332e","from":"GUIDE-FEDRAMP-8cbae23203cb@f2979c7e9d10cd2e","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"Leverage Inheritance","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 241–245","fromKeys":["GUIDE-FEDRAMP-8cbae23203cb@f2979c7e9d10cd2e"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d2f646775d7865fc1ab4","from":"GUIDE-FEDRAMP-0a1a03af4b1b@b80e9b6053a27fae","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"FedRAMP Assessment Output","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 246–287","fromKeys":["GUIDE-FEDRAMP-0a1a03af4b1b@b80e9b6053a27fae"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a817116fa2354844a914","from":"GUIDE-FEDRAMP-69824d3b0e70@47fbdd9fc7f4ac13","to":"FW-FEDRAMP@7206bc418288eb24","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(6).md","heading":"References","primarySourceVerified":false},"sourceKey":"policy-guide-fedramp@6bc3eb5520724cd4","locator":"POLICY(6).md:lines 288–297","fromKeys":["GUIDE-FEDRAMP-69824d3b0e70@47fbdd9fc7f4ac13"],"toKeys":["FW-FEDRAMP@7206bc418288eb24"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-012d39260198d9f0b510","from":"GUIDE-ISO-42001-7c6db84cd8c4@3bc51136634fc40e","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"What It Is","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 11–31","fromKeys":["GUIDE-ISO-42001-7c6db84cd8c4@3bc51136634fc40e"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-558dca77051484a10b55","from":"GUIDE-ISO-42001-ae397bc490c1@ad752048ff465c99","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Certification Requirements","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 32–67","fromKeys":["GUIDE-ISO-42001-ae397bc490c1@ad752048ff465c99"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-eb7ad7dd5d24658a9eea","from":"GUIDE-ISO-42001-aacb45a1ed8d@08bb02aa48f4bfa1","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Clause-by-Clause Breakdown","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 68–377","fromKeys":["GUIDE-ISO-42001-aacb45a1ed8d@08bb02aa48f4bfa1"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-554252e53dd5c7afdf57","from":"GUIDE-ISO-42001-b566bba7e495@845777a1cabdfb1b","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Clause 1 — Scope","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 70–76","fromKeys":["GUIDE-ISO-42001-b566bba7e495@845777a1cabdfb1b"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-22c3bfe8f7ef159a31e2","from":"GUIDE-ISO-42001-dc7d7769da1f@a22eed717505324b","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Clause 2 — Normative References","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 77–81","fromKeys":["GUIDE-ISO-42001-dc7d7769da1f@a22eed717505324b"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8e0ef5620e388e83dcbd","from":"GUIDE-ISO-42001-886ce3b1e993@20116caad1ed39cc","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Clause 3 — Terms and Definitions","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 82–91","fromKeys":["GUIDE-ISO-42001-886ce3b1e993@20116caad1ed39cc"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-36ee16991e6c08601449","from":"GUIDE-ISO-42001-793ac9ae7a5d@5d272a101bfbff2a","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Clause 4 — Context of the Organization","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 92–125","fromKeys":["GUIDE-ISO-42001-793ac9ae7a5d@5d272a101bfbff2a"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4ea3a096092abe4e8b35","from":"GUIDE-ISO-42001-1ecb53ae5b83@4029dba246be29b6","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Clause 5 — Leadership","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 126–167","fromKeys":["GUIDE-ISO-42001-1ecb53ae5b83@4029dba246be29b6"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-574728204e1b3075c4e2","from":"GUIDE-ISO-42001-2a80864131f4@99f20bd4d6648ffe","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Clause 6 — Planning","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 168–218","fromKeys":["GUIDE-ISO-42001-2a80864131f4@99f20bd4d6648ffe"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e589e66c36438f086bb2","from":"GUIDE-ISO-42001-a582b0e42e13@a7708ac51cba506a","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Clause 7 — Support","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 219–269","fromKeys":["GUIDE-ISO-42001-a582b0e42e13@a7708ac51cba506a"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-2ea4b7f9bed818e593d3","from":"GUIDE-ISO-42001-c5f57ff9b66e@e6527fa9a54ceec3","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Clause 8 — Operation","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 270–317","fromKeys":["GUIDE-ISO-42001-c5f57ff9b66e@e6527fa9a54ceec3"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8f0f6a4252a36aaf39e2","from":"GUIDE-ISO-42001-39b16eac9f6e@9c0fda06dc6624d2","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Clause 9 — Performance Evaluation","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 318–358","fromKeys":["GUIDE-ISO-42001-39b16eac9f6e@9c0fda06dc6624d2"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5cebbd30d56957c369f3","from":"GUIDE-ISO-42001-c2b8d01eb4ee@d18383a7f6eb6808","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Clause 10 — Improvement","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 359–377","fromKeys":["GUIDE-ISO-42001-c2b8d01eb4ee@d18383a7f6eb6808"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-fe839e70539a5a0a7500","from":"GUIDE-ISO-42001-6533523f5df9@9d3caf320644bc76","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Annex A — Reference Control Objectives and Controls","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 378–450","fromKeys":["GUIDE-ISO-42001-6533523f5df9@9d3caf320644bc76"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8b8f97cc40ae25eed8d5","from":"GUIDE-ISO-42001-7fb0b5ed1b72@b217cd182e323200","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Annex B — Implementation Guidance","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 451–477","fromKeys":["GUIDE-ISO-42001-7fb0b5ed1b72@b217cd182e323200"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1fd7fc8f4b6f8bb7234b","from":"GUIDE-ISO-42001-08d209fd5b33@b5275f1b978b7287","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Market Adoption","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 478–497","fromKeys":["GUIDE-ISO-42001-08d209fd5b33@b5275f1b978b7287"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7e7bd3ebf6025f57f8e4","from":"GUIDE-ISO-42001-cd71633f0fc2@6b36906c7bc77ee4","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"GOVERN Component Mapping to ISO 42001","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 498–526","fromKeys":["GUIDE-ISO-42001-cd71633f0fc2@6b36906c7bc77ee4"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-485ffa95a1212a189e92","from":"GUIDE-ISO-42001-d42e3bd38d0a@38db7de90efb22ce","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","heading":"Relationship to Other Standards","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 527–539","fromKeys":["GUIDE-ISO-42001-d42e3bd38d0a@38db7de90efb22ce"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d169438f8ec0a8e2d1b6","from":"MD-CTRL-ISO-42001-6.1.1@60c86a4b6f52bb30","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","control":"6.1.1","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 174–187","fromKeys":["MD-CTRL-ISO-42001-6.1.1@60c86a4b6f52bb30"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e918526714afb79025e7","from":"MD-CTRL-ISO-42001-6.1.2@f5ba6f854ea753db","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","control":"6.1.2","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 188–195","fromKeys":["MD-CTRL-ISO-42001-6.1.2@f5ba6f854ea753db"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-fe7a37934f40cfef657a","from":"MD-CTRL-ISO-42001-6.1.3@4cbac668c4e2aafb","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","control":"6.1.3","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 196–218","fromKeys":["MD-CTRL-ISO-42001-6.1.3@4cbac668c4e2aafb"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1a7ff6ab5d5af5453a6a","from":"MD-CTRL-ISO-42001-7.5.1@69707987c069fc16","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","control":"7.5.1","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 260–261","fromKeys":["MD-CTRL-ISO-42001-7.5.1@69707987c069fc16"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-54ecf45094d2be104f1e","from":"MD-CTRL-ISO-42001-7.5.2@a71f6796e748a2e8","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","control":"7.5.2","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 262–263","fromKeys":["MD-CTRL-ISO-42001-7.5.2@a71f6796e748a2e8"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1682e944fa1db1a47c99","from":"MD-CTRL-ISO-42001-7.5.3@941f62a64cb49911","to":"FW-ISO-42001@28241fae4a19810f","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(7).md","control":"7.5.3","primarySourceVerified":false},"sourceKey":"policy-guide-iso-42001@ef8be3fea8d9b33e","locator":"POLICY(7).md:lines 264–269","fromKeys":["MD-CTRL-ISO-42001-7.5.3@941f62a64cb49911"],"toKeys":["FW-ISO-42001@28241fae4a19810f"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-30bf14a44d619049ca46","from":"GUIDE-NIST-800-53-6f01a27d6a6f@d4b53e1b497c487b","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"What NIST 800-53 Is","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 11–25","fromKeys":["GUIDE-NIST-800-53-6f01a27d6a6f@d4b53e1b497c487b"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-79031fc5c975994e81f6","from":"GUIDE-NIST-800-53-731b91db998a@462c5a0bf1798039","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"The 20 Control Families","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 26–52","fromKeys":["GUIDE-NIST-800-53-731b91db998a@462c5a0bf1798039"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1afa580ea5b3b7d18044","from":"GUIDE-NIST-800-53-b950af7c81af@c88f4ee8bb4dbfe5","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"AI-Relevant Control Families — Detailed Coverage","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 53–481","fromKeys":["GUIDE-NIST-800-53-b950af7c81af@c88f4ee8bb4dbfe5"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a48b57ebf824eee25fc1","from":"GUIDE-NIST-800-53-f2bf89da1da4@d5e73ec6aab7e575","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"AC — Access Control","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 57–87","fromKeys":["GUIDE-NIST-800-53-f2bf89da1da4@d5e73ec6aab7e575"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d8e00bb03440fc14a7fc","from":"GUIDE-NIST-800-53-0743deca6f7b@c2f483fbc22e746b","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"AU — Audit and Accountability","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 88–131","fromKeys":["GUIDE-NIST-800-53-0743deca6f7b@c2f483fbc22e746b"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e2e8d8bdfcb80dffa97f","from":"GUIDE-NIST-800-53-d147bc7034d0@0523c2965273d51a","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"CA — Assessment, Authorization, and Monitoring","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 132–165","fromKeys":["GUIDE-NIST-800-53-d147bc7034d0@0523c2965273d51a"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f0d49cbf88544b5b1b5c","from":"GUIDE-NIST-800-53-1f56a3a417ea@624a7e6bb1239f71","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"CM — Configuration Management","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 166–202","fromKeys":["GUIDE-NIST-800-53-1f56a3a417ea@624a7e6bb1239f71"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-2da8628f0240f2102575","from":"GUIDE-NIST-800-53-1331bdd740d3@a0b6978c0652b99c","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"IA — Identification and Authentication","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 203–236","fromKeys":["GUIDE-NIST-800-53-1331bdd740d3@a0b6978c0652b99c"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7824f0cf379b362a6ff3","from":"GUIDE-NIST-800-53-418994068646@d2ec7e502a31b081","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"IR — Incident Response","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 237–275","fromKeys":["GUIDE-NIST-800-53-418994068646@d2ec7e502a31b081"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c92c59441df005bbfb05","from":"GUIDE-NIST-800-53-8203737bcad6@b194315c5584aade","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"PM — Program Management","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 276–309","fromKeys":["GUIDE-NIST-800-53-8203737bcad6@b194315c5584aade"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ab7a2c5726a7d8267c69","from":"GUIDE-NIST-800-53-736ea77000b8@fea1f874eab0216b","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"RA — Risk Assessment","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 310–344","fromKeys":["GUIDE-NIST-800-53-736ea77000b8@fea1f874eab0216b"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-53f16845c1ae3a54664f","from":"GUIDE-NIST-800-53-f1486694983a@cb6c81d2063349cf","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"SA — System and Services Acquisition","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 345–394","fromKeys":["GUIDE-NIST-800-53-f1486694983a@cb6c81d2063349cf"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-37530f757362fd4eb5b9","from":"GUIDE-NIST-800-53-adb5566704f5@e729eb62a8aea3b5","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"SC — System and Communications Protection","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 395–431","fromKeys":["GUIDE-NIST-800-53-adb5566704f5@e729eb62a8aea3b5"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f911b54eac63915d2b25","from":"GUIDE-NIST-800-53-9adfc07ac816@d28ae77fb99c199b","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"SI — System and Information Integrity","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 432–481","fromKeys":["GUIDE-NIST-800-53-9adfc07ac816@d28ae77fb99c199b"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-06473e174b1ceccbb7f4","from":"GUIDE-NIST-800-53-19c4d11e2a52@9b23c0114c875da5","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"GOVERN Assess — 800-53 Evaluation Methodology","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 482–517","fromKeys":["GUIDE-NIST-800-53-19c4d11e2a52@9b23c0114c875da5"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-25a026a2dc3058efed08","from":"GUIDE-NIST-800-53-29e4be67bb64@e15901b9447103a5","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"Rapid Assess (AI-Focused Subset)","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 486–495","fromKeys":["GUIDE-NIST-800-53-29e4be67bb64@e15901b9447103a5"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b3036b94b8f9719b2909","from":"GUIDE-NIST-800-53-739d010f67db@67d0dc1f8ee0b454","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"Deep Assess (Full 800-53 Coverage)","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 496–505","fromKeys":["GUIDE-NIST-800-53-739d010f67db@67d0dc1f8ee0b454"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-12f64cb67e6520c15bb4","from":"GUIDE-NIST-800-53-31beb12f9cd8@37949cb5e01270cd","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"Continuous Assess (Ongoing Monitoring)","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 506–517","fromKeys":["GUIDE-NIST-800-53-31beb12f9cd8@37949cb5e01270cd"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-496e9e5b38770bd69216","from":"GUIDE-NIST-800-53-ebbde2e3b2f5@797e5a166229d141","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"ATO Package Requirements for AI Systems","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 518–553","fromKeys":["GUIDE-NIST-800-53-ebbde2e3b2f5@797e5a166229d141"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-15d58e669e9b9b9bf15e","from":"GUIDE-NIST-800-53-2eebb65a40bd@499d3b7dcf89a257","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"Standard ATO Components","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 522–529","fromKeys":["GUIDE-NIST-800-53-2eebb65a40bd@499d3b7dcf89a257"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-54e7df3120aa73a7c218","from":"GUIDE-NIST-800-53-a7525c04851c@81f099eda58e210d","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"AI-Specific ATO Components","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 530–542","fromKeys":["GUIDE-NIST-800-53-a7525c04851c@81f099eda58e210d"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-9da5d721e1c4c86b7d57","from":"GUIDE-NIST-800-53-bec100c5792c@8cdde3f477e5d273","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"ATO Risk Acceptance Levels","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 543–553","fromKeys":["GUIDE-NIST-800-53-bec100c5792c@8cdde3f477e5d273"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-51cb824960cd3073c039","from":"GUIDE-NIST-800-53-e0409438abb1@a75885e36e0d7710","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"FedRAMP Mapping","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 554–584","fromKeys":["GUIDE-NIST-800-53-e0409438abb1@a75885e36e0d7710"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-97dfb1ff13a366943d32","from":"GUIDE-NIST-800-53-f0a601342e91@dcec9a029ab33a57","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"FedRAMP Baseline Control Sets","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 558–565","fromKeys":["GUIDE-NIST-800-53-f0a601342e91@dcec9a029ab33a57"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-725d20723f5ed0eca2b2","from":"GUIDE-NIST-800-53-c73acc1a14c9@6978decbe1821433","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"AI-Specific FedRAMP Documentation Requirements","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 566–578","fromKeys":["GUIDE-NIST-800-53-c73acc1a14c9@6978decbe1821433"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e015d1309b9e046f8522","from":"GUIDE-NIST-800-53-73615bad7de2@156331b87924f9c8","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"FedRAMP AI Annex (Emerging)","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 579–584","fromKeys":["GUIDE-NIST-800-53-73615bad7de2@156331b87924f9c8"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-6d928dd3387f140b8dad","from":"GUIDE-NIST-800-53-e65249c4d2c1@7f6ba98d9cae3f50","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","heading":"Cross-Framework Control Mapping","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 585–602","fromKeys":["GUIDE-NIST-800-53-e65249c4d2c1@7f6ba98d9cae3f50"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d274a21824e4af2b5eed","from":"MD-CTRL-NIST-800-53-AC-1@ffc5aee74d3fc65e","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AC-1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 63–65","fromKeys":["MD-CTRL-NIST-800-53-AC-1@ffc5aee74d3fc65e"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c7a148eb5961241c4512","from":"MD-CTRL-NIST-800-53-AC-2@3f85328fe1521853","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AC-2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 66–68","fromKeys":["MD-CTRL-NIST-800-53-AC-2@3f85328fe1521853"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a40b9128f2fa4c6a1861","from":"MD-CTRL-NIST-800-53-AC-3@87ed3ce01e96d062","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AC-3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 69–71","fromKeys":["MD-CTRL-NIST-800-53-AC-3@87ed3ce01e96d062"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e5560e4d39149ef54347","from":"MD-CTRL-NIST-800-53-AC-4@641056b3e2b83cb1","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AC-4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 72–74","fromKeys":["MD-CTRL-NIST-800-53-AC-4@641056b3e2b83cb1"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a6de9d758b3a7571c786","from":"MD-CTRL-NIST-800-53-AC-6@6cce771a8ebe982b","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AC-6","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 75–77","fromKeys":["MD-CTRL-NIST-800-53-AC-6@6cce771a8ebe982b"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-efdd315647f47e47deb5","from":"MD-CTRL-NIST-800-53-AC-17@933a2051223687b5","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AC-17","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 78–80","fromKeys":["MD-CTRL-NIST-800-53-AC-17@933a2051223687b5"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-28c14baccea9f45fb70e","from":"MD-CTRL-NIST-800-53-AC-22@0d85b298668b280c","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AC-22","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 81–87","fromKeys":["MD-CTRL-NIST-800-53-AC-22@0d85b298668b280c"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-3bac3c493f1d12958425","from":"MD-CTRL-NIST-800-53-AU-1@d05ac18178adc30d","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AU-1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 94–96","fromKeys":["MD-CTRL-NIST-800-53-AU-1@d05ac18178adc30d"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-847d0655aef71e772aea","from":"MD-CTRL-NIST-800-53-AU-2@ab193a7febc8a215","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AU-2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 97–106","fromKeys":["MD-CTRL-NIST-800-53-AU-2@ab193a7febc8a215"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7d3a8ac3a36329e77546","from":"MD-CTRL-NIST-800-53-AU-3@a5a2547b7300a36e","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AU-3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 107–109","fromKeys":["MD-CTRL-NIST-800-53-AU-3@a5a2547b7300a36e"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-503905c9a019c4cd8b22","from":"MD-CTRL-NIST-800-53-AU-6@83cd30f14c8fa126","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AU-6","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 110–112","fromKeys":["MD-CTRL-NIST-800-53-AU-6@83cd30f14c8fa126"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7683824981368a9ad28b","from":"MD-CTRL-NIST-800-53-AU-9@fcde7a027e522d94","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AU-9","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 113–115","fromKeys":["MD-CTRL-NIST-800-53-AU-9@fcde7a027e522d94"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-6b90789ad6b64bcda053","from":"MD-CTRL-NIST-800-53-AU-10@08f387c8911d4d05","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AU-10","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 116–118","fromKeys":["MD-CTRL-NIST-800-53-AU-10@08f387c8911d4d05"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-75ad71950d9ea8cb131c","from":"MD-CTRL-NIST-800-53-AU-11@a26d421379fb44f1","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AU-11","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 119–121","fromKeys":["MD-CTRL-NIST-800-53-AU-11@a26d421379fb44f1"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-6877cdcd7756c4c6225f","from":"MD-CTRL-NIST-800-53-AU-12@037fdf52ec2a4527","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AU-12","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 122–124","fromKeys":["MD-CTRL-NIST-800-53-AU-12@037fdf52ec2a4527"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-79f5b3ff5de4105c37ba","from":"MD-CTRL-NIST-800-53-AU-14@5bd76e6a91f17539","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"AU-14","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 125–131","fromKeys":["MD-CTRL-NIST-800-53-AU-14@5bd76e6a91f17539"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-49f3376420ac368a0175","from":"MD-CTRL-NIST-800-53-CA-1@1f09cd22b9f67243","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CA-1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 138–140","fromKeys":["MD-CTRL-NIST-800-53-CA-1@1f09cd22b9f67243"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-16b824cff763fb81037d","from":"MD-CTRL-NIST-800-53-CA-2@29a21d24d3f9cded","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CA-2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 141–143","fromKeys":["MD-CTRL-NIST-800-53-CA-2@29a21d24d3f9cded"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-3bbfc7e456926e24d87e","from":"MD-CTRL-NIST-800-53-CA-3@e0d9f1d2eb445d9c","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CA-3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 144–146","fromKeys":["MD-CTRL-NIST-800-53-CA-3@e0d9f1d2eb445d9c"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-df2541621df43a00386b","from":"MD-CTRL-NIST-800-53-CA-5@bd5759ed9df51fc9","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CA-5","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 147–149","fromKeys":["MD-CTRL-NIST-800-53-CA-5@bd5759ed9df51fc9"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-cbd176475a34bdb6d7cb","from":"MD-CTRL-NIST-800-53-CA-6@69232618983df2fe","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CA-6","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 150–152","fromKeys":["MD-CTRL-NIST-800-53-CA-6@69232618983df2fe"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e2697c0e1df433ae5c57","from":"MD-CTRL-NIST-800-53-CA-7@392ed8f13a4bfca4","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CA-7","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 153–155","fromKeys":["MD-CTRL-NIST-800-53-CA-7@392ed8f13a4bfca4"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-bdcaf9c54bc78ea46677","from":"MD-CTRL-NIST-800-53-CA-8@451236ee100f65b6","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CA-8","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 156–158","fromKeys":["MD-CTRL-NIST-800-53-CA-8@451236ee100f65b6"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-025bccd2d54a55a2f0f2","from":"MD-CTRL-NIST-800-53-CA-9@c9f9401ec0608756","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CA-9","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 159–165","fromKeys":["MD-CTRL-NIST-800-53-CA-9@c9f9401ec0608756"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-91166035a4aabb2e5f92","from":"MD-CTRL-NIST-800-53-CM-1@bc57786ef48c3c55","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CM-1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 172–174","fromKeys":["MD-CTRL-NIST-800-53-CM-1@bc57786ef48c3c55"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d024d02ac607a664bad0","from":"MD-CTRL-NIST-800-53-CM-2@6ca208a8af9d92e7","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CM-2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 175–177","fromKeys":["MD-CTRL-NIST-800-53-CM-2@6ca208a8af9d92e7"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5210a8d6a96f36160ef6","from":"MD-CTRL-NIST-800-53-CM-3@e91dda2288deb770","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CM-3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 178–180","fromKeys":["MD-CTRL-NIST-800-53-CM-3@e91dda2288deb770"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-44e35290f012bfd0d6db","from":"MD-CTRL-NIST-800-53-CM-4@d0963b8777d1594a","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CM-4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 181–183","fromKeys":["MD-CTRL-NIST-800-53-CM-4@d0963b8777d1594a"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-36fdd48b5f6c995433f1","from":"MD-CTRL-NIST-800-53-CM-6@63db226c32ee8b80","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CM-6","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 184–186","fromKeys":["MD-CTRL-NIST-800-53-CM-6@63db226c32ee8b80"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-94766a8e98b9a4ebcf71","from":"MD-CTRL-NIST-800-53-CM-7@a69c75d907ebf563","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CM-7","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 187–189","fromKeys":["MD-CTRL-NIST-800-53-CM-7@a69c75d907ebf563"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-febb892fb990c0da23d7","from":"MD-CTRL-NIST-800-53-CM-8@1d08274a0812ff53","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CM-8","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 190–192","fromKeys":["MD-CTRL-NIST-800-53-CM-8@1d08274a0812ff53"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-65010bf3e578ce2ca2cd","from":"MD-CTRL-NIST-800-53-CM-10@657eeba351ec85bb","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CM-10","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 193–195","fromKeys":["MD-CTRL-NIST-800-53-CM-10@657eeba351ec85bb"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-6822646352e4c1ffdc71","from":"MD-CTRL-NIST-800-53-CM-11@e8634afde5343f2c","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"CM-11","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 196–202","fromKeys":["MD-CTRL-NIST-800-53-CM-11@e8634afde5343f2c"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f7bf5436368e9c19fe42","from":"MD-CTRL-NIST-800-53-IA-1@44eec4dafeb6ab22","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IA-1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 209–211","fromKeys":["MD-CTRL-NIST-800-53-IA-1@44eec4dafeb6ab22"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-20e5921a387b8e811bb9","from":"MD-CTRL-NIST-800-53-IA-2@4dbd18c7d07a8c02","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IA-2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 212–214","fromKeys":["MD-CTRL-NIST-800-53-IA-2@4dbd18c7d07a8c02"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ad289529941a282b5ee6","from":"MD-CTRL-NIST-800-53-IA-3@e59257ab71b137d1","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IA-3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 215–217","fromKeys":["MD-CTRL-NIST-800-53-IA-3@e59257ab71b137d1"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-772bfbbb0a0205b9b8c0","from":"MD-CTRL-NIST-800-53-IA-4@5ccb98ae4773b0ae","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IA-4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 218–220","fromKeys":["MD-CTRL-NIST-800-53-IA-4@5ccb98ae4773b0ae"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-eca0fca77b1f69289b99","from":"MD-CTRL-NIST-800-53-IA-5@6912705fe10577c0","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IA-5","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 221–223","fromKeys":["MD-CTRL-NIST-800-53-IA-5@6912705fe10577c0"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-900e4eb5ad413afcca22","from":"MD-CTRL-NIST-800-53-IA-8@1e9c45672f8be5e2","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IA-8","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 224–226","fromKeys":["MD-CTRL-NIST-800-53-IA-8@1e9c45672f8be5e2"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c5c452e2942be9400cfc","from":"MD-CTRL-NIST-800-53-IA-9@3b4a7410abb86aa0","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IA-9","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 227–229","fromKeys":["MD-CTRL-NIST-800-53-IA-9@3b4a7410abb86aa0"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7b72dcfcce506feba652","from":"MD-CTRL-NIST-800-53-IA-10@844b4ea2fbfe06a2","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IA-10","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 230–236","fromKeys":["MD-CTRL-NIST-800-53-IA-10@844b4ea2fbfe06a2"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-9f0da69e30cebe273c3e","from":"MD-CTRL-NIST-800-53-IR-1@dae3790d9c539d4f","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IR-1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 243–245","fromKeys":["MD-CTRL-NIST-800-53-IR-1@dae3790d9c539d4f"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4f9a41f5c83038271ba2","from":"MD-CTRL-NIST-800-53-IR-2@18e62078d0aaf86e","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IR-2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 246–248","fromKeys":["MD-CTRL-NIST-800-53-IR-2@18e62078d0aaf86e"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b820497b0e7c33f4fe3d","from":"MD-CTRL-NIST-800-53-IR-3@c3539103480ee029","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IR-3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 249–251","fromKeys":["MD-CTRL-NIST-800-53-IR-3@c3539103480ee029"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-52eee4c8e2ede56d43b5","from":"MD-CTRL-NIST-800-53-IR-4@74f271e15a55d06f","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IR-4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 252–259","fromKeys":["MD-CTRL-NIST-800-53-IR-4@74f271e15a55d06f"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a80591cd4884ed3b8026","from":"MD-CTRL-NIST-800-53-IR-5@e55da11cb54be2d6","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IR-5","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 260–262","fromKeys":["MD-CTRL-NIST-800-53-IR-5@e55da11cb54be2d6"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b54757d41409e661b3b8","from":"MD-CTRL-NIST-800-53-IR-6@9e4dcdda8ecccb40","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IR-6","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 263–265","fromKeys":["MD-CTRL-NIST-800-53-IR-6@9e4dcdda8ecccb40"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b40f2a300eb20eea04f5","from":"MD-CTRL-NIST-800-53-IR-7@fa507783126d7133","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IR-7","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 266–268","fromKeys":["MD-CTRL-NIST-800-53-IR-7@fa507783126d7133"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f8cdf3554de6f749b96a","from":"MD-CTRL-NIST-800-53-IR-8@51f32f068339c089","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"IR-8","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 269–275","fromKeys":["MD-CTRL-NIST-800-53-IR-8@51f32f068339c089"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-405381f17b3418d17793","from":"MD-CTRL-NIST-800-53-PM-1@69750f5f0416c2fa","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"PM-1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 282–284","fromKeys":["MD-CTRL-NIST-800-53-PM-1@69750f5f0416c2fa"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-17a8ec34670648f81027","from":"MD-CTRL-NIST-800-53-PM-2@795047a8cbe9fbb5","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"PM-2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 285–287","fromKeys":["MD-CTRL-NIST-800-53-PM-2@795047a8cbe9fbb5"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d1b5999f986bb8d08620","from":"MD-CTRL-NIST-800-53-PM-9@7503567857e7df87","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"PM-9","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 288–290","fromKeys":["MD-CTRL-NIST-800-53-PM-9@7503567857e7df87"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b9db305dd97bf760b8cc","from":"MD-CTRL-NIST-800-53-PM-10@021385ebe95aa945","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"PM-10","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 291–293","fromKeys":["MD-CTRL-NIST-800-53-PM-10@021385ebe95aa945"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d797aec71ed98a7de7ee","from":"MD-CTRL-NIST-800-53-PM-11@6404267950f4384c","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"PM-11","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 294–296","fromKeys":["MD-CTRL-NIST-800-53-PM-11@6404267950f4384c"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7275c6c3c76ad5557a5b","from":"MD-CTRL-NIST-800-53-PM-28@1535dca973c04265","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"PM-28","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 297–299","fromKeys":["MD-CTRL-NIST-800-53-PM-28@1535dca973c04265"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-91d62de56fd9616c0284","from":"MD-CTRL-NIST-800-53-PM-30@bd194fc8faba5a62","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"PM-30","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 300–302","fromKeys":["MD-CTRL-NIST-800-53-PM-30@bd194fc8faba5a62"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-3a3343dcf44dfb70a4cf","from":"MD-CTRL-NIST-800-53-PM-31@8ec47a6977771a5d","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"PM-31","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 303–309","fromKeys":["MD-CTRL-NIST-800-53-PM-31@8ec47a6977771a5d"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-263f633fb3c6827d28ce","from":"MD-CTRL-NIST-800-53-RA-1@d702535aea729240","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"RA-1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 316–318","fromKeys":["MD-CTRL-NIST-800-53-RA-1@d702535aea729240"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-920d8ae8cb539e667cf4","from":"MD-CTRL-NIST-800-53-RA-2@142900acfb09c925","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"RA-2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 319–321","fromKeys":["MD-CTRL-NIST-800-53-RA-2@142900acfb09c925"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-604d79d739e822694184","from":"MD-CTRL-NIST-800-53-RA-3@d00b852124c3dec7","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"RA-3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 322–328","fromKeys":["MD-CTRL-NIST-800-53-RA-3@d00b852124c3dec7"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f8c0f135963d3ff400ea","from":"MD-CTRL-NIST-800-53-RA-5@57426b8d738375a3","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"RA-5","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 329–331","fromKeys":["MD-CTRL-NIST-800-53-RA-5@57426b8d738375a3"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-9d9b9e82b84964bf4e83","from":"MD-CTRL-NIST-800-53-RA-7@ee7ce7823a829c1c","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"RA-7","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 332–334","fromKeys":["MD-CTRL-NIST-800-53-RA-7@ee7ce7823a829c1c"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c70bac74a27afb50542c","from":"MD-CTRL-NIST-800-53-RA-9@70a28b2a6c497cc9","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"RA-9","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 335–337","fromKeys":["MD-CTRL-NIST-800-53-RA-9@70a28b2a6c497cc9"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-023cec00d0a79b8fbb58","from":"MD-CTRL-NIST-800-53-RA-10@eba55ec082405cec","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"RA-10","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 338–344","fromKeys":["MD-CTRL-NIST-800-53-RA-10@eba55ec082405cec"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1ab6bfde361ec70ad653","from":"MD-CTRL-NIST-800-53-SA-1@309b07e6cc036608","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SA-1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 351–353","fromKeys":["MD-CTRL-NIST-800-53-SA-1@309b07e6cc036608"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-526134391e3141b9932f","from":"MD-CTRL-NIST-800-53-SA-3@b815d0da54550870","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SA-3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 354–356","fromKeys":["MD-CTRL-NIST-800-53-SA-3@b815d0da54550870"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f817c2c96aa1d477aca5","from":"MD-CTRL-NIST-800-53-SA-4@2089f0161299c68f","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SA-4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 357–366","fromKeys":["MD-CTRL-NIST-800-53-SA-4@2089f0161299c68f"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-29158857cfbe9e70ce29","from":"MD-CTRL-NIST-800-53-SA-5@e77f15a31d58575e","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SA-5","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 367–369","fromKeys":["MD-CTRL-NIST-800-53-SA-5@e77f15a31d58575e"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-22ed23590da8dfb54546","from":"MD-CTRL-NIST-800-53-SA-8@2b86c88f0eecd714","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SA-8","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 370–372","fromKeys":["MD-CTRL-NIST-800-53-SA-8@2b86c88f0eecd714"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4b177c24868268d2d709","from":"MD-CTRL-NIST-800-53-SA-9@3c5e2b7020feae29","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SA-9","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 373–375","fromKeys":["MD-CTRL-NIST-800-53-SA-9@3c5e2b7020feae29"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f7afd7c678fdb35fd1f3","from":"MD-CTRL-NIST-800-53-SA-10@a4d719708b6892dc","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SA-10","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 376–378","fromKeys":["MD-CTRL-NIST-800-53-SA-10@a4d719708b6892dc"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-9fde8b93670befcb6396","from":"MD-CTRL-NIST-800-53-SA-11@12de82f7c2a7535a","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SA-11","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 379–381","fromKeys":["MD-CTRL-NIST-800-53-SA-11@12de82f7c2a7535a"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ecba9feb08d0a8153447","from":"MD-CTRL-NIST-800-53-SA-15@cefad96f4aebe687","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SA-15","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 382–384","fromKeys":["MD-CTRL-NIST-800-53-SA-15@cefad96f4aebe687"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-fbd88fbfee9fe3bbe50b","from":"MD-CTRL-NIST-800-53-SA-16@db44a794b2764652","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SA-16","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 385–387","fromKeys":["MD-CTRL-NIST-800-53-SA-16@db44a794b2764652"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5e75f932a175d066aa64","from":"MD-CTRL-NIST-800-53-SA-17@2d9b2c327e2565c2","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SA-17","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 388–394","fromKeys":["MD-CTRL-NIST-800-53-SA-17@2d9b2c327e2565c2"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b5e78f471e99285ead15","from":"MD-CTRL-NIST-800-53-SC-1@b4d57711604fb27e","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SC-1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 401–403","fromKeys":["MD-CTRL-NIST-800-53-SC-1@b4d57711604fb27e"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c1de726a5222d9f51306","from":"MD-CTRL-NIST-800-53-SC-5@ce265468b83475c0","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SC-5","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 404–406","fromKeys":["MD-CTRL-NIST-800-53-SC-5@ce265468b83475c0"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5221d84bf7f58905e810","from":"MD-CTRL-NIST-800-53-SC-7@d10fc1ec31afd8d6","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SC-7","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 407–409","fromKeys":["MD-CTRL-NIST-800-53-SC-7@d10fc1ec31afd8d6"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-00352aadb41567d4db93","from":"MD-CTRL-NIST-800-53-SC-8@7b948b208b7abf07","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SC-8","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 410–412","fromKeys":["MD-CTRL-NIST-800-53-SC-8@7b948b208b7abf07"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-53d3b224332f7553c745","from":"MD-CTRL-NIST-800-53-SC-12@8dfd4e26096126e7","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SC-12","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 413–415","fromKeys":["MD-CTRL-NIST-800-53-SC-12@8dfd4e26096126e7"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-50cd390b4ee3fd3113e3","from":"MD-CTRL-NIST-800-53-SC-13@c27d59cc80254553","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SC-13","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 416–418","fromKeys":["MD-CTRL-NIST-800-53-SC-13@c27d59cc80254553"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-6b180e00d0745606953d","from":"MD-CTRL-NIST-800-53-SC-28@26a647ade2207565","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SC-28","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 419–421","fromKeys":["MD-CTRL-NIST-800-53-SC-28@26a647ade2207565"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5ff8956d78058136b18b","from":"MD-CTRL-NIST-800-53-SC-39@7c12ddd5379d47ac","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SC-39","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 422–424","fromKeys":["MD-CTRL-NIST-800-53-SC-39@7c12ddd5379d47ac"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5a8a1ccbf9d417b2b5d8","from":"MD-CTRL-NIST-800-53-SC-45@fe95bc3ea1490562","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SC-45","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 425–431","fromKeys":["MD-CTRL-NIST-800-53-SC-45@fe95bc3ea1490562"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d837768f3c7b0c770066","from":"MD-CTRL-NIST-800-53-SI-1@4ac016ff436432f1","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SI-1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 438–440","fromKeys":["MD-CTRL-NIST-800-53-SI-1@4ac016ff436432f1"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4f284c0a806820cb6666","from":"MD-CTRL-NIST-800-53-SI-2@8334352df167f779","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SI-2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 441–443","fromKeys":["MD-CTRL-NIST-800-53-SI-2@8334352df167f779"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d03d5d0240cdfc9f959d","from":"MD-CTRL-NIST-800-53-SI-3@36a9351db2e579f5","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SI-3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 444–446","fromKeys":["MD-CTRL-NIST-800-53-SI-3@36a9351db2e579f5"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ffec908f4c0f3a764f2f","from":"MD-CTRL-NIST-800-53-SI-4@ef1e6b7493043f32","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SI-4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 447–449","fromKeys":["MD-CTRL-NIST-800-53-SI-4@ef1e6b7493043f32"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4e7d9717ecaad51fb26a","from":"MD-CTRL-NIST-800-53-SI-5@c971f424e49dc627","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SI-5","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 450–452","fromKeys":["MD-CTRL-NIST-800-53-SI-5@c971f424e49dc627"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-88fc0f44d4e3ceaf3099","from":"MD-CTRL-NIST-800-53-SI-7@0e6f9a93a3f85800","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SI-7","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 453–459","fromKeys":["MD-CTRL-NIST-800-53-SI-7@0e6f9a93a3f85800"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-244f2ce5ad78768c11da","from":"MD-CTRL-NIST-800-53-SI-8@bc876d5de3499002","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SI-8","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 460–462","fromKeys":["MD-CTRL-NIST-800-53-SI-8@bc876d5de3499002"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f24afb407aa3123fb94e","from":"MD-CTRL-NIST-800-53-SI-10@bc113287605ea9a9","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SI-10","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 463–465","fromKeys":["MD-CTRL-NIST-800-53-SI-10@bc113287605ea9a9"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7ee9a791eff20568ba7f","from":"MD-CTRL-NIST-800-53-SI-12@795eeae5d78bd687","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SI-12","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 466–468","fromKeys":["MD-CTRL-NIST-800-53-SI-12@795eeae5d78bd687"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-edc84f7f21942a32962b","from":"MD-CTRL-NIST-800-53-SI-14@3c584cf219106ab8","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SI-14","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 469–471","fromKeys":["MD-CTRL-NIST-800-53-SI-14@3c584cf219106ab8"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-35cefaf94fb8c6872852","from":"MD-CTRL-NIST-800-53-SI-19@95632491c2dd0957","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SI-19","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 472–474","fromKeys":["MD-CTRL-NIST-800-53-SI-19@95632491c2dd0957"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-83c044184bb95dc4126c","from":"MD-CTRL-NIST-800-53-SI-20@c8ecbf25dfb02463","to":"FW-NIST-800-53@535a8767b33f3a33","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(8).md","control":"SI-20","primarySourceVerified":false},"sourceKey":"policy-guide-nist-800-53@4818dbe94063b8d9","locator":"POLICY(8).md:lines 475–481","fromKeys":["MD-CTRL-NIST-800-53-SI-20@c8ecbf25dfb02463"],"toKeys":["FW-NIST-800-53@535a8767b33f3a33"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-efebfba361fa5fb464b7","from":"GUIDE-NIST-AI-RMF-7c6db84cd8c4@0e9f2bee89aa5338","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"What It Is","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 11–24","fromKeys":["GUIDE-NIST-AI-RMF-7c6db84cd8c4@0e9f2bee89aa5338"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-617a79c941c9f6cff3ef","from":"GUIDE-NIST-AI-RMF-dc191148229a@5bd1e394c3c18f3f","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"Who Must Comply","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 25–36","fromKeys":["GUIDE-NIST-AI-RMF-dc191148229a@5bd1e394c3c18f3f"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1ecbb9b49d68291d7151","from":"GUIDE-NIST-AI-RMF-de65ea7212a1@259f65bf14c86181","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"The 4 Core Functions","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 37–64","fromKeys":["GUIDE-NIST-AI-RMF-de65ea7212a1@259f65bf14c86181"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4ff8d0a56e67bbf7b9f3","from":"GUIDE-NIST-AI-RMF-d1571dca21dd@3210336c4fe6b49d","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"GOVERN","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 39–44","fromKeys":["GUIDE-NIST-AI-RMF-d1571dca21dd@3210336c4fe6b49d"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d6b4dad8d45352257331","from":"GUIDE-NIST-AI-RMF-a29c7c79013c@263671feea0b9021","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"MAP","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 45–50","fromKeys":["GUIDE-NIST-AI-RMF-a29c7c79013c@263671feea0b9021"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-9511f9b7464eeebd5ed7","from":"GUIDE-NIST-AI-RMF-4f8971da28d6@1fdab7ff5532c7e9","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"MEASURE","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 51–56","fromKeys":["GUIDE-NIST-AI-RMF-4f8971da28d6@1fdab7ff5532c7e9"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-24a08c61153e5fa054e0","from":"GUIDE-NIST-AI-RMF-67bf02f03c63@b71e7ae6744b87dd","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"MANAGE","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 57–64","fromKeys":["GUIDE-NIST-AI-RMF-67bf02f03c63@b71e7ae6744b87dd"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-3b85d4d2245059695e53","from":"GUIDE-NIST-AI-RMF-4e4b91eb92c2@a36520d442951010","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"The 19 Categories and 72 Subcategories","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 65–321","fromKeys":["GUIDE-NIST-AI-RMF-4e4b91eb92c2@a36520d442951010"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-84e847d4b3ad6f4a69ef","from":"GUIDE-NIST-AI-RMF-062eb065e58e@6c463216a74b7cf1","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"GOVERN Categories and Subcategories","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 67–136","fromKeys":["GUIDE-NIST-AI-RMF-062eb065e58e@6c463216a74b7cf1"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-fcba08d090294c27e196","from":"GUIDE-NIST-AI-RMF-927be92340ef@f5ecae1e6f760bc7","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"MAP Categories and Subcategories","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 137–207","fromKeys":["GUIDE-NIST-AI-RMF-927be92340ef@f5ecae1e6f760bc7"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-250b32292eead5220784","from":"GUIDE-NIST-AI-RMF-e4cae8eec3a7@c129fa4bb56f9cbc","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"MEASURE Categories and Subcategories","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 208–264","fromKeys":["GUIDE-NIST-AI-RMF-e4cae8eec3a7@c129fa4bb56f9cbc"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-eb8896a6e318603f6c30","from":"GUIDE-NIST-AI-RMF-a919355c4e09@0591523d8c0a9635","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"MANAGE Categories and Subcategories","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 265–321","fromKeys":["GUIDE-NIST-AI-RMF-a919355c4e09@0591523d8c0a9635"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-51059d15625bd433f7bc","from":"GUIDE-NIST-AI-RMF-e318cd54a2b7@72f29d480d06f9c3","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"Key Profiles","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 322–364","fromKeys":["GUIDE-NIST-AI-RMF-e318cd54a2b7@72f29d480d06f9c3"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-fa671c697100ba627841","from":"GUIDE-NIST-AI-RMF-dac8513ddd37@6b1f6e12d859d904","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"GenAI Profile (NIST AI 600-1, July 2024)","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 324–358","fromKeys":["GUIDE-NIST-AI-RMF-dac8513ddd37@6b1f6e12d859d904"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-162864852420cc840684","from":"GUIDE-NIST-AI-RMF-85df6670bfba@311d05c17dd6514b","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"Critical Infrastructure Profile","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 359–364","fromKeys":["GUIDE-NIST-AI-RMF-85df6670bfba@311d05c17dd6514b"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d174a33ee4e570f89e5d","from":"GUIDE-NIST-AI-RMF-a17b86a657d5@2a0a15cf90e53939","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"How GOVERN Implements Each Function","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 365–411","fromKeys":["GUIDE-NIST-AI-RMF-a17b86a657d5@2a0a15cf90e53939"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d9d2f731c82ba545f187","from":"GUIDE-NIST-AI-RMF-04c74e63063d@61c4203de98a0df6","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"GOVERN Function Implementation","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 367–377","fromKeys":["GUIDE-NIST-AI-RMF-04c74e63063d@61c4203de98a0df6"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-07cac4c8e81f681c7abe","from":"GUIDE-NIST-AI-RMF-e64fca448669@04bc7d28f3ce21ff","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"MAP Function Implementation","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 378–388","fromKeys":["GUIDE-NIST-AI-RMF-e64fca448669@04bc7d28f3ce21ff"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5569289a845aba7ff6da","from":"GUIDE-NIST-AI-RMF-54c30d9f2758@672e9717a620ec50","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"MEASURE Function Implementation","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 389–399","fromKeys":["GUIDE-NIST-AI-RMF-54c30d9f2758@672e9717a620ec50"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-07dcefb3599cf2d0410b","from":"GUIDE-NIST-AI-RMF-acae6214195c@e9cd01e808172860","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"MANAGE Function Implementation","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 400–411","fromKeys":["GUIDE-NIST-AI-RMF-acae6214195c@e9cd01e808172860"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d762c62cb72b6813a06e","from":"GUIDE-NIST-AI-RMF-f4955f27718e@0f8e4b82e29ad23a","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"Relationship to Other Frameworks","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 412–454","fromKeys":["GUIDE-NIST-AI-RMF-f4955f27718e@0f8e4b82e29ad23a"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4a6e575196f0573ff3d4","from":"GUIDE-NIST-AI-RMF-27ef85883347@cadbe8d331e0b436","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"ISO/IEC 42001:2023","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 414–423","fromKeys":["GUIDE-NIST-AI-RMF-27ef85883347@cadbe8d331e0b436"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e89df08783a4aa698248","from":"GUIDE-NIST-AI-RMF-40cd5d352cd9@9640d7036af8ac0b","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"EU AI Act (2024)","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 424–433","fromKeys":["GUIDE-NIST-AI-RMF-40cd5d352cd9@9640d7036af8ac0b"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-6e6ddd80f42ecd0bca95","from":"GUIDE-NIST-AI-RMF-167ce49106e6@28a3786f2493069f","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"Executive Order 14110 (October 2023)","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 434–443","fromKeys":["GUIDE-NIST-AI-RMF-167ce49106e6@28a3786f2493069f"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8c67069ff33cd22a9da5","from":"GUIDE-NIST-AI-RMF-bd8b35579fc3@83814a74b2ae9d80","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"NIST Cybersecurity Framework (CSF)","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 444–447","fromKeys":["GUIDE-NIST-AI-RMF-bd8b35579fc3@83814a74b2ae9d80"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c4e80a5eea61b7a37455","from":"GUIDE-NIST-AI-RMF-369744f54a55@6203fd0a0fc4911b","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","heading":"NIST 800-53 Rev 5","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 448–454","fromKeys":["GUIDE-NIST-AI-RMF-369744f54a55@6203fd0a0fc4911b"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-69e0eabcb3e4dd4c5c2f","from":"MD-CTRL-NIST-AI-RMF-GV-1@0de2bf71e02dd5cd","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 69–70","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-1@0de2bf71e02dd5cd"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ceaf39fb977bc436c5ec","from":"MD-CTRL-NIST-AI-RMF-GV-1.1@bdbcfd71ba42be06","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-1.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 71–73","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-1.1@bdbcfd71ba42be06"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-fd70fc9a64b09b6a2c07","from":"MD-CTRL-NIST-AI-RMF-GV-1.2@ab473567d15e4af5","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-1.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 74–76","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-1.2@ab473567d15e4af5"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-07402739f864d3e08e0f","from":"MD-CTRL-NIST-AI-RMF-GV-1.3@d22d1e83339c8c63","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-1.3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 77–79","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-1.3@d22d1e83339c8c63"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-50edce4f54f2a55e66f7","from":"MD-CTRL-NIST-AI-RMF-GV-1.4@2020dd450f236171","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-1.4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 80–82","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-1.4@2020dd450f236171"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-25be5f60ebbbd7b3c6cd","from":"MD-CTRL-NIST-AI-RMF-GV-1.5@aaaf26ad3a8a4fd4","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-1.5","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 83–85","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-1.5@aaaf26ad3a8a4fd4"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-698d6806c2ba4ed905c3","from":"MD-CTRL-NIST-AI-RMF-GV-1.6@be0e2e03a9219756","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-1.6","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 86–88","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-1.6@be0e2e03a9219756"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a5b42e87b7558ae28489","from":"MD-CTRL-NIST-AI-RMF-GV-2@69f0fa0562a7bb7b","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 89–90","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-2@69f0fa0562a7bb7b"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-db5e28f4aefc55e515fb","from":"MD-CTRL-NIST-AI-RMF-GV-2.1@6f97ef6893eb6791","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-2.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 91–93","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-2.1@6f97ef6893eb6791"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-863304bc9ddb10368d8f","from":"MD-CTRL-NIST-AI-RMF-GV-2.2@14c9e3dd1e7ae2d2","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-2.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 94–96","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-2.2@14c9e3dd1e7ae2d2"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c3e1fe2bcfc1c74cf53e","from":"MD-CTRL-NIST-AI-RMF-GV-2.3@61c182f47632821e","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-2.3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 97–99","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-2.3@61c182f47632821e"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4535fd9d48e2e239985d","from":"MD-CTRL-NIST-AI-RMF-GV-3@1558fb47f7cf9932","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 100–101","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-3@1558fb47f7cf9932"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-37be9db3a774684d2059","from":"MD-CTRL-NIST-AI-RMF-GV-3.1@91b2ef14962b8d77","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-3.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 102–104","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-3.1@91b2ef14962b8d77"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ef329dd8fee358d3d66e","from":"MD-CTRL-NIST-AI-RMF-GV-3.2@3a67f386bc577301","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-3.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 105–107","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-3.2@3a67f386bc577301"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-75cb22632d5ecd691293","from":"MD-CTRL-NIST-AI-RMF-GV-3.3@38c99ab4d4ea7203","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-3.3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 108–110","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-3.3@38c99ab4d4ea7203"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7ef069e71806484a28b5","from":"MD-CTRL-NIST-AI-RMF-GV-4@3556d8bf940083af","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 111–112","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-4@3556d8bf940083af"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f428d0d109229017f859","from":"MD-CTRL-NIST-AI-RMF-GV-4.1@a974cd747263f200","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-4.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 113–115","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-4.1@a974cd747263f200"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f1a834bfa9bcdaf515e1","from":"MD-CTRL-NIST-AI-RMF-GV-4.2@a622ff3f078e93cf","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-4.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 116–118","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-4.2@a622ff3f078e93cf"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d7dc19d3a727101764a4","from":"MD-CTRL-NIST-AI-RMF-GV-5@93dc995b8ff9abde","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-5","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 119–120","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-5@93dc995b8ff9abde"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-40346932e7909719b7c7","from":"MD-CTRL-NIST-AI-RMF-GV-5.1@84d34fd03f15c80e","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-5.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 121–123","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-5.1@84d34fd03f15c80e"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-3978422f0d216a81dab9","from":"MD-CTRL-NIST-AI-RMF-GV-5.2@965d4067681d82b9","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-5.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 124–126","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-5.2@965d4067681d82b9"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c48a47401f9a50b3904c","from":"MD-CTRL-NIST-AI-RMF-GV-6@a4ba43eaa1337653","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-6","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 127–128","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-6@a4ba43eaa1337653"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-68cab85538c9dff445ac","from":"MD-CTRL-NIST-AI-RMF-GV-6.1@7209d881fb2885bc","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-6.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 129–131","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-6.1@7209d881fb2885bc"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-73f209e053870b3ea97c","from":"MD-CTRL-NIST-AI-RMF-GV-6.2@4c79e228b7ca2411","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"GV-6.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 132–136","fromKeys":["MD-CTRL-NIST-AI-RMF-GV-6.2@4c79e228b7ca2411"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-039fca45c2e79554c741","from":"MD-CTRL-NIST-AI-RMF-MP-1@46fa049af6fa11e7","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 139–140","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-1@46fa049af6fa11e7"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-59e1caff5f9c4fc751c7","from":"MD-CTRL-NIST-AI-RMF-MP-1.1@948bbc263b6bf018","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-1.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 141–143","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-1.1@948bbc263b6bf018"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-0a30eb7167615bbca6e9","from":"MD-CTRL-NIST-AI-RMF-MP-1.2@d6c1d3bfbec54b27","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-1.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 144–146","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-1.2@d6c1d3bfbec54b27"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f25504ef57ee2abd0204","from":"MD-CTRL-NIST-AI-RMF-MP-1.3@4dc810d10cd18048","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-1.3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 147–149","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-1.3@4dc810d10cd18048"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-940d1e757920715809d3","from":"MD-CTRL-NIST-AI-RMF-MP-1.4@ace0923cc2ee941c","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-1.4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 150–152","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-1.4@ace0923cc2ee941c"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-0abd1a8504091248666c","from":"MD-CTRL-NIST-AI-RMF-MP-1.5@a7ff6a88b989b09c","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-1.5","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 153–155","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-1.5@a7ff6a88b989b09c"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e95ebebe5174e7da7555","from":"MD-CTRL-NIST-AI-RMF-MP-1.6@4b5819ed7019fad3","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-1.6","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 156–158","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-1.6@4b5819ed7019fad3"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-56966b9dc593481e358a","from":"MD-CTRL-NIST-AI-RMF-MP-2@7ed5f2910241eb56","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 159–160","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-2@7ed5f2910241eb56"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d3c736121c1571f43456","from":"MD-CTRL-NIST-AI-RMF-MP-2.1@d4b8bcdeb93c2a5a","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-2.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 161–163","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-2.1@d4b8bcdeb93c2a5a"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8a799b709f8273b5f15f","from":"MD-CTRL-NIST-AI-RMF-MP-2.2@7a833f69ddb44d12","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-2.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 164–166","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-2.2@7a833f69ddb44d12"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-76b3f4cac94f8c232051","from":"MD-CTRL-NIST-AI-RMF-MP-2.3@2818bc1bf5b0b45e","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-2.3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 167–169","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-2.3@2818bc1bf5b0b45e"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-36063b542789fa76bf16","from":"MD-CTRL-NIST-AI-RMF-MP-3@0197e7801ff1eef2","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 170–171","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-3@0197e7801ff1eef2"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-6e6b8c773d50396cf654","from":"MD-CTRL-NIST-AI-RMF-MP-3.1@d746171a4ecb38ae","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-3.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 172–174","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-3.1@d746171a4ecb38ae"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-bd7122e10dceac771ccc","from":"MD-CTRL-NIST-AI-RMF-MP-3.2@9bb861a173d6c988","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-3.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 175–177","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-3.2@9bb861a173d6c988"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-42bc844e0b0fad3b133b","from":"MD-CTRL-NIST-AI-RMF-MP-3.3@164d4cf369dbdb7b","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-3.3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 178–180","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-3.3@164d4cf369dbdb7b"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ebfd5d7bf18a60b8c793","from":"MD-CTRL-NIST-AI-RMF-MP-4@116809592f02d31d","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 181–182","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-4@116809592f02d31d"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8728b27f2a95bf0e787f","from":"MD-CTRL-NIST-AI-RMF-MP-4.1@19ef7cb4c6564ed8","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-4.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 183–185","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-4.1@19ef7cb4c6564ed8"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ee5b86880cc308d9e5d3","from":"MD-CTRL-NIST-AI-RMF-MP-4.2@8c1931b7addc0936","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-4.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 186–188","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-4.2@8c1931b7addc0936"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c388609e9c9788dcaad1","from":"MD-CTRL-NIST-AI-RMF-MP-5@85c46fc251a9ab85","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-5","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 189–190","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-5@85c46fc251a9ab85"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-418c4fc5e8ffd0d20571","from":"MD-CTRL-NIST-AI-RMF-MP-5.1@996cf16264eaf3ff","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-5.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 191–193","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-5.1@996cf16264eaf3ff"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4ee6283bd00c9a8d1276","from":"MD-CTRL-NIST-AI-RMF-MP-5.2@1b0bb9682f4942e2","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-5.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 194–196","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-5.2@1b0bb9682f4942e2"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e3050dee39caef7be0f5","from":"MD-CTRL-NIST-AI-RMF-MP-5.3@b6c9d0c08416d3ad","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-5.3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 197–199","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-5.3@b6c9d0c08416d3ad"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-22b5fae2d98d79e6151c","from":"MD-CTRL-NIST-AI-RMF-MP-5.4@7121982e45e8874f","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-5.4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 200–202","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-5.4@7121982e45e8874f"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c7567a2fbf5b4e66c0f9","from":"MD-CTRL-NIST-AI-RMF-MP-5.5@19531afae23ba3c1","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MP-5.5","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 203–207","fromKeys":["MD-CTRL-NIST-AI-RMF-MP-5.5@19531afae23ba3c1"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b212230ff61974fdec56","from":"MD-CTRL-NIST-AI-RMF-MS-1@3db895bbb56b2968","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 210–211","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-1@3db895bbb56b2968"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c16d3f021d72337ca4d1","from":"MD-CTRL-NIST-AI-RMF-MS-1.1@a54bc54c8aa5c92e","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-1.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 212–214","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-1.1@a54bc54c8aa5c92e"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c17faaf12688fab58707","from":"MD-CTRL-NIST-AI-RMF-MS-1.2@6a2f2ebcef2e6151","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-1.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 215–217","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-1.2@6a2f2ebcef2e6151"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1787d7fdea2f4dcbd06c","from":"MD-CTRL-NIST-AI-RMF-MS-1.3@4bb2f120858c1ad3","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-1.3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 218–220","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-1.3@4bb2f120858c1ad3"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-84492f0a889d5cfa8afc","from":"MD-CTRL-NIST-AI-RMF-MS-2@f56b66173a3f92e8","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 221–222","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-2@f56b66173a3f92e8"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-85097b9feb5c681b9fa6","from":"MD-CTRL-NIST-AI-RMF-MS-2.1@1d81c09bf1afde53","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-2.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 223–225","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-2.1@1d81c09bf1afde53"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-3afce5f5c7d7e381f1e8","from":"MD-CTRL-NIST-AI-RMF-MS-2.2@829bb463942d1486","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-2.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 226–228","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-2.2@829bb463942d1486"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-0a9f04adb6a6f222b4e8","from":"MD-CTRL-NIST-AI-RMF-MS-2.3@1f93e70b9d8b4eb9","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-2.3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 229–231","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-2.3@1f93e70b9d8b4eb9"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a1857fed09c4791a958e","from":"MD-CTRL-NIST-AI-RMF-MS-2.4@621355bb503e08e8","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-2.4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 232–234","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-2.4@621355bb503e08e8"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c1f7d7900a6896f4033d","from":"MD-CTRL-NIST-AI-RMF-MS-2.5@9cd16c6b1ee118d7","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-2.5","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 235–237","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-2.5@9cd16c6b1ee118d7"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-6b63af66d1c71643db8f","from":"MD-CTRL-NIST-AI-RMF-MS-2.6@67a44d3238b92bf7","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-2.6","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 238–240","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-2.6@67a44d3238b92bf7"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-0477e941a3ebc9522719","from":"MD-CTRL-NIST-AI-RMF-MS-3@7c5dfb51d57ba7ef","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 241–242","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-3@7c5dfb51d57ba7ef"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c7a5689786745194bd80","from":"MD-CTRL-NIST-AI-RMF-MS-3.1@2ba441a6cb62d709","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-3.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 243–245","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-3.1@2ba441a6cb62d709"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b2cbaa45177d4745155e","from":"MD-CTRL-NIST-AI-RMF-MS-3.2@ad1af42485a958a4","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-3.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 246–248","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-3.2@ad1af42485a958a4"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e6e3dc57b743e079b247","from":"MD-CTRL-NIST-AI-RMF-MS-3.3@dac1b0c4325b68cc","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-3.3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 249–251","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-3.3@dac1b0c4325b68cc"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a468950502d9916d84dd","from":"MD-CTRL-NIST-AI-RMF-MS-3.4@0b8137f06e7a2949","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-3.4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 252–254","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-3.4@0b8137f06e7a2949"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-667a42c65529c8d26bef","from":"MD-CTRL-NIST-AI-RMF-MS-4@5ca3ca99c4aa3259","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 255–256","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-4@5ca3ca99c4aa3259"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-3a9ed5ea5c54ca7cbcb4","from":"MD-CTRL-NIST-AI-RMF-MS-4.1@b643563d272a7c58","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-4.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 257–259","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-4.1@b643563d272a7c58"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f43faccf2964bfeaaa9e","from":"MD-CTRL-NIST-AI-RMF-MS-4.2@555cf50a631386bb","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MS-4.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 260–264","fromKeys":["MD-CTRL-NIST-AI-RMF-MS-4.2@555cf50a631386bb"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-7b74fdef59c3e4b632bd","from":"MD-CTRL-NIST-AI-RMF-MG-1@3d2e30ac47caad63","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 267–268","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-1@3d2e30ac47caad63"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-662508e09b2849e40f16","from":"MD-CTRL-NIST-AI-RMF-MG-1.1@c8fc8c5d1f8338ae","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-1.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 269–271","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-1.1@c8fc8c5d1f8338ae"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-741d77c4f9adf1874c45","from":"MD-CTRL-NIST-AI-RMF-MG-1.2@4767f43db3a271de","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-1.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 272–274","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-1.2@4767f43db3a271de"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f0310c6f5da44f3ea69a","from":"MD-CTRL-NIST-AI-RMF-MG-1.3@0d3757fb71970b26","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-1.3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 275–277","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-1.3@0d3757fb71970b26"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-34d9faf63fa5f45eab9d","from":"MD-CTRL-NIST-AI-RMF-MG-2@1612f29b60ecb89e","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 278–279","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-2@1612f29b60ecb89e"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-500dcb93ac08922f8496","from":"MD-CTRL-NIST-AI-RMF-MG-2.1@56900e8e5880f6ab","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-2.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 280–282","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-2.1@56900e8e5880f6ab"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-2f10f6aec0ac29f4e00d","from":"MD-CTRL-NIST-AI-RMF-MG-2.2@05301d4e5281ab61","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-2.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 283–285","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-2.2@05301d4e5281ab61"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a25ac8dd948f725f5f0c","from":"MD-CTRL-NIST-AI-RMF-MG-2.3@6d48f395ec619a37","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-2.3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 286–288","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-2.3@6d48f395ec619a37"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d778b1ec69fd659290d5","from":"MD-CTRL-NIST-AI-RMF-MG-2.4@b934cd7280da0290","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-2.4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 289–291","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-2.4@b934cd7280da0290"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-40c6559a5709ddf37fd7","from":"MD-CTRL-NIST-AI-RMF-MG-3@51ec0c06c6e0589e","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 292–293","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-3@51ec0c06c6e0589e"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-083782ffe892ce019ad6","from":"MD-CTRL-NIST-AI-RMF-MG-3.1@c848d8590de967bc","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-3.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 294–296","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-3.1@c848d8590de967bc"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d9975dfed4e06c11f0d9","from":"MD-CTRL-NIST-AI-RMF-MG-3.2@c0f884a2359551c6","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-3.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 297–299","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-3.2@c0f884a2359551c6"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1f77dfc865c84ff2db1c","from":"MD-CTRL-NIST-AI-RMF-MG-3.3@610a85d7bb36dc41","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-3.3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 300–302","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-3.3@610a85d7bb36dc41"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-2d45e7abd803e8c9647c","from":"MD-CTRL-NIST-AI-RMF-MG-3.4@c198b1aab695886f","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-3.4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 303–305","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-3.4@c198b1aab695886f"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-eb818d161c8487546a92","from":"MD-CTRL-NIST-AI-RMF-MG-4@c5f5cc304b06fbc9","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 306–307","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-4@c5f5cc304b06fbc9"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-4270e74dddc27075771e","from":"MD-CTRL-NIST-AI-RMF-MG-4.1@e3b40befb48fe092","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-4.1","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 308–310","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-4.1@e3b40befb48fe092"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-42e5924d02fe811bd84e","from":"MD-CTRL-NIST-AI-RMF-MG-4.2@7821ca590c95a3b6","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-4.2","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 311–313","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-4.2@7821ca590c95a3b6"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e7fc38fb09cde54e838b","from":"MD-CTRL-NIST-AI-RMF-MG-4.3@4b10893d8fcf1c84","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-4.3","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 314–316","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-4.3@4b10893d8fcf1c84"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-9cce440e3d7b89f9646b","from":"MD-CTRL-NIST-AI-RMF-MG-4.4@ef983e76a584418a","to":"FW-NIST-AI-RMF@bbe6c7c2ea68b83d","kind":"SECONDARY_CONTROL_REFERENCE","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(9).md","control":"MG-4.4","primarySourceVerified":false},"sourceKey":"policy-guide-nist-ai-rmf@aca4e7485fc3b0a9","locator":"POLICY(9).md:lines 317–321","fromKeys":["MD-CTRL-NIST-AI-RMF-MG-4.4@ef983e76a584418a"],"toKeys":["FW-NIST-AI-RMF@bbe6c7c2ea68b83d"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e95b20a802b83b580303","from":"GUIDE-OWASP-LLM-2025-d4b1ea5708dd@cd44ac29977646fd","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Overview","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 10–15","fromKeys":["GUIDE-OWASP-LLM-2025-d4b1ea5708dd@cd44ac29977646fd"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-2159de91fbe476134237","from":"GUIDE-OWASP-LLM-2025-25fa7b58c8a8@cf882bdb5202a8a5","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"LLM01 — Prompt Injection","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 16–52","fromKeys":["GUIDE-OWASP-LLM-2025-25fa7b58c8a8@cf882bdb5202a8a5"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b86eee9285b76c68e9ad","from":"GUIDE-OWASP-LLM-2025-30014e32669c@a999ad4b6bf365c4","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Description","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 18–20","fromKeys":["GUIDE-OWASP-LLM-2025-30014e32669c@a999ad4b6bf365c4"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-057f63893b44048f84b9","from":"GUIDE-OWASP-LLM-2025-6a0068187d05@029b6f3794e02275","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Real-World Examples","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 21–27","fromKeys":["GUIDE-OWASP-LLM-2025-6a0068187d05@029b6f3794e02275"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d016bc2c00bd8c8bd9ac","from":"GUIDE-OWASP-LLM-2025-ed9bcdeffe38@099de8c76e54338f","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Detection Methods","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 28–34","fromKeys":["GUIDE-OWASP-LLM-2025-ed9bcdeffe38@099de8c76e54338f"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ab6076bf9312e0db6521","from":"GUIDE-OWASP-LLM-2025-ae9ad1b46138@b345118b4dd7d52b","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Mitigations","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 35–41","fromKeys":["GUIDE-OWASP-LLM-2025-ae9ad1b46138@b345118b4dd7d52b"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-de9056489d4c8fde9249","from":"GUIDE-OWASP-LLM-2025-8668f86ea2b9@9dfe8ff685d63e25","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Policy Engine","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 42–44","fromKeys":["GUIDE-OWASP-LLM-2025-8668f86ea2b9@9dfe8ff685d63e25"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-87d4be118c8a5fe1b164","from":"GUIDE-OWASP-LLM-2025-f68bab7e3905@79a457b93f0bf4bd","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Assess","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 45–47","fromKeys":["GUIDE-OWASP-LLM-2025-f68bab7e3905@79a457b93f0bf4bd"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-cadeca9e7cee333df20c","from":"GUIDE-OWASP-LLM-2025-3c955bf27a33@a31bfb4c6bdc407b","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Probe","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 48–52","fromKeys":["GUIDE-OWASP-LLM-2025-3c955bf27a33@a31bfb4c6bdc407b"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-9b0cc963a8cc41ec4475","from":"GUIDE-OWASP-LLM-2025-53a66f6341e1@6555f52e8452d880","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"LLM02 — Sensitive Information Disclosure","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 53–89","fromKeys":["GUIDE-OWASP-LLM-2025-53a66f6341e1@6555f52e8452d880"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-59452cb6a9e6a1e3f3ab","from":"GUIDE-OWASP-LLM-2025-b6f5e5a7a236@329fcac81f726bb4","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Description","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 55–57","fromKeys":["GUIDE-OWASP-LLM-2025-b6f5e5a7a236@329fcac81f726bb4"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ead98e11e5eb3c111bbe","from":"GUIDE-OWASP-LLM-2025-66eccc7d5a2e@427bd71f0b232d76","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Real-World Examples","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 58–64","fromKeys":["GUIDE-OWASP-LLM-2025-66eccc7d5a2e@427bd71f0b232d76"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-689df812594afd4ecfc0","from":"GUIDE-OWASP-LLM-2025-06bab9e19df5@291a039c2afef20d","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Detection Methods","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 65–71","fromKeys":["GUIDE-OWASP-LLM-2025-06bab9e19df5@291a039c2afef20d"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-30d5106398eca1ce8ba2","from":"GUIDE-OWASP-LLM-2025-b0392b89d1e5@433f7facc64c24f6","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Mitigations","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 72–78","fromKeys":["GUIDE-OWASP-LLM-2025-b0392b89d1e5@433f7facc64c24f6"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5bbf4820360c8ec17030","from":"GUIDE-OWASP-LLM-2025-6b31f1dab462@8ba0780917311d2d","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Policy Engine","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 79–81","fromKeys":["GUIDE-OWASP-LLM-2025-6b31f1dab462@8ba0780917311d2d"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-930f9cef442cbcaf155f","from":"GUIDE-OWASP-LLM-2025-dbd0bcddf152@6a5c852556ea0206","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Assess","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 82–84","fromKeys":["GUIDE-OWASP-LLM-2025-dbd0bcddf152@6a5c852556ea0206"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-723c716dc5139a38cbaa","from":"GUIDE-OWASP-LLM-2025-df0252acd5f3@ca80c398783a4bde","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Probe","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 85–89","fromKeys":["GUIDE-OWASP-LLM-2025-df0252acd5f3@ca80c398783a4bde"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-42dc374e043bf9da52b2","from":"GUIDE-OWASP-LLM-2025-6f85a1a132eb@6f89618929f57d67","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"LLM03 — Supply Chain","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 90–126","fromKeys":["GUIDE-OWASP-LLM-2025-6f85a1a132eb@6f89618929f57d67"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b9eb00605767b80b720c","from":"GUIDE-OWASP-LLM-2025-d1c0f03cc24d@3908b2f7213c1d8f","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Description","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 92–94","fromKeys":["GUIDE-OWASP-LLM-2025-d1c0f03cc24d@3908b2f7213c1d8f"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-2aa7771395265bca0546","from":"GUIDE-OWASP-LLM-2025-3f43e0354a54@e448dff1d90ecf0d","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Real-World Examples","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 95–101","fromKeys":["GUIDE-OWASP-LLM-2025-3f43e0354a54@e448dff1d90ecf0d"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-835f8dd24187894d3477","from":"GUIDE-OWASP-LLM-2025-833a87566bc1@ab06e4ad60d2c83f","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Detection Methods","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 102–108","fromKeys":["GUIDE-OWASP-LLM-2025-833a87566bc1@ab06e4ad60d2c83f"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b44ac0efc02b9bd09f11","from":"GUIDE-OWASP-LLM-2025-7706e7e9b7b6@fd1611c5b3ad9f26","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Mitigations","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 109–115","fromKeys":["GUIDE-OWASP-LLM-2025-7706e7e9b7b6@fd1611c5b3ad9f26"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-908a69773c261d915ab8","from":"GUIDE-OWASP-LLM-2025-70c023247d26@ebbe7b07f906eb6d","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Policy Engine","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 116–118","fromKeys":["GUIDE-OWASP-LLM-2025-70c023247d26@ebbe7b07f906eb6d"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b84dddbaa9002ae37114","from":"GUIDE-OWASP-LLM-2025-71440703f4b7@fc8b9d083ab47bb0","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Assess","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 119–121","fromKeys":["GUIDE-OWASP-LLM-2025-71440703f4b7@fc8b9d083ab47bb0"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f230792982b31d087a60","from":"GUIDE-OWASP-LLM-2025-ddd044ffba36@f5b909b17365b6ca","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Probe","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 122–126","fromKeys":["GUIDE-OWASP-LLM-2025-ddd044ffba36@f5b909b17365b6ca"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-f59114505d6ea6b8c884","from":"GUIDE-OWASP-LLM-2025-b8b8b3821562@087f01d94c518a46","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"LLM04 — Data and Model Poisoning","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 127–162","fromKeys":["GUIDE-OWASP-LLM-2025-b8b8b3821562@087f01d94c518a46"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ae2e35524e1ea9872642","from":"GUIDE-OWASP-LLM-2025-ec98e4af2fe3@d968b48094cf6c68","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Description","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 129–131","fromKeys":["GUIDE-OWASP-LLM-2025-ec98e4af2fe3@d968b48094cf6c68"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-22b206d39470c01e78c8","from":"GUIDE-OWASP-LLM-2025-b01dd39ee9eb@107d847e9a140a40","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Real-World Examples","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 132–137","fromKeys":["GUIDE-OWASP-LLM-2025-b01dd39ee9eb@107d847e9a140a40"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-05640acaec90b78ad205","from":"GUIDE-OWASP-LLM-2025-9fce493a2e4e@0453f5d39db0076b","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Detection Methods","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 138–144","fromKeys":["GUIDE-OWASP-LLM-2025-9fce493a2e4e@0453f5d39db0076b"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c82f02e02583afacf6fe","from":"GUIDE-OWASP-LLM-2025-87f93fc34f39@67a0b58181f1fa98","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Mitigations","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 145–151","fromKeys":["GUIDE-OWASP-LLM-2025-87f93fc34f39@67a0b58181f1fa98"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-8ace08676e1a2db70608","from":"GUIDE-OWASP-LLM-2025-81d2108e2b97@6bbabbd9979771af","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Policy Engine","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 152–154","fromKeys":["GUIDE-OWASP-LLM-2025-81d2108e2b97@6bbabbd9979771af"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e385ff20967fe5e95f06","from":"GUIDE-OWASP-LLM-2025-fe44732a946d@9bd0d5c3ca83a12c","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Assess","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 155–157","fromKeys":["GUIDE-OWASP-LLM-2025-fe44732a946d@9bd0d5c3ca83a12c"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-aa1ef6915e79f56f4aff","from":"GUIDE-OWASP-LLM-2025-1e15f2a62cf2@8ff548031a0a226a","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Probe","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 158–162","fromKeys":["GUIDE-OWASP-LLM-2025-1e15f2a62cf2@8ff548031a0a226a"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-32f3980827c15f9dd455","from":"GUIDE-OWASP-LLM-2025-f9ac17eaac49@a9b8748b9bc6c714","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"LLM05 — Improper Output Handling","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 163–198","fromKeys":["GUIDE-OWASP-LLM-2025-f9ac17eaac49@a9b8748b9bc6c714"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5a797e62aea0202524fd","from":"GUIDE-OWASP-LLM-2025-c78216df5eac@0b951f8a52c4ad6c","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Description","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 165–167","fromKeys":["GUIDE-OWASP-LLM-2025-c78216df5eac@0b951f8a52c4ad6c"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-322c4be5c54d66ddf195","from":"GUIDE-OWASP-LLM-2025-d5c26cf498a7@8ed3adf0ab2c3253","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Real-World Examples","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 168–174","fromKeys":["GUIDE-OWASP-LLM-2025-d5c26cf498a7@8ed3adf0ab2c3253"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a600474534de76f9fe32","from":"GUIDE-OWASP-LLM-2025-f3540baee82f@bd6ac8c6af661d50","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Detection Methods","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 175–180","fromKeys":["GUIDE-OWASP-LLM-2025-f3540baee82f@bd6ac8c6af661d50"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-e53c30773eaffb0358c7","from":"GUIDE-OWASP-LLM-2025-157ee04104e7@15e9ae5b64736133","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Mitigations","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 181–187","fromKeys":["GUIDE-OWASP-LLM-2025-157ee04104e7@15e9ae5b64736133"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-501d44e1ad56321e4378","from":"GUIDE-OWASP-LLM-2025-bb73c2b77831@0d1748c203c889f7","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Policy Engine","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 188–190","fromKeys":["GUIDE-OWASP-LLM-2025-bb73c2b77831@0d1748c203c889f7"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-451941f1bf5d9b336153","from":"GUIDE-OWASP-LLM-2025-3962733dc087@1f1f8deaf9fd59a4","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Assess","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 191–193","fromKeys":["GUIDE-OWASP-LLM-2025-3962733dc087@1f1f8deaf9fd59a4"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-b5874777a982295298ec","from":"GUIDE-OWASP-LLM-2025-1226515d46f4@35b5a5f74c340c4e","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Probe","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 194–198","fromKeys":["GUIDE-OWASP-LLM-2025-1226515d46f4@35b5a5f74c340c4e"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c8c3a6fbc252cb54a935","from":"GUIDE-OWASP-LLM-2025-4c849547fb93@2d8a428244f449c9","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"LLM06 — Excessive Agency","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 199–233","fromKeys":["GUIDE-OWASP-LLM-2025-4c849547fb93@2d8a428244f449c9"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-68a34a8625afca68fc3a","from":"GUIDE-OWASP-LLM-2025-12d7f20e97aa@fe801f8a2d7889c3","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Description","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 201–203","fromKeys":["GUIDE-OWASP-LLM-2025-12d7f20e97aa@fe801f8a2d7889c3"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-398623f50b2a6cbdc005","from":"GUIDE-OWASP-LLM-2025-44dedd4b1869@0586318b52800bf9","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Real-World Examples","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 204–209","fromKeys":["GUIDE-OWASP-LLM-2025-44dedd4b1869@0586318b52800bf9"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-562658a1f39c984209f5","from":"GUIDE-OWASP-LLM-2025-e4dc38dde086@08dc7672848d4a40","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Detection Methods","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 210–215","fromKeys":["GUIDE-OWASP-LLM-2025-e4dc38dde086@08dc7672848d4a40"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-fd2de70609bd8b302763","from":"GUIDE-OWASP-LLM-2025-0b2e07fa8e29@831898f078d1b763","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Mitigations","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 216–222","fromKeys":["GUIDE-OWASP-LLM-2025-0b2e07fa8e29@831898f078d1b763"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-112369b5d1db9435438e","from":"GUIDE-OWASP-LLM-2025-5ccb3347058a@85fd67460a3650d7","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Policy Engine","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 223–225","fromKeys":["GUIDE-OWASP-LLM-2025-5ccb3347058a@85fd67460a3650d7"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c49a57de7dec906581cc","from":"GUIDE-OWASP-LLM-2025-e76e0ae7e054@f1acc931a2ccbe18","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Assess","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 226–228","fromKeys":["GUIDE-OWASP-LLM-2025-e76e0ae7e054@f1acc931a2ccbe18"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-455674b32a41254658ec","from":"GUIDE-OWASP-LLM-2025-389a2eb29de7@049169f27717f2a4","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Probe","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 229–233","fromKeys":["GUIDE-OWASP-LLM-2025-389a2eb29de7@049169f27717f2a4"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-bf3c41f7117e74552249","from":"GUIDE-OWASP-LLM-2025-07d274f56b42@170722f267b3b8ad","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"LLM07 — System Prompt Leakage","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 234–268","fromKeys":["GUIDE-OWASP-LLM-2025-07d274f56b42@170722f267b3b8ad"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ddac3960d93292e79195","from":"GUIDE-OWASP-LLM-2025-939b442560c6@99f123349d4f9da9","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Description","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 236–238","fromKeys":["GUIDE-OWASP-LLM-2025-939b442560c6@99f123349d4f9da9"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-2f39545218adcb8f5aad","from":"GUIDE-OWASP-LLM-2025-eb1dc90907fb@e264c9b534ccb8c8","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Real-World Examples","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 239–244","fromKeys":["GUIDE-OWASP-LLM-2025-eb1dc90907fb@e264c9b534ccb8c8"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-2c0e5e8a46b8f2c2a6c9","from":"GUIDE-OWASP-LLM-2025-a755af857924@fda6bb1be92157e5","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Detection Methods","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 245–250","fromKeys":["GUIDE-OWASP-LLM-2025-a755af857924@fda6bb1be92157e5"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-16374591e74a3006d4b6","from":"GUIDE-OWASP-LLM-2025-c9b02a4092b4@26fb833baba3fae2","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Mitigations","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 251–257","fromKeys":["GUIDE-OWASP-LLM-2025-c9b02a4092b4@26fb833baba3fae2"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-97e19ad63277d1088c87","from":"GUIDE-OWASP-LLM-2025-78f477d17d08@56d8b428f60f0dfe","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Policy Engine","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 258–260","fromKeys":["GUIDE-OWASP-LLM-2025-78f477d17d08@56d8b428f60f0dfe"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-12d1a396585fa37dc3e2","from":"GUIDE-OWASP-LLM-2025-0d13f6c26718@8ab4954acf5d683c","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Assess","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 261–263","fromKeys":["GUIDE-OWASP-LLM-2025-0d13f6c26718@8ab4954acf5d683c"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-2daaae5eaab0ef06562b","from":"GUIDE-OWASP-LLM-2025-36078fd2244a@39741edb162d20ee","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Probe","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 264–268","fromKeys":["GUIDE-OWASP-LLM-2025-36078fd2244a@39741edb162d20ee"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a2a8b322336f526e2847","from":"GUIDE-OWASP-LLM-2025-318712d2f340@5ea94e6248985221","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"LLM08 — Vector and Embedding Weaknesses","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 269–303","fromKeys":["GUIDE-OWASP-LLM-2025-318712d2f340@5ea94e6248985221"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-583c2a58324f2e75368b","from":"GUIDE-OWASP-LLM-2025-5ac4070bfd22@12281d88dad3c76f","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Description","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 271–273","fromKeys":["GUIDE-OWASP-LLM-2025-5ac4070bfd22@12281d88dad3c76f"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a7084412d23a0e96d19d","from":"GUIDE-OWASP-LLM-2025-d688c985ff87@f21236fce59db60c","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Real-World Examples","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 274–279","fromKeys":["GUIDE-OWASP-LLM-2025-d688c985ff87@f21236fce59db60c"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-73bcc3e36f9dfb979973","from":"GUIDE-OWASP-LLM-2025-47c7b15c5e00@899675ebcaa91aad","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Detection Methods","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 280–285","fromKeys":["GUIDE-OWASP-LLM-2025-47c7b15c5e00@899675ebcaa91aad"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-5b31cea5b75a4f080f87","from":"GUIDE-OWASP-LLM-2025-c30a8864d6b7@c7f10ef3b4888d45","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Mitigations","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 286–292","fromKeys":["GUIDE-OWASP-LLM-2025-c30a8864d6b7@c7f10ef3b4888d45"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-1ac2ec8478814ed9186c","from":"GUIDE-OWASP-LLM-2025-c99af8fb9b72@e8f96efc4c3fa3f9","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Policy Engine","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 293–295","fromKeys":["GUIDE-OWASP-LLM-2025-c99af8fb9b72@e8f96efc4c3fa3f9"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-98ff3f57a3b34adcfa03","from":"GUIDE-OWASP-LLM-2025-d27feb93b609@464ba8fefee39f23","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Assess","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 296–298","fromKeys":["GUIDE-OWASP-LLM-2025-d27feb93b609@464ba8fefee39f23"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-35a3b8edbe24b11bd67c","from":"GUIDE-OWASP-LLM-2025-d9c16257105d@56f7b1ab2b5a62f5","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Probe","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 299–303","fromKeys":["GUIDE-OWASP-LLM-2025-d9c16257105d@56f7b1ab2b5a62f5"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-457dac560aff99f641e9","from":"GUIDE-OWASP-LLM-2025-e9fe62e9b03b@c767198a491c5a72","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"LLM09 — Misinformation","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 304–339","fromKeys":["GUIDE-OWASP-LLM-2025-e9fe62e9b03b@c767198a491c5a72"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-fb21ad384d354f27ab4a","from":"GUIDE-OWASP-LLM-2025-4971f15eae25@9513c0449c91d085","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Description","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 306–308","fromKeys":["GUIDE-OWASP-LLM-2025-4971f15eae25@9513c0449c91d085"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-56235068ecd1c9accc68","from":"GUIDE-OWASP-LLM-2025-ea404651be03@21956335e6e226f5","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Real-World Examples","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 309–314","fromKeys":["GUIDE-OWASP-LLM-2025-ea404651be03@21956335e6e226f5"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a2229c56cb420a7dee36","from":"GUIDE-OWASP-LLM-2025-b6d9654c7322@8400dd6f7e8be934","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Detection Methods","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 315–321","fromKeys":["GUIDE-OWASP-LLM-2025-b6d9654c7322@8400dd6f7e8be934"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-ad1a9dae704cb62433c9","from":"GUIDE-OWASP-LLM-2025-1295be80c5ef@6dfe248c03858897","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Mitigations","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 322–328","fromKeys":["GUIDE-OWASP-LLM-2025-1295be80c5ef@6dfe248c03858897"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-a74e3eb1005b4950b88d","from":"GUIDE-OWASP-LLM-2025-96a223013baa@d21759c22fba7220","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Policy Engine","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 329–331","fromKeys":["GUIDE-OWASP-LLM-2025-96a223013baa@d21759c22fba7220"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-c74535b4d9e716a6ccd4","from":"GUIDE-OWASP-LLM-2025-bbdd28946ee5@60caedb08e98fa32","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Assess","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 332–334","fromKeys":["GUIDE-OWASP-LLM-2025-bbdd28946ee5@60caedb08e98fa32"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-13e75a28dca7fd3446a7","from":"GUIDE-OWASP-LLM-2025-680e0fb740f6@cbb979e80f389d5d","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Probe","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 335–339","fromKeys":["GUIDE-OWASP-LLM-2025-680e0fb740f6@cbb979e80f389d5d"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-6d5ae52e7fead906ac92","from":"GUIDE-OWASP-LLM-2025-3d7a231766b7@28796b76df479a62","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"LLM10 — Unbounded Consumption","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 340–374","fromKeys":["GUIDE-OWASP-LLM-2025-3d7a231766b7@28796b76df479a62"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-6e97fa844ded4638dfd9","from":"GUIDE-OWASP-LLM-2025-0c521534ee21@a623bd8664b932b1","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Description","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 342–344","fromKeys":["GUIDE-OWASP-LLM-2025-0c521534ee21@a623bd8664b932b1"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-53ea051d6aa2b9fe4304","from":"GUIDE-OWASP-LLM-2025-8eea2c58ecbf@95513d429c113232","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Real-World Examples","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 345–350","fromKeys":["GUIDE-OWASP-LLM-2025-8eea2c58ecbf@95513d429c113232"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-87423dadcbf56d478be4","from":"GUIDE-OWASP-LLM-2025-91aa88183e20@e342f8d7488ef5b5","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Detection Methods","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 351–356","fromKeys":["GUIDE-OWASP-LLM-2025-91aa88183e20@e342f8d7488ef5b5"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d517ce990328e9da370d","from":"GUIDE-OWASP-LLM-2025-bda235d59494@ee1fefa9c1071500","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"Mitigations","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 357–363","fromKeys":["GUIDE-OWASP-LLM-2025-bda235d59494@ee1fefa9c1071500"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-bbd8b38f591f2d390d60","from":"GUIDE-OWASP-LLM-2025-7798ca0d2dfa@2363b774d4fb43f4","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Policy Engine","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 364–366","fromKeys":["GUIDE-OWASP-LLM-2025-7798ca0d2dfa@2363b774d4fb43f4"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d2663a128c5d5afdec00","from":"GUIDE-OWASP-LLM-2025-922edb48d46d@af4eff0667977fa6","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Assess","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 367–369","fromKeys":["GUIDE-OWASP-LLM-2025-922edb48d46d@af4eff0667977fa6"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-d2066d3ec32e3f749827","from":"GUIDE-OWASP-LLM-2025-dd1187cf221c@aa2cf0eb7a86ea0c","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Probe","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 370–374","fromKeys":["GUIDE-OWASP-LLM-2025-dd1187cf221c@aa2cf0eb7a86ea0c"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-6c050b8975361f5dafd8","from":"GUIDE-OWASP-LLM-2025-d1b02093c29d@7aaeff2d2d37c5a1","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"GOVERN Component Coverage Matrix","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 375–391","fromKeys":["GUIDE-OWASP-LLM-2025-d1b02093c29d@7aaeff2d2d37c5a1"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"},{"id":"MAP-MD-3c9931e09c6aa0e519f6","from":"GUIDE-OWASP-LLM-2025-69824d3b0e70@f045b4e2d26280e4","to":"FW-OWASP-LLM-2025@cf74d9c685ef413a","kind":"SECONDARY_GUIDANCE_FOR_FRAMEWORK","status":"SOURCE_REPORTED_REVIEW_REQUIRED","body":{"sourceFile":"POLICY(10).md","heading":"References","primarySourceVerified":false},"sourceKey":"policy-guide-owasp-llm-2025@3d2cb13d3349744d","locator":"POLICY(10).md:lines 392–398","fromKeys":["GUIDE-OWASP-LLM-2025-69824d3b0e70@f045b4e2d26280e4"],"toKeys":["FW-OWASP-LLM-2025@cf74d9c685ef413a"],"resolution":"RESOLVED_REFERENCE_REVIEW_REQUIRED"}],"ruleScores":[{"id":"AIR-4DC94000A9@1d5863420bba9e58@cgrcc-mission-score-0.1","recordKey":"AIR-4DC94000A9@1d5863420bba9e58","ruleId":"AIR-4DC94000A9","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NCSC, CISA and partners"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cisa-ncsc-secure-ai-development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","control":"Secure development / assets","version":"1.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-AB2476BBAB@130c3fac51082d54@cgrcc-mission-score-0.1","recordKey":"AIR-AB2476BBAB@130c3fac51082d54","ruleId":"AIR-AB2476BBAB","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NCSC, CISA and partners"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cisa-ncsc-secure-ai-development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","control":"Secure development / documentation","version":"1.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-DA02521292@fb0f442688ba560a@cgrcc-mission-score-0.1","recordKey":"AIR-DA02521292@fb0f442688ba560a","ruleId":"AIR-DA02521292","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 7(2)","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-4849919367@1edcc23cf35b43e4@cgrcc-mission-score-0.1","recordKey":"AIR-4849919367@1edcc23cf35b43e4","ruleId":"AIR-4849919367","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["North Carolina Department of Information Technology"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nc-public-genai","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","control":"p.5, appropriate use, bullet 1","version":"1.1 — April 14, 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-727F5459C2@05d7396f20ccf349@cgrcc-mission-score-0.1","recordKey":"AIR-727F5459C2@05d7396f20ccf349","ruleId":"AIR-727F5459C2","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Office of Management and Budget"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"omb-m-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=10","control":"4(d)(ii)(E)(I)","version":"M-25-22","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-36FDB9AAD2@1e225e4043da0e0f@cgrcc-mission-score-0.1","recordKey":"AIR-36FDB9AAD2@1e225e4043da0e0f","ruleId":"AIR-36FDB9AAD2","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 5(1)(e)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-8E3444C5DD@24c0145c2464366a@cgrcc-mission-score-0.1","recordKey":"AIR-8E3444C5DD@24c0145c2464366a","ruleId":"AIR-8E3444C5DD","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 5(2)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-653ED4C38B@a19421791b38bd15@cgrcc-mission-score-0.1","recordKey":"AIR-653ED4C38B@a19421791b38bd15","ruleId":"AIR-653ED4C38B","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Treasury Board of Canada"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"ca-automated-decisions","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","control":"6.2.4","version":"Modified 2025-06-24","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-AA8C667747@e811992389077596@cgrcc-mission-score-0.1","recordKey":"AIR-AA8C667747@e811992389077596","ruleId":"AIR-AA8C667747","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Pennsylvania Office of Administration"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"pa-ai-2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","control":"5.2.6.2, p.7","version":"Revision January 13, 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-ABAA5F0412@a224b4705d19abd7@cgrcc-mission-score-0.1","recordKey":"AIR-ABAA5F0412@a224b4705d19abd7","ruleId":"AIR-ABAA5F0412","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 10(2)(a)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-584850ADDF@237be1194f0adc35@cgrcc-mission-score-0.1","recordKey":"AIR-584850ADDF@237be1194f0adc35","ruleId":"AIR-584850ADDF","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 15(1)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-0EAF27F441@f0be17c777da998d@cgrcc-mission-score-0.1","recordKey":"AIR-0EAF27F441@f0be17c777da998d","ruleId":"AIR-0EAF27F441","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 10(3)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-2D3230CFEA@db9d6234e0c4c651@cgrcc-mission-score-0.1","recordKey":"AIR-2D3230CFEA@db9d6234e0c4c651","ruleId":"AIR-2D3230CFEA","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 26(4)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-41D9F2CC95@665332b2581266bc@cgrcc-mission-score-0.1","recordKey":"AIR-41D9F2CC95@665332b2581266bc","ruleId":"AIR-41D9F2CC95","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Michigan State University"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"msu-genai-guidelines","url":"https://ai.msu.edu/guidelines","control":"Non-Permissible Uses, final paragraph","version":"Approved August 12, 2025; no revisions listed","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-3867F71ADB@b352f8f186701b7b@cgrcc-mission-score-0.1","recordKey":"AIR-3867F71ADB@b352f8f186701b7b","ruleId":"AIR-3867F71ADB","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 2.12","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-9A5BD1A87A@0e29409bc678f694@cgrcc-mission-score-0.1","recordKey":"AIR-9A5BD1A87A@0e29409bc678f694","ruleId":"AIR-9A5BD1A87A","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 53(1)(c)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-6BBD510385@c5d5a0a2782a143b@cgrcc-mission-score-0.1","recordKey":"AIR-6BBD510385@c5d5a0a2782a143b","ruleId":"AIR-6BBD510385","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 25(1)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-19AAD3D220@9039963c5253c129@cgrcc-mission-score-0.1","recordKey":"AIR-19AAD3D220@9039963c5253c129","ruleId":"AIR-19AAD3D220","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 7(4)","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-1C31FD0739@9438a27a13e45099@cgrcc-mission-score-0.1","recordKey":"AIR-1C31FD0739@9438a27a13e45099","ruleId":"AIR-1C31FD0739","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-privacy-1","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","control":"ID.IM-P3","version":"CSWP 10 / 1.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-A0754F863D@ff197327de98039f@cgrcc-mission-score-0.1","recordKey":"AIR-A0754F863D@ff197327de98039f","ruleId":"AIR-A0754F863D","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-privacy-1","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","control":"ID.IM-P5","version":"CSWP 10 / 1.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-32A014BA72@80809bb2d11324b7@cgrcc-mission-score-0.1","recordKey":"AIR-32A014BA72@80809bb2d11324b7","ruleId":"AIR-32A014BA72","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-privacy-1","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","control":"ID.IM-P1","version":"CSWP 10 / 1.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-7265A37732@017a7c56129fae99@cgrcc-mission-score-0.1","recordKey":"AIR-7265A37732@017a7c56129fae99","ruleId":"AIR-7265A37732","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-privacy-1","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","control":"ID.IM-P4","version":"CSWP 10 / 1.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-54647B2218@04ec7c174b09443f@cgrcc-mission-score-0.1","recordKey":"AIR-54647B2218@04ec7c174b09443f","ruleId":"AIR-54647B2218","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 35(1)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-4FA53D5DDD@6bd3ff49f43409cc@cgrcc-mission-score-0.1","recordKey":"AIR-4FA53D5DDD@6bd3ff49f43409cc","ruleId":"AIR-4FA53D5DDD","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 53(1)(d)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-2ABDCD7376@06f5b6a210731a85@cgrcc-mission-score-0.1","recordKey":"AIR-2ABDCD7376@06f5b6a210731a85","ruleId":"AIR-2ABDCD7376","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 4(3)","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-A31D302A1B@e7538e87b5117430@cgrcc-mission-score-0.1","recordKey":"AIR-A31D302A1B@e7538e87b5117430","ruleId":"AIR-A31D302A1B","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Pennsylvania Office of Administration"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"pa-ai-2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","control":"5.1.4, p.2","version":"Revision January 13, 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-B1B0E054D0@9ce679f11b6245e3@cgrcc-mission-score-0.1","recordKey":"AIR-B1B0E054D0@9ce679f11b6245e3","ruleId":"AIR-B1B0E054D0","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["North Carolina Department of Information Technology"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nc-public-genai","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","control":"p.5, data sharing, bullets 1–2","version":"1.1 — April 14, 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-50088C8736@1fd711dd4abe9f75@cgrcc-mission-score-0.1","recordKey":"AIR-50088C8736@1fd711dd4abe9f75","ruleId":"AIR-50088C8736","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 7(1)","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-6E435F72F8@4d22d944b760bee5@cgrcc-mission-score-0.1","recordKey":"AIR-6E435F72F8@4d22d944b760bee5","ruleId":"AIR-6E435F72F8","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NSA AISC, CISA, FBI and partners"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nsa-cisa-secure-ai-deployment","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","control":"Summary / validation","version":"April 2024 / 1.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-9B67275315@16e7d7f05ae6bbb2@cgrcc-mission-score-0.1","recordKey":"AIR-9B67275315@16e7d7f05ae6bbb2","ruleId":"AIR-9B67275315","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 4.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-1BE3C102BD@73c7232546f1b4e9@cgrcc-mission-score-0.1","recordKey":"AIR-1BE3C102BD@73c7232546f1b4e9","ruleId":"AIR-1BE3C102BD","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Office of Management and Budget"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"omb-m-25-21","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf#page=15","control":"4(a)(ii)","version":"M-25-21","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-587EDFB2DD@b8810ad503621000@cgrcc-mission-score-0.1","recordKey":"AIR-587EDFB2DD@b8810ad503621000","ruleId":"AIR-587EDFB2DD","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 3.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-B4750175C0@149648d306b67ce5@cgrcc-mission-score-0.1","recordKey":"AIR-B4750175C0@149648d306b67ce5","ruleId":"AIR-B4750175C0","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 4.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-CFAE0A69A5@e49fa223cd0cb762@cgrcc-mission-score-0.1","recordKey":"AIR-CFAE0A69A5@e49fa223cd0cb762","ruleId":"AIR-CFAE0A69A5","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Office of Management and Budget"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"omb-m-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=9","control":"4(d)(i)","version":"M-25-22","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-33B04C2296@841ed4850964440b@cgrcc-mission-score-0.1","recordKey":"AIR-33B04C2296@841ed4850964440b","ruleId":"AIR-33B04C2296","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 2.5","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-F1A3CFC876@379e3e5f01416194@cgrcc-mission-score-0.1","recordKey":"AIR-F1A3CFC876@379e3e5f01416194","ruleId":"AIR-F1A3CFC876","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 2.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-A271230967@6c27fb177bb45d30@cgrcc-mission-score-0.1","recordKey":"AIR-A271230967@6c27fb177bb45d30","ruleId":"AIR-A271230967","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 4.3","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-AD7B04DC9D@04e3ca392f0df072@cgrcc-mission-score-0.1","recordKey":"AIR-AD7B04DC9D@04e3ca392f0df072","ruleId":"AIR-AD7B04DC9D","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 2.13","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-DFA60F69C7@34d1f2384eaff36b@cgrcc-mission-score-0.1","recordKey":"AIR-DFA60F69C7@34d1f2384eaff36b","ruleId":"AIR-DFA60F69C7","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 1.3","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-E80EDA7CD6@036513630d55f1a6@cgrcc-mission-score-0.1","recordKey":"AIR-E80EDA7CD6@036513630d55f1a6","ruleId":"AIR-E80EDA7CD6","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 2.3","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-95915B3947@e69e1136b78ff50b@cgrcc-mission-score-0.1","recordKey":"AIR-95915B3947@e69e1136b78ff50b","ruleId":"AIR-95915B3947","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 55(1)(a)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-1237C81D58@059fc01b368e6947@cgrcc-mission-score-0.1","recordKey":"AIR-1237C81D58@059fc01b368e6947","ruleId":"AIR-1237C81D58","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Treasury Board of Canada"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"ca-automated-decisions","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","control":"6.2.6.1","version":"Modified 2025-06-24","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-2EBCC14EEF@f8cd4a247e9eb702@cgrcc-mission-score-0.1","recordKey":"AIR-2EBCC14EEF@f8cd4a247e9eb702","ruleId":"AIR-2EBCC14EEF","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 1.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-ABF5BBD0E9@0328d6d72be161a1@cgrcc-mission-score-0.1","recordKey":"AIR-ABF5BBD0E9@0328d6d72be161a1","ruleId":"AIR-ABF5BBD0E9","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 9(7)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-AA1B934A14@623aa668561d8032@cgrcc-mission-score-0.1","recordKey":"AIR-AA1B934A14@623aa668561d8032","ruleId":"AIR-AA1B934A14","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Office of Management and Budget"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"omb-m-26-04","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf#page=3","control":"Agency Actions (a)","version":"M-26-04","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-9958F2923D@5b9a621c5b466bec@cgrcc-mission-score-0.1","recordKey":"AIR-9958F2923D@5b9a621c5b466bec","ruleId":"AIR-9958F2923D","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 2.11","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-0370617F00@db2749549f56e03b@cgrcc-mission-score-0.1","recordKey":"AIR-0370617F00@db2749549f56e03b","ruleId":"AIR-0370617F00","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 10(2)(f)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-50B746363D@36a623ea31f9bbda@cgrcc-mission-score-0.1","recordKey":"AIR-50B746363D@36a623ea31f9bbda","ruleId":"AIR-50B746363D","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Virginia Information Technologies Agency"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"va-ai-ea400","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","control":"p.5, Ethical Use","version":"EA400 — June 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-04955B1030@a3bb8bd27a5794a1@cgrcc-mission-score-0.1","recordKey":"AIR-04955B1030@a3bb8bd27a5794a1","ruleId":"AIR-04955B1030","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 3.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-4483D77189@872494c580e8a595@cgrcc-mission-score-0.1","recordKey":"AIR-4483D77189@872494c580e8a595","ruleId":"AIR-4483D77189","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 4(2)","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-3307E11EB9@2700a775f8da9b21@cgrcc-mission-score-0.1","recordKey":"AIR-3307E11EB9@2700a775f8da9b21","ruleId":"AIR-3307E11EB9","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NSA AISC, CISA, FBI and partners"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nsa-cisa-secure-ai-deployment","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","control":"Deployment architecture / boundaries","version":"April 2024 / 1.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-8566190520@7d33916dd6f567ff@cgrcc-mission-score-0.1","recordKey":"AIR-8566190520@7d33916dd6f567ff","ruleId":"AIR-8566190520","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NSA AISC, CISA, FBI and partners"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nsa-cisa-secure-ai-deployment","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","control":"Deployment governance / threat model","version":"April 2024 / 1.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-602BA32576@a69c70a20564200e@cgrcc-mission-score-0.1","recordKey":"AIR-602BA32576@a69c70a20564200e","ruleId":"AIR-602BA32576","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NSA AISC, CISA, FBI and partners"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nsa-cisa-secure-ai-deployment","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","control":"Summary / model weights","version":"April 2024 / 1.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-08171EB6BD@275b6e07d9f31fe3@cgrcc-mission-score-0.1","recordKey":"AIR-08171EB6BD@275b6e07d9f31fe3","ruleId":"AIR-08171EB6BD","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 15(1)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-599AAF4DAB@1720a88a3cae6692@cgrcc-mission-score-0.1","recordKey":"AIR-599AAF4DAB@1720a88a3cae6692","ruleId":"AIR-599AAF4DAB","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 9","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-8B82635DEA@1d78eb894fae8a0f@cgrcc-mission-score-0.1","recordKey":"AIR-8B82635DEA@1d78eb894fae8a0f","ruleId":"AIR-8B82635DEA","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Treasury Board of Canada"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"ca-automated-decisions","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","control":"6.1.2","version":"Modified 2025-06-24","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-2C5DD821EE@53e9a115afca361b@cgrcc-mission-score-0.1","recordKey":"AIR-2C5DD821EE@53e9a115afca361b","ruleId":"AIR-2C5DD821EE","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Manage 2.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-342C0977BB@761e80b20f52373a@cgrcc-mission-score-0.1","recordKey":"AIR-342C0977BB@761e80b20f52373a","ruleId":"AIR-342C0977BB","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 5(1)(c)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-AC38374E07@f4b6ff20ba87b97b@cgrcc-mission-score-0.1","recordKey":"AIR-AC38374E07@f4b6ff20ba87b97b","ruleId":"AIR-AC38374E07","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 27(1)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-9E7F166E73@602687ff4895a4e9@cgrcc-mission-score-0.1","recordKey":"AIR-9E7F166E73@602687ff4895a4e9","ruleId":"AIR-9E7F166E73","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 55(1)(b)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-4EA78BC0D9@790ae68a9c089b79@cgrcc-mission-score-0.1","recordKey":"AIR-4EA78BC0D9@790ae68a9c089b79","ruleId":"AIR-4EA78BC0D9","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 1.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-29043D921A@228d236f393a3d58@cgrcc-mission-score-0.1","recordKey":"AIR-29043D921A@228d236f393a3d58","ruleId":"AIR-29043D921A","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 2.3","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-184958056C@a31940c1d965bcb1@cgrcc-mission-score-0.1","recordKey":"AIR-184958056C@a31940c1d965bcb1","ruleId":"AIR-184958056C","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 9(1)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-E7F9A07274@453678b2d8eb8b8e@cgrcc-mission-score-0.1","recordKey":"AIR-E7F9A07274@453678b2d8eb8b8e","ruleId":"AIR-E7F9A07274","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 5.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-3B0B09F1A3@11413c778a47cf3c@cgrcc-mission-score-0.1","recordKey":"AIR-3B0B09F1A3@11413c778a47cf3c","ruleId":"AIR-3B0B09F1A3","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 17","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-F3D285541D@bc96e432e51bf4d2@cgrcc-mission-score-0.1","recordKey":"AIR-F3D285541D@bc96e432e51bf4d2","ruleId":"AIR-F3D285541D","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Manage 2.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-242001C9D0@d5bb3a8f15cc4543@cgrcc-mission-score-0.1","recordKey":"AIR-242001C9D0@d5bb3a8f15cc4543","ruleId":"AIR-242001C9D0","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Michigan State University"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"msu-genai-guidelines","url":"https://ai.msu.edu/guidelines","control":"Procuring or Registering, paragraph 2","version":"Approved August 12, 2025; no revisions listed","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-1003DA2A0B@0300bded90f382ce@cgrcc-mission-score-0.1","recordKey":"AIR-1003DA2A0B@0300bded90f382ce","ruleId":"AIR-1003DA2A0B","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Office of Management and Budget"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"omb-m-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=11","control":"4(e)(i)","version":"M-25-22","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-4AD720A286@fc42372987a55441@cgrcc-mission-score-0.1","recordKey":"AIR-4AD720A286@fc42372987a55441","ruleId":"AIR-4AD720A286","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Office of Management and Budget"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"omb-m-25-21","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf#page=16","control":"4(b)(ii)","version":"M-25-21","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-7939E9BF07@9a167fc297fb8774@cgrcc-mission-score-0.1","recordKey":"AIR-7939E9BF07@9a167fc297fb8774","ruleId":"AIR-7939E9BF07","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Office of Management and Budget"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"omb-m-25-21","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf#page=12","control":"3(b)(v)","version":"M-25-21","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-8EB0EC219E@b40bbbac8f211201@cgrcc-mission-score-0.1","recordKey":"AIR-8EB0EC219E@b40bbbac8f211201","ruleId":"AIR-8EB0EC219E","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 3.4","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-B098FE0267@9c690d85f3bff28c@cgrcc-mission-score-0.1","recordKey":"AIR-B098FE0267@9c690d85f3bff28c","ruleId":"AIR-B098FE0267","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 1.7","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-E069B1B813@d0e787d52df48a64@cgrcc-mission-score-0.1","recordKey":"AIR-E069B1B813@d0e787d52df48a64","ruleId":"AIR-E069B1B813","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 2.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-260ECC7519@acfa461478a2370b@cgrcc-mission-score-0.1","recordKey":"AIR-260ECC7519@acfa461478a2370b","ruleId":"AIR-260ECC7519","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 1.4","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-1394624FB2@17b1694d9f8b5889@cgrcc-mission-score-0.1","recordKey":"AIR-1394624FB2@17b1694d9f8b5889","ruleId":"AIR-1394624FB2","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 1.3","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-65283B4BFC@0734a37af474e127@cgrcc-mission-score-0.1","recordKey":"AIR-65283B4BFC@0734a37af474e127","ruleId":"AIR-65283B4BFC","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Manage 1.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-1A04293BCD@0d554e062cff5e8e@cgrcc-mission-score-0.1","recordKey":"AIR-1A04293BCD@0d554e062cff5e8e","ruleId":"AIR-1A04293BCD","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Michigan State University"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"msu-genai-guidelines","url":"https://ai.msu.edu/guidelines","control":"Teaching and Learning, detection paragraph","version":"Approved August 12, 2025; no revisions listed","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-604F1B8C71@46ee19ff4fd8682a@cgrcc-mission-score-0.1","recordKey":"AIR-604F1B8C71@46ee19ff4fd8682a","ruleId":"AIR-604F1B8C71","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["North Carolina Department of Information Technology"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nc-public-genai","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","control":"p.5, appropriate use, bullet 2","version":"1.1 — April 14, 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-6A21A315BB@d5897846efcefb70@cgrcc-mission-score-0.1","recordKey":"AIR-6A21A315BB@d5897846efcefb70","ruleId":"AIR-6A21A315BB","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 2.3","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-7B1A838FFF@e020695aeaedbd45@cgrcc-mission-score-0.1","recordKey":"AIR-7B1A838FFF@e020695aeaedbd45","ruleId":"AIR-7B1A838FFF","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 2.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-9EE4AB873B@619363766d1fff2c@cgrcc-mission-score-0.1","recordKey":"AIR-9EE4AB873B@619363766d1fff2c","ruleId":"AIR-9EE4AB873B","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 1.5","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-8822957DD8@04ee6dbcff4c4b33@cgrcc-mission-score-0.1","recordKey":"AIR-8822957DD8@04ee6dbcff4c4b33","ruleId":"AIR-8822957DD8","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 2.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-E477C3290A@a1d566c6c34de5c9@cgrcc-mission-score-0.1","recordKey":"AIR-E477C3290A@a1d566c6c34de5c9","ruleId":"AIR-E477C3290A","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 4.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-5C041B0CCA@7ea28a695e4aad1a@cgrcc-mission-score-0.1","recordKey":"AIR-5C041B0CCA@7ea28a695e4aad1a","ruleId":"AIR-5C041B0CCA","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 1.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-F61F6AC2CB@56d05301885c6e58@cgrcc-mission-score-0.1","recordKey":"AIR-F61F6AC2CB@56d05301885c6e58","ruleId":"AIR-F61F6AC2CB","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 1.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-AC404254CF@fdd21907e0626ce6@cgrcc-mission-score-0.1","recordKey":"AIR-AC404254CF@fdd21907e0626ce6","ruleId":"AIR-AC404254CF","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 4.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-98C41762F1@537bb60241a02d70@cgrcc-mission-score-0.1","recordKey":"AIR-98C41762F1@537bb60241a02d70","ruleId":"AIR-98C41762F1","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Manage 1.4","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-692200D867@2cf95dc9e58cedd1@cgrcc-mission-score-0.1","recordKey":"AIR-692200D867@2cf95dc9e58cedd1","ruleId":"AIR-692200D867","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 1.3","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-4306CEE8C8@b0544a675ee7f8b8@cgrcc-mission-score-0.1","recordKey":"AIR-4306CEE8C8@b0544a675ee7f8b8","ruleId":"AIR-4306CEE8C8","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 3.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-DD41393A6A@130e2fc97601e5c6@cgrcc-mission-score-0.1","recordKey":"AIR-DD41393A6A@130e2fc97601e5c6","ruleId":"AIR-DD41393A6A","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 1.6","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-C57A5D1D72@dc7e31aaa4a56cf2@cgrcc-mission-score-0.1","recordKey":"AIR-C57A5D1D72@dc7e31aaa4a56cf2","ruleId":"AIR-C57A5D1D72","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 12(1)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-9EC219543F@ebf1af41b7a47c54@cgrcc-mission-score-0.1","recordKey":"AIR-9EC219543F@ebf1af41b7a47c54","ruleId":"AIR-9EC219543F","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 7(3)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-6630D57F8E@2e89ffefec328e15@cgrcc-mission-score-0.1","recordKey":"AIR-6630D57F8E@2e89ffefec328e15","ruleId":"AIR-6630D57F8E","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 4","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-D8C5075D47@d84ddd521abe79d6@cgrcc-mission-score-0.1","recordKey":"AIR-D8C5075D47@d84ddd521abe79d6","ruleId":"AIR-D8C5075D47","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 15(4)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-96F8E30D4E@554a9bdfd5daf88b@cgrcc-mission-score-0.1","recordKey":"AIR-96F8E30D4E@554a9bdfd5daf88b","ruleId":"AIR-96F8E30D4E","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 72(1)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-2D3F66EE87@a9f992bc13c78b6e@cgrcc-mission-score-0.1","recordKey":"AIR-2D3F66EE87@a9f992bc13c78b6e","ruleId":"AIR-2D3F66EE87","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 17(1)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-972D7C9D89@f58f1a8cded65e60@cgrcc-mission-score-0.1","recordKey":"AIR-972D7C9D89@f58f1a8cded65e60","ruleId":"AIR-972D7C9D89","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 9(1)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-22E9FC8F8B@0dadc34a046b3598@cgrcc-mission-score-0.1","recordKey":"AIR-22E9FC8F8B@0dadc34a046b3598","ruleId":"AIR-22E9FC8F8B","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 15","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-601E866E1A@caf69c88ed9bf9fc@cgrcc-mission-score-0.1","recordKey":"AIR-601E866E1A@caf69c88ed9bf9fc","ruleId":"AIR-601E866E1A","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-genai-profile","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","control":"GV-1.4-001","version":"AI 600-1","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-6F2EEB6462@e739d9d7e4daf8e5@cgrcc-mission-score-0.1","recordKey":"AIR-6F2EEB6462@e739d9d7e4daf8e5","ruleId":"AIR-6F2EEB6462","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 5.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-D4E3A56AB8@aec3865ec09bb78e@cgrcc-mission-score-0.1","recordKey":"AIR-D4E3A56AB8@aec3865ec09bb78e","ruleId":"AIR-D4E3A56AB8","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 5.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-8F9AE0F269@a1d23a19bcf73815@cgrcc-mission-score-0.1","recordKey":"AIR-8F9AE0F269@a1d23a19bcf73815","ruleId":"AIR-8F9AE0F269","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 3.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-7F4EB9435F@004c59994b3cf4b5@cgrcc-mission-score-0.1","recordKey":"AIR-7F4EB9435F@004c59994b3cf4b5","ruleId":"AIR-7F4EB9435F","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 26(1)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-C1F74ECF84@7dc33a77a8d3a773@cgrcc-mission-score-0.1","recordKey":"AIR-C1F74ECF84@7dc33a77a8d3a773","ruleId":"AIR-C1F74ECF84","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 6(1)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-FD9E9E9724@1012ed2a7988dabb@cgrcc-mission-score-0.1","recordKey":"AIR-FD9E9E9724@1012ed2a7988dabb","ruleId":"AIR-FD9E9E9724","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 9(2)(a)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-9E0C4702D4@e3f3f142eb8523dc@cgrcc-mission-score-0.1","recordKey":"AIR-9E0C4702D4@e3f3f142eb8523dc","ruleId":"AIR-9E0C4702D4","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Manage 4.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-03619CE6CD@adca6df93b142c79@cgrcc-mission-score-0.1","recordKey":"AIR-03619CE6CD@adca6df93b142c79","ruleId":"AIR-03619CE6CD","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 4(5)","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-A7714C60EE@d62d0078bc9e65e1@cgrcc-mission-score-0.1","recordKey":"AIR-A7714C60EE@d62d0078bc9e65e1","ruleId":"AIR-A7714C60EE","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 5.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-F306231C79@caf52b00cf41c374@cgrcc-mission-score-0.1","recordKey":"AIR-F306231C79@caf52b00cf41c374","ruleId":"AIR-F306231C79","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 5(1)(f)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-FBD73FD1D8@fcebf6c55b97a17c@cgrcc-mission-score-0.1","recordKey":"AIR-FBD73FD1D8@fcebf6c55b97a17c","ruleId":"AIR-FBD73FD1D8","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 26(7)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-8E51985BF0@1e5d0cfb9d125308@cgrcc-mission-score-0.1","recordKey":"AIR-8E51985BF0@1e5d0cfb9d125308","ruleId":"AIR-8E51985BF0","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Virginia Information Technologies Agency"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"va-ai-ea400","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","control":"pp.6–7, AI Disclaimers","version":"EA400 — June 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-B9CECE710F@c4f81501268171a4@cgrcc-mission-score-0.1","recordKey":"AIR-B9CECE710F@c4f81501268171a4","ruleId":"AIR-B9CECE710F","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 50(3)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-86AF529571@ccb86427e4aadc8a@cgrcc-mission-score-0.1","recordKey":"AIR-86AF529571@ccb86427e4aadc8a","ruleId":"AIR-86AF529571","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 50(1)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-04690263D1@a422dc4de9c630fa@cgrcc-mission-score-0.1","recordKey":"AIR-04690263D1@a422dc4de9c630fa","ruleId":"AIR-04690263D1","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Manage 4.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-E3E35C8AE8@d9113f51a24ef8f6@cgrcc-mission-score-0.1","recordKey":"AIR-E3E35C8AE8@d9113f51a24ef8f6","ruleId":"AIR-E3E35C8AE8","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 1.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-9365A6ADE2@20d6eb8a48ebd2d4@cgrcc-mission-score-0.1","recordKey":"AIR-9365A6ADE2@20d6eb8a48ebd2d4","ruleId":"AIR-9365A6ADE2","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 1.6","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-6DAA5CD4FD@ec0680416b29fb99@cgrcc-mission-score-0.1","recordKey":"AIR-6DAA5CD4FD@ec0680416b29fb99","ruleId":"AIR-6DAA5CD4FD","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-genai-profile","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","control":"GV-1.6-001","version":"AI 600-1","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-B43991A570@e07dc0ac83da75fe@cgrcc-mission-score-0.1","recordKey":"AIR-B43991A570@e07dc0ac83da75fe","ruleId":"AIR-B43991A570","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-genai-profile","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","control":"GV-6.1-007","version":"AI 600-1","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-D1EC03300E@ff3e30b28afc2253@cgrcc-mission-score-0.1","recordKey":"AIR-D1EC03300E@ff3e30b28afc2253","ruleId":"AIR-D1EC03300E","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 1.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-F027EE41CE@d677a0372296b2c9@cgrcc-mission-score-0.1","recordKey":"AIR-F027EE41CE@d677a0372296b2c9","ruleId":"AIR-F027EE41CE","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 5(1)(b)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-423A77F29F@614fa00dae363777@cgrcc-mission-score-0.1","recordKey":"AIR-423A77F29F@614fa00dae363777","ruleId":"AIR-423A77F29F","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 53(1)(a)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-689F104CE2@0bd6e76036538bf1@cgrcc-mission-score-0.1","recordKey":"AIR-689F104CE2@0bd6e76036538bf1","ruleId":"AIR-689F104CE2","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 30(1)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-413925FF98@6b2df5091a42ef9a@cgrcc-mission-score-0.1","recordKey":"AIR-413925FF98@6b2df5091a42ef9a","ruleId":"AIR-413925FF98","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 4.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-5C96C1D94B@47902f34b3a364f5@cgrcc-mission-score-0.1","recordKey":"AIR-5C96C1D94B@47902f34b3a364f5","ruleId":"AIR-5C96C1D94B","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 50(2)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-F6290E21EB@f19e8c0b437c9d53@cgrcc-mission-score-0.1","recordKey":"AIR-F6290E21EB@f19e8c0b437c9d53","ruleId":"AIR-F6290E21EB","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 2.4","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-20C51AF468@80172ed3950e5a4e@cgrcc-mission-score-0.1","recordKey":"AIR-20C51AF468@80172ed3950e5a4e","ruleId":"AIR-20C51AF468","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 26(5)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-91B7104B7C@1ca75582d8a75712@cgrcc-mission-score-0.1","recordKey":"AIR-91B7104B7C@1ca75582d8a75712","ruleId":"AIR-91B7104B7C","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-genai-profile","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","control":"GV-1.5-003","version":"AI 600-1","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-E86C054724@9a8c36635cd43279@cgrcc-mission-score-0.1","recordKey":"AIR-E86C054724@9a8c36635cd43279","ruleId":"AIR-E86C054724","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Manage 3.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-8FFA25BD3B@f5e87ca6e56ca7ed@cgrcc-mission-score-0.1","recordKey":"AIR-8FFA25BD3B@f5e87ca6e56ca7ed","ruleId":"AIR-8FFA25BD3B","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-genai-profile","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","control":"GV-1.3-004","version":"AI 600-1","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-79A1D26388@51c5488b7e041703@cgrcc-mission-score-0.1","recordKey":"AIR-79A1D26388@51c5488b7e041703","ruleId":"AIR-79A1D26388","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-800-171-r3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=18","control":"03.01.02","version":"SP 800-171 Rev.3","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-D151BEE055@3af1ed44d6ed4b52@cgrcc-mission-score-0.1","recordKey":"AIR-D151BEE055@3af1ed44d6ed4b52","ruleId":"AIR-D151BEE055","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-800-53-r5","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=50","control":"AC-3","version":"SP 800-53 Rev.5 / Dec-2020 updates","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-239800B9C4@ae7e87dc03c931ad@cgrcc-mission-score-0.1","recordKey":"AIR-239800B9C4@ae7e87dc03c931ad","ruleId":"AIR-239800B9C4","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-csf-2","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=25","control":"PR.PS-04","version":"CSWP 29 / 2.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-6CFD9FC4BD@f48d56c08a6188da@cgrcc-mission-score-0.1","recordKey":"AIR-6CFD9FC4BD@f48d56c08a6188da","ruleId":"AIR-6CFD9FC4BD","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-csf-2","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=23","control":"ID.AM-02","version":"CSWP 29 / 2.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-64615EE538@7d73fe15bcc48eb4@cgrcc-mission-score-0.1","recordKey":"AIR-64615EE538@7d73fe15bcc48eb4","ruleId":"AIR-64615EE538","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-csf-2","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=23","control":"ID.AM-01","version":"CSWP 29 / 2.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-957F5E0FE9@cff4ebef1d4cca10@cgrcc-mission-score-0.1","recordKey":"AIR-957F5E0FE9@cff4ebef1d4cca10","ruleId":"AIR-957F5E0FE9","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-800-53-r5","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=63","control":"AC-6","version":"SP 800-53 Rev.5 / Dec-2020 updates","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-DD72BC62FE@e9b55167d1115092@cgrcc-mission-score-0.1","recordKey":"AIR-DD72BC62FE@e9b55167d1115092","ruleId":"AIR-DD72BC62FE","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-800-171-r3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=20","control":"03.01.05(a)","version":"SP 800-171 Rev.3","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-2711651405@ad3986b7b3466500@cgrcc-mission-score-0.1","recordKey":"AIR-2711651405@ad3986b7b3466500","ruleId":"AIR-2711651405","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-800-171-r3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=21","control":"03.01.07(a)","version":"SP 800-171 Rev.3","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-8014471E79@cd2299a5772a4c71@cgrcc-mission-score-0.1","recordKey":"AIR-8014471E79@cd2299a5772a4c71","ruleId":"AIR-8014471E79","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-csf-2","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=25","control":"PR.PS-05","version":"CSWP 29 / 2.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-93CD199B6D@eebad49411512bd1@cgrcc-mission-score-0.1","recordKey":"AIR-93CD199B6D@eebad49411512bd1","ruleId":"AIR-93CD199B6D","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-800-171-r3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=21","control":"03.01.07(b)","version":"SP 800-171 Rev.3","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-10D05FADF9@6b35afe41ac0a5f4@cgrcc-mission-score-0.1","recordKey":"AIR-10D05FADF9@6b35afe41ac0a5f4","ruleId":"AIR-10D05FADF9","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Manage 1.3","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-DDC1AF69E8@e01ae87beaf929ab@cgrcc-mission-score-0.1","recordKey":"AIR-DDC1AF69E8@e01ae87beaf929ab","ruleId":"AIR-DDC1AF69E8","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 5(1)(d)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-6C1ECA98A1@79971c442fa84f2e@cgrcc-mission-score-0.1","recordKey":"AIR-6C1ECA98A1@79971c442fa84f2e","ruleId":"AIR-6C1ECA98A1","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 11(1)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-1AE367EE4E@f16ee6fc6066cd00@cgrcc-mission-score-0.1","recordKey":"AIR-1AE367EE4E@f16ee6fc6066cd00","ruleId":"AIR-1AE367EE4E","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 10","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-8B497F4F74@731ecfa0018c376a@cgrcc-mission-score-0.1","recordKey":"AIR-8B497F4F74@731ecfa0018c376a","ruleId":"AIR-8B497F4F74","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Manage 1.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-0156EA65AB@302d0c170dbf354c@cgrcc-mission-score-0.1","recordKey":"AIR-0156EA65AB@302d0c170dbf354c","ruleId":"AIR-0156EA65AB","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 22(1)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-504A6F5FAE@a53448cc80e7901a@cgrcc-mission-score-0.1","recordKey":"AIR-504A6F5FAE@a53448cc80e7901a","ruleId":"AIR-504A6F5FAE","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 11","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-837D00B454@58d1236be88d2c69@cgrcc-mission-score-0.1","recordKey":"AIR-837D00B454@58d1236be88d2c69","ruleId":"AIR-837D00B454","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 53(1)(b)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-3E2FF36AEB@c549587bacfe6983@cgrcc-mission-score-0.1","recordKey":"AIR-3E2FF36AEB@c549587bacfe6983","ruleId":"AIR-3E2FF36AEB","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 13(2)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-130AE1C465@9bfdc1d72bba8156@cgrcc-mission-score-0.1","recordKey":"AIR-130AE1C465@9bfdc1d72bba8156","ruleId":"AIR-130AE1C465","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Treasury Board of Canada"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"ca-automated-decisions","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","control":"6.2.3","version":"Modified 2025-06-24","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-5E618A5099@99b7ad5ea4ffbf96@cgrcc-mission-score-0.1","recordKey":"AIR-5E618A5099@99b7ad5ea4ffbf96","ruleId":"AIR-5E618A5099","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 13","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-134DC94A5A@65d3e4c7bed571f0@cgrcc-mission-score-0.1","recordKey":"AIR-134DC94A5A@65d3e4c7bed571f0","ruleId":"AIR-134DC94A5A","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Treasury Board of Canada"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"ca-automated-decisions","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","control":"6.1.1","version":"Modified 2025-06-24","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-687C1F2AA0@c86677a938736f82@cgrcc-mission-score-0.1","recordKey":"AIR-687C1F2AA0@c86677a938736f82","ruleId":"AIR-687C1F2AA0","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 10","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-A98A489B02@5a563fee90bb52f1@cgrcc-mission-score-0.1","recordKey":"AIR-A98A489B02@5a563fee90bb52f1","ruleId":"AIR-A98A489B02","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["North Carolina Department of Information Technology"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nc-public-genai","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","control":"p.5, appropriate use, bullet 4","version":"1.1 — April 14, 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-014E35D5FC@903aba701d5fd191@cgrcc-mission-score-0.1","recordKey":"AIR-014E35D5FC@903aba701d5fd191","ruleId":"AIR-014E35D5FC","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 14","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-A3EACF1A4E@bdfcce3127b14f2e@cgrcc-mission-score-0.1","recordKey":"AIR-A3EACF1A4E@bdfcce3127b14f2e","ruleId":"AIR-A3EACF1A4E","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Manage 2.3","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-1B927E390F@90b0968cc7bd920f@cgrcc-mission-score-0.1","recordKey":"AIR-1B927E390F@90b0968cc7bd920f","ruleId":"AIR-1B927E390F","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 19(1)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-FC504B8B3E@44396d3a1667e971@cgrcc-mission-score-0.1","recordKey":"AIR-FC504B8B3E@44396d3a1667e971","ruleId":"AIR-FC504B8B3E","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 18(1)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-AEFB7467B3@e26b3eb75ade016c@cgrcc-mission-score-0.1","recordKey":"AIR-AEFB7467B3@e26b3eb75ade016c","ruleId":"AIR-AEFB7467B3","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Treasury Board of Canada"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"ca-automated-decisions","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","control":"6.2.5","version":"Modified 2025-06-24","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-48A3BA0A96@b263653f0a99c7ad@cgrcc-mission-score-0.1","recordKey":"AIR-48A3BA0A96@b263653f0a99c7ad","ruleId":"AIR-48A3BA0A96","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 28(1)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-7C668908A8@78cf8740a649a0f3@cgrcc-mission-score-0.1","recordKey":"AIR-7C668908A8@78cf8740a649a0f3","ruleId":"AIR-7C668908A8","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ssdf-1-1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=19","control":"PS.2.1","version":"SP 800-218 / SSDF 1.1","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-7AA947C3E4@118c7450b632ede7@cgrcc-mission-score-0.1","recordKey":"AIR-7AA947C3E4@118c7450b632ede7","ruleId":"AIR-7AA947C3E4","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ssdf-1-1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=18","control":"PS.1.1","version":"SP 800-218 / SSDF 1.1","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-C25C44E28B@2731fcfc158e2fa1@cgrcc-mission-score-0.1","recordKey":"AIR-C25C44E28B@2731fcfc158e2fa1","ruleId":"AIR-C25C44E28B","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 3.3","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-635250368A@6c55b8ae37092884@cgrcc-mission-score-0.1","recordKey":"AIR-635250368A@6c55b8ae37092884","ruleId":"AIR-635250368A","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 14","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-DA110B3EF2@5fb47f8a5be1b724@cgrcc-mission-score-0.1","recordKey":"AIR-DA110B3EF2@5fb47f8a5be1b724","ruleId":"AIR-DA110B3EF2","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 20(1)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-C8E01637B6@c05d05ad9a3b2910@cgrcc-mission-score-0.1","recordKey":"AIR-C8E01637B6@c05d05ad9a3b2910","ruleId":"AIR-C8E01637B6","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Pennsylvania Office of Administration"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"pa-ai-2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","control":"5.1.5, p.2","version":"Revision January 13, 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-E4C9EA7E18@d8c85f5cc0d70f15@cgrcc-mission-score-0.1","recordKey":"AIR-E4C9EA7E18@d8c85f5cc0d70f15","ruleId":"AIR-E4C9EA7E18","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 3.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-E528E1DA42@48d256608f07f2b5@cgrcc-mission-score-0.1","recordKey":"AIR-E528E1DA42@48d256608f07f2b5","ruleId":"AIR-E528E1DA42","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 2.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-0BD6CF8CF8@290628708f099b2a@cgrcc-mission-score-0.1","recordKey":"AIR-0BD6CF8CF8@290628708f099b2a","ruleId":"AIR-0BD6CF8CF8","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Treasury Board of Canada"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"ca-automated-decisions","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","control":"6.1.3","version":"Modified 2025-06-24","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-5F6922C679@da9d666ec3ecbe6e@cgrcc-mission-score-0.1","recordKey":"AIR-5F6922C679@da9d666ec3ecbe6e","ruleId":"AIR-5F6922C679","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Michigan State University"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"msu-genai-guidelines","url":"https://ai.msu.edu/guidelines","control":"Teaching and Learning, opening paragraph","version":"Approved August 12, 2025; no revisions listed","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-32BF4E5A3E@f2cce8e56cb500cf@cgrcc-mission-score-0.1","recordKey":"AIR-32BF4E5A3E@f2cce8e56cb500cf","ruleId":"AIR-32BF4E5A3E","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["Harvard University Information Technology","Pennsylvania Office of Administration"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"pa-ai-2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","control":"5.2, p.5","version":"Revision January 13, 2026","reviewState":"interpretation-needs-review"},{"sourceId":"harvard-genai-guidelines","url":"https://www.huit.harvard.edu/ai/guidelines","control":"Protect confidential data, paragraph 2","version":"Edition unspecified; prepared index checked 2026-09-28","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-1BD7B65A31@f37aeab29f1a8c48@cgrcc-mission-score-0.1","recordKey":"AIR-1BD7B65A31@f37aeab29f1a8c48","ruleId":"AIR-1BD7B65A31","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Town of Brookline, Massachusetts"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"brookline-genai","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","control":"Use, bullet 2","version":"1.7 — August 2025","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-FED5F6D978@b3cf26d93229f90e@cgrcc-mission-score-0.1","recordKey":"AIR-FED5F6D978@b3cf26d93229f90e","ruleId":"AIR-FED5F6D978","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 2.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-E59A08E459@33c8b38759b2908d@cgrcc-mission-score-0.1","recordKey":"AIR-E59A08E459@33c8b38759b2908d","ruleId":"AIR-E59A08E459","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 26(2)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-E98925E526@6bd2395b938c69d4@cgrcc-mission-score-0.1","recordKey":"AIR-E98925E526@6bd2395b938c69d4","ruleId":"AIR-E98925E526","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Map 3.5","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-2FB9BEA395@a3db1a2847eee5bc@cgrcc-mission-score-0.1","recordKey":"AIR-2FB9BEA395@a3db1a2847eee5bc","ruleId":"AIR-2FB9BEA395","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 3.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-4D850F7FFA@e43b05ce5986a37b@cgrcc-mission-score-0.1","recordKey":"AIR-4D850F7FFA@e43b05ce5986a37b","ruleId":"AIR-4D850F7FFA","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Virginia Information Technologies Agency"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"va-ai-ea400","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","control":"p.5, Ethical Use","version":"EA400 — June 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-9F0606F820@5012763ddf10c824@cgrcc-mission-score-0.1","recordKey":"AIR-9F0606F820@5012763ddf10c824","ruleId":"AIR-9F0606F820","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 14(1)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-BF19955A9B@735005e86bd3475f@cgrcc-mission-score-0.1","recordKey":"AIR-BF19955A9B@735005e86bd3475f","ruleId":"AIR-BF19955A9B","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 14(4)(d)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-72DBAB9908@83ef03fd64caec83@cgrcc-mission-score-0.1","recordKey":"AIR-72DBAB9908@83ef03fd64caec83","ruleId":"AIR-72DBAB9908","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 14(4)(c)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-0865D3E990@af385593071ea4c8@cgrcc-mission-score-0.1","recordKey":"AIR-0865D3E990@af385593071ea4c8","ruleId":"AIR-0865D3E990","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 14(4)(e)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-E0CAD3FF88@228493a9f6f40dd7@cgrcc-mission-score-0.1","recordKey":"AIR-E0CAD3FF88@228493a9f6f40dd7","ruleId":"AIR-E0CAD3FF88","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-genai-profile","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","control":"GV-1.3-002","version":"AI 600-1","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-6E499BCE84@df500105ee99c8b7@cgrcc-mission-score-0.1","recordKey":"AIR-6E499BCE84@df500105ee99c8b7","ruleId":"AIR-6E499BCE84","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 3.3","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-4045E1AF90@0676fdd2f6b2d7dc@cgrcc-mission-score-0.1","recordKey":"AIR-4045E1AF90@0676fdd2f6b2d7dc","ruleId":"AIR-4045E1AF90","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Virginia Information Technologies Agency"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"va-ai-ea400","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","control":"p.7, Transparency Requirements","version":"EA400 — June 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-D5475CA27F@94cb73d4ed08239d@cgrcc-mission-score-0.1","recordKey":"AIR-D5475CA27F@94cb73d4ed08239d","ruleId":"AIR-D5475CA27F","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Town of Brookline, Massachusetts"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"brookline-genai","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","control":"Use, recording-app bullet","version":"1.7 — August 2025","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-0AEC8A401C@b648927da35f5f88@cgrcc-mission-score-0.1","recordKey":"AIR-0AEC8A401C@b648927da35f5f88","ruleId":"AIR-0AEC8A401C","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 1.5","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-9987CCC485@6df1dc002d91d472@cgrcc-mission-score-0.1","recordKey":"AIR-9987CCC485@6df1dc002d91d472","ruleId":"AIR-9987CCC485","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Harvard University Information Technology"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"harvard-genai-guidelines","url":"https://www.huit.harvard.edu/ai/guidelines","control":"Review content before publishing or sharing","version":"Edition unspecified; prepared index checked 2026-09-28","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-FEDC04B3F1@f043d388f59ae1c8@cgrcc-mission-score-0.1","recordKey":"AIR-FEDC04B3F1@f043d388f59ae1c8","ruleId":"AIR-FEDC04B3F1","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Michigan State University"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"msu-genai-guidelines","url":"https://ai.msu.edu/guidelines","control":"General Expectations for Administrative Use","version":"Approved August 12, 2025; no revisions listed","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-7899BD6734@a456d1f9da1f7505@cgrcc-mission-score-0.1","recordKey":"AIR-7899BD6734@a456d1f9da1f7505","ruleId":"AIR-7899BD6734","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Pennsylvania Office of Administration"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"pa-ai-2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","control":"5.2.3, p.6","version":"Revision January 13, 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-DCFE285C28@80f8b54157b055cf@cgrcc-mission-score-0.1","recordKey":"AIR-DCFE285C28@80f8b54157b055cf","ruleId":"AIR-DCFE285C28","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["North Carolina Department of Information Technology"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nc-public-genai","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","control":"p.5, appropriate use, bullet 3","version":"1.1 — April 14, 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-6F83A570B6@c5a86b6e888d1e7e@cgrcc-mission-score-0.1","recordKey":"AIR-6F83A570B6@c5a86b6e888d1e7e","ruleId":"AIR-6F83A570B6","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NCSC, CISA and partners"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cisa-ncsc-secure-ai-development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","control":"Secure development / assets","version":"1.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-D8BE1AA186@1b20bfcc68fa1712@cgrcc-mission-score-0.1","recordKey":"AIR-D8BE1AA186@1b20bfcc68fa1712","ruleId":"AIR-D8BE1AA186","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 11","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-99485B54FC@def03c1901e63f94@cgrcc-mission-score-0.1","recordKey":"AIR-99485B54FC@def03c1901e63f94","ruleId":"AIR-99485B54FC","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Town of Brookline, Massachusetts"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"brookline-genai","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","control":"Use, security-review bullet","version":"1.7 — August 2025","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-E89D3740A1@1bbda13ba2404d8d@cgrcc-mission-score-0.1","recordKey":"AIR-E89D3740A1@1bbda13ba2404d8d","ruleId":"AIR-E89D3740A1","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 5(1)(g)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-471437DC20@654377fb15657e58@cgrcc-mission-score-0.1","recordKey":"AIR-471437DC20@654377fb15657e58","ruleId":"AIR-471437DC20","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 16","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-04A480E942@1fad5149884758b7@cgrcc-mission-score-0.1","recordKey":"AIR-04A480E942@1fad5149884758b7","ruleId":"AIR-04A480E942","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 17(1)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-231E86FCF1@f84f67f595b58984@cgrcc-mission-score-0.1","recordKey":"AIR-231E86FCF1@f84f67f595b58984","ruleId":"AIR-231E86FCF1","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 7(3)","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-C4036FF921@7b5c70c24f9fb8b6@cgrcc-mission-score-0.1","recordKey":"AIR-C4036FF921@7b5c70c24f9fb8b6","ruleId":"AIR-C4036FF921","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 2.10","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-65595252CE@0e47a820c6f27347@cgrcc-mission-score-0.1","recordKey":"AIR-65595252CE@0e47a820c6f27347","ruleId":"AIR-65595252CE","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Michigan State University"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"msu-genai-guidelines","url":"https://ai.msu.edu/guidelines","control":"Non-Permissible Uses, paragraph 3","version":"Approved August 12, 2025; no revisions listed","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-40C4A84CA0@d8e76ecbac03e5a2@cgrcc-mission-score-0.1","recordKey":"AIR-40C4A84CA0@d8e76ecbac03e5a2","ruleId":"AIR-40C4A84CA0","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 5(1)(e)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-5C638CD3DB@7aa35edd30765d47@cgrcc-mission-score-0.1","recordKey":"AIR-5C638CD3DB@7aa35edd30765d47","ruleId":"AIR-5C638CD3DB","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 5(1)(d)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-5DE52C1C2C@b8589288940671eb@cgrcc-mission-score-0.1","recordKey":"AIR-5DE52C1C2C@b8589288940671eb","ruleId":"AIR-5DE52C1C2C","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 5(1)(c)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-FED6DB2BF6@171f97503ad3de30@cgrcc-mission-score-0.1","recordKey":"AIR-FED6DB2BF6@171f97503ad3de30","ruleId":"AIR-FED6DB2BF6","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 33(1)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-9752AE9F94@6b370d1498673bd2@cgrcc-mission-score-0.1","recordKey":"AIR-9752AE9F94@6b370d1498673bd2","ruleId":"AIR-9752AE9F94","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Harvard University Information Technology"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"harvard-genai-guidelines","url":"https://www.huit.harvard.edu/ai/guidelines","control":"Use approved tools, bullet 3","version":"Edition unspecified; prepared index checked 2026-09-28","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-75F300981F@dbac33d943ce135d@cgrcc-mission-score-0.1","recordKey":"AIR-75F300981F@dbac33d943ce135d","ruleId":"AIR-75F300981F","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-800-53-r5","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=257","control":"PT-2(a)","version":"SP 800-53 Rev.5 / Dec-2020 updates","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-70303212C7@78ebdd02d253a65e@cgrcc-mission-score-0.1","recordKey":"AIR-70303212C7@78ebdd02d253a65e","ruleId":"AIR-70303212C7","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-800-53-r5","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=257","control":"PT-2(a)","version":"SP 800-53 Rev.5 / Dec-2020 updates","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-6486E8DBA4@a977535adfe8c5f9@cgrcc-mission-score-0.1","recordKey":"AIR-6486E8DBA4@a977535adfe8c5f9","ruleId":"AIR-6486E8DBA4","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-csf-2","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=25","control":"PR.DS-02","version":"CSWP 29 / 2.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-B39B348823@0bbd2c78b730d31a@cgrcc-mission-score-0.1","recordKey":"AIR-B39B348823@0bbd2c78b730d31a","ruleId":"AIR-B39B348823","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-800-53-r5","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=257","control":"PT-2(b)","version":"SP 800-53 Rev.5 / Dec-2020 updates","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-386B595FB5@7ef261ecda593467@cgrcc-mission-score-0.1","recordKey":"AIR-386B595FB5@7ef261ecda593467","ruleId":"AIR-386B595FB5","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 5(1)(a)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-685E3BDEA7@f7b18353a9f38d68@cgrcc-mission-score-0.1","recordKey":"AIR-685E3BDEA7@f7b18353a9f38d68","ruleId":"AIR-685E3BDEA7","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 11","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-CC0117ACB7@a39157a66d3ab446@cgrcc-mission-score-0.1","recordKey":"AIR-CC0117ACB7@a39157a66d3ab446","ruleId":"AIR-CC0117ACB7","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 5(1)(f)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-5D8AD7CDE4@25322c901b420703@cgrcc-mission-score-0.1","recordKey":"AIR-5D8AD7CDE4@25322c901b420703","ruleId":"AIR-5D8AD7CDE4","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 4(4)","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-8EDD597B2C@f5caafd8854d2856@cgrcc-mission-score-0.1","recordKey":"AIR-8EDD597B2C@f5caafd8854d2856","ruleId":"AIR-8EDD597B2C","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 12(1)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-974125D9F2@87ea56034db7850c@cgrcc-mission-score-0.1","recordKey":"AIR-974125D9F2@87ea56034db7850c","ruleId":"AIR-974125D9F2","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 44","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-3A61647692@f0f14c77d6718ec7@cgrcc-mission-score-0.1","recordKey":"AIR-3A61647692@f0f14c77d6718ec7","ruleId":"AIR-3A61647692","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 6.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-5EF003576B@fd8937807d4dd124@cgrcc-mission-score-0.1","recordKey":"AIR-5EF003576B@fd8937807d4dd124","ruleId":"AIR-5EF003576B","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Harvard University Information Technology"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"harvard-genai-guidelines","url":"https://www.huit.harvard.edu/ai/guidelines","control":"Use approved tools, bullet 2","version":"Edition unspecified; prepared index checked 2026-09-28","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-E05F392822@de62189c90557ced@cgrcc-mission-score-0.1","recordKey":"AIR-E05F392822@de62189c90557ced","ruleId":"AIR-E05F392822","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Office of Management and Budget"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"omb-m-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=10","control":"4(d)(ii)(E)","version":"M-25-22","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-A80EF3B4B0@98587c97b69b08d7@cgrcc-mission-score-0.1","recordKey":"AIR-A80EF3B4B0@98587c97b69b08d7","ruleId":"AIR-A80EF3B4B0","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Office of Management and Budget"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"omb-m-26-04","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf#page=5","control":"Appendix A.1(A)(i)","version":"M-26-04","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-21AFA15D02@a7811294bc65a07f@cgrcc-mission-score-0.1","recordKey":"AIR-21AFA15D02@a7811294bc65a07f","ruleId":"AIR-21AFA15D02","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Office of Management and Budget"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"omb-m-26-04","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf#page=3","control":"Agency Actions (c)","version":"M-26-04","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-8312DD76DB@0295ab913e4e3e62@cgrcc-mission-score-0.1","recordKey":"AIR-8312DD76DB@0295ab913e4e3e62","ruleId":"AIR-8312DD76DB","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 6.2","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-746FA0104C@5f1458d4a3aacef2@cgrcc-mission-score-0.1","recordKey":"AIR-746FA0104C@5f1458d4a3aacef2","ruleId":"AIR-746FA0104C","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Manage 3.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-69B1D0BD8A@60600a5b89d7c7bd@cgrcc-mission-score-0.1","recordKey":"AIR-69B1D0BD8A@60600a5b89d7c7bd","ruleId":"AIR-69B1D0BD8A","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NCSC, CISA and partners"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cisa-ncsc-secure-ai-development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","control":"Secure development / assets","version":"1.0","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-4EB0C43D04@c2e0b8c3781c5053@cgrcc-mission-score-0.1","recordKey":"AIR-4EB0C43D04@c2e0b8c3781c5053","ruleId":"AIR-4EB0C43D04","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Manage 4.3","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-EB5574CE22@27c89c0bee804f65@cgrcc-mission-score-0.1","recordKey":"AIR-EB5574CE22@27c89c0bee804f65","ruleId":"AIR-EB5574CE22","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-genai-profile","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","control":"GV-6.2-002","version":"AI 600-1","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-E358CEFA41@80b6874b881ca2de@cgrcc-mission-score-0.1","recordKey":"AIR-E358CEFA41@80b6874b881ca2de","ruleId":"AIR-E358CEFA41","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 4.3","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-0E39923F61@8a2f4d6b72dc1f31@cgrcc-mission-score-0.1","recordKey":"AIR-0E39923F61@8a2f4d6b72dc1f31","ruleId":"AIR-0E39923F61","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 4.1","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-347AC3B548@e04bac9bfaafb68a@cgrcc-mission-score-0.1","recordKey":"AIR-347AC3B548@e04bac9bfaafb68a","ruleId":"AIR-347AC3B548","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Manage 2.4","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-FC4DFA8060@27a742230b44339c@cgrcc-mission-score-0.1","recordKey":"AIR-FC4DFA8060@27a742230b44339c","ruleId":"AIR-FC4DFA8060","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 2.6","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-EBC5423CFD@2d0f74d7690e4f19@cgrcc-mission-score-0.1","recordKey":"AIR-EBC5423CFD@2d0f74d7690e4f19","ruleId":"AIR-EBC5423CFD","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["North Carolina Department of Information Technology"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nc-public-genai","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","control":"p.5, reporting, bullet 2","version":"1.1 — April 14, 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-F24F48122C@cabc825842e76334@cgrcc-mission-score-0.1","recordKey":"AIR-F24F48122C@cabc825842e76334","ruleId":"AIR-F24F48122C","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-genai-profile","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","control":"GV-1.3-007","version":"AI 600-1","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-4EE1F0E0DF@12b3a10bf8dfe8e7@cgrcc-mission-score-0.1","recordKey":"AIR-4EE1F0E0DF@12b3a10bf8dfe8e7","ruleId":"AIR-4EE1F0E0DF","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 73(1)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-D711D2E5E0@0561cd3d226d57ce@cgrcc-mission-score-0.1","recordKey":"AIR-D711D2E5E0@0561cd3d226d57ce","ruleId":"AIR-D711D2E5E0","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 55(1)(c)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-D1FFF5F35C@a4bcaf0acdb8196c@cgrcc-mission-score-0.1","recordKey":"AIR-D1FFF5F35C@a4bcaf0acdb8196c","ruleId":"AIR-D1FFF5F35C","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 5(1)(a)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-BB06F70AC1@ff157b8672270cb8@cgrcc-mission-score-0.1","recordKey":"AIR-BB06F70AC1@ff157b8672270cb8","ruleId":"AIR-BB06F70AC1","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 55(1)(d)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-63476788C2@c32c1f927a34ffb2@cgrcc-mission-score-0.1","recordKey":"AIR-63476788C2@c32c1f927a34ffb2","ruleId":"AIR-63476788C2","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 15(5)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-B8B189C1E1@00ac86f13ce23247@cgrcc-mission-score-0.1","recordKey":"AIR-B8B189C1E1@00ac86f13ce23247","ruleId":"AIR-B8B189C1E1","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 2.7","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-5D6EB58CC1@99e40328d1f59817@cgrcc-mission-score-0.1","recordKey":"AIR-5D6EB58CC1@99e40328d1f59817","ruleId":"AIR-5D6EB58CC1","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 5(1)(b)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-80606F42F7@b2d872cf597227e9@cgrcc-mission-score-0.1","recordKey":"AIR-80606F42F7@b2d872cf597227e9","ruleId":"AIR-80606F42F7","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-gdpr","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","control":"Article 32(1)","version":"Regulation 2016/679","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-49A6A9BEE4@a4d44b5353204e1b@cgrcc-mission-score-0.1","recordKey":"AIR-49A6A9BEE4@a4d44b5353204e1b","ruleId":"AIR-49A6A9BEE4","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Town of Brookline, Massachusetts"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"brookline-genai","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","control":"Use, prohibited-data bullet","version":"1.7 — August 2025","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-95F550699A@ee442d9172f563a6@cgrcc-mission-score-0.1","recordKey":"AIR-95F550699A@ee442d9172f563a6","ruleId":"AIR-95F550699A","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["North Carolina Department of Information Technology"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nc-public-genai","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","control":"p.5, reporting, bullet 1","version":"1.1 — April 14, 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-8D76274A01@40d42229a0510505@cgrcc-mission-score-0.1","recordKey":"AIR-8D76274A01@40d42229a0510505","ruleId":"AIR-8D76274A01","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["North Carolina Department of Information Technology","Town of Brookline, Massachusetts"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nc-public-genai","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","control":"p.5, data sharing, bullet 3","version":"1.1 — April 14, 2026","reviewState":"interpretation-needs-review"},{"sourceId":"brookline-genai","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","control":"Use, bullet 1","version":"1.7 — August 2025","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-0029859136@3d4d358d3575ab26@cgrcc-mission-score-0.1","recordKey":"AIR-0029859136@3d4d358d3575ab26","ruleId":"AIR-0029859136","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 17","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-D67362ED3A@462abb625892a08e@cgrcc-mission-score-0.1","recordKey":"AIR-D67362ED3A@462abb625892a08e","ruleId":"AIR-D67362ED3A","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 4(3)","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-50E6F7AEC2@782d3ec5f5a25e1c@cgrcc-mission-score-0.1","recordKey":"AIR-50E6F7AEC2@782d3ec5f5a25e1c","ruleId":"AIR-50E6F7AEC2","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Virginia Information Technologies Agency"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"va-ai-ea400","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","control":"p.6, Approval Workflow / Exemptions","version":"EA400 — June 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-59B6D94E34@f9b40f179c9acbff@cgrcc-mission-score-0.1","recordKey":"AIR-59B6D94E34@f9b40f179c9acbff","ruleId":"AIR-59B6D94E34","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ssdf-1-1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=25","control":"RV.1.1","version":"SP 800-218 / SSDF 1.1","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-BC2EBDF815@ba5cacc272d0c8ff@cgrcc-mission-score-0.1","recordKey":"AIR-BC2EBDF815@ba5cacc272d0c8ff","ruleId":"AIR-BC2EBDF815","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ssdf-1-1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=25","control":"RV.1.1","version":"SP 800-218 / SSDF 1.1","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-F52DD6D81F@f56b78a67bafc8d2@cgrcc-mission-score-0.1","recordKey":"AIR-F52DD6D81F@f56b78a67bafc8d2","ruleId":"AIR-F52DD6D81F","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-genai-profile","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","control":"GV-1.5-001","version":"AI 600-1","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-9B0903C354@7f143d94576da7f6@cgrcc-mission-score-0.1","recordKey":"AIR-9B0903C354@7f143d94576da7f6","ruleId":"AIR-9B0903C354","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 8","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-B8A087CCC2@0f50cbbae66bbfd9@cgrcc-mission-score-0.1","recordKey":"AIR-B8A087CCC2@0f50cbbae66bbfd9","ruleId":"AIR-B8A087CCC2","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 13(1)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-8530787112@ba8fd4d18125f749@cgrcc-mission-score-0.1","recordKey":"AIR-8530787112@ba8fd4d18125f749","ruleId":"AIR-8530787112","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"eu-ai-act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","control":"Article 50(4)","version":"Regulation 2024/1689; 2026 amendments tracked separately","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-0A0DBE76B1@7670d7e907c28472@cgrcc-mission-score-0.1","recordKey":"AIR-0A0DBE76B1@7670d7e907c28472","ruleId":"AIR-0A0DBE76B1","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Govern 1.4","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-2C63EF342D@baf1d5a6e6a95322@cgrcc-mission-score-0.1","recordKey":"AIR-2C63EF342D@baf1d5a6e6a95322","ruleId":"AIR-2C63EF342D","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-genai-profile","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","control":"GV-1.4-002","version":"AI 600-1","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-0CD56857BE@bfb7684b32e64d32@cgrcc-mission-score-0.1","recordKey":"AIR-0CD56857BE@bfb7684b32e64d32","ruleId":"AIR-0CD56857BE","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 8","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-2D2E913625@fed32907e88d1244@cgrcc-mission-score-0.1","recordKey":"AIR-2D2E913625@fed32907e88d1244","ruleId":"AIR-2D2E913625","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 2.8","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-BDE09E3088@51e3e0c4ac111b76@cgrcc-mission-score-0.1","recordKey":"AIR-BDE09E3088@51e3e0c4ac111b76","ruleId":"AIR-BDE09E3088","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Virginia Information Technologies Agency"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"va-ai-ea400","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","control":"p.5, Ethical Use","version":"EA400 — June 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-87BEC56E72@d70d49b2d92c4378@cgrcc-mission-score-0.1","recordKey":"AIR-87BEC56E72@d70d49b2d92c4378","ruleId":"AIR-87BEC56E72","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"nist-ai-rmf-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","control":"Measure 2.9","version":"AI RMF 1.0 (2023)","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-5CE518437C@c4b0b36befd2d652@cgrcc-mission-score-0.1","recordKey":"AIR-5CE518437C@c4b0b36befd2d652","ruleId":"AIR-5CE518437C","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 4(5)","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-1DD5F7B4C4@6a3dcdef0815bf45@cgrcc-mission-score-0.1","recordKey":"AIR-1DD5F7B4C4@6a3dcdef0815bf45","ruleId":"AIR-1DD5F7B4C4","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 12","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-66E5FC0789@4a2300431d80ddac@cgrcc-mission-score-0.1","recordKey":"AIR-66E5FC0789@4a2300431d80ddac","ruleId":"AIR-66E5FC0789","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Town of Brookline, Massachusetts"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"brookline-genai","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","control":"Use, transparency bullet","version":"1.7 — August 2025","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-7F72121E8B@b050cce0ee004acb@cgrcc-mission-score-0.1","recordKey":"AIR-7F72121E8B@b050cce0ee004acb","ruleId":"AIR-7F72121E8B","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Treasury Board of Canada"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"ca-automated-decisions","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","control":"6.2.2","version":"Modified 2025-06-24","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-E28075A396@c05f72a406998f94@cgrcc-mission-score-0.1","recordKey":"AIR-E28075A396@c05f72a406998f94","ruleId":"AIR-E28075A396","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Pennsylvania Office of Administration"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"pa-ai-2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","control":"5.2.4, pp.6–7","version":"Revision January 13, 2026","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-9F12707A1E@3404b8d82f57c69f@cgrcc-mission-score-0.1","recordKey":"AIR-9F12707A1E@3404b8d82f57c69f","ruleId":"AIR-9F12707A1E","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Treasury Board of Canada"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"ca-automated-decisions","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","control":"6.2.1","version":"Modified 2025-06-24","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"AIR-634CB1FAE6@9c443d797f303d0a@cgrcc-mission-score-0.1","recordKey":"AIR-634CB1FAE6@9c443d797f303d0a","ruleId":"AIR-634CB1FAE6","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["Cyberspace Administration of China and six departments"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"sourceId":"cn-genai-interim","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","control":"Article 8","version":"Order 15; effective 2023-08-15","reviewState":"interpretation-needs-review"}],"impactHint":null,"impactHintSource":null,"missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-01@82066dbd9b9a4f14@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-01@82066dbd9b9a4f14","ruleId":"MS-RULE-DP-01","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-800-53","locator":"IA-5; AC-4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"PR.AA; PR.DS","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM02 Sensitive Information Disclosure","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"IA-5; AC-4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"PR.AA; PR.DS","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM02 Sensitive Information Disclosure","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-02@d20cd6810e42f858@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-02@d20cd6810e42f858","ruleId":"MS-RULE-DP-02","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["GLBA","NIST","PCI SSC"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-800-53","locator":"IA-5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-PCI-DSS","locator":"Requirements 7–8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GLBA","locator":"16 CFR 314.4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"IA-5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-PCI-DSS","locator":"Requirements 7–8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GLBA","locator":"16 CFR 314.4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-03@4cbb47b109e98f4a@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-03@4cbb47b109e98f4a","ruleId":"MS-RULE-DP-03","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["OWASP","PCI SSC"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-PCI-DSS","locator":"Req. 3.4 and 4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM02","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-PCI-DSS","locator":"Req. 3.4 and 4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM02","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-04@13c6ba85197d9a69@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-04@13c6ba85197d9a69","ruleId":"MS-RULE-DP-04","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["OWASP","PCI SSC"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-PCI-DSS","locator":"Req. 3.3.1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM02","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-PCI-DSS","locator":"Req. 3.3.1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM02","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-05@30a7a6fc8d2d373f@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-05@30a7a6fc8d2d373f","ruleId":"MS-RULE-DP-05","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["European Union","FERPA","HIPAA"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-GDPR","locator":"Arts. 5, 25, 32","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-HIPAA","locator":"45 CFR 164.514(b) identifiers","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-FERPA","locator":"34 CFR 99.3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 5, 25, 32","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-HIPAA","locator":"45 CFR 164.514(b) identifiers","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-FERPA","locator":"34 CFR 99.3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-06@af062b3863346b41@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-06@af062b3863346b41","ruleId":"MS-RULE-DP-06","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["European Union","GLBA"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-GLBA","locator":"16 CFR 314.4","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 5 and 32","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GLBA","locator":"16 CFR 314.4","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 5 and 32","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-07@94c870d43e4286ab@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-07@94c870d43e4286ab","ruleId":"MS-RULE-DP-07","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["HIPAA","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-HIPAA","locator":"45 CFR 164.502; 164.308; 164.312","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Data Privacy risk actions","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-HIPAA","locator":"45 CFR 164.502; 164.308; 164.312","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Data Privacy risk actions","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-08@f94b476097640eb3@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-08@f94b476097640eb3","ruleId":"MS-RULE-DP-08","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["FERPA","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-FERPA","locator":"34 CFR 99.30; 99.37","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Data Privacy","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-FERPA","locator":"34 CFR 99.30; 99.37","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Data Privacy","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-09@e32553c4840951b3@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-09@e32553c4840951b3","ruleId":"MS-RULE-DP-09","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["CCPA-CPRA","European Union","HIPAA"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-GDPR","locator":"Arts. 5, 25, 32","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-CCPA-CPRA","locator":"Personal information; reasonable security","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-HIPAA","locator":"45 CFR 164.514(b)","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 5, 25, 32","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-CCPA-CPRA","locator":"Personal information; reasonable security","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-HIPAA","locator":"45 CFR 164.514(b)","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-10@fc6f0a161d4f201f@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-10@fc6f0a161d4f201f","ruleId":"MS-RULE-DP-10","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["CCPA-CPRA","European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-GDPR","locator":"Arts. 9, 25, 32","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-CCPA-CPRA","locator":"Sensitive personal information","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Arts. 5, 9, 10","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 9, 25, 32","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-CCPA-CPRA","locator":"Sensitive personal information","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Arts. 5, 9, 10","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-11@b7d96f7e1501e4ed@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-11@b7d96f7e1501e4ed","ruleId":"MS-RULE-DP-11","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["CCPA-CPRA","European Union"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-GDPR","locator":"Arts. 5, 25, 32","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-CCPA-CPRA","locator":"Sensitive personal information","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 5, 25, 32","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-CCPA-CPRA","locator":"Sensitive personal information","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-12@4ae51c2523134e28@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-12@4ae51c2523134e28","ruleId":"MS-RULE-DP-12","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","US federal executive policy"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-800-53","locator":"AC-4; MP; SC families","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-FEDRAMP","locator":"Information-flow and boundary controls","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"AC-4; MP; SC families","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-FEDRAMP","locator":"Information-flow and boundary controls","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-13@1299bbf89c50bd1a@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-13@1299bbf89c50bd1a","ruleId":"MS-RULE-DP-13","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","US federal executive policy"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-800-53","locator":"AC-4; PL-8","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"Agency risk management","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"AC-4; PL-8","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"Agency risk management","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-14@7b898303f53ec49b@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-14@7b898303f53ec49b","ruleId":"MS-RULE-DP-14","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["AICPA","NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-SOC2","locator":"C1.1 Confidentiality","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"PR.DS","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM02","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"C1.1 Confidentiality","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"PR.DS","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM02","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-15@208a0f796d79405e@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-15@208a0f796d79405e","ruleId":"MS-RULE-DP-15","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["AICPA","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-CSF2","locator":"ID.RA; PR.PS","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"CM-8; RA-5; SC-7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"CC4.2; CC6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"ID.RA; PR.PS","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"CM-8; RA-5; SC-7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"CC4.2; CC6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-16@d0dca88853814a51@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-16@d0dca88853814a51","ruleId":"MS-RULE-DP-16","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["AICPA","European Union","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-SOC2","locator":"C1.1; P-series","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 5 and 32","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Data Privacy","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"C1.1; P-series","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 5 and 32","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Data Privacy","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-17@d1c8e0c542b0a6f6@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-17@d1c8e0c542b0a6f6","ruleId":"MS-RULE-DP-17","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["AICPA","SOX"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-SOX","locator":"Reporting integrity / ICFR","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"Confidentiality","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOX","locator":"Reporting integrity / ICFR","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"Confidentiality","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-18@082a5a202e1a48ef@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-18@082a5a202e1a48ef","ruleId":"MS-RULE-DP-18","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["AICPA","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-SOC2","locator":"C1.1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"PR.DS","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"C1.1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"PR.DS","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AU-01@32b7d4ac14b06f7b@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AU-01@32b7d4ac14b06f7b","ruleId":"MS-RULE-AU-01","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-AI-600-1","locator":"Approved GAI provider lists","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"GV.SC; ID.AM","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Approved GAI provider lists","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"GV.SC; ID.AM","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AU-02@1a166eaeb8f7f1ad@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AU-02@1a166eaeb8f7f1ad","ruleId":"MS-RULE-AU-02","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["GLBA","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-GLBA","locator":"16 CFR 314.4; MFA","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"IA-2; IA-5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"PR.AA","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GLBA","locator":"16 CFR 314.4; MFA","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"IA-2; IA-5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"PR.AA","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AU-03@ece0c972ca2c62e1@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AU-03@ece0c972ca2c62e1","ruleId":"MS-RULE-AU-03","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["AICPA","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-800-53","locator":"AC-2; AC-3; AC-6","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"CC6.1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"AC-2; AC-3; AC-6","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"CC6.1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AU-04@d51101a040857487@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AU-04@d51101a040857487","ruleId":"MS-RULE-AU-04","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["European Union","ISO/IEC","US federal executive policy"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-EU-AI-ACT","locator":"Arts. 9 and 26","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-ISO-42005","locator":"AI impact assessment","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"High-impact AI practices","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Arts. 9 and 26","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-ISO-42005","locator":"AI impact assessment","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"High-impact AI practices","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AU-05@7c58fddd6817f607@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AU-05@7c58fddd6817f607","ruleId":"MS-RULE-AU-05","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["European Union","US federal executive policy"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-GDPR","locator":"Arts. 5, 25, 32","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-22","locator":"Acquisition and data terms","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 5, 25, 32","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-22","locator":"Acquisition and data terms","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AU-06@e8c8f3b771054fbc@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AU-06@e8c8f3b771054fbc","ruleId":"MS-RULE-AU-06","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["AICPA","European Union","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-AI-600-1","locator":"Third-party and value-chain actions","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"Confidentiality and privacy","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Purpose limitation","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Third-party and value-chain actions","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"Confidentiality and privacy","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Purpose limitation","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AU-07@989c3a6787fc6689@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AU-07@989c3a6787fc6689","ruleId":"MS-RULE-AU-07","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["AICPA","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-800-53","locator":"IA-2; AC-2","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"CC6.1","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"IA-2; AC-2","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"CC6.1","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AU-08@4eda0a221f3ef380@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AU-08@4eda0a221f3ef380","ruleId":"MS-RULE-AU-08","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-CSF2","locator":"ID.AM","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Approved provider lists","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM04 Supply Chain","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"ID.AM","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Approved provider lists","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM04 Supply Chain","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-IN-01@e4fe11be1a20f12f@cgrcc-mission-score-0.1","recordKey":"MS-RULE-IN-01@e4fe11be1a20f12f","ruleId":"MS-RULE-IN-01","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM01 Prompt Injection","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Information Security risk actions","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM01 Prompt Injection","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Information Security risk actions","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-IN-02@dbb47a84e8a96c05@cgrcc-mission-score-0.1","recordKey":"MS-RULE-IN-02@dbb47a84e8a96c05","ruleId":"MS-RULE-IN-02","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM01","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM08 Hidden Context Exposure","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM01","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM08 Hidden Context Exposure","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-IN-03@900d1ac2806dab1c@cgrcc-mission-score-0.1","recordKey":"MS-RULE-IN-03@900d1ac2806dab1c","ruleId":"MS-RULE-IN-03","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM01","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Pre-deployment testing","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM01","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Pre-deployment testing","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-IN-04@40341d186f0bd606@cgrcc-mission-score-0.1","recordKey":"MS-RULE-IN-04@40341d186f0bd606","ruleId":"MS-RULE-IN-04","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-AI-600-1","locator":"Information Security; Dangerous/Violent content","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM03 Excessive Agency","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Information Security; Dangerous/Violent content","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM03 Excessive Agency","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-IN-05@8dff43ab30881e3f@cgrcc-mission-score-0.1","recordKey":"MS-RULE-IN-05@8dff43ab30881e3f","ruleId":"MS-RULE-IN-05","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-CSF2","locator":"PR.DS; DE.CM","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM04 Supply Chain","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"PR.DS; DE.CM","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM04 Supply Chain","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-IN-06@478a04da335c1e7f@cgrcc-mission-score-0.1","recordKey":"MS-RULE-IN-06@478a04da335c1e7f","ruleId":"MS-RULE-IN-06","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM05 Data and Model Poisoning","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM09 Vector and Embedding Weaknesses","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Data governance and testing","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM05 Data and Model Poisoning","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM09 Vector and Embedding Weaknesses","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Data governance and testing","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-IN-07@31e317962beaeb5b@cgrcc-mission-score-0.1","recordKey":"MS-RULE-IN-07@31e317962beaeb5b","ruleId":"MS-RULE-IN-07","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["European Union","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-AI-600-1","locator":"Acceptable-use policies","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Arts. 9, 13, 26","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Acceptable-use policies","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Arts. 9, 13, 26","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-IN-08@94324ccfd3a491ef@cgrcc-mission-score-0.1","recordKey":"MS-RULE-IN-08@94324ccfd3a491ef","ruleId":"MS-RULE-IN-08","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM06 Unbounded Consumption","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Operational monitoring","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM06 Unbounded Consumption","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Operational monitoring","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OU-01@d0805195b855c7dd@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OU-01@d0805195b855c7dd","ruleId":"MS-RULE-OU-01","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["European Union","NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM02","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Detect PII in outputs","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 25 and 32","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM02","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Detect PII in outputs","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 25 and 32","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OU-02@4965655028a3d485@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OU-02@4965655028a3d485","ruleId":"MS-RULE-OU-02","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM08 Hidden Context Exposure","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM02","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM08 Hidden Context Exposure","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM02","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OU-03@ce8e31e07eb4da96@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OU-03@ce8e31e07eb4da96","ruleId":"MS-RULE-OU-03","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM07 Misinformation","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Confabulation; source/citation review","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM07 Misinformation","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Confabulation; source/citation review","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OU-04@4f3b3444715b2744@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OU-04@4f3b3444715b2744","ruleId":"MS-RULE-OU-04","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["European Union","US federal executive policy"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-EU-AI-ACT","locator":"Arts. 14 and 26","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Art. 22","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"Human oversight and fail-safe","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Arts. 14 and 26","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Art. 22","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"Human oversight and fail-safe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OU-05@cb5aeaa742fb4521@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OU-05@cb5aeaa742fb4521","ruleId":"MS-RULE-OU-05","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["CO-AI","European Union","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-EU-AI-ACT","locator":"Arts. 9, 10, 15","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Harmful Bias and Homogenization","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-CO-AI","locator":"High-risk AI governance","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Arts. 9, 10, 15","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Harmful Bias and Homogenization","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-CO-AI","locator":"High-risk AI governance","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OU-06@ce0137df984ac601@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OU-06@ce0137df984ac601","ruleId":"MS-RULE-OU-06","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-AI-600-1","locator":"Harmful Bias; Human-AI Configuration","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Harmful Bias; Human-AI Configuration","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OU-07@7d5bc203e83e95c9@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OU-07@7d5bc203e83e95c9","ruleId":"MS-RULE-OU-07","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["European Union","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-AI-600-1","locator":"Dangerous/Violent or Hateful Content; CBRN","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Art. 5 where applicable","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Dangerous/Violent or Hateful Content; CBRN","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Art. 5 where applicable","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OU-08@4c7bb6dc00dfcbfd@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OU-08@4c7bb6dc00dfcbfd","ruleId":"MS-RULE-OU-08","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM10 Improper Output Handling","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"PR.PS","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM10 Improper Output Handling","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"PR.PS","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OU-09@2ffb1322457172b3@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OU-09@2ffb1322457172b3","ruleId":"MS-RULE-OU-09","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM10 Improper Output Handling","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Information Security","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM10 Improper Output Handling","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Information Security","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OU-10@2332653b89bcd331@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OU-10@2332653b89bcd331","ruleId":"MS-RULE-OU-10","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["European Union","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-AI-600-1","locator":"Intellectual Property","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"GPAI transparency obligations","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Intellectual Property","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"GPAI transparency obligations","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OU-11@0710643d8a955cf6@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OU-11@0710643d8a955cf6","ruleId":"MS-RULE-OU-11","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["European Union","HIPAA"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-GDPR","locator":"Arts. 5, 25, 32, 35","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-HIPAA","locator":"45 CFR 164.514","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 5, 25, 32, 35","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-HIPAA","locator":"45 CFR 164.514","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OU-12@295cdecda41b8b55@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OU-12@295cdecda41b8b55","ruleId":"MS-RULE-OU-12","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["CO-AI","European Union","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-EU-AI-ACT","locator":"Art. 50","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-CO-AI","locator":"Chatbot and AI disclosures","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Content provenance","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Art. 50","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-CO-AI","locator":"Chatbot and AI disclosures","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Content provenance","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AG-01@e6aee1767c267990@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AG-01@e6aee1767c267990","ruleId":"MS-RULE-AG-01","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM03 Excessive Agency","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM04 Supply Chain","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM03 Excessive Agency","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM04 Supply Chain","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AG-02@d4d178c0433fd6d4@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AG-02@d4d178c0433fd6d4","ruleId":"MS-RULE-AG-02","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-800-53","locator":"AC-6; IA-5","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM03","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"AC-6; IA-5","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM03","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AG-03@20aa3c90fa880f0d@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AG-03@20aa3c90fa880f0d","ruleId":"MS-RULE-AG-03","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["European Union","OWASP","US federal executive policy"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM03","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Art. 14","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"Human oversight and fail-safe","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM03","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Art. 14","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"Human oversight and fail-safe","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AG-04@c7af717b1d68045e@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AG-04@c7af717b1d68045e","ruleId":"MS-RULE-AG-04","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["European Union","US federal executive policy"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-GDPR","locator":"Art. 22","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Arts. 14 and 26","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"High-impact AI","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Art. 22","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Arts. 14 and 26","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"High-impact AI","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AG-05@8829d873310f18f9@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AG-05@8829d873310f18f9","ruleId":"MS-RULE-AG-05","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM03","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Human-AI Configuration","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM03","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Human-AI Configuration","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AG-06@6371f819b40b0d97@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AG-06@6371f819b40b0d97","ruleId":"MS-RULE-AG-06","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM03","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"AC-3; CM-3","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM03","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"AC-3; CM-3","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AG-07@c2fb36c556cb8a62@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AG-07@c2fb36c556cb8a62","ruleId":"MS-RULE-AG-07","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM03; LLM06","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM03; LLM06","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AG-08@b98e349c6e27f319@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AG-08@b98e349c6e27f319","ruleId":"MS-RULE-AG-08","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["AICPA","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM08; LLM09","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"CC6; Confidentiality","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM08; LLM09","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"CC6; Confidentiality","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AG-09@2bd07e82a72d4f2e@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AG-09@2bd07e82a72d4f2e","ruleId":"MS-RULE-AG-09","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["European Union","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM05; LLM08","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 5 and 25","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM05; LLM08","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 5 and 25","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AG-10@41b899de0bf0744b@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AG-10@41b899de0bf0744b","ruleId":"MS-RULE-AG-10","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","OWASP"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM04","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"GV.SC; ID.RA","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM04","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"GV.SC; ID.RA","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-01@ce84968e8045ef9e@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-01@ce84968e8045ef9e","ruleId":"MS-RULE-OP-01","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["AICPA","European Union","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-EU-AI-ACT","locator":"Art. 12","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"AU family","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"CC7","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Art. 12","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"AU family","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-SOC2","locator":"CC7","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-02@7147e78f71e89fcb@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-02@7147e78f71e89fcb","ruleId":"MS-RULE-OP-02","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["European Union","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-AI-600-1","locator":"Content provenance and source review","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Arts. 13 and 50","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Content provenance and source review","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Arts. 13 and 50","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-03@410599212edc432e@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-03@410599212edc432e","ruleId":"MS-RULE-OP-03","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["European Union","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-AI-RMF","locator":"MEASURE and MANAGE","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Ongoing monitoring","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Arts. 9 and 15","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-RMF","locator":"MEASURE and MANAGE","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Ongoing monitoring","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Arts. 9 and 15","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-04@63fbf478664e5e99@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-04@63fbf478664e5e99","ruleId":"MS-RULE-OP-04","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-CSF2","locator":"RS and RC","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-RMF","locator":"MANAGE","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"RS and RC","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-RMF","locator":"MANAGE","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-05@98df9a80a2151ad4@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-05@98df9a80a2151ad4","ruleId":"MS-RULE-OP-05","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["European Union","NIST","US federal executive policy"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OMB-M25-21","locator":"Fail-safe and discontinuation","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Halt systems presenting unacceptable risk","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Art. 14","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"Fail-safe and discontinuation","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Halt systems presenting unacceptable risk","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Art. 14","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-06@6ecbeba4e14a59af@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-06@6ecbeba4e14a59af","ruleId":"MS-RULE-OP-06","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["ISO/IEC","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-ISO-5338","locator":"AI system lifecycle","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-ISO-42005","locator":"Impact reassessment","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-RMF","locator":"GOVERN/MANAGE","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-ISO-5338","locator":"AI system lifecycle","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-ISO-42005","locator":"Impact reassessment","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-RMF","locator":"GOVERN/MANAGE","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-07@f1df2cbcb724af3b@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-07@f1df2cbcb724af3b","ruleId":"MS-RULE-OP-07","modelVersion":"cgrcc-mission-score-0.1","value":20,"computedAt":"2026-10-16","body":{"score":20,"reviewedScore":null,"supportingFamilies":["NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-AI-RMF","locator":"Risk treatment and accountability","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"CA-5; risk acceptance context","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-RMF","locator":"Risk treatment and accountability","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-800-53","locator":"CA-5; risk acceptance context","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-08@a38dff87950aa40f@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-08@a38dff87950aa40f","ruleId":"MS-RULE-OP-08","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["European Union","US federal executive policy"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OMB-M25-21","locator":"Remedies and human review","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 13–15 and 22","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Human oversight/transparency","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"Remedies and human review","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 13–15 and 22","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Human oversight/transparency","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-09@ec587343b8220a51@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-09@ec587343b8220a51","ruleId":"MS-RULE-OP-09","modelVersion":"cgrcc-mission-score-0.1","value":40,"computedAt":"2026-10-16","body":{"score":40,"reviewedScore":null,"supportingFamilies":["NIST","US federal executive policy"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-CSF2","locator":"ID.AM","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-RMF","locator":"GOVERN/MAP","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"Annual AI use-case inventory","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"ID.AM","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-RMF","locator":"GOVERN/MAP","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"Annual AI use-case inventory","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-10@8c831bc5659a4340@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-10@8c831bc5659a4340","ruleId":"MS-RULE-OP-10","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["NIST","OWASP","US federal executive policy"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-OWASP-LLM-2026","locator":"LLM04","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"GV.SC","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-22","locator":"AI acquisition","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OWASP-LLM-2026","locator":"LLM04","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-CSF2","locator":"GV.SC","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-22","locator":"AI acquisition","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-11@a024a5509524bfa2@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-11@a024a5509524bfa2","ruleId":"MS-RULE-OP-11","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["European Union","ISO/IEC","NIST"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-GDPR","locator":"Arts. 5 and 17","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-ISO-5338","locator":"Lifecycle processes","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-RMF","locator":"MANAGE","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-GDPR","locator":"Arts. 5 and 17","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-ISO-5338","locator":"Lifecycle processes","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-RMF","locator":"MANAGE","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-12@04d0287d10225094@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-12@04d0287d10225094","ruleId":"MS-RULE-OP-12","modelVersion":"cgrcc-mission-score-0.1","value":60,"computedAt":"2026-10-16","body":{"score":60,"reviewedScore":null,"supportingFamilies":["European Union","NIST","US federal executive policy"],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[{"framework":"FW-NIST-AI-600-1","locator":"Pre-deployment testing; go/no-go thresholds","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Arts. 9 and 15","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"Pre-deployment testing and independent review","sourceKey":"workbook-38dbe80823a08687@65c7282ca4ef","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-NIST-AI-600-1","locator":"Pre-deployment testing; go/no-go thresholds","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-EU-AI-ACT","locator":"Arts. 9 and 15","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"},{"framework":"FW-OMB-M25-21","locator":"Pre-deployment testing and independent review","sourceKey":"workbook-90529719e3e3b5bc@943924618a78","reviewState":"WORKBOOK_CROSSWALK_UNVERIFIED"}],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-001@509512b407ba323f@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-001@509512b407ba323f","ruleId":"MS-CAND-NEW-001","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-002@dd7cd2c2185cb3be@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-002@dd7cd2c2185cb3be","ruleId":"MS-CAND-NEW-002","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-003@7f66b26f02e70247@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-003@7f66b26f02e70247","ruleId":"MS-CAND-NEW-003","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-004@1f7783b7dfd1c8f0@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-004@1f7783b7dfd1c8f0","ruleId":"MS-CAND-NEW-004","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-005@661eef265a01d387@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-005@661eef265a01d387","ruleId":"MS-CAND-NEW-005","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-006@2b402714e7447ef9@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-006@2b402714e7447ef9","ruleId":"MS-CAND-NEW-006","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-007@1968c0b4da07c794@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-007@1968c0b4da07c794","ruleId":"MS-CAND-NEW-007","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-008@7f5e7d46a2aad819@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-008@7f5e7d46a2aad819","ruleId":"MS-CAND-NEW-008","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-009@dc38476b6ec92927@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-009@dc38476b6ec92927","ruleId":"MS-CAND-NEW-009","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-010@1f0aa4ed22f3b974@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-010@1f0aa4ed22f3b974","ruleId":"MS-CAND-NEW-010","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-011@eb8c525f119b2451@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-011@eb8c525f119b2451","ruleId":"MS-CAND-NEW-011","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-012@63aeb4ef30b9a5ea@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-012@63aeb4ef30b9a5ea","ruleId":"MS-CAND-NEW-012","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-013@4a78d015b8aed3b2@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-013@4a78d015b8aed3b2","ruleId":"MS-CAND-NEW-013","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-014@a900830f86017334@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-014@a900830f86017334","ruleId":"MS-CAND-NEW-014","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-015@059ceef5f7f28f3e@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-015@059ceef5f7f28f3e","ruleId":"MS-CAND-NEW-015","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-016@a111ada45bf38256@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-016@a111ada45bf38256","ruleId":"MS-CAND-NEW-016","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-017@b5e5161410a8d580@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-017@b5e5161410a8d580","ruleId":"MS-CAND-NEW-017","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-018@54f9a4e37a671e7a@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-018@54f9a4e37a671e7a","ruleId":"MS-CAND-NEW-018","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-019@cfda8bff95bda54a@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-019@cfda8bff95bda54a","ruleId":"MS-CAND-NEW-019","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-020@49217c323c1ec189@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-020@49217c323c1ec189","ruleId":"MS-CAND-NEW-020","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-021@acf75b35650aad9b@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-021@acf75b35650aad9b","ruleId":"MS-CAND-NEW-021","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-022@2d639205a30919ff@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-022@2d639205a30919ff","ruleId":"MS-CAND-NEW-022","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-023@2359834ed0531f83@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-023@2359834ed0531f83","ruleId":"MS-CAND-NEW-023","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-024@bbb6556715869f07@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-024@bbb6556715869f07","ruleId":"MS-CAND-NEW-024","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-025@b5f600cff2931a26@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-025@b5f600cff2931a26","ruleId":"MS-CAND-NEW-025","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-026@3215de61044934fd@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-026@3215de61044934fd","ruleId":"MS-CAND-NEW-026","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-027@75eb3c7b5cd5ffbf@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-027@75eb3c7b5cd5ffbf","ruleId":"MS-CAND-NEW-027","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-028@0bc326f2a1492a55@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-028@0bc326f2a1492a55","ruleId":"MS-CAND-NEW-028","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-029@e06b2e60826dc541@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-029@e06b2e60826dc541","ruleId":"MS-CAND-NEW-029","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-030@97f8b2f2a700caa5@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-030@97f8b2f2a700caa5","ruleId":"MS-CAND-NEW-030","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-031@898c23d1d41d6929@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-031@898c23d1d41d6929","ruleId":"MS-CAND-NEW-031","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-032@e78704005029c4c5@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-032@e78704005029c4c5","ruleId":"MS-CAND-NEW-032","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-033@09f4aaa7beb703f8@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-033@09f4aaa7beb703f8","ruleId":"MS-CAND-NEW-033","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-034@fc985e372c91fbe4@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-034@fc985e372c91fbe4","ruleId":"MS-CAND-NEW-034","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-035@30e918c1ae393723@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-035@30e918c1ae393723","ruleId":"MS-CAND-NEW-035","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-036@a37923d38786c3fa@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-036@a37923d38786c3fa","ruleId":"MS-CAND-NEW-036","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-037@bf9ef6fc19602a76@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-037@bf9ef6fc19602a76","ruleId":"MS-CAND-NEW-037","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-038@4decd1c8f441e4ba@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-038@4decd1c8f441e4ba","ruleId":"MS-CAND-NEW-038","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-039@7695f412051bd33a@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-039@7695f412051bd33a","ruleId":"MS-CAND-NEW-039","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-040@b23f7245c8e57ed5@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-040@b23f7245c8e57ed5","ruleId":"MS-CAND-NEW-040","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-041@5627d6c42d034b72@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-041@5627d6c42d034b72","ruleId":"MS-CAND-NEW-041","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-042@09aa4b4698159abd@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-042@09aa4b4698159abd","ruleId":"MS-CAND-NEW-042","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-043@9bdbd1939cb002c5@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-043@9bdbd1939cb002c5","ruleId":"MS-CAND-NEW-043","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-044@18c14a883f78168e@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-044@18c14a883f78168e","ruleId":"MS-CAND-NEW-044","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-045@1acab126fb11a883@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-045@1acab126fb11a883","ruleId":"MS-CAND-NEW-045","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-046@8cbd72430eb7e76f@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-046@8cbd72430eb7e76f","ruleId":"MS-CAND-NEW-046","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-047@f2cca3acb9056674@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-047@f2cca3acb9056674","ruleId":"MS-CAND-NEW-047","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-048@469fd8f52e815ef3@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-048@469fd8f52e815ef3","ruleId":"MS-CAND-NEW-048","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-049@414ff7309da7ef76@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-049@414ff7309da7ef76","ruleId":"MS-CAND-NEW-049","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-050@e471430a56ad2ef1@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-050@e471430a56ad2ef1","ruleId":"MS-CAND-NEW-050","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-051@de412e97cc5acfc0@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-051@de412e97cc5acfc0","ruleId":"MS-CAND-NEW-051","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-052@3ff507cc0cd5b18d@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-052@3ff507cc0cd5b18d","ruleId":"MS-CAND-NEW-052","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-053@d278701e70ca567c@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-053@d278701e70ca567c","ruleId":"MS-CAND-NEW-053","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-054@5ae3dd8f9a5e0458@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-054@5ae3dd8f9a5e0458","ruleId":"MS-CAND-NEW-054","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-055@fc1ce4188d8e37fb@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-055@fc1ce4188d8e37fb","ruleId":"MS-CAND-NEW-055","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-056@d3cbeb5b80268736@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-056@d3cbeb5b80268736","ruleId":"MS-CAND-NEW-056","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-057@bb3ae2030b306c3a@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-057@bb3ae2030b306c3a","ruleId":"MS-CAND-NEW-057","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-058@c89dff651b4042aa@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-058@c89dff651b4042aa","ruleId":"MS-CAND-NEW-058","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-059@ebad9ea249c278c2@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-059@ebad9ea249c278c2","ruleId":"MS-CAND-NEW-059","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-060@64c6f48b85080ba2@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-060@64c6f48b85080ba2","ruleId":"MS-CAND-NEW-060","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-061@f9099cd979d61a91@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-061@f9099cd979d61a91","ruleId":"MS-CAND-NEW-061","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-062@df513b7c6e9ed060@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-062@df513b7c6e9ed060","ruleId":"MS-CAND-NEW-062","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-063@4bd59069df557c8c@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-063@4bd59069df557c8c","ruleId":"MS-CAND-NEW-063","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-064@5dfca2afdff3ee98@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-064@5dfca2afdff3ee98","ruleId":"MS-CAND-NEW-064","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-065@96266b06cc2a95a8@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-065@96266b06cc2a95a8","ruleId":"MS-CAND-NEW-065","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-066@79bc2d38ab7a3aa6@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-066@79bc2d38ab7a3aa6","ruleId":"MS-CAND-NEW-066","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-067@71285db4258481c7@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-067@71285db4258481c7","ruleId":"MS-CAND-NEW-067","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-068@4403f2bfe20d8ecc@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-068@4403f2bfe20d8ecc","ruleId":"MS-CAND-NEW-068","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-CAND-NEW-069@f233806372e80118@cgrcc-mission-score-0.1","recordKey":"MS-CAND-NEW-069@f233806372e80118","ruleId":"MS-CAND-NEW-069","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":50,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-DP-19@40fb41ffda35d9a3@cgrcc-mission-score-0.1","recordKey":"MS-RULE-DP-19@40fb41ffda35d9a3","ruleId":"MS-RULE-DP-19","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AU-09@204573caad930259@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AU-09@204573caad930259","ruleId":"MS-RULE-AU-09","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AU-10@7f425f52b685ce44@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AU-10@7f425f52b685ce44","ruleId":"MS-RULE-AU-10","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OU-13@1eb7cb01e3cf473f@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OU-13@1eb7cb01e3cf473f","ruleId":"MS-RULE-OU-13","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OU-14@ae9d5f3f618c9838@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OU-14@ae9d5f3f618c9838","ruleId":"MS-RULE-OU-14","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OU-15@17dad38dad581076@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OU-15@17dad38dad581076","ruleId":"MS-RULE-OU-15","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-13@d9a7b8a98719c7c2@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-13@d9a7b8a98719c7c2","ruleId":"MS-RULE-OP-13","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-14@b102df5650885781@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-14@b102df5650885781","ruleId":"MS-RULE-OP-14","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-15@bab74c0be8fc582d@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-15@bab74c0be8fc582d","ruleId":"MS-RULE-OP-15","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-16@277159bc0f54c27c@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-16@277159bc0f54c27c","ruleId":"MS-RULE-OP-16","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-17@6b311b898e8dc850@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-17@6b311b898e8dc850","ruleId":"MS-RULE-OP-17","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-18@1df03547863d8288@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-18@1df03547863d8288","ruleId":"MS-RULE-OP-18","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-OP-19@744dc9983a3098ac@cgrcc-mission-score-0.1","recordKey":"MS-RULE-OP-19@744dc9983a3098ac","ruleId":"MS-RULE-OP-19","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":80,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}},{"id":"MS-RULE-AG-11@f9288b5977523607@cgrcc-mission-score-0.1","recordKey":"MS-RULE-AG-11@f9288b5977523607","ruleId":"MS-RULE-AG-11","modelVersion":"cgrcc-mission-score-0.1","value":null,"computedAt":"2026-10-16","body":{"score":null,"reviewedScore":null,"supportingFamilies":[],"reviewedFamilies":[],"targetFamilies":5,"reviewState":"PROVISIONAL_MAPPING_REVIEW_REQUIRED","meaning":"Saturating recurrence index, not percentage prevalence or proof of applicability.","sourceReferences":[],"impactHint":100,"impactHintSource":"Source severity hint; local mission impact not assessed","missionImpact":null,"missionPriority":null,"calibration":"PROPOSED_NOT_EMPIRICALLY_VALIDATED","historicalOrSecondaryCopiesExcluded":true,"sourceSnapshot":"CGRCC workbook/AIR mapping snapshot, 2026-10-16"}}],"legacyCompatibility":{"schema":"archetypal-rule-registry/1.0","release":"2026-10-03.2","updatedAt":"2026-10-03","missionId":"mis_fg_ebc661d105513d4a3b5d78c5615430c83f20f34c7bbe5d11b7ac81f185efc0af","coverageStatement":"A growing, source-linked starter registry. No claim of global completeness. All source interpretations require review before organizational adoption.","deduplication":"Stable hash of action + object groups exact normalized intents. Actor, authority, scope, timing and exceptions remain separate source variants. Semantic near-duplicate review remains open.","sources":[{"id":"nc-public-genai","title":"Use of Publicly Available Generative Artificial Intelligence Policy","publisher":"North Carolina Department of Information Technology","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","jurisdiction":"North Carolina, US","type":"organizational-policy","edition":"1.1 — April 14, 2026","effectiveDate":null,"checkedAt":"2026-09-28","coverage":"partial","summary":"State-agency minimum requirements for public GenAI tools.","limitations":"Selected employee rules. Full PDF read; extraction incomplete. Separate web guidance differs. Effective date unstated.","tags":["state-government","generative-ai","data-protection","North Carolina"],"fingerprint":"eb79447a45563393feec0d8eb94807a4e26174a1c47eca173eede98254d8f5be","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":8},{"id":"va-ai-ea400","title":"Artificial Intelligence (AI) Utilization Policy","publisher":"Virginia Information Technologies Agency","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","jurisdiction":"Virginia, US","type":"organizational-policy","edition":"EA400 — June 2026","effectiveDate":null,"checkedAt":"2026-09-28","coverage":"partial","summary":"Executive-branch AI governance and approvals.","limitations":"Effective-date field is an unfilled placeholder. Higher-education research and instruction excluded. Reconfirm adoption before enforcement.","tags":["state-government","approval","human-review","transparency"],"fingerprint":"2752e8df4f1c7488837ab7f3dcc8a1b74b7e9b349cf75e960df393d93d2f81f6","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":6},{"id":"pa-ai-2026","title":"Artificial Intelligence Policy","publisher":"Pennsylvania Office of Administration","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","jurisdiction":"Pennsylvania, US","type":"organizational-policy","edition":"Revision January 13, 2026","effectiveDate":"2026-01-13","checkedAt":"2026-09-28","coverage":"partial","summary":"Commonwealth AI governance and employee-use restrictions.","limitations":"Partial extraction. Scope includes Governor-jurisdiction agencies and Commonwealth-network entities. Formal exceptions use IT Policy Governance.","tags":["state-government","generative-ai","retention","disclosure"],"fingerprint":"f02f2e947d173f480bf386674ab3dc7c01b5892c3aec710e25f3fb440b7f3756","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":6},{"id":"brookline-genai","title":"Generative Artificial Intelligence Use Policy","publisher":"Town of Brookline, Massachusetts","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","jurisdiction":"Brookline, Massachusetts, US","type":"organizational-policy","edition":"1.7 — August 2025","effectiveDate":null,"checkedAt":"2026-09-28","coverage":"partial","summary":"Rules for users exposing town systems or data to GenAI.","limitations":"Selected rules. Sensitive-data prohibition and constrained-tool permission need reconciliation. Exceptions require IT security review; adoption August 19, 2025.","tags":["local-government","generative-ai","approval","human-review"],"fingerprint":"f88055fe772f4fdf64cddb84e749822d4204369ff50933a3a2e41ac50cafb305","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":6},{"id":"harvard-genai-guidelines","title":"Generative AI Guidelines","publisher":"Harvard University Information Technology","url":"https://www.huit.harvard.edu/ai/guidelines","jurisdiction":"Harvard University, US","type":"organizational-policy","edition":"Edition unspecified; prepared index checked 2026-09-28","effectiveDate":null,"checkedAt":"2026-09-28","coverage":"partial","summary":"Institutional guidance for Harvard AI use.","limitations":"Guidelines, not legislation. Revision/effective dates unavailable; school policies also apply.","tags":["university","generative-ai","confidentiality","procurement"],"fingerprint":"17fccd7682a4db1fbc185d3e0c7d89eee1c4f141b17287526522c589e97ba441","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4},{"id":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","publisher":"Michigan State University","url":"https://ai.msu.edu/guidelines","jurisdiction":"Michigan State University, US","type":"organizational-policy","edition":"Approved August 12, 2025; no revisions listed","effectiveDate":null,"checkedAt":"2026-09-28","coverage":"partial","summary":"University guidance spanning academic and administrative AI.","limitations":"Partial extraction of institutional guidelines. Approval date is not an explicit effective date.","tags":["university","generative-ai","education","research"],"fingerprint":"9082b619d9a71d8373dff619801545bed89a05e7506ba0bce9a4d957ac8bf350","reviewStatus":"prior-researched-partial-index","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":6},{"id":"nist-ai-rmf-1","title":"AI Risk Management Framework 1.0","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","jurisdiction":"United States","type":"framework","edition":"AI RMF 1.0 (2023)","effectiveDate":null,"publishedDate":"2023-01-26","checkedAt":"2026-10-03","coverage":"partial","summary":"Voluntary AI risk outcomes across the lifecycle.","limitations":"All 72 core subcategories mapped to selected atomic actions. Compound outcomes may require additional actions; this is not full Playbook extraction.","tags":["AI governance","inventory","risk management"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"publisher-core-read","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["GOVERN 1.1","GOVERN 1.5","GOVERN 1.6","GOVERN 1.7"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:b1183dbe301b7cbde20ab8b0d1ad6035e561f6165c0c01a6accf90691b3a68fd","fingerprint":"570d6996fff58a679befc826cd489145fdabb2013912e93704bdd7e0ab0a71d6","lastVerifiedAt":"2026-10-03","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":72},{"id":"nist-genai-profile","title":"Generative AI Profile","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","jurisdiction":"United States","type":"framework","edition":"AI 600-1","effectiveDate":null,"publishedDate":"2024-07-26","checkedAt":"2026-10-03","coverage":"partial","summary":"Suggested generative AI risk-management actions.","limitations":"Selected precisely located atomic templates from AI 600-1; full 211-action extraction remains a coverage gap.","tags":["generative AI","inventory","shutdown","provenance"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"selected-publisher-actions-read","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":5,"coverageDetail":{"indexedControls":["GV-1.3-007","GV-1.5-003","GV-1.6-001","GV-1.6-002","GV-1.7-001"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:c4ad40875bcac148ab8f66c168b9e44b7e9e194e70f7407dd8c205a96da6f189","fingerprint":"854b49562c3fcbd2c491c3096dbe4cd9332bf64eac581448292dde4c17a39c5d","lastVerifiedAt":"2026-10-03","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":10},{"id":"nist-csf-2","title":"Cybersecurity Framework 2.0","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","jurisdiction":"United States","type":"framework","edition":"CSWP 29 / 2.0","effectiveDate":null,"publishedDate":"2024-02-26","checkedAt":"2026-09-28","coverage":"partial","summary":"Cybersecurity outcomes for organizational risk management.","limitations":"Five selected outcomes; this is not a complete CSF profile.","tags":["cybersecurity","inventory","logging","data protection"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":5,"coverageDetail":{"indexedControls":["ID.AM-01","ID.AM-02","PR.DS-02","PR.PS-04","PR.PS-05"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:1616137186c21fd736d139aaa6448eb70458e479cd6dc11b5b4432815491a637","fingerprint":"a39b6ed597fcc0a7d4e15fc04b1e0186985631c3ff05405558cc587a24fedf39","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":5},{"id":"nist-privacy-1","title":"Privacy Framework 1.0","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf","jurisdiction":"United States","type":"framework","edition":"CSWP 10 / 1.0","effectiveDate":null,"publishedDate":"2020-01-16","checkedAt":"2026-09-28","coverage":"partial","summary":"Voluntary privacy risk-management outcomes.","limitations":"Inventory subset only. Publisher also advertises a 1.1 initial public draft; draft is not substituted here.","tags":["privacy","data inventory","data purpose"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","versionState":"final-baseline","updatePointer":"https://www.nist.gov/privacy-framework","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"},{"url":"https://www.nist.gov/privacy-framework","readAt":"2026-09-28","method":"Publisher version metadata checked"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["ID.IM-P1","ID.IM-P3","ID.IM-P4","ID.IM-P5"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:aca377a8893100dc77d1c1a88d358aa047019fdc5ebcedbaacca99a69bee8e8c","fingerprint":"f6c65f5795ec4b430c2e81ed947a1e55c5d6768f4be9264380520ff6f9fafc36","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4},{"id":"nist-800-53-r5","title":"Security and Privacy Controls","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf","jurisdiction":"United States","type":"framework","edition":"SP 800-53 Rev.5 / Dec-2020 updates","effectiveDate":null,"publishedDate":"2020-09-23","checkedAt":"2026-09-28","coverage":"partial","summary":"Tailorable security and privacy control catalog.","limitations":"Baseline PDF only; publisher lists Release 5.2.0 (2025-08-27). Reconcile newer release before adoption. Controls require selection and parameters.","tags":["security controls","least privilege","privacy"],"authority":"technical-controls-when-adopted","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","versionState":"newer-release-needs-reconciliation","updatePointer":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"},{"url":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","readAt":"2026-09-28","method":"Publisher version metadata checked"}],"preparedRuleCount":5,"coverageDetail":{"indexedControls":["AC-3","AC-6","PT-2(a)","PT-2(b)"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:6253e0836e2c9c832252aba60e9a91aac38b13eba7b15c3ffd1e48ed0a0ba88b","fingerprint":"f90285ebe9f7628c21a3c2a1c5887626002e0aab40d63ec84655fff809a50392","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":5},{"id":"nist-800-171-r3","title":"Protecting Controlled Unclassified Information","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf","jurisdiction":"United States","type":"guidance","edition":"SP 800-171 Rev.3","effectiveDate":null,"publishedDate":"2024-05-14","checkedAt":"2026-09-28","coverage":"partial","summary":"Recommended CUI safeguards for nonfederal systems.","limitations":"Four selected requirements. Contract incorporation and required revision must be verified; publication alone does not bind every organization.","tags":["CUI","access control","federal contractors"],"authority":"technical-requirements-when-incorporated","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["03.01.02","03.01.05(a)","03.01.07(a)","03.01.07(b)"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:5bc814d991eed9d9478f00d730d9a0091af6f82888232deadc81ef3e6fd48958","fingerprint":"345e6f1c845ad7bb3fe7642ffe3cc2c553fd3cc8c66a62eea1203845ec65f20a","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4},{"id":"nist-ssdf-1-1","title":"Secure Software Development Framework","publisher":"NIST","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf","jurisdiction":"United States","type":"framework","edition":"SP 800-218 / SSDF 1.1","effectiveDate":null,"publishedDate":"2022-02-03","checkedAt":"2026-09-28","coverage":"partial","summary":"Recommended secure software development practices.","limitations":"Selected practices only. Revision 1 initial public draft exists; this index retains final 1.1.","tags":["software security","supply chain","vulnerability response"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","versionState":"final-baseline","updatePointer":"https://csrc.nist.gov/pubs/sp/800/218/final","evidence":[{"url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"},{"url":"https://csrc.nist.gov/pubs/sp/800/218/final","readAt":"2026-09-28","method":"Publisher version metadata checked"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["PS.1.1","PS.2.1","RV.1.1"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:938270e36b849dbaf065a70ec30318f8b91cba2f639f89a94c89a0c51fff47cd","fingerprint":"ada47701174cc35e7ebaed3eb003ca0222bd920f4bb30e30a527e263e238cb7d","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4},{"id":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","publisher":"NCSC, CISA and partners","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","jurisdiction":"United States","type":"guidance","edition":"1.0","effectiveDate":null,"publishedDate":"2023-11-27","checkedAt":"2026-09-28","coverage":"partial","summary":"Lifecycle security recommendations for AI providers.","limitations":"Four selected development recommendations; other lifecycle sections remain unindexed.","tags":["AI security","development","supply chain","sensitive data"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","jurisdictionDetail":"Joint international guidance","evidence":[{"url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["Secure development / assets","Secure development / documentation"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:f0e5b3bdf7c95b67d87c1194bd3883e616a42c1572eb3a7eb4f68be05a16803b","fingerprint":"3887e1b0420cfda9908d30c4887cbb157678194db20a4ee2aac0e326b6f8e602","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4},{"id":"nsa-cisa-secure-ai-deployment","title":"Deploying AI Systems Securely","publisher":"NSA AISC, CISA, FBI and partners","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","jurisdiction":"United States","type":"guidance","edition":"April 2024 / 1.0","effectiveDate":null,"publishedDate":"2024-04-15","checkedAt":"2026-09-28","coverage":"partial","summary":"Security guidance for deploying externally developed AI.","limitations":"Selected recommendations. Applies to deployers; not merely users of others’ hosted AI. Official coauthor HTML used after NSA PDF returned 403.","tags":["AI security","deployment","model weights","threat modeling"],"authority":"voluntary","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","jurisdictionDetail":"Joint international guidance","primaryPublisherPointer":"https://media.defense.gov/2024/Apr/15/2003439257/-1/-1/0/CSI-DEPLOYING-AI-SYSTEMS-SECURELY.PDF","evidence":[{"url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["Deployment governance / threat model","Deployment architecture / boundaries","Summary / validation","Summary / model weights"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:c46c4b15947f61b1067d4175985bd261b3d813e7a487030e3c1a2099fc2f7c70","fingerprint":"5a2b6af416a7db93086cd04c8accccfaebba166d07ef5a071f3566e34ea8eaa5","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4},{"id":"omb-m-25-21","title":"Accelerating Federal Use of AI","publisher":"Office of Management and Budget","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","jurisdiction":"United States","type":"policy","edition":"M-25-21","effectiveDate":"2025-04-03","publishedDate":"2025-04-03","checkedAt":"2026-09-28","coverage":"partial","summary":"Federal agency AI governance policy.","limitations":"Three clauses only. NSS excluded; inventory excludes DoD/IC; §4(a)-(b) excludes IC. High-impact practices have conditional pilot exemptions and CAIO waivers.","tags":["federal AI","impact assessment","inventory","waivers"],"authority":"binding-within-defined-federal-scope","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","supersedes":["OMB M-24-10"],"evidence":[{"url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":3,"coverageDetail":{"indexedControls":["3(b)(v)","4(b)(ii)","4(a)(ii)"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:51038bec3f6608e7a8d52074dd8f85af7232dea13c7aa49ce09d83183acb62f8","fingerprint":"ecef40be10a4ce3aa18ebb38bff1d891d4a566c1be5b55d134ba49831bbaf3c9","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":3},{"id":"omb-m-25-22","title":"Driving Efficient Acquisition of AI","publisher":"Office of Management and Budget","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","jurisdiction":"United States","type":"policy","edition":"M-25-22","effectiveDate":"2025-04-03","publishedDate":"2025-04-03","checkedAt":"2026-09-28","coverage":"partial","summary":"Federal AI acquisition requirements.","limitations":"Selected clauses only. §2 limits scope, excludes NSS and some embedded AI, and specifies contract transition dates.","tags":["procurement","federal AI","evaluation","authorization"],"authority":"binding-within-defined-federal-scope","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","supersedes":["OMB M-24-18"],"evidence":[{"url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":4,"coverageDetail":{"indexedControls":["4(d)(i)","4(d)(ii)(E)","4(d)(ii)(E)(I)","4(e)(i)"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:819b375905f73f1b06bac23dc2ec49316737caf641df12b4cd543104ef8baea5","fingerprint":"d950443a125c5bf4dda71e469bedf029813704e5ba4e3c0b613cf8219a9fc941","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":4},{"id":"omb-m-26-04","title":"Increasing Public Trust Through Unbiased AI Principles","publisher":"Office of Management and Budget","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf","jurisdiction":"United States","type":"policy","edition":"M-26-04","effectiveDate":"2025-12-11","publishedDate":"2025-12-11","checkedAt":"2026-09-28","coverage":"partial","summary":"Additional federal LLM procurement requirements.","limitations":"Three clauses only; exclusions and open-source treatment require scope review. Sunset: two years after issuance unless OMB directs otherwise.","tags":["LLM procurement","federal AI","transparency"],"authority":"binding-within-defined-federal-scope","lastReviewedAt":null,"reviewStatus":"prior-researched-partial-index","sourceContentFingerprint":null,"sourceFingerprintStatus":"not-captured","evidence":[{"url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf","readAt":"2026-09-28","method":"Primary publisher document retrieved with web search; selected sections read"}],"preparedRuleCount":3,"coverageDetail":{"indexedControls":["Agency Actions (a)","Agency Actions (c)","Appendix A.1(A)(i)"],"fullSourceReviewed":false,"missing":"All sections and independent clauses not explicitly indexed","adoptionStatus":"not-adopted"},"indexFingerprint":"sha256:f8794e4df44d7a3d18c8dd9b86db768253f639236749d84bb574e12fdb48a86b","fingerprint":"d844d521b5f24a0745be44d963a1907257304ec739c5afef5af7696345c4d116","lastVerifiedAt":"2026-09-28","rights":"Link to publisher; selective original paraphrases. No licensed standard text is mirrored.","ruleCount":3},{"id":"eu-ai-act","title":"EU Artificial Intelligence Act","publisher":"European Union","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","jurisdiction":"European Union","type":"law","edition":"Regulation 2024/1689; 2026 amendments tracked separately","authority":"binding-within-scope","checkedAt":"2026-10-03","lastVerifiedAt":"2026-10-03","coverage":"partial","reviewStatus":"publisher-text-read","summary":"Provider, deployer or other specified operator; territorial and risk-category scope must be assessed.","limitations":"Selected original-text obligations. AI Omnibus amendments require consolidated clause review; high-risk deadlines follow the Commission timeline. Do not assume every clause is currently applicable.","rights":"Selective original paraphrases; authoritative text remains with publisher.","tags":[],"timelineUrl":"https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai","applicabilityNote":"Commission reports Annex III high-risk rules apply 2027-12-02; Annex I product rules 2028-08-02 after the 2026 AI Omnibus. Original text retained as source edition; clause reconciliation pending.","ruleCount":49,"fingerprint":"4faacfc940d07c320a04fd01df149dd266f3fd7df675842b2d628694508bb589"},{"id":"eu-gdpr","title":"General Data Protection Regulation","publisher":"European Union","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","jurisdiction":"European Union","type":"law","edition":"Regulation 2016/679","authority":"binding-within-scope","checkedAt":"2026-10-03","lastVerifiedAt":"2026-10-03","coverage":"partial","reviewStatus":"publisher-text-read","summary":"Personal-data processing within GDPR material and territorial scope.","limitations":"Selected data-protection obligations relevant to AI; full GDPR and national overlays are not extracted.","rights":"Selective original paraphrases; authoritative text remains with publisher.","tags":[],"ruleCount":22,"fingerprint":"85767c145543fcffff25030496963a6df99affce4c5e494f0207757afe1e98e8"},{"id":"cn-genai-interim","title":"Interim Measures for Generative AI Services","publisher":"Cyberspace Administration of China and six departments","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","jurisdiction":"China","type":"law","edition":"Order 15; effective 2023-08-15","authority":"binding-within-scope","checkedAt":"2026-10-03","lastVerifiedAt":"2026-10-03","coverage":"partial","reviewStatus":"publisher-text-read","summary":"GenAI services offered to the public in mainland China; nonpublic research and enterprise development excluded by Article 2.","limitations":"Selected English paraphrases of Chinese provisions; professional translation and later measures require reconciliation.","rights":"Selective original paraphrases; authoritative text remains with publisher.","tags":[],"ruleCount":26,"fingerprint":"f3a1e4c8093d56999b178a4b5614fb931dd00d1cf6a607a0d8832f32aedcabed"},{"id":"ca-automated-decisions","title":"Directive on Automated Decision-Making","publisher":"Treasury Board of Canada","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","jurisdiction":"Canada federal government","type":"policy","edition":"Modified 2025-06-24","authority":"binding-within-federal-scope","checkedAt":"2026-10-03","lastVerifiedAt":"2026-10-03","coverage":"partial","reviewStatus":"publisher-index-retrieved-direct-fetch-rejected","summary":"Federal administrative decisions; scope and department exemptions apply; research and test-only systems excluded.","limitations":"Indexed search retrieval available; direct publisher fetch rejected. Selected clauses only; Appendix C severity-specific obligations remain unextracted.","rights":"Selective original paraphrases; authoritative text remains with publisher.","tags":[],"ruleCount":9,"fingerprint":"9b20a10c09087ef5d40744e11bbb0f33f0a7e0aad94faa9035b88f600770fb3c"}],"rules":[{"id":"AIR-4DC94000A9","version":2,"title":"AI providers should control the data their AI systems can access.","text":"AI provider should control AI data access.","topic":"Data & IP","intent":"control ai data access","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / assets","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"control","object":"AI data access","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"control\" for AI data access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"control\" for AI data access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI data access. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: control AI data access.","examples":{"meetsRule":"AI provider follows the recommendation to \"control\" for AI data access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"control\" for AI data access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-AB2476BBAB","version":2,"title":"AI providers should document the lifecycle of models, datasets and system prompts.","text":"AI provider should document model, dataset and prompt lifecycle.","topic":"Data & IP","intent":"document model dataset and prompt lifecycle","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / documentation","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"document","object":"model, dataset and prompt lifecycle","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"document\" for model, dataset and prompt lifecycle within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"document\" for model, dataset and prompt lifecycle. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves model, dataset and prompt lifecycle. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document model, dataset and prompt lifecycle.","examples":{"meetsRule":"AI provider follows the recommendation to \"document\" for model, dataset and prompt lifecycle within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"document\" for model, dataset and prompt lifecycle. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-DA02521292","version":2,"title":"Avoid infringing training-data intellectual property","text":"Covered GenAI service providers must avoid infringing training-data intellectual property.","topic":"Data & IP","intent":"avoid infringing training data intellectual property","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 7(2)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"avoid","object":"infringing training-data intellectual property","condition":"Covered training activities","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"avoid\" for infringing training-data intellectual property within these source conditions: Covered training activities, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"avoid\" for infringing training-data intellectual property while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves infringing training-data intellectual property. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: avoid infringing training-data intellectual property.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"avoid\" for infringing training-data intellectual property within these source conditions: Covered training activities, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"avoid\" for infringing training-data intellectual property while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4849919367","version":2,"title":"Complete state and agency GenAI training.","text":"Employees must complete training.","topic":"Data & IP","intent":"complete training","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 1","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"complete","object":"training","condition":"before use","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"complete\" for training within these source conditions: before use, and retains evidence.","doesNotMeetRule":"employees omits the required action \"complete\" for training while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves training. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: complete training.","examples":{"meetsRule":"employees performs the required action \"complete\" for training within these source conditions: before use, and retains evidence.","doesNotMeetRule":"employees omits the required action \"complete\" for training while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-727F5459C2","version":2,"title":"Covered agencies must use agency-defined data for independent AI evaluations.","text":"Covered agency must use agency-defined evaluation data.","topic":"Data & IP","intent":"use agency defined evaluation data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-22","control":"4(d)(ii)(E)(I)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=10","actor":"Covered agency","modality":"must","action":"use","object":"agency-defined evaluation data","condition":"Independent evaluations","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"use\" for agency-defined evaluation data within these source conditions: Independent evaluations, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"use\" for agency-defined evaluation data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves agency-defined evaluation data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use agency-defined evaluation data.","examples":{"meetsRule":"Covered agency performs the required action \"use\" for agency-defined evaluation data within these source conditions: Independent evaluations, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"use\" for agency-defined evaluation data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-36FDB9AAD2","version":2,"title":"Create facial recognition databases by untargeted scraping","text":"AI operators must not create facial recognition databases by untargeted scraping.","topic":"Data & IP","intent":"create facial recognition databases by untargeted scraping","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(e)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"create","object":"facial recognition databases by untargeted scraping","condition":"Internet or CCTV facial images","exception":"Assess statutory scope","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"create\" for facial recognition databases by untargeted scraping while these conditions apply: Internet or CCTV facial images.","doesNotMeetRule":"AI operators performs the prohibited action \"create\" for facial recognition databases by untargeted scraping while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves facial recognition databases by untargeted scraping. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: create facial recognition databases by untargeted scraping.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"create\" for facial recognition databases by untargeted scraping while these conditions apply: Internet or CCTV facial images.","doesNotMeetRule":"AI operators performs the prohibited action \"create\" for facial recognition databases by untargeted scraping while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8E3444C5DD","version":2,"title":"Demonstrate compliance with data-protection principles","text":"Data controllers must demonstrate compliance with data-protection principles.","topic":"Data & IP","intent":"demonstrate compliance with data protection principles","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(2)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"demonstrate","object":"compliance with data-protection principles","condition":"Controller accountability","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"demonstrate\" for compliance with data-protection principles within these source conditions: Controller accountability, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"demonstrate\" for compliance with data-protection principles while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves compliance with data-protection principles. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: demonstrate compliance with data-protection principles.","examples":{"meetsRule":"Data controllers performs the required action \"demonstrate\" for compliance with data-protection principles within these source conditions: Controller accountability, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"demonstrate\" for compliance with data-protection principles while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-653ED4C38B","version":2,"title":"Determine appropriate software licensing","text":"Responsible senior federal officials must determine appropriate software licensing.","topic":"Data & IP","intent":"determine appropriate software licensing","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.4","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"determine","object":"appropriate software licensing","condition":"Including consideration of open source","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"determine\" for appropriate software licensing within these source conditions: Including consideration of open source, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"determine\" for appropriate software licensing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves appropriate software licensing. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: determine appropriate software licensing.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"determine\" for appropriate software licensing within these source conditions: Including consideration of open source, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"determine\" for appropriate software licensing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-AA8C667747","version":2,"title":"Do not enter Class C data into GenAI.","text":"Users must-not enter Class C data.","topic":"Data & IP","intent":"enter class c data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.2.6.2, p.7","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must-not","action":"enter","object":"Class C data","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"enter\" for Class C data within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for Class C data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves Class C data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enter Class C data.","examples":{"meetsRule":"users performs the required action \"enter\" for Class C data within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for Class C data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-ABAA5F0412","version":2,"title":"Document dataset design choices","text":"High-risk AI providers must document dataset design choices.","topic":"Data & IP","intent":"document dataset design choices","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 10(2)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"document","object":"dataset design choices","condition":"Systems trained with data","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"document\" for dataset design choices within these source conditions: Systems trained with data, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"document\" for dataset design choices while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves dataset design choices. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document dataset design choices.","examples":{"meetsRule":"High-risk AI providers performs the required action \"document\" for dataset design choices within these source conditions: Systems trained with data, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"document\" for dataset design choices while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-584850ADDF","version":2,"title":"Enable data-subject access","text":"Data controllers must enable data-subject access.","topic":"Data & IP","intent":"enable data subject access","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 15(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"enable","object":"data-subject access","condition":"Subject to statutory exceptions","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"enable\" for data-subject access within these source conditions: Subject to statutory exceptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"enable\" for data-subject access while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data-subject access. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable data-subject access.","examples":{"meetsRule":"Data controllers performs the required action \"enable\" for data-subject access within these source conditions: Subject to statutory exceptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"enable\" for data-subject access while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0EAF27F441","version":2,"title":"Ensure dataset representativeness","text":"High-risk AI providers must ensure dataset representativeness.","topic":"Data & IP","intent":"ensure dataset representativeness","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 10(3)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"ensure","object":"dataset representativeness","condition":"Intended purpose of high-risk AI","exception":"To the extent applicable","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for dataset representativeness within these source conditions: Intended purpose of high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for dataset representativeness while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves dataset representativeness. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure dataset representativeness.","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for dataset representativeness within these source conditions: Intended purpose of high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for dataset representativeness while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2D3230CFEA","version":2,"title":"Ensure relevant input data","text":"High-risk AI deployers must ensure relevant input data.","topic":"Data & IP","intent":"ensure relevant input data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 26(4)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"ensure","object":"relevant input data","condition":"Input data under deployer control","exception":"Sufficient representativeness","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"ensure\" for relevant input data within these source conditions: Input data under deployer control, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"ensure\" for relevant input data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves relevant input data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure relevant input data.","examples":{"meetsRule":"High-risk AI deployers performs the required action \"ensure\" for relevant input data within these source conditions: Input data under deployer control, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"ensure\" for relevant input data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-41D9F2CC95","version":2,"title":"Enter CUI/export-controlled data only into tools formally approved within the research enclave.","text":"Users must use enclave-approved tools.","topic":"Data & IP","intent":"use enclave approved tools","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"Non-Permissible Uses, final paragraph","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must","action":"use","object":"enclave-approved tools","condition":"CUI/export-controlled data","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for enclave-approved tools within these source conditions: CUI/export-controlled data, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for enclave-approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves enclave-approved tools. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use enclave-approved tools.","examples":{"meetsRule":"users performs the required action \"use\" for enclave-approved tools within these source conditions: CUI/export-controlled data, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for enclave-approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-3867F71ADB","version":2,"title":"Evaluate environmental impacts of AI training","text":"AI governance owners should evaluate environmental impacts of AI training.","topic":"Data & IP","intent":"evaluate environmental impacts of ai training","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.12","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"environmental impacts of AI training","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for environmental impacts of AI training within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for environmental impacts of AI training. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves environmental impacts of AI training. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate environmental impacts of AI training.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for environmental impacts of AI training within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for environmental impacts of AI training. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9A5BD1A87A","version":2,"title":"Implement a copyright-compliance policy","text":"GPAI model providers must implement a copyright-compliance policy.","topic":"Data & IP","intent":"implement a copyright compliance policy","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 53(1)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"implement","object":"a copyright-compliance policy","condition":"Covered general-purpose AI models","exception":"Including rights reservations under EU copyright law","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"implement\" for a copyright-compliance policy within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"implement\" for a copyright-compliance policy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a copyright-compliance policy. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: implement a copyright-compliance policy.","examples":{"meetsRule":"GPAI model providers performs the required action \"implement\" for a copyright-compliance policy within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"implement\" for a copyright-compliance policy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6BBD510385","version":2,"title":"Implement data protection by design","text":"Data controllers must implement data protection by design.","topic":"Data & IP","intent":"implement data protection by design","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 25(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"implement","object":"data protection by design","condition":"Appropriate to processing risks","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"implement\" for data protection by design within these source conditions: Appropriate to processing risks, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"implement\" for data protection by design while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data protection by design. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: implement data protection by design.","examples":{"meetsRule":"Data controllers performs the required action \"implement\" for data protection by design within these source conditions: Appropriate to processing risks, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"implement\" for data protection by design while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-19AAD3D220","version":2,"title":"Improve training-data quality","text":"Covered GenAI service providers must improve training-data quality.","topic":"Data & IP","intent":"improve training data quality","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 7(4)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"improve","object":"training-data quality","condition":"Covered training activities","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for training-data quality within these source conditions: Covered training activities, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for training-data quality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves training-data quality. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: improve training-data quality.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for training-data quality within these source conditions: Covered training activities, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for training-data quality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1C31FD0739","version":2,"title":"Organizations should inventory categories of people whose data they process.","text":"Organization should inventory affected person categories.","topic":"Data & IP","intent":"inventory affected person categories","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-privacy-1","control":"ID.IM-P3","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"affected person categories","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for affected person categories within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for affected person categories. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves affected person categories. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory affected person categories.","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for affected person categories within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for affected person categories. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-A0754F863D","version":2,"title":"Organizations should inventory purposes for data actions.","text":"Organization should inventory data-action purposes.","topic":"Data & IP","intent":"inventory data action purposes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-privacy-1","control":"ID.IM-P5","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"data-action purposes","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for data-action purposes within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for data-action purposes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data-action purposes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory data-action purposes.","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for data-action purposes within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for data-action purposes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-32A014BA72","version":2,"title":"Organizations should inventory systems that process data.","text":"Organization should inventory data-processing systems.","topic":"Data & IP","intent":"inventory data processing systems","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-privacy-1","control":"ID.IM-P1","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"data-processing systems","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for data-processing systems within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for data-processing systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data-processing systems. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory data-processing systems.","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for data-processing systems within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for data-processing systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7265A37732","version":2,"title":"Organizations should inventory the data actions performed by their systems.","text":"Organization should inventory system data actions.","topic":"Data & IP","intent":"inventory system data actions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-privacy-1","control":"ID.IM-P4","sourceVersion":"CSWP 10 / 1.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.01162020.pdf#page=24","actor":"Organization","modality":"should","action":"inventory","object":"system data actions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for system data actions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for system data actions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves system data actions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory system data actions.","examples":{"meetsRule":"Organization follows the recommendation to \"inventory\" for system data actions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"inventory\" for system data actions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-54647B2218","version":2,"title":"Perform a data-protection impact assessment","text":"Data controllers must perform a data-protection impact assessment.","topic":"Data & IP","intent":"perform a data protection impact assessment","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 35(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"perform","object":"a data-protection impact assessment","condition":"Processing likely to create high risk","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"perform\" for a data-protection impact assessment within these source conditions: Processing likely to create high risk, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"perform\" for a data-protection impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a data-protection impact assessment. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: perform a data-protection impact assessment.","examples":{"meetsRule":"Data controllers performs the required action \"perform\" for a data-protection impact assessment within these source conditions: Processing likely to create high risk, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"perform\" for a data-protection impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4FA53D5DDD","version":2,"title":"Publish a training-content summary","text":"GPAI model providers must publish a training-content summary.","topic":"Data & IP","intent":"publish a training content summary","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 53(1)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"publish","object":"a training-content summary","condition":"Covered general-purpose AI models","exception":"AI Office template and transition provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"publish\" for a training-content summary within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"publish\" for a training-content summary while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a training-content summary. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: publish a training-content summary.","examples":{"meetsRule":"GPAI model providers performs the required action \"publish\" for a training-content summary within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"publish\" for a training-content summary while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2ABDCD7376","version":2,"title":"Respect intellectual-property rights","text":"Covered GenAI service providers must respect intellectual-property rights.","topic":"Data & IP","intent":"respect intellectual property rights","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(3)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"respect","object":"intellectual-property rights","condition":"Covered service use and provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"respect\" for intellectual-property rights within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"respect\" for intellectual-property rights while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves intellectual-property rights. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: respect intellectual-property rights.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"respect\" for intellectual-property rights within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"respect\" for intellectual-property rights while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-A31D302A1B","version":2,"title":"Retain prompts and input data under records-management requirements.","text":"Agencies must retain inputs.","topic":"Data & IP","intent":"retain inputs","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.1.4, p.2","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"agencies","modality":"must","action":"retain","object":"inputs","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"retain\" for inputs within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"retain\" for inputs while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves inputs. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: retain inputs.","examples":{"meetsRule":"agencies performs the required action \"retain\" for inputs within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"retain\" for inputs while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B1B0E054D0","version":2,"title":"Share only public data with public GenAI.","text":"Employees must share public data.","topic":"Data & IP","intent":"share public data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, data sharing, bullets 1–2","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"share","object":"public data","condition":"state work","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"share\" for public data within these source conditions: state work, and retains evidence.","doesNotMeetRule":"employees omits the required action \"share\" for public data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves public data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: share public data.","examples":{"meetsRule":"employees performs the required action \"share\" for public data within these source conditions: state work, and retains evidence.","doesNotMeetRule":"employees omits the required action \"share\" for public data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-50088C8736","version":2,"title":"Use lawfully sourced training data","text":"Covered GenAI service providers must use lawfully sourced training data.","topic":"Data & IP","intent":"use lawfully sourced training data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 7(1)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"use","object":"lawfully sourced training data","condition":"Pretraining and fine-tuning","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"use\" for lawfully sourced training data within these source conditions: Pretraining and fine-tuning, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"use\" for lawfully sourced training data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves lawfully sourced training data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use lawfully sourced training data.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"use\" for lawfully sourced training data within these source conditions: Pretraining and fine-tuning, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"use\" for lawfully sourced training data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6E435F72F8","version":2,"title":"AI deployers should validate the AI system before deployment.","text":"AI deployer should validate AI system.","topic":"Evaluation","intent":"validate ai system","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Summary / validation","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"validate","object":"AI system","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":"Before deployment","authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"validate\" for AI system within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"validate\" for AI system. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI system. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: validate AI system.","examples":{"meetsRule":"AI deployer follows the recommendation to \"validate\" for AI system within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"validate\" for AI system. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9B67275315","version":2,"title":"Adapt AI measurements to deployment context","text":"AI governance owners should adapt AI measurements to deployment context.","topic":"Evaluation","intent":"adapt ai measurements to deployment context","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"adapt","object":"AI measurements to deployment context","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"adapt\" for AI measurements to deployment context within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"adapt\" for AI measurements to deployment context. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI measurements to deployment context. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: adapt AI measurements to deployment context.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"adapt\" for AI measurements to deployment context within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"adapt\" for AI measurements to deployment context. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1BE3C102BD","version":2,"title":"Chief AI Officers must annually certify that each minimum-practice waiver remains valid.","text":"Chief AI Officer must certify waiver continuing validity.","topic":"Evaluation","intent":"certify waiver continuing validity","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-21","control":"4(a)(ii)","sourceVersion":"M-25-21","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf#page=15","actor":"Chief AI Officer","modality":"must","action":"certify","object":"waiver continuing validity","condition":"In coordination with relevant officials","exception":null,"timing":"Annually","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Chief AI Officer performs the required action \"certify\" for waiver continuing validity within these source conditions: In coordination with relevant officials, and retains evidence.","doesNotMeetRule":"Chief AI Officer omits the required action \"certify\" for waiver continuing validity while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves waiver continuing validity. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: certify waiver continuing validity.","examples":{"meetsRule":"Chief AI Officer performs the required action \"certify\" for waiver continuing validity within these source conditions: In coordination with relevant officials, and retains evidence.","doesNotMeetRule":"Chief AI Officer omits the required action \"certify\" for waiver continuing validity while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-587EDFB2DD","version":2,"title":"Consider risk tracking for difficult-to-measure risks","text":"AI governance owners should consider risk tracking for difficult-to-measure risks.","topic":"Evaluation","intent":"consider risk tracking for difficult to measure risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"consider","object":"risk tracking for difficult-to-measure risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for risk tracking for difficult-to-measure risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for risk tracking for difficult-to-measure risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves risk tracking for difficult-to-measure risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: consider risk tracking for difficult-to-measure risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for risk tracking for difficult-to-measure risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for risk tracking for difficult-to-measure risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B4750175C0","version":2,"title":"Consider stakeholder input in trustworthiness measurements","text":"AI governance owners should consider stakeholder input in trustworthiness measurements.","topic":"Evaluation","intent":"consider stakeholder input in trustworthiness measurements","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"consider","object":"stakeholder input in trustworthiness measurements","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for stakeholder input in trustworthiness measurements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for stakeholder input in trustworthiness measurements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves stakeholder input in trustworthiness measurements. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: consider stakeholder input in trustworthiness measurements.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for stakeholder input in trustworthiness measurements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for stakeholder input in trustworthiness measurements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-CFAE0A69A5","version":2,"title":"Covered agencies must test proposed AI solutions to the greatest practicable extent.","text":"Covered agency must test proposed AI solutions.","topic":"Evaluation","intent":"test proposed ai solutions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-22","control":"4(d)(i)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=9","actor":"Covered agency","modality":"must","action":"test","object":"proposed AI solutions","condition":"During proposal evaluation; practicable extent","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"test\" for proposed AI solutions within these source conditions: During proposal evaluation; practicable extent, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"test\" for proposed AI solutions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves proposed AI solutions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: test proposed AI solutions.","examples":{"meetsRule":"Covered agency performs the required action \"test\" for proposed AI solutions within these source conditions: During proposal evaluation; practicable extent, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"test\" for proposed AI solutions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-33B04C2296","version":2,"title":"Demonstrate AI validity within tested conditions","text":"AI governance owners should demonstrate AI validity within tested conditions.","topic":"Evaluation","intent":"demonstrate ai validity within tested conditions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"demonstrate","object":"AI validity within tested conditions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"demonstrate\" for AI validity within tested conditions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"demonstrate\" for AI validity within tested conditions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI validity within tested conditions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: demonstrate AI validity within tested conditions.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"demonstrate\" for AI validity within tested conditions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"demonstrate\" for AI validity within tested conditions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F1A3CFC876","version":2,"title":"Document AI test sets and evaluation metrics","text":"AI governance owners should document AI test sets and evaluation metrics.","topic":"Evaluation","intent":"document ai test sets and evaluation metrics","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI test sets and evaluation metrics","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI test sets and evaluation metrics within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI test sets and evaluation metrics. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI test sets and evaluation metrics. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI test sets and evaluation metrics.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI test sets and evaluation metrics within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI test sets and evaluation metrics. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-A271230967","version":2,"title":"Document measurable AI performance changes","text":"AI governance owners should document measurable AI performance changes.","topic":"Evaluation","intent":"document measurable ai performance changes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 4.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"measurable AI performance changes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for measurable AI performance changes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for measurable AI performance changes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves measurable AI performance changes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document measurable AI performance changes.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for measurable AI performance changes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for measurable AI performance changes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-AD7B04DC9D","version":2,"title":"Evaluate the effectiveness of AI evaluation processes","text":"AI governance owners should evaluate the effectiveness of AI evaluation processes.","topic":"Evaluation","intent":"evaluate the effectiveness of ai evaluation processes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.13","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"the effectiveness of AI evaluation processes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for the effectiveness of AI evaluation processes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for the effectiveness of AI evaluation processes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves the effectiveness of AI evaluation processes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate the effectiveness of AI evaluation processes.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for the effectiveness of AI evaluation processes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for the effectiveness of AI evaluation processes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-DFA60F69C7","version":2,"title":"Involve independent assessors in AI evaluation","text":"AI governance owners should involve independent assessors in AI evaluation.","topic":"Evaluation","intent":"involve independent assessors in ai evaluation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"involve","object":"independent assessors in AI evaluation","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"involve\" for independent assessors in AI evaluation within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"involve\" for independent assessors in AI evaluation. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves independent assessors in AI evaluation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: involve independent assessors in AI evaluation.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"involve\" for independent assessors in AI evaluation within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"involve\" for independent assessors in AI evaluation. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E80EDA7CD6","version":2,"title":"Measure AI performance under deployment-like conditions","text":"AI governance owners should measure AI performance under deployment-like conditions.","topic":"Evaluation","intent":"measure ai performance under deployment like conditions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"measure","object":"AI performance under deployment-like conditions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"measure\" for AI performance under deployment-like conditions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"measure\" for AI performance under deployment-like conditions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI performance under deployment-like conditions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: measure AI performance under deployment-like conditions.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"measure\" for AI performance under deployment-like conditions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"measure\" for AI performance under deployment-like conditions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-95915B3947","version":2,"title":"Perform model evaluations","text":"Systemic-risk GPAI providers must perform model evaluations.","topic":"Evaluation","intent":"perform model evaluations","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 55(1)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"perform","object":"model evaluations","condition":"Covered systemic-risk models","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"perform\" for model evaluations within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"perform\" for model evaluations while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves model evaluations. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: perform model evaluations.","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"perform\" for model evaluations within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"perform\" for model evaluations while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1237C81D58","version":2,"title":"Retain rights to test proprietary decision software","text":"Responsible senior federal officials must retain rights to test proprietary decision software.","topic":"Evaluation","intent":"retain rights to test proprietary decision software","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.6.1","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"retain","object":"rights to test proprietary decision software","condition":"Audits, investigations and other specified purposes","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"retain\" for rights to test proprietary decision software within these source conditions: Audits, investigations and other specified purposes, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"retain\" for rights to test proprietary decision software while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves rights to test proprietary decision software. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: retain rights to test proprietary decision software.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"retain\" for rights to test proprietary decision software within these source conditions: Audits, investigations and other specified purposes, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"retain\" for rights to test proprietary decision software while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2EBCC14EEF","version":2,"title":"Select metrics for prioritized AI risks","text":"AI governance owners should select metrics for prioritized AI risks.","topic":"Evaluation","intent":"select metrics for prioritized ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"select","object":"metrics for prioritized AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"select\" for metrics for prioritized AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"select\" for metrics for prioritized AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves metrics for prioritized AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: select metrics for prioritized AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"select\" for metrics for prioritized AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"select\" for metrics for prioritized AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-ABF5BBD0E9","version":2,"title":"Test risk-management measures","text":"High-risk AI providers must test risk-management measures.","topic":"Evaluation","intent":"test risk management measures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 9(7)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"test","object":"risk-management measures","condition":"Before placing high-risk systems on the market","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"test\" for risk-management measures within these source conditions: Before placing high-risk systems on the market, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"test\" for risk-management measures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves risk-management measures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: test risk-management measures.","examples":{"meetsRule":"High-risk AI providers performs the required action \"test\" for risk-management measures within these source conditions: Before placing high-risk systems on the market, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"test\" for risk-management measures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-AA1B934A14","version":2,"title":"Covered agencies must include Unbiased AI Principles compliance terms in new LLM solicitations.","text":"Covered agency must include compliance terms.","topic":"Fairness","intent":"include compliance terms","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-26-04","control":"Agency Actions (a)","sourceVersion":"M-26-04","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf#page=3","actor":"Covered agency","modality":"must","action":"include","object":"compliance terms","condition":"Covered solicitations issued after memorandum","exception":"Scope exclusions; free open-source licenses","timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"include\" for compliance terms within these source conditions: Covered solicitations issued after memorandum, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"include\" for compliance terms while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves compliance terms. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: include compliance terms.","examples":{"meetsRule":"Covered agency performs the required action \"include\" for compliance terms within these source conditions: Covered solicitations issued after memorandum, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"include\" for compliance terms while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9958F2923D","version":2,"title":"Evaluate AI fairness and bias","text":"AI governance owners should evaluate AI fairness and bias.","topic":"Fairness","intent":"evaluate ai fairness and bias","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.11","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"AI fairness and bias","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI fairness and bias within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI fairness and bias. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI fairness and bias. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate AI fairness and bias.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI fairness and bias within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI fairness and bias. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0370617F00","version":2,"title":"Examine possible biases in datasets","text":"High-risk AI providers must examine possible biases in datasets.","topic":"Fairness","intent":"examine possible biases in datasets","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 10(2)(f)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"examine","object":"possible biases in datasets","condition":"Training, validation and testing data","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"examine\" for possible biases in datasets within these source conditions: Training, validation and testing data, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"examine\" for possible biases in datasets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves possible biases in datasets. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: examine possible biases in datasets.","examples":{"meetsRule":"High-risk AI providers performs the required action \"examine\" for possible biases in datasets within these source conditions: Training, validation and testing data, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"examine\" for possible biases in datasets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-50B746363D","version":2,"title":"Have humans validate outcomes for bias and unintended consequences.","text":"Agencies must validate outcomes.","topic":"Fairness","intent":"validate outcomes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"p.5, Ethical Use","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"validate","object":"outcomes","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"validate\" for outcomes within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"validate\" for outcomes while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves outcomes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: validate outcomes.","examples":{"meetsRule":"agencies performs the required action \"validate\" for outcomes within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"validate\" for outcomes while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-04955B1030","version":2,"title":"Include diverse perspectives in AI risk decisions","text":"AI governance owners should include diverse perspectives in AI risk decisions.","topic":"Fairness","intent":"include diverse perspectives in ai risk decisions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"include","object":"diverse perspectives in AI risk decisions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"include\" for diverse perspectives in AI risk decisions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"include\" for diverse perspectives in AI risk decisions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves diverse perspectives in AI risk decisions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: include diverse perspectives in AI risk decisions.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"include\" for diverse perspectives in AI risk decisions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"include\" for diverse perspectives in AI risk decisions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4483D77189","version":2,"title":"Prevent discriminatory generation","text":"Covered GenAI service providers must prevent discriminatory generation.","topic":"Fairness","intent":"prevent discriminatory generation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(2)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"prevent","object":"discriminatory generation","condition":"Algorithm design, training and service provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"prevent\" for discriminatory generation within these source conditions: Algorithm design, training and service provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"prevent\" for discriminatory generation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves discriminatory generation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prevent discriminatory generation.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"prevent\" for discriminatory generation within these source conditions: Algorithm design, training and service provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"prevent\" for discriminatory generation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-3307E11EB9","version":2,"title":"AI deployers should establish protections between the IT environment and AI system.","text":"AI deployer should establish IT/AI boundary protections.","topic":"Governance","intent":"establish it ai boundary protections","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Deployment architecture / boundaries","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"establish","object":"IT/AI boundary protections","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"establish\" for IT/AI boundary protections within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"establish\" for IT/AI boundary protections. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves IT/AI boundary protections. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish IT/AI boundary protections.","examples":{"meetsRule":"AI deployer follows the recommendation to \"establish\" for IT/AI boundary protections within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"establish\" for IT/AI boundary protections. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8566190520","version":2,"title":"AI deployers should require a threat model from the primary developer.","text":"AI deployer should require developer threat model.","topic":"Governance","intent":"require developer threat model","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Deployment governance / threat model","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"require","object":"developer threat model","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"require\" for developer threat model within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"require\" for developer threat model. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves developer threat model. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: require developer threat model.","examples":{"meetsRule":"AI deployer follows the recommendation to \"require\" for developer threat model within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"require\" for developer threat model. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-602BA32576","version":2,"title":"AI deployers should restrict access to model weights.","text":"AI deployer should restrict model-weight access.","topic":"Governance","intent":"restrict model weight access","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nsa-cisa-secure-ai-deployment","control":"Summary / model weights","sourceVersion":"April 2024 / 1.0","url":"https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/deploying-ai-systems-securely","actor":"AI deployer","modality":"should","action":"restrict","object":"model-weight access","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployer follows the recommendation to \"restrict\" for model-weight access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"restrict\" for model-weight access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves model-weight access. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: restrict model-weight access.","examples":{"meetsRule":"AI deployer follows the recommendation to \"restrict\" for model-weight access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI deployer omits the recommended action \"restrict\" for model-weight access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-08171EB6BD","version":2,"title":"Achieve appropriate AI accuracy","text":"High-risk AI providers must achieve appropriate AI accuracy.","topic":"Governance","intent":"achieve appropriate ai accuracy","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 15(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"achieve","object":"appropriate AI accuracy","condition":"Throughout high-risk AI lifecycle","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"achieve\" for appropriate AI accuracy within these source conditions: Throughout high-risk AI lifecycle, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"achieve\" for appropriate AI accuracy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves appropriate AI accuracy. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: achieve appropriate AI accuracy.","examples":{"meetsRule":"High-risk AI providers performs the required action \"achieve\" for appropriate AI accuracy within these source conditions: Throughout high-risk AI lifecycle, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"achieve\" for appropriate AI accuracy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-599AAF4DAB","version":2,"title":"Agree service rights and obligations with users","text":"Covered GenAI service providers must agree service rights and obligations with users.","topic":"Governance","intent":"agree service rights and obligations with users","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 9","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"agree","object":"service rights and obligations with users","condition":"Registered service users","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"agree\" for service rights and obligations with users within these source conditions: Registered service users, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"agree\" for service rights and obligations with users while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves service rights and obligations with users. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: agree service rights and obligations with users.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"agree\" for service rights and obligations with users within these source conditions: Registered service users, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"agree\" for service rights and obligations with users while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8B82635DEA","version":2,"title":"Apply impact-level requirements from Appendix C","text":"Responsible senior federal officials must apply impact-level requirements from Appendix C.","topic":"Governance","intent":"apply impact level requirements from appendix c","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.1.2","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"apply","object":"impact-level requirements from Appendix C","condition":"As determined by the assessment","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"apply\" for impact-level requirements from Appendix C within these source conditions: As determined by the assessment, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"apply\" for impact-level requirements from Appendix C while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves impact-level requirements from Appendix C. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: apply impact-level requirements from Appendix C.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"apply\" for impact-level requirements from Appendix C within these source conditions: As determined by the assessment, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"apply\" for impact-level requirements from Appendix C while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2C5DD821EE","version":2,"title":"Apply mechanisms to sustain deployed AI value","text":"AI governance owners should apply mechanisms to sustain deployed AI value.","topic":"Governance","intent":"apply mechanisms to sustain deployed ai value","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"apply","object":"mechanisms to sustain deployed AI value","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"apply\" for mechanisms to sustain deployed AI value within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"apply\" for mechanisms to sustain deployed AI value. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves mechanisms to sustain deployed AI value. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: apply mechanisms to sustain deployed AI value.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"apply\" for mechanisms to sustain deployed AI value within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"apply\" for mechanisms to sustain deployed AI value. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-342C0977BB","version":2,"title":"Apply prohibited social scoring","text":"AI operators must not apply prohibited social scoring.","topic":"Governance","intent":"apply prohibited social scoring","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"apply","object":"prohibited social scoring","condition":"Unrelated-context or unjustified adverse treatment","exception":"Statutory elements must all be assessed","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"apply\" for prohibited social scoring while these conditions apply: Unrelated-context or unjustified adverse treatment.","doesNotMeetRule":"AI operators performs the prohibited action \"apply\" for prohibited social scoring while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves prohibited social scoring. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: apply prohibited social scoring.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"apply\" for prohibited social scoring while these conditions apply: Unrelated-context or unjustified adverse treatment.","doesNotMeetRule":"AI operators performs the prohibited action \"apply\" for prohibited social scoring while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-AC38374E07","version":2,"title":"Assess fundamental rights impacts","text":"Covered high-risk AI deployers must assess fundamental rights impacts.","topic":"Governance","intent":"assess fundamental rights impacts","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 27(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Covered high-risk AI deployers","modality":"must","action":"assess","object":"fundamental rights impacts","condition":"Specified public bodies and private public-service deployers","exception":"Scope exclusions and applicability date require review","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered high-risk AI deployers performs the required action \"assess\" for fundamental rights impacts within these source conditions: Specified public bodies and private public-service deployers, and retains evidence.","doesNotMeetRule":"Covered high-risk AI deployers omits the required action \"assess\" for fundamental rights impacts while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves fundamental rights impacts. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assess fundamental rights impacts.","examples":{"meetsRule":"Covered high-risk AI deployers performs the required action \"assess\" for fundamental rights impacts within these source conditions: Specified public bodies and private public-service deployers, and retains evidence.","doesNotMeetRule":"Covered high-risk AI deployers omits the required action \"assess\" for fundamental rights impacts while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9E7F166E73","version":2,"title":"Assess systemic risks","text":"Systemic-risk GPAI providers must assess systemic risks.","topic":"Governance","intent":"assess systemic risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 55(1)(b)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"assess","object":"systemic risks","condition":"Covered systemic-risk models","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"assess\" for systemic risks within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"assess\" for systemic risks while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves systemic risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assess systemic risks.","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"assess\" for systemic risks within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"assess\" for systemic risks while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4EA78BC0D9","version":2,"title":"Assess the effectiveness of existing AI controls","text":"AI governance owners should assess the effectiveness of existing AI controls.","topic":"Governance","intent":"assess the effectiveness of existing ai controls","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"assess","object":"the effectiveness of existing AI controls","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assess\" for the effectiveness of existing AI controls within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assess\" for the effectiveness of existing AI controls. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves the effectiveness of existing AI controls. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assess the effectiveness of existing AI controls.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assess\" for the effectiveness of existing AI controls within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assess\" for the effectiveness of existing AI controls. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-29043D921A","version":2,"title":"Assign executive accountability for AI risk decisions","text":"AI governance owners should assign executive accountability for AI risk decisions.","topic":"Governance","intent":"assign executive accountability for ai risk decisions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"assign","object":"executive accountability for AI risk decisions","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assign\" for executive accountability for AI risk decisions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assign\" for executive accountability for AI risk decisions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves executive accountability for AI risk decisions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assign executive accountability for AI risk decisions.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assign\" for executive accountability for AI risk decisions within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assign\" for executive accountability for AI risk decisions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-184958056C","version":2,"title":"Avoid prohibited special-category processing","text":"Data controllers must avoid prohibited special-category processing.","topic":"Governance","intent":"avoid prohibited special category processing","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 9(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"avoid","object":"prohibited special-category processing","condition":"Unless an Article 9 exception applies","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"avoid\" for prohibited special-category processing within these source conditions: Unless an Article 9 exception applies, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"avoid\" for prohibited special-category processing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves prohibited special-category processing. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: avoid prohibited special-category processing.","examples":{"meetsRule":"Data controllers performs the required action \"avoid\" for prohibited special-category processing within these source conditions: Unless an Article 9 exception applies, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"avoid\" for prohibited special-category processing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E7F9A07274","version":2,"title":"Collect feedback from affected stakeholders","text":"AI governance owners should collect feedback from affected stakeholders.","topic":"Governance","intent":"collect feedback from affected stakeholders","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 5.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"collect","object":"feedback from affected stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"collect\" for feedback from affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"collect\" for feedback from affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves feedback from affected stakeholders. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: collect feedback from affected stakeholders.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"collect\" for feedback from affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"collect\" for feedback from affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-3B0B09F1A3","version":2,"title":"Complete required algorithm filings","text":"Covered GenAI service providers must complete required algorithm filings.","topic":"Governance","intent":"complete required algorithm filings","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 17","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"complete","object":"required algorithm filings","condition":"Applicable algorithm-filing provisions","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"complete\" for required algorithm filings within these source conditions: Applicable algorithm-filing provisions, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"complete\" for required algorithm filings while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves required algorithm filings. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: complete required algorithm filings.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"complete\" for required algorithm filings within these source conditions: Applicable algorithm-filing provisions, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"complete\" for required algorithm filings while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F3D285541D","version":2,"title":"Consider viable non-AI alternatives","text":"AI governance owners should consider viable non-AI alternatives.","topic":"Governance","intent":"consider viable non ai alternatives","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"consider","object":"viable non-AI alternatives","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for viable non-AI alternatives within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for viable non-AI alternatives. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves viable non-AI alternatives. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: consider viable non-AI alternatives.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"consider\" for viable non-AI alternatives within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"consider\" for viable non-AI alternatives. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-242001C9D0","version":2,"title":"Consult IT Services before using MSU credentials for AI products, including free tools.","text":"Users must consult IT Services.","topic":"Governance","intent":"consult it services","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"Procuring or Registering, paragraph 2","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must","action":"consult","object":"IT Services","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"consult\" for IT Services within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"consult\" for IT Services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves IT Services. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: consult IT Services.","examples":{"meetsRule":"users performs the required action \"consult\" for IT Services within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"consult\" for IT Services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1003DA2A0B","version":2,"title":"Covered AI information systems must receive agency authorization before deployment.","text":"Covered AI information system must receive authorization to operate.","topic":"Governance","intent":"receive authorization to operate","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-22","control":"4(e)(i)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=11","actor":"Covered AI information system","modality":"must","action":"receive","object":"authorization to operate","condition":"Operated by or for an agency","exception":null,"timing":"Before deployment","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered AI information system performs the required action \"receive\" for authorization to operate within these source conditions: Operated by or for an agency, and retains evidence.","doesNotMeetRule":"Covered AI information system omits the required action \"receive\" for authorization to operate while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves authorization to operate. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: receive authorization to operate.","examples":{"meetsRule":"Covered AI information system performs the required action \"receive\" for authorization to operate within these source conditions: Operated by or for an agency, and retains evidence.","doesNotMeetRule":"Covered AI information system omits the required action \"receive\" for authorization to operate while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4AD720A286","version":2,"title":"Covered agencies must complete an impact assessment before deploying high-impact AI.","text":"Covered agency must complete AI impact assessment.","topic":"Governance","intent":"complete ai impact assessment","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-21","control":"4(b)(ii)","sourceVersion":"M-25-21","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf#page=16","actor":"Covered agency","modality":"must","action":"complete","object":"AI impact assessment","condition":"High-impact use within §4 scope","exception":"Conditional pilot exemption or CAIO waiver under §4(a)","timing":"Before deployment","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"complete\" for AI impact assessment within these source conditions: High-impact use within §4 scope, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"complete\" for AI impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI impact assessment. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: complete AI impact assessment.","examples":{"meetsRule":"Covered agency performs the required action \"complete\" for AI impact assessment within these source conditions: High-impact use within §4 scope, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"complete\" for AI impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7939E9BF07","version":2,"title":"Covered agencies must inventory AI use cases at least annually.","text":"Covered agency must inventory AI use cases.","topic":"Governance","intent":"inventory ai use cases","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-21","control":"3(b)(v)","sourceVersion":"M-25-21","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf#page=12","actor":"Covered agency","modality":"must","action":"inventory","object":"AI use cases","condition":"Within the source scope; assess applicability before adoption.","exception":"DoD and Intelligence Community","timing":"At least annually","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"inventory\" for AI use cases within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"inventory\" for AI use cases while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI use cases. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory AI use cases.","examples":{"meetsRule":"Covered agency performs the required action \"inventory\" for AI use cases within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"inventory\" for AI use cases while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8EB0EC219E","version":2,"title":"Define operator proficiency requirements","text":"AI governance owners should define operator proficiency requirements.","topic":"Governance","intent":"define operator proficiency requirements","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 3.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"operator proficiency requirements","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for operator proficiency requirements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for operator proficiency requirements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves operator proficiency requirements. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define operator proficiency requirements.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for operator proficiency requirements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for operator proficiency requirements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B098FE0267","version":2,"title":"Define safe AI decommissioning procedures","text":"AI governance owners should define safe AI decommissioning procedures.","topic":"Governance","intent":"define safe ai decommissioning procedures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.7","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"safe AI decommissioning procedures","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for safe AI decommissioning procedures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for safe AI decommissioning procedures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves safe AI decommissioning procedures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define safe AI decommissioning procedures.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for safe AI decommissioning procedures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for safe AI decommissioning procedures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E069B1B813","version":2,"title":"Define tasks supported by the AI system","text":"AI governance owners should define tasks supported by the AI system.","topic":"Governance","intent":"define tasks supported by the ai system","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"tasks supported by the AI system","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for tasks supported by the AI system within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for tasks supported by the AI system. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves tasks supported by the AI system. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define tasks supported by the AI system.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for tasks supported by the AI system within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for tasks supported by the AI system. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-260ECC7519","version":2,"title":"Define the business value of AI use","text":"AI governance owners should define the business value of AI use.","topic":"Governance","intent":"define the business value of ai use","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"the business value of AI use","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for the business value of AI use within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for the business value of AI use. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves the business value of AI use. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define the business value of AI use.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for the business value of AI use within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for the business value of AI use. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1394624FB2","version":2,"title":"Determine risk-management effort based on risk tolerance","text":"AI governance owners should determine risk-management effort based on risk tolerance.","topic":"Governance","intent":"determine risk management effort based on risk tolerance","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"determine","object":"risk-management effort based on risk tolerance","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"determine\" for risk-management effort based on risk tolerance within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"determine\" for risk-management effort based on risk tolerance. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves risk-management effort based on risk tolerance. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: determine risk-management effort based on risk tolerance.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"determine\" for risk-management effort based on risk tolerance within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"determine\" for risk-management effort based on risk tolerance. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-65283B4BFC","version":2,"title":"Determine whether AI deployment should proceed","text":"AI governance owners should determine whether AI deployment should proceed.","topic":"Governance","intent":"determine whether ai deployment should proceed","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"determine","object":"whether AI deployment should proceed","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"determine\" for whether AI deployment should proceed within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"determine\" for whether AI deployment should proceed. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves whether AI deployment should proceed. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: determine whether AI deployment should proceed.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"determine\" for whether AI deployment should proceed within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"determine\" for whether AI deployment should proceed. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1A04293BCD","version":2,"title":"Do not base academic or grading decisions solely on AI-detection output.","text":"Instructors should-not rely detector output.","topic":"Governance","intent":"rely detector output","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"Teaching and Learning, detection paragraph","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"instructors","modality":"should-not","action":"rely","object":"detector output","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"instructors performs the required action \"rely\" for detector output within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"instructors omits the required action \"rely\" for detector output while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves detector output. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: rely detector output.","examples":{"meetsRule":"instructors performs the required action \"rely\" for detector output within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"instructors omits the required action \"rely\" for detector output while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-604F1B8C71","version":2,"title":"Do not use state-designated high-risk GenAI tools.","text":"Employees must-not use high-risk tools.","topic":"Governance","intent":"use high risk tools","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 2","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must-not","action":"use","object":"high-risk tools","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"use\" for high-risk tools within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"use\" for high-risk tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves high-risk tools. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use high-risk tools.","examples":{"meetsRule":"employees performs the required action \"use\" for high-risk tools within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"use\" for high-risk tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6A21A315BB","version":2,"title":"Document AI experimental design considerations","text":"AI governance owners should document AI experimental design considerations.","topic":"Governance","intent":"document ai experimental design considerations","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI experimental design considerations","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI experimental design considerations within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI experimental design considerations. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI experimental design considerations. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI experimental design considerations.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI experimental design considerations within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI experimental design considerations. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7B1A838FFF","version":2,"title":"Document AI knowledge limitations","text":"AI governance owners should document AI knowledge limitations.","topic":"Governance","intent":"document ai knowledge limitations","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI knowledge limitations","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI knowledge limitations within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI knowledge limitations. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI knowledge limitations. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI knowledge limitations.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI knowledge limitations within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI knowledge limitations. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9EE4AB873B","version":2,"title":"Document AI risk tolerance","text":"AI governance owners should document AI risk tolerance.","topic":"Governance","intent":"document ai risk tolerance","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI risk tolerance","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risk tolerance within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risk tolerance. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI risk tolerance. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI risk tolerance.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risk tolerance within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risk tolerance. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8822957DD8","version":2,"title":"Document AI risk-management responsibilities","text":"AI governance owners should document AI risk-management responsibilities.","topic":"Governance","intent":"document ai risk management responsibilities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 2.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI risk-management responsibilities","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risk-management responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risk-management responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI risk-management responsibilities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI risk-management responsibilities.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risk-management responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risk-management responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E477C3290A","version":2,"title":"Document AI risks and potential impacts","text":"AI governance owners should document AI risks and potential impacts.","topic":"Governance","intent":"document ai risks and potential impacts","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"AI risks and potential impacts","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risks and potential impacts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risks and potential impacts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI risks and potential impacts. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document AI risks and potential impacts.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for AI risks and potential impacts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for AI risks and potential impacts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5C041B0CCA","version":2,"title":"Document applicable AI legal requirements","text":"AI governance owners should document applicable AI legal requirements.","topic":"Governance","intent":"document applicable ai legal requirements","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"applicable AI legal requirements","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for applicable AI legal requirements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for applicable AI legal requirements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves applicable AI legal requirements. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document applicable AI legal requirements.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for applicable AI legal requirements within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for applicable AI legal requirements. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F61F6AC2CB","version":2,"title":"Document intended AI use contexts","text":"AI governance owners should document intended AI use contexts.","topic":"Governance","intent":"document intended ai use contexts","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"intended AI use contexts","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for intended AI use contexts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for intended AI use contexts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves intended AI use contexts. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document intended AI use contexts.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for intended AI use contexts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for intended AI use contexts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-AC404254CF","version":2,"title":"Document internal controls for AI components","text":"AI governance owners should document internal controls for AI components.","topic":"Governance","intent":"document internal controls for ai components","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"internal controls for AI components","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for internal controls for AI components within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for internal controls for AI components. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves internal controls for AI components. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document internal controls for AI components.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for internal controls for AI components within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for internal controls for AI components. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-98C41762F1","version":2,"title":"Document negative residual AI risks","text":"AI governance owners should document negative residual AI risks.","topic":"Governance","intent":"document negative residual ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 1.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"negative residual AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for negative residual AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for negative residual AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves negative residual AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document negative residual AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for negative residual AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for negative residual AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-692200D867","version":2,"title":"Document organizational goals for AI","text":"AI governance owners should document organizational goals for AI.","topic":"Governance","intent":"document organizational goals for ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"organizational goals for AI","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for organizational goals for AI within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for organizational goals for AI. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves organizational goals for AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document organizational goals for AI.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for organizational goals for AI within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for organizational goals for AI. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4306CEE8C8","version":2,"title":"Document potential benefits of AI functionality","text":"AI governance owners should document potential benefits of AI functionality.","topic":"Governance","intent":"document potential benefits of ai functionality","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"potential benefits of AI functionality","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for potential benefits of AI functionality within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for potential benefits of AI functionality. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves potential benefits of AI functionality. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document potential benefits of AI functionality.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for potential benefits of AI functionality within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for potential benefits of AI functionality. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-DD41393A6A","version":2,"title":"Elicit AI system requirements from stakeholders","text":"AI governance owners should elicit AI system requirements from stakeholders.","topic":"Governance","intent":"elicit ai system requirements from stakeholders","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.6","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"elicit","object":"AI system requirements from stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"elicit\" for AI system requirements from stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"elicit\" for AI system requirements from stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI system requirements from stakeholders. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: elicit AI system requirements from stakeholders.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"elicit\" for AI system requirements from stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"elicit\" for AI system requirements from stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-C57A5D1D72","version":2,"title":"Enable automatic event logging","text":"High-risk AI providers must enable automatic event logging.","topic":"Governance","intent":"enable automatic event logging","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 12(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"automatic event logging","condition":"Covered high-risk systems","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for automatic event logging within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for automatic event logging while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves automatic event logging. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable automatic event logging.","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for automatic event logging within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for automatic event logging while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9EC219543F","version":2,"title":"Enable withdrawal of consent","text":"Data controllers must enable withdrawal of consent.","topic":"Governance","intent":"enable withdrawal of consent","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 7(3)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"enable","object":"withdrawal of consent","condition":"Where consent is the lawful basis","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"enable\" for withdrawal of consent within these source conditions: Where consent is the lawful basis, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"enable\" for withdrawal of consent while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves withdrawal of consent. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable withdrawal of consent.","examples":{"meetsRule":"Data controllers performs the required action \"enable\" for withdrawal of consent within these source conditions: Where consent is the lawful basis, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"enable\" for withdrawal of consent while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6630D57F8E","version":2,"title":"Ensure appropriate AI literacy","text":"Providers and deployers must ensure appropriate AI literacy.","topic":"Governance","intent":"ensure appropriate ai literacy","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 4","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Providers and deployers","modality":"must","action":"ensure","object":"appropriate AI literacy","condition":"Staff and persons operating AI on their behalf","exception":"Consider technical knowledge, experience, training and context","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Providers and deployers performs the required action \"ensure\" for appropriate AI literacy within these source conditions: Staff and persons operating AI on their behalf, and retains evidence.","doesNotMeetRule":"Providers and deployers omits the required action \"ensure\" for appropriate AI literacy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves appropriate AI literacy. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure appropriate AI literacy.","examples":{"meetsRule":"Providers and deployers performs the required action \"ensure\" for appropriate AI literacy within these source conditions: Staff and persons operating AI on their behalf, and retains evidence.","doesNotMeetRule":"Providers and deployers omits the required action \"ensure\" for appropriate AI literacy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D8C5075D47","version":2,"title":"Ensure resilience to errors and faults","text":"High-risk AI providers must ensure resilience to errors and faults.","topic":"Governance","intent":"ensure resilience to errors and faults","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 15(4)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"ensure","object":"resilience to errors and faults","condition":"Covered high-risk systems","exception":"Appropriate technical measures","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for resilience to errors and faults within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for resilience to errors and faults while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves resilience to errors and faults. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure resilience to errors and faults.","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for resilience to errors and faults within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for resilience to errors and faults while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-96F8E30D4E","version":2,"title":"Establish a post-market monitoring system","text":"High-risk AI providers must establish a post-market monitoring system.","topic":"Governance","intent":"establish a post market monitoring system","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 72(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"establish","object":"a post-market monitoring system","condition":"Covered high-risk systems","exception":"Applicability date and scope review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for a post-market monitoring system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for a post-market monitoring system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a post-market monitoring system. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish a post-market monitoring system.","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for a post-market monitoring system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for a post-market monitoring system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2D3F66EE87","version":2,"title":"Establish a quality-management system","text":"High-risk AI providers must establish a quality-management system.","topic":"Governance","intent":"establish a quality management system","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 17(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"establish","object":"a quality-management system","condition":"Covered high-risk systems","exception":"Proportionate to provider size","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for a quality-management system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for a quality-management system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a quality-management system. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish a quality-management system.","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for a quality-management system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for a quality-management system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-972D7C9D89","version":2,"title":"Establish an AI risk-management system","text":"High-risk AI providers must establish an AI risk-management system.","topic":"Governance","intent":"establish an ai risk management system","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 9(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"establish","object":"an AI risk-management system","condition":"Covered high-risk systems","exception":"Applicability date and scope review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for an AI risk-management system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for an AI risk-management system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves an AI risk-management system. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish an AI risk-management system.","examples":{"meetsRule":"High-risk AI providers performs the required action \"establish\" for an AI risk-management system within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"establish\" for an AI risk-management system while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-22E9FC8F8B","version":2,"title":"Establish complaint and reporting channels","text":"Covered GenAI service providers must establish complaint and reporting channels.","topic":"Governance","intent":"establish complaint and reporting channels","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 15","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"establish","object":"complaint and reporting channels","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"establish\" for complaint and reporting channels within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"establish\" for complaint and reporting channels while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves complaint and reporting channels. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish complaint and reporting channels.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"establish\" for complaint and reporting channels within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"establish\" for complaint and reporting channels while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-601E866E1A","version":2,"title":"Establish controls against prohibited GAI content","text":"AI governance owners should establish controls against prohibited GAI content.","topic":"Governance","intent":"establish controls against prohibited gai content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.4-001","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"controls against prohibited GAI content","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for controls against prohibited GAI content within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for controls against prohibited GAI content. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves controls against prohibited GAI content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish controls against prohibited GAI content.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for controls against prohibited GAI content within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for controls against prohibited GAI content. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6F2EEB6462","version":2,"title":"Establish regular engagement with affected stakeholders","text":"AI governance owners should establish regular engagement with affected stakeholders.","topic":"Governance","intent":"establish regular engagement with affected stakeholders","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 5.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"regular engagement with affected stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for regular engagement with affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for regular engagement with affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves regular engagement with affected stakeholders. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish regular engagement with affected stakeholders.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for regular engagement with affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for regular engagement with affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D4E3A56AB8","version":2,"title":"Estimate likelihood and magnitude of AI impacts","text":"AI governance owners should estimate likelihood and magnitude of AI impacts.","topic":"Governance","intent":"estimate likelihood and magnitude of ai impacts","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 5.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"estimate","object":"likelihood and magnitude of AI impacts","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"estimate\" for likelihood and magnitude of AI impacts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"estimate\" for likelihood and magnitude of AI impacts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves likelihood and magnitude of AI impacts. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: estimate likelihood and magnitude of AI impacts.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"estimate\" for likelihood and magnitude of AI impacts within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"estimate\" for likelihood and magnitude of AI impacts. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8F9AE0F269","version":2,"title":"Examine potential costs of AI errors","text":"AI governance owners should examine potential costs of AI errors.","topic":"Governance","intent":"examine potential costs of ai errors","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"examine","object":"potential costs of AI errors","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for potential costs of AI errors within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for potential costs of AI errors. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves potential costs of AI errors. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: examine potential costs of AI errors.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for potential costs of AI errors within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for potential costs of AI errors. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7F4EB9435F","version":2,"title":"Follow provider instructions for use","text":"High-risk AI deployers must follow provider instructions for use.","topic":"Governance","intent":"follow provider instructions for use","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 26(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"follow","object":"provider instructions for use","condition":"Covered high-risk AI use","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"follow\" for provider instructions for use within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"follow\" for provider instructions for use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves provider instructions for use. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: follow provider instructions for use.","examples":{"meetsRule":"High-risk AI deployers performs the required action \"follow\" for provider instructions for use within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"follow\" for provider instructions for use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-C1F74ECF84","version":2,"title":"Identify a lawful basis for processing","text":"Data controllers must identify a lawful basis for processing.","topic":"Governance","intent":"identify a lawful basis for processing","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 6(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"identify","object":"a lawful basis for processing","condition":"Before covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"identify\" for a lawful basis for processing within these source conditions: Before covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"identify\" for a lawful basis for processing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a lawful basis for processing. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: identify a lawful basis for processing.","examples":{"meetsRule":"Data controllers performs the required action \"identify\" for a lawful basis for processing within these source conditions: Before covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"identify\" for a lawful basis for processing while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-FD9E9E9724","version":2,"title":"Identify reasonably foreseeable AI risks","text":"High-risk AI providers must identify reasonably foreseeable AI risks.","topic":"Governance","intent":"identify reasonably foreseeable ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 9(2)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"identify","object":"reasonably foreseeable AI risks","condition":"Intended purpose and foreseeable misuse","exception":"Applicability date and scope review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"identify\" for reasonably foreseeable AI risks within these source conditions: Intended purpose and foreseeable misuse, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"identify\" for reasonably foreseeable AI risks while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves reasonably foreseeable AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: identify reasonably foreseeable AI risks.","examples":{"meetsRule":"High-risk AI providers performs the required action \"identify\" for reasonably foreseeable AI risks within these source conditions: Intended purpose and foreseeable misuse, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"identify\" for reasonably foreseeable AI risks while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9E0C4702D4","version":2,"title":"Implement post-deployment AI monitoring plans","text":"AI governance owners should implement post-deployment AI monitoring plans.","topic":"Governance","intent":"implement post deployment ai monitoring plans","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"implement","object":"post-deployment AI monitoring plans","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"implement\" for post-deployment AI monitoring plans within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"implement\" for post-deployment AI monitoring plans. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves post-deployment AI monitoring plans. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: implement post-deployment AI monitoring plans.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"implement\" for post-deployment AI monitoring plans within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"implement\" for post-deployment AI monitoring plans. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-03619CE6CD","version":2,"title":"Improve accuracy of generated content","text":"Covered GenAI service providers must improve accuracy of generated content.","topic":"Governance","intent":"improve accuracy of generated content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(5)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"improve","object":"accuracy of generated content","condition":"According to service characteristics","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for accuracy of generated content within these source conditions: According to service characteristics, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for accuracy of generated content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves accuracy of generated content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: improve accuracy of generated content.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for accuracy of generated content within these source conditions: According to service characteristics, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for accuracy of generated content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-A7714C60EE","version":2,"title":"Incorporate adjudicated stakeholder feedback","text":"AI governance owners should incorporate adjudicated stakeholder feedback.","topic":"Governance","intent":"incorporate adjudicated stakeholder feedback","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 5.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"incorporate","object":"adjudicated stakeholder feedback","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"incorporate\" for adjudicated stakeholder feedback within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"incorporate\" for adjudicated stakeholder feedback. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves adjudicated stakeholder feedback. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: incorporate adjudicated stakeholder feedback.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"incorporate\" for adjudicated stakeholder feedback within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"incorporate\" for adjudicated stakeholder feedback. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F306231C79","version":2,"title":"Infer emotions in workplaces or schools","text":"AI operators must not infer emotions in workplaces or schools.","topic":"Governance","intent":"infer emotions in workplaces or schools","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(f)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"infer","object":"emotions in workplaces or schools","condition":"Covered emotion recognition systems","exception":"Medical or safety reasons","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"infer\" for emotions in workplaces or schools while these conditions apply: Covered emotion recognition systems.","doesNotMeetRule":"AI operators performs the prohibited action \"infer\" for emotions in workplaces or schools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves emotions in workplaces or schools. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: infer emotions in workplaces or schools.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"infer\" for emotions in workplaces or schools while these conditions apply: Covered emotion recognition systems.","doesNotMeetRule":"AI operators performs the prohibited action \"infer\" for emotions in workplaces or schools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-FBD73FD1D8","version":2,"title":"Inform affected workers of high-risk AI use","text":"Employer deployers must inform affected workers of high-risk AI use.","topic":"Governance","intent":"inform affected workers of high risk ai use","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 26(7)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Employer deployers","modality":"must","action":"inform","object":"affected workers of high-risk AI use","condition":"Before workplace use","exception":"National information rights also apply","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Employer deployers performs the required action \"inform\" for affected workers of high-risk AI use within these source conditions: Before workplace use, and retains evidence.","doesNotMeetRule":"Employer deployers omits the required action \"inform\" for affected workers of high-risk AI use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves affected workers of high-risk AI use. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inform affected workers of high-risk AI use.","examples":{"meetsRule":"Employer deployers performs the required action \"inform\" for affected workers of high-risk AI use within these source conditions: Before workplace use, and retains evidence.","doesNotMeetRule":"Employer deployers omits the required action \"inform\" for affected workers of high-risk AI use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8E51985BF0","version":2,"title":"Inform people before AI makes decisions about them.","text":"Agencies must notify affected people.","topic":"Governance","intent":"notify affected people","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"pp.6–7, AI Disclaimers","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"notify","object":"affected people","condition":"citizen/business impact","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"notify\" for affected people within these source conditions: citizen/business impact, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"notify\" for affected people while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves affected people. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: notify affected people.","examples":{"meetsRule":"agencies performs the required action \"notify\" for affected people within these source conditions: citizen/business impact, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"notify\" for affected people while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B9CECE710F","version":2,"title":"Inform people exposed to emotion recognition","text":"Covered AI deployers must inform people exposed to emotion recognition.","topic":"Governance","intent":"inform people exposed to emotion recognition","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 50(3)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Covered AI deployers","modality":"must","action":"inform","object":"people exposed to emotion recognition","condition":"Covered systems","exception":"Specific legal exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered AI deployers performs the required action \"inform\" for people exposed to emotion recognition within these source conditions: Covered systems, and retains evidence.","doesNotMeetRule":"Covered AI deployers omits the required action \"inform\" for people exposed to emotion recognition while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves people exposed to emotion recognition. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inform people exposed to emotion recognition.","examples":{"meetsRule":"Covered AI deployers performs the required action \"inform\" for people exposed to emotion recognition within these source conditions: Covered systems, and retains evidence.","doesNotMeetRule":"Covered AI deployers omits the required action \"inform\" for people exposed to emotion recognition while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-86AF529571","version":2,"title":"Inform people they are interacting with AI","text":"AI providers must inform people they are interacting with AI.","topic":"Governance","intent":"inform people they are interacting with ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 50(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI providers","modality":"must","action":"inform","object":"people they are interacting with AI","condition":"Direct interaction with natural persons","exception":"Obvious interaction and specified law-enforcement exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI providers performs the required action \"inform\" for people they are interacting with AI within these source conditions: Direct interaction with natural persons, and retains evidence.","doesNotMeetRule":"AI providers omits the required action \"inform\" for people they are interacting with AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves people they are interacting with AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inform people they are interacting with AI.","examples":{"meetsRule":"AI providers performs the required action \"inform\" for people they are interacting with AI within these source conditions: Direct interaction with natural persons, and retains evidence.","doesNotMeetRule":"AI providers omits the required action \"inform\" for people they are interacting with AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-04690263D1","version":2,"title":"Integrate continual improvements into AI updates","text":"AI governance owners should integrate continual improvements into AI updates.","topic":"Governance","intent":"integrate continual improvements into ai updates","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 4.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"integrate","object":"continual improvements into AI updates","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"integrate\" for continual improvements into AI updates within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"integrate\" for continual improvements into AI updates. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves continual improvements into AI updates. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: integrate continual improvements into AI updates.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"integrate\" for continual improvements into AI updates within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"integrate\" for continual improvements into AI updates. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E3E35C8AE8","version":2,"title":"Integrate trustworthiness characteristics into AI policies","text":"AI governance owners should integrate trustworthiness characteristics into AI policies.","topic":"Governance","intent":"integrate trustworthiness characteristics into ai policies","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"integrate","object":"trustworthiness characteristics into AI policies","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"integrate\" for trustworthiness characteristics into AI policies within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"integrate\" for trustworthiness characteristics into AI policies. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves trustworthiness characteristics into AI policies. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: integrate trustworthiness characteristics into AI policies.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"integrate\" for trustworthiness characteristics into AI policies within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"integrate\" for trustworthiness characteristics into AI policies. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9365A6ADE2","version":2,"title":"Inventory organizational AI systems","text":"AI governance owners should inventory organizational AI systems.","topic":"Governance","intent":"inventory organizational ai systems","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.6","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"inventory","object":"organizational AI systems","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for organizational AI systems within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for organizational AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves organizational AI systems. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory organizational AI systems.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for organizational AI systems within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for organizational AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6DAA5CD4FD","version":2,"title":"Inventory organizational generative AI systems","text":"AI governance owners should inventory organizational generative AI systems.","topic":"Governance","intent":"inventory organizational generative ai systems","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.6-001","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"inventory","object":"organizational generative AI systems","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for organizational generative AI systems within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for organizational generative AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves organizational generative AI systems. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory organizational generative AI systems.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for organizational generative AI systems within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for organizational generative AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B43991A570","version":2,"title":"Inventory third parties with access to organizational content","text":"AI governance owners should inventory third parties with access to organizational content.","topic":"Governance","intent":"inventory third parties with access to organizational content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-6.1-007","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"inventory","object":"third parties with access to organizational content","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for third parties with access to organizational content within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for third parties with access to organizational content. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves third parties with access to organizational content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: inventory third parties with access to organizational content.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"inventory\" for third parties with access to organizational content within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"inventory\" for third parties with access to organizational content. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D1EC03300E","version":2,"title":"Involve interdisciplinary AI actors in context assessment","text":"AI governance owners should involve interdisciplinary AI actors in context assessment.","topic":"Governance","intent":"involve interdisciplinary ai actors in context assessment","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"involve","object":"interdisciplinary AI actors in context assessment","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"involve\" for interdisciplinary AI actors in context assessment within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"involve\" for interdisciplinary AI actors in context assessment. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves interdisciplinary AI actors in context assessment. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: involve interdisciplinary AI actors in context assessment.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"involve\" for interdisciplinary AI actors in context assessment within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"involve\" for interdisciplinary AI actors in context assessment. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F027EE41CE","version":2,"title":"Limit processing to specified purposes","text":"Data controllers must limit processing to specified purposes.","topic":"Governance","intent":"limit processing to specified purposes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(b)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"limit","object":"processing to specified purposes","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"limit\" for processing to specified purposes within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"limit\" for processing to specified purposes while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves processing to specified purposes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: limit processing to specified purposes.","examples":{"meetsRule":"Data controllers performs the required action \"limit\" for processing to specified purposes within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"limit\" for processing to specified purposes while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-423A77F29F","version":2,"title":"Maintain model technical documentation","text":"GPAI model providers must maintain model technical documentation.","topic":"Governance","intent":"maintain model technical documentation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 53(1)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"maintain","object":"model technical documentation","condition":"Covered general-purpose AI models","exception":"Specified open-source exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"maintain\" for model technical documentation within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"maintain\" for model technical documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves model technical documentation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain model technical documentation.","examples":{"meetsRule":"GPAI model providers performs the required action \"maintain\" for model technical documentation within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"maintain\" for model technical documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-689F104CE2","version":2,"title":"Maintain records of processing activities","text":"Data controllers must maintain records of processing activities.","topic":"Governance","intent":"maintain records of processing activities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 30(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"maintain","object":"records of processing activities","condition":"Applicable scope and exemptions","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"maintain\" for records of processing activities within these source conditions: Applicable scope and exemptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"maintain\" for records of processing activities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves records of processing activities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain records of processing activities.","examples":{"meetsRule":"Data controllers performs the required action \"maintain\" for records of processing activities within these source conditions: Applicable scope and exemptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"maintain\" for records of processing activities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-413925FF98","version":2,"title":"Map legal risks of AI components","text":"AI governance owners should map legal risks of AI components.","topic":"Governance","intent":"map legal risks of ai components","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"map","object":"legal risks of AI components","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"map\" for legal risks of AI components within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"map\" for legal risks of AI components. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves legal risks of AI components. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: map legal risks of AI components.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"map\" for legal risks of AI components within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"map\" for legal risks of AI components. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5C96C1D94B","version":2,"title":"Mark generated content in machine-readable form","text":"Synthetic-content AI providers must mark generated content in machine-readable form.","topic":"Governance","intent":"mark generated content in machine readable form","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 50(2)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Synthetic-content AI providers","modality":"must","action":"mark","object":"generated content in machine-readable form","condition":"Covered synthetic text, audio, images or video","exception":"Standard editing and specified law-enforcement exceptions; transitions apply","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Synthetic-content AI providers performs the required action \"mark\" for generated content in machine-readable form within these source conditions: Covered synthetic text, audio, images or video, and retains evidence.","doesNotMeetRule":"Synthetic-content AI providers omits the required action \"mark\" for generated content in machine-readable form while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves generated content in machine-readable form. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: mark generated content in machine-readable form.","examples":{"meetsRule":"Synthetic-content AI providers performs the required action \"mark\" for generated content in machine-readable form within these source conditions: Covered synthetic text, audio, images or video, and retains evidence.","doesNotMeetRule":"Synthetic-content AI providers omits the required action \"mark\" for generated content in machine-readable form while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F6290E21EB","version":2,"title":"Monitor AI behavior in production","text":"AI governance owners should monitor AI behavior in production.","topic":"Governance","intent":"monitor ai behavior in production","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"AI behavior in production","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for AI behavior in production within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for AI behavior in production. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI behavior in production. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: monitor AI behavior in production.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for AI behavior in production within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for AI behavior in production. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-20C51AF468","version":2,"title":"Monitor AI operation in accordance with instructions","text":"High-risk AI deployers must monitor AI operation in accordance with instructions.","topic":"Governance","intent":"monitor ai operation in accordance with instructions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 26(5)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"monitor","object":"AI operation in accordance with instructions","condition":"Covered high-risk AI use","exception":"Suspend and notify when statutory risk threshold is met","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"monitor\" for AI operation in accordance with instructions within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"monitor\" for AI operation in accordance with instructions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI operation in accordance with instructions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: monitor AI operation in accordance with instructions.","examples":{"meetsRule":"High-risk AI deployers performs the required action \"monitor\" for AI operation in accordance with instructions within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"monitor\" for AI operation in accordance with instructions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-91B7104B7C","version":2,"title":"Monitor emergent GAI risks","text":"AI governance owners should monitor emergent GAI risks.","topic":"Governance","intent":"monitor emergent gai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.5-003","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"emergent GAI risks","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for emergent GAI risks within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for emergent GAI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves emergent GAI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: monitor emergent GAI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for emergent GAI risks within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for emergent GAI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E86C054724","version":2,"title":"Monitor pre-trained models used in development","text":"AI governance owners should monitor pre-trained models used in development.","topic":"Governance","intent":"monitor pre trained models used in development","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"pre-trained models used in development","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for pre-trained models used in development within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for pre-trained models used in development. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves pre-trained models used in development. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: monitor pre-trained models used in development.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for pre-trained models used in development within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for pre-trained models used in development. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8FFA25BD3B","version":2,"title":"Obtain stakeholder input on unacceptable GAI use","text":"AI governance owners should obtain stakeholder input on unacceptable GAI use.","topic":"Governance","intent":"obtain stakeholder input on unacceptable gai use","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.3-004","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"obtain","object":"stakeholder input on unacceptable GAI use","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"obtain\" for stakeholder input on unacceptable GAI use within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"obtain\" for stakeholder input on unacceptable GAI use. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves stakeholder input on unacceptable GAI use. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain stakeholder input on unacceptable GAI use.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"obtain\" for stakeholder input on unacceptable GAI use within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"obtain\" for stakeholder input on unacceptable GAI use. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-79A1D26388","version":2,"title":"Organizations should enforce approved access permissions for CUI and system resources.","text":"Organization should enforce approved CUI access permissions.","topic":"Governance","intent":"enforce approved cui access permissions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-171-r3","control":"03.01.02","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=18","actor":"Organization","modality":"should","action":"enforce","object":"approved CUI access permissions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"enforce\" for approved CUI access permissions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"enforce\" for approved CUI access permissions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves approved CUI access permissions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enforce approved CUI access permissions.","examples":{"meetsRule":"Organization follows the recommendation to \"enforce\" for approved CUI access permissions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"enforce\" for approved CUI access permissions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D151BEE055","version":2,"title":"Organizations should enforce approved logical-access permissions.","text":"Organization should enforce approved logical-access permissions.","topic":"Governance","intent":"enforce approved logical access permissions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-53-r5","control":"AC-3","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=50","actor":"Organization","modality":"should","action":"enforce","object":"approved logical-access permissions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"enforce\" for approved logical-access permissions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"enforce\" for approved logical-access permissions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves approved logical-access permissions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enforce approved logical-access permissions.","examples":{"meetsRule":"Organization follows the recommendation to \"enforce\" for approved logical-access permissions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"enforce\" for approved logical-access permissions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-239800B9C4","version":2,"title":"Organizations should generate log records for continuous monitoring.","text":"Organization should generate monitoring log records.","topic":"Governance","intent":"generate monitoring log records","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-csf-2","control":"PR.PS-04","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=25","actor":"Organization","modality":"should","action":"generate","object":"monitoring log records","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"generate\" for monitoring log records within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"generate\" for monitoring log records. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves monitoring log records. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: generate monitoring log records.","examples":{"meetsRule":"Organization follows the recommendation to \"generate\" for monitoring log records within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"generate\" for monitoring log records. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6CFD9FC4BD","version":2,"title":"Organizations should keep inventories of managed software, services and systems current.","text":"Organization should maintain software, service and system inventories.","topic":"Governance","intent":"maintain software service and system inventories","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-csf-2","control":"ID.AM-02","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=23","actor":"Organization","modality":"should","action":"maintain","object":"software, service and system inventories","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"maintain\" for software, service and system inventories within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"maintain\" for software, service and system inventories. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves software, service and system inventories. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain software, service and system inventories.","examples":{"meetsRule":"Organization follows the recommendation to \"maintain\" for software, service and system inventories within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"maintain\" for software, service and system inventories. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-64615EE538","version":2,"title":"Organizations should keep their managed hardware inventory current.","text":"Organization should maintain managed hardware inventory.","topic":"Governance","intent":"maintain managed hardware inventory","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-csf-2","control":"ID.AM-01","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=23","actor":"Organization","modality":"should","action":"maintain","object":"managed hardware inventory","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"maintain\" for managed hardware inventory within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"maintain\" for managed hardware inventory. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves managed hardware inventory. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain managed hardware inventory.","examples":{"meetsRule":"Organization follows the recommendation to \"maintain\" for managed hardware inventory within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"maintain\" for managed hardware inventory. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-957F5E0FE9","version":2,"title":"Organizations should limit authorized access to what assigned tasks require.","text":"Organization should limit authorized access.","topic":"Governance","intent":"limit authorized access","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-53-r5","control":"AC-6","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=63","actor":"Organization","modality":"should","action":"limit","object":"authorized access","condition":"Assigned task needs","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"limit\" for authorized access within these conditions: Assigned task needs.","doesNotMeetRule":"Organization omits the recommended action \"limit\" for authorized access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves authorized access. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: limit authorized access.","examples":{"meetsRule":"Organization follows the recommendation to \"limit\" for authorized access within these conditions: Assigned task needs.","doesNotMeetRule":"Organization omits the recommended action \"limit\" for authorized access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-DD72BC62FE","version":2,"title":"Organizations should permit only authorized access needed for assigned tasks.","text":"Organization should permit task-necessary authorized access.","topic":"Governance","intent":"permit task necessary authorized access","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-171-r3","control":"03.01.05(a)","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=20","actor":"Organization","modality":"should","action":"permit","object":"task-necessary authorized access","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"permit\" for task-necessary authorized access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"permit\" for task-necessary authorized access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves task-necessary authorized access. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: permit task-necessary authorized access.","examples":{"meetsRule":"Organization follows the recommendation to \"permit\" for task-necessary authorized access within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"permit\" for task-necessary authorized access. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2711651405","version":2,"title":"Organizations should prevent nonprivileged users from performing privileged functions.","text":"Organization should prevent nonprivileged execution of privileged functions.","topic":"Governance","intent":"prevent nonprivileged execution of privileged functions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-171-r3","control":"03.01.07(a)","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=21","actor":"Organization","modality":"should","action":"prevent","object":"nonprivileged execution of privileged functions","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"prevent\" for nonprivileged execution of privileged functions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"prevent\" for nonprivileged execution of privileged functions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves nonprivileged execution of privileged functions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prevent nonprivileged execution of privileged functions.","examples":{"meetsRule":"Organization follows the recommendation to \"prevent\" for nonprivileged execution of privileged functions within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"prevent\" for nonprivileged execution of privileged functions. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8014471E79","version":2,"title":"Organizations should prevent unauthorized software execution.","text":"Organization should prevent unauthorized software execution.","topic":"Governance","intent":"prevent unauthorized software execution","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-csf-2","control":"PR.PS-05","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=25","actor":"Organization","modality":"should","action":"prevent","object":"unauthorized software execution","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"prevent\" for unauthorized software execution within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"prevent\" for unauthorized software execution. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves unauthorized software execution. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prevent unauthorized software execution.","examples":{"meetsRule":"Organization follows the recommendation to \"prevent\" for unauthorized software execution within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"prevent\" for unauthorized software execution. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-93CD199B6D","version":2,"title":"Organizations should record execution of privileged functions.","text":"Organization should record privileged-function execution.","topic":"Governance","intent":"record privileged function execution","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-171-r3","control":"03.01.07(b)","sourceVersion":"SP 800-171 Rev.3","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-171r3.pdf#page=21","actor":"Organization","modality":"should","action":"record","object":"privileged-function execution","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-requirements-when-incorporated","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"record\" for privileged-function execution within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"record\" for privileged-function execution. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves privileged-function execution. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: record privileged-function execution.","examples":{"meetsRule":"Organization follows the recommendation to \"record\" for privileged-function execution within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"record\" for privileged-function execution. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-10D05FADF9","version":2,"title":"Plan responses to high-priority AI risks","text":"AI governance owners should plan responses to high-priority AI risks.","topic":"Governance","intent":"plan responses to high priority ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 1.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"plan","object":"responses to high-priority AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for responses to high-priority AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for responses to high-priority AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves responses to high-priority AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: plan responses to high-priority AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for responses to high-priority AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for responses to high-priority AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-DDC1AF69E8","version":2,"title":"Predict criminal offending solely from profiling","text":"AI operators must not predict criminal offending solely from profiling.","topic":"Governance","intent":"predict criminal offending solely from profiling","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"predict","object":"criminal offending solely from profiling","condition":"Individual risk assessments","exception":"Human assessments based on objective verifiable crime facts are excepted","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"predict\" for criminal offending solely from profiling while these conditions apply: Individual risk assessments.","doesNotMeetRule":"AI operators performs the prohibited action \"predict\" for criminal offending solely from profiling while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves criminal offending solely from profiling. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: predict criminal offending solely from profiling.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"predict\" for criminal offending solely from profiling while these conditions apply: Individual risk assessments.","doesNotMeetRule":"AI operators performs the prohibited action \"predict\" for criminal offending solely from profiling while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6C1ECA98A1","version":2,"title":"Prepare technical documentation","text":"High-risk AI providers must prepare technical documentation.","topic":"Governance","intent":"prepare technical documentation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 11(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"prepare","object":"technical documentation","condition":"Before market placement or service","exception":"Simplified forms may apply","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"prepare\" for technical documentation within these source conditions: Before market placement or service, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"prepare\" for technical documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves technical documentation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prepare technical documentation.","examples":{"meetsRule":"High-risk AI providers performs the required action \"prepare\" for technical documentation within these source conditions: Before market placement or service, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"prepare\" for technical documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1AE367EE4E","version":2,"title":"Prevent minors from overreliance on GenAI","text":"Covered GenAI service providers must prevent minors from overreliance on GenAI.","topic":"Governance","intent":"prevent minors from overreliance on genai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 10","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"prevent","object":"minors from overreliance on GenAI","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"prevent\" for minors from overreliance on GenAI within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"prevent\" for minors from overreliance on GenAI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves minors from overreliance on GenAI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prevent minors from overreliance on GenAI.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"prevent\" for minors from overreliance on GenAI within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"prevent\" for minors from overreliance on GenAI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8B497F4F74","version":2,"title":"Prioritize treatment of documented AI risks","text":"AI governance owners should prioritize treatment of documented AI risks.","topic":"Governance","intent":"prioritize treatment of documented ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 1.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"prioritize","object":"treatment of documented AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"prioritize\" for treatment of documented AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"prioritize\" for treatment of documented AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves treatment of documented AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: prioritize treatment of documented AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"prioritize\" for treatment of documented AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"prioritize\" for treatment of documented AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0156EA65AB","version":2,"title":"Protect against solely automated significant decisions","text":"Data controllers must protect against solely automated significant decisions.","topic":"Governance","intent":"protect against solely automated significant decisions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 22(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"protect","object":"against solely automated significant decisions","condition":"Subject to Article 22 exceptions and safeguards","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"protect\" for against solely automated significant decisions within these source conditions: Subject to Article 22 exceptions and safeguards, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"protect\" for against solely automated significant decisions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves against solely automated significant decisions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect against solely automated significant decisions.","examples":{"meetsRule":"Data controllers performs the required action \"protect\" for against solely automated significant decisions within these source conditions: Subject to Article 22 exceptions and safeguards, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"protect\" for against solely automated significant decisions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-504A6F5FAE","version":2,"title":"Protect user input and usage records","text":"Covered GenAI service providers must protect user input and usage records.","topic":"Governance","intent":"protect user input and usage records","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 11","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"protect","object":"user input and usage records","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for user input and usage records within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for user input and usage records while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves user input and usage records. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect user input and usage records.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for user input and usage records within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for user input and usage records while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-837D00B454","version":2,"title":"Provide documentation to downstream system providers","text":"GPAI model providers must provide documentation to downstream system providers.","topic":"Governance","intent":"provide documentation to downstream system providers","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 53(1)(b)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"GPAI model providers","modality":"must","action":"provide","object":"documentation to downstream system providers","condition":"Covered general-purpose AI models","exception":"Specified open-source exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"GPAI model providers performs the required action \"provide\" for documentation to downstream system providers within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"provide\" for documentation to downstream system providers while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves documentation to downstream system providers. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide documentation to downstream system providers.","examples":{"meetsRule":"GPAI model providers performs the required action \"provide\" for documentation to downstream system providers within these source conditions: Covered general-purpose AI models, and retains evidence.","doesNotMeetRule":"GPAI model providers omits the required action \"provide\" for documentation to downstream system providers while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-3E2FF36AEB","version":2,"title":"Provide instructions for use","text":"High-risk AI providers must provide instructions for use.","topic":"Governance","intent":"provide instructions for use","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 13(2)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"provide","object":"instructions for use","condition":"Covered high-risk systems","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"provide\" for instructions for use within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"provide\" for instructions for use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves instructions for use. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide instructions for use.","examples":{"meetsRule":"High-risk AI providers performs the required action \"provide\" for instructions for use within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"provide\" for instructions for use while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-130AE1C465","version":2,"title":"Provide meaningful explanations of decisions","text":"Responsible senior federal officials must provide meaningful explanations of decisions.","topic":"Governance","intent":"provide meaningful explanations of decisions","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.3","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"provide","object":"meaningful explanations of decisions","condition":"After decisions; Appendix C applies","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"provide\" for meaningful explanations of decisions within these source conditions: After decisions; Appendix C applies, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"provide\" for meaningful explanations of decisions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves meaningful explanations of decisions. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide meaningful explanations of decisions.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"provide\" for meaningful explanations of decisions within these source conditions: After decisions; Appendix C applies, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"provide\" for meaningful explanations of decisions while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5E618A5099","version":2,"title":"Provide safe and stable GenAI services","text":"Covered GenAI service providers must provide safe and stable GenAI services.","topic":"Governance","intent":"provide safe and stable genai services","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 13","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"provide","object":"safe and stable GenAI services","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"provide\" for safe and stable GenAI services within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"provide\" for safe and stable GenAI services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves safe and stable GenAI services. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide safe and stable GenAI services.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"provide\" for safe and stable GenAI services within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"provide\" for safe and stable GenAI services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-134DC94A5A","version":2,"title":"Publish an algorithmic impact assessment","text":"Responsible senior federal officials must publish an algorithmic impact assessment.","topic":"Governance","intent":"publish an algorithmic impact assessment","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.1.1","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"publish","object":"an algorithmic impact assessment","condition":"Before production; accessible Open Government publication","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"publish\" for an algorithmic impact assessment within these source conditions: Before production; accessible Open Government publication, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"publish\" for an algorithmic impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves an algorithmic impact assessment. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: publish an algorithmic impact assessment.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"publish\" for an algorithmic impact assessment within these source conditions: Before production; accessible Open Government publication, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"publish\" for an algorithmic impact assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-687C1F2AA0","version":2,"title":"Publish intended GenAI audiences and uses","text":"Covered GenAI service providers must publish intended GenAI audiences and uses.","topic":"Governance","intent":"publish intended genai audiences and uses","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 10","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"publish","object":"intended GenAI audiences and uses","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"publish\" for intended GenAI audiences and uses within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"publish\" for intended GenAI audiences and uses while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves intended GenAI audiences and uses. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: publish intended GenAI audiences and uses.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"publish\" for intended GenAI audiences and uses within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"publish\" for intended GenAI audiences and uses while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-A98A489B02","version":2,"title":"Register with a state employee email address.","text":"Employees must register state email.","topic":"Governance","intent":"register state email","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 4","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"register","object":"state email","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"register\" for state email within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"register\" for state email while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves state email. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: register state email.","examples":{"meetsRule":"employees performs the required action \"register\" for state email within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"register\" for state email while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-014E35D5FC","version":2,"title":"Report unlawful content to competent authorities","text":"Covered GenAI service providers must report unlawful content to competent authorities.","topic":"Governance","intent":"report unlawful content to competent authorities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 14","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"report","object":"unlawful content to competent authorities","condition":"When unlawful content is discovered","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"report\" for unlawful content to competent authorities within these source conditions: When unlawful content is discovered, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"report\" for unlawful content to competent authorities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves unlawful content to competent authorities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: report unlawful content to competent authorities.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"report\" for unlawful content to competent authorities within these source conditions: When unlawful content is discovered, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"report\" for unlawful content to competent authorities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-A3EACF1A4E","version":2,"title":"Respond to previously unknown AI risks","text":"AI governance owners should respond to previously unknown AI risks.","topic":"Governance","intent":"respond to previously unknown ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 2.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"respond","object":"to previously unknown AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"respond\" for to previously unknown AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"respond\" for to previously unknown AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves to previously unknown AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: respond to previously unknown AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"respond\" for to previously unknown AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"respond\" for to previously unknown AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1B927E390F","version":2,"title":"Retain automatically generated logs under their control","text":"High-risk AI providers must retain automatically generated logs under their control.","topic":"Governance","intent":"retain automatically generated logs under their control","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 19(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"retain","object":"automatically generated logs under their control","condition":"Covered high-risk systems","exception":"Applicable law and minimum statutory period","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"retain\" for automatically generated logs under their control within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"retain\" for automatically generated logs under their control while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves automatically generated logs under their control. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: retain automatically generated logs under their control.","examples":{"meetsRule":"High-risk AI providers performs the required action \"retain\" for automatically generated logs under their control within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"retain\" for automatically generated logs under their control while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-FC504B8B3E","version":2,"title":"Retain required conformity documentation","text":"High-risk AI providers must retain required conformity documentation.","topic":"Governance","intent":"retain required conformity documentation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 18(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"retain","object":"required conformity documentation","condition":"Following market placement","exception":"Retention period and amendments require review","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"retain\" for required conformity documentation within these source conditions: Following market placement, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"retain\" for required conformity documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves required conformity documentation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: retain required conformity documentation.","examples":{"meetsRule":"High-risk AI providers performs the required action \"retain\" for required conformity documentation within these source conditions: Following market placement, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"retain\" for required conformity documentation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-AEFB7467B3","version":2,"title":"Safeguard released versions of decision-system software","text":"Responsible senior federal officials must safeguard released versions of decision-system software.","topic":"Governance","intent":"safeguard released versions of decision system software","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.5","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"safeguard","object":"released versions of decision-system software","condition":"All released components","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"safeguard\" for released versions of decision-system software within these source conditions: All released components, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"safeguard\" for released versions of decision-system software while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves released versions of decision-system software. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: safeguard released versions of decision-system software.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"safeguard\" for released versions of decision-system software within these source conditions: All released components, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"safeguard\" for released versions of decision-system software while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-48A3BA0A96","version":2,"title":"Select processors with sufficient guarantees","text":"Data controllers must select processors with sufficient guarantees.","topic":"Governance","intent":"select processors with sufficient guarantees","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 28(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"select","object":"processors with sufficient guarantees","condition":"Use of processing providers","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"select\" for processors with sufficient guarantees within these source conditions: Use of processing providers, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"select\" for processors with sufficient guarantees while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves processors with sufficient guarantees. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: select processors with sufficient guarantees.","examples":{"meetsRule":"Data controllers performs the required action \"select\" for processors with sufficient guarantees within these source conditions: Use of processing providers, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"select\" for processors with sufficient guarantees while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7C668908A8","version":2,"title":"Software producers should give acquirers information for verifying release integrity.","text":"Software producer should provide release-integrity verification information.","topic":"Governance","intent":"provide release integrity verification information","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ssdf-1-1","control":"PS.2.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=19","actor":"Software producer","modality":"should","action":"provide","object":"release-integrity verification information","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"provide\" for release-integrity verification information within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"provide\" for release-integrity verification information. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves release-integrity verification information. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide release-integrity verification information.","examples":{"meetsRule":"Software producer follows the recommendation to \"provide\" for release-integrity verification information within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"provide\" for release-integrity verification information. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7AA947C3E4","version":2,"title":"Software producers should store code with access limited by least privilege.","text":"Software producer should store code.","topic":"Governance","intent":"store code","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ssdf-1-1","control":"PS.1.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=18","actor":"Software producer","modality":"should","action":"store","object":"code","condition":"Least-privilege access","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"store\" for code within these conditions: Least-privilege access.","doesNotMeetRule":"Software producer omits the recommended action \"store\" for code. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves code. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: store code.","examples":{"meetsRule":"Software producer follows the recommendation to \"store\" for code within these conditions: Least-privilege access.","doesNotMeetRule":"Software producer omits the recommended action \"store\" for code. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-C25C44E28B","version":2,"title":"Specify the targeted AI application scope","text":"AI governance owners should specify the targeted AI application scope.","topic":"Governance","intent":"specify the targeted ai application scope","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 3.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"specify","object":"the targeted AI application scope","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"specify\" for the targeted AI application scope within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"specify\" for the targeted AI application scope. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves the targeted AI application scope. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: specify the targeted AI application scope.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"specify\" for the targeted AI application scope within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"specify\" for the targeted AI application scope. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-635250368A","version":2,"title":"Stop generation of unlawful content","text":"Covered GenAI service providers must stop generation of unlawful content.","topic":"Governance","intent":"stop generation of unlawful content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 14","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"stop","object":"generation of unlawful content","condition":"When unlawful content is discovered","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"stop\" for generation of unlawful content within these source conditions: When unlawful content is discovered, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"stop\" for generation of unlawful content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves generation of unlawful content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: stop generation of unlawful content.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"stop\" for generation of unlawful content within these source conditions: When unlawful content is discovered, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"stop\" for generation of unlawful content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-DA110B3EF2","version":2,"title":"Take corrective action for nonconforming AI","text":"High-risk AI providers must take corrective action for nonconforming AI.","topic":"Governance","intent":"take corrective action for nonconforming ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 20(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"take","object":"corrective action for nonconforming AI","condition":"Reason to consider system nonconforming","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"take\" for corrective action for nonconforming AI within these source conditions: Reason to consider system nonconforming, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"take\" for corrective action for nonconforming AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves corrective action for nonconforming AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: take corrective action for nonconforming AI.","examples":{"meetsRule":"High-risk AI providers performs the required action \"take\" for corrective action for nonconforming AI within these source conditions: Reason to consider system nonconforming, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"take\" for corrective action for nonconforming AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-C8E01637B6","version":2,"title":"Tell customers when they interact with agency AI.","text":"Agencies must disclose AI interaction.","topic":"Governance","intent":"disclose ai interaction","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.1.5, p.2","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"agencies","modality":"must","action":"disclose","object":"AI interaction","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"disclose\" for AI interaction within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"disclose\" for AI interaction while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI interaction. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: disclose AI interaction.","examples":{"meetsRule":"agencies performs the required action \"disclose\" for AI interaction within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"disclose\" for AI interaction while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E4C9EA7E18","version":2,"title":"Track emerging AI risks","text":"AI governance owners should track emerging AI risks.","topic":"Governance","intent":"track emerging ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"track","object":"emerging AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"track\" for emerging AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"track\" for emerging AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves emerging AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: track emerging AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"track\" for emerging AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"track\" for emerging AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E528E1DA42","version":2,"title":"Train personnel in their AI risk responsibilities","text":"AI governance owners should train personnel in their AI risk responsibilities.","topic":"Governance","intent":"train personnel in their ai risk responsibilities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"train","object":"personnel in their AI risk responsibilities","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"train\" for personnel in their AI risk responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"train\" for personnel in their AI risk responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personnel in their AI risk responsibilities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: train personnel in their AI risk responsibilities.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"train\" for personnel in their AI risk responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"train\" for personnel in their AI risk responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0BD6CF8CF8","version":2,"title":"Update published algorithmic impact assessments","text":"Responsible senior federal officials must update published algorithmic impact assessments.","topic":"Governance","intent":"update published algorithmic impact assessments","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.1.3","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"update","object":"published algorithmic impact assessments","condition":"Scheduled review and functionality or scope changes","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"update\" for published algorithmic impact assessments within these source conditions: Scheduled review and functionality or scope changes, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"update\" for published algorithmic impact assessments while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves published algorithmic impact assessments. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: update published algorithmic impact assessments.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"update\" for published algorithmic impact assessments within these source conditions: Scheduled review and functionality or scope changes, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"update\" for published algorithmic impact assessments while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5F6922C679","version":2,"title":"Use GenAI for coursework only with instructor permission.","text":"Students must obtain permission.","topic":"Governance","intent":"obtain permission","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"Teaching and Learning, opening paragraph","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"students","modality":"must","action":"obtain","object":"permission","condition":"coursework","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"students performs the required action \"obtain\" for permission within these source conditions: coursework, and retains evidence.","doesNotMeetRule":"students omits the required action \"obtain\" for permission while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves permission. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain permission.","examples":{"meetsRule":"students performs the required action \"obtain\" for permission within these source conditions: coursework, and retains evidence.","doesNotMeetRule":"students omits the required action \"obtain\" for permission while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-32BF4E5A3E","version":2,"title":"Use only approved Commonwealth enterprise GenAI tools.","text":"Users must use approved tools.","topic":"Governance","intent":"use approved tools","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.2, p.5","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must","action":"use","object":"approved tools","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for approved tools within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}},{"sourceId":"harvard-genai-guidelines","control":"Protect confidential data, paragraph 2","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"must","action":"use","object":"approved tools","condition":"Harvard confidential data","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for approved tools within these source conditions: Harvard confidential data, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves approved tools. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use approved tools.","examples":{"meetsRule":"users performs the required action \"use\" for approved tools within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for approved tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1BD7B65A31","version":2,"title":"Use town credentials for official approved-tool access.","text":"Users must use town credentials.","topic":"Governance","intent":"use town credentials","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"brookline-genai","control":"Use, bullet 2","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"use","object":"town credentials","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for town credentials within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for town credentials while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves town credentials. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use town credentials.","examples":{"meetsRule":"users performs the required action \"use\" for town credentials within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for town credentials while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-FED5F6D978","version":2,"title":"Apply human-subject protections in AI evaluation","text":"AI governance owners should apply human-subject protections in AI evaluation.","topic":"Human oversight","intent":"apply human subject protections in ai evaluation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"apply","object":"human-subject protections in AI evaluation","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"apply\" for human-subject protections in AI evaluation within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"apply\" for human-subject protections in AI evaluation. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves human-subject protections in AI evaluation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: apply human-subject protections in AI evaluation.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"apply\" for human-subject protections in AI evaluation within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"apply\" for human-subject protections in AI evaluation. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E59A08E459","version":2,"title":"Assign human oversight to competent personnel","text":"High-risk AI deployers must assign human oversight to competent personnel.","topic":"Human oversight","intent":"assign human oversight to competent personnel","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 26(2)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI deployers","modality":"must","action":"assign","object":"human oversight to competent personnel","condition":"Covered high-risk AI use","exception":"Necessary training and authority","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI deployers performs the required action \"assign\" for human oversight to competent personnel within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"assign\" for human oversight to competent personnel while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves human oversight to competent personnel. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assign human oversight to competent personnel.","examples":{"meetsRule":"High-risk AI deployers performs the required action \"assign\" for human oversight to competent personnel within these source conditions: Covered high-risk AI use, and retains evidence.","doesNotMeetRule":"High-risk AI deployers omits the required action \"assign\" for human oversight to competent personnel while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E98925E526","version":2,"title":"Define human oversight processes","text":"AI governance owners should define human oversight processes.","topic":"Human oversight","intent":"define human oversight processes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Map 3.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"human oversight processes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for human oversight processes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for human oversight processes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves human oversight processes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define human oversight processes.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for human oversight processes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for human oversight processes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2FB9BEA395","version":2,"title":"Define human oversight responsibilities","text":"AI governance owners should define human oversight responsibilities.","topic":"Human oversight","intent":"define human oversight responsibilities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 3.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"define","object":"human oversight responsibilities","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for human oversight responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for human oversight responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves human oversight responsibilities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define human oversight responsibilities.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"define\" for human oversight responsibilities within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"define\" for human oversight responsibilities. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4D850F7FFA","version":2,"title":"Document AI models for review.","text":"Agencies must document models.","topic":"Human oversight","intent":"document models","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"p.5, Ethical Use","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"document","object":"models","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"document\" for models within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"document\" for models while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves models. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document models.","examples":{"meetsRule":"agencies performs the required action \"document\" for models within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"agencies omits the required action \"document\" for models while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9F0606F820","version":2,"title":"Enable effective human oversight","text":"High-risk AI providers must enable effective human oversight.","topic":"Human oversight","intent":"enable effective human oversight","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 14(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"effective human oversight","condition":"During system use","exception":"Appropriate to risks and autonomy","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for effective human oversight within these source conditions: During system use, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for effective human oversight while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves effective human oversight. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable effective human oversight.","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for effective human oversight within these source conditions: During system use, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for effective human oversight while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-BF19955A9B","version":2,"title":"Enable oversight personnel to disregard AI output","text":"High-risk AI providers must enable oversight personnel to disregard AI output.","topic":"Human oversight","intent":"enable oversight personnel to disregard ai output","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 14(4)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"oversight personnel to disregard AI output","condition":"When overseeing high-risk AI","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to disregard AI output within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to disregard AI output while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves oversight personnel to disregard AI output. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable oversight personnel to disregard AI output.","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to disregard AI output within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to disregard AI output while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-72DBAB9908","version":2,"title":"Enable oversight personnel to interpret AI outputs appropriately","text":"High-risk AI providers must enable oversight personnel to interpret AI outputs appropriately.","topic":"Human oversight","intent":"enable oversight personnel to interpret ai outputs appropriately","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 14(4)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"oversight personnel to interpret AI outputs appropriately","condition":"When overseeing high-risk AI","exception":"According to available tools","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to interpret AI outputs appropriately within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to interpret AI outputs appropriately while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves oversight personnel to interpret AI outputs appropriately. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable oversight personnel to interpret AI outputs appropriately.","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to interpret AI outputs appropriately within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to interpret AI outputs appropriately while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0865D3E990","version":2,"title":"Enable oversight personnel to interrupt high-risk AI","text":"High-risk AI providers must enable oversight personnel to interrupt high-risk AI.","topic":"Human oversight","intent":"enable oversight personnel to interrupt high risk ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 14(4)(e)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"enable","object":"oversight personnel to interrupt high-risk AI","condition":"When overseeing high-risk AI","exception":"Safe stop procedure","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to interrupt high-risk AI within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to interrupt high-risk AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves oversight personnel to interrupt high-risk AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable oversight personnel to interrupt high-risk AI.","examples":{"meetsRule":"High-risk AI providers performs the required action \"enable\" for oversight personnel to interrupt high-risk AI within these source conditions: When overseeing high-risk AI, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"enable\" for oversight personnel to interrupt high-risk AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E0CAD3FF88","version":2,"title":"Establish GAI deployment approval thresholds","text":"AI governance owners should establish GAI deployment approval thresholds.","topic":"Human oversight","intent":"establish gai deployment approval thresholds","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.3-002","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"GAI deployment approval thresholds","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for GAI deployment approval thresholds within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for GAI deployment approval thresholds. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves GAI deployment approval thresholds. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish GAI deployment approval thresholds.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for GAI deployment approval thresholds within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for GAI deployment approval thresholds. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6E499BCE84","version":2,"title":"Establish mechanisms to appeal AI outcomes","text":"AI governance owners should establish mechanisms to appeal AI outcomes.","topic":"Human oversight","intent":"establish mechanisms to appeal ai outcomes","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 3.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"mechanisms to appeal AI outcomes","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for mechanisms to appeal AI outcomes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for mechanisms to appeal AI outcomes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves mechanisms to appeal AI outcomes. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish mechanisms to appeal AI outcomes.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for mechanisms to appeal AI outcomes within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for mechanisms to appeal AI outcomes. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4045E1AF90","version":2,"title":"List available appeal options for external AI decisions.","text":"Agencies must list appeal options.","topic":"Human oversight","intent":"list appeal options","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"p.7, Transparency Requirements","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"list","object":"appeal options","condition":"external decisions","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"list\" for appeal options within these source conditions: external decisions, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"list\" for appeal options while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves appeal options. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: list appeal options.","examples":{"meetsRule":"agencies performs the required action \"list\" for appeal options within these source conditions: external decisions, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"list\" for appeal options while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D5475CA27F","version":2,"title":"Obtain IT approval for public meeting-recording or email/calendar-connecting apps.","text":"Users must obtain IT approval.","topic":"Human oversight","intent":"obtain it approval","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"brookline-genai","control":"Use, recording-app bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"obtain","object":"IT approval","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"obtain\" for IT approval within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for IT approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves IT approval. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain IT approval.","examples":{"meetsRule":"users performs the required action \"obtain\" for IT approval within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for IT approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0AEC8A401C","version":2,"title":"Plan periodic AI risk-management reviews","text":"AI governance owners should plan periodic AI risk-management reviews.","topic":"Human oversight","intent":"plan periodic ai risk management reviews","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.5","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"plan","object":"periodic AI risk-management reviews","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for periodic AI risk-management reviews within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for periodic AI risk-management reviews. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves periodic AI risk-management reviews. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: plan periodic AI risk-management reviews.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for periodic AI risk-management reviews within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for periodic AI risk-management reviews. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9987CCC485","version":2,"title":"Review AI material before publishing or sharing it.","text":"Users should review AI material.","topic":"Human oversight","intent":"review ai material","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"harvard-genai-guidelines","control":"Review content before publishing or sharing","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"should","action":"review","object":"AI material","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users follows the recommendation to \"review\" for AI material within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"users omits the recommended action \"review\" for AI material. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI material. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: review AI material.","examples":{"meetsRule":"users follows the recommendation to \"review\" for AI material within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"users omits the recommended action \"review\" for AI material. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-FEDC04B3F1","version":2,"title":"Review administrative AI content for accuracy, tone, and appropriateness.","text":"Users must review content.","topic":"Human oversight","intent":"review content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"General Expectations for Administrative Use","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must","action":"review","object":"content","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"review\" for content within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"review\" for content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: review content.","examples":{"meetsRule":"users performs the required action \"review\" for content within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"review\" for content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7899BD6734","version":2,"title":"Review and verify all GenAI output with relevant subject expertise.","text":"Users must verify outputs.","topic":"Human oversight","intent":"verify outputs","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.2.3, p.6","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must","action":"verify","object":"outputs","condition":"Commonwealth business","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"verify\" for outputs within these source conditions: Commonwealth business, and retains evidence.","doesNotMeetRule":"users omits the required action \"verify\" for outputs while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves outputs. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: verify outputs.","examples":{"meetsRule":"users performs the required action \"verify\" for outputs within these source conditions: Commonwealth business, and retains evidence.","doesNotMeetRule":"users omits the required action \"verify\" for outputs while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-DCFE285C28","version":2,"title":"Use online tools on state devices; downloading requires ESRMO special approval.","text":"Employees must use online tools.","topic":"Human oversight","intent":"use online tools","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, appropriate use, bullet 3","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"use","object":"online tools","condition":"state device","exception":"ESRMO-approved download","timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"use\" for online tools within these source conditions: state device, and retains evidence.","doesNotMeetRule":"employees omits the required action \"use\" for online tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves online tools. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use online tools.","examples":{"meetsRule":"employees performs the required action \"use\" for online tools within these source conditions: state device, and retains evidence.","doesNotMeetRule":"employees omits the required action \"use\" for online tools while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6F83A570B6","version":2,"title":"AI providers should protect sensitive logs against unauthorized access.","text":"AI provider should protect sensitive logs.","topic":"Privacy","intent":"protect sensitive logs","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / assets","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"protect","object":"sensitive logs","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"protect\" for sensitive logs within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"protect\" for sensitive logs. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves sensitive logs. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect sensitive logs.","examples":{"meetsRule":"AI provider follows the recommendation to \"protect\" for sensitive logs within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"AI provider omits the recommended action \"protect\" for sensitive logs. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D8BE1AA186","version":2,"title":"Avoid collecting unnecessary personal information","text":"Covered GenAI service providers must avoid collecting unnecessary personal information.","topic":"Privacy","intent":"avoid collecting unnecessary personal information","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 11","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"avoid","object":"collecting unnecessary personal information","condition":"Covered public services","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"avoid\" for collecting unnecessary personal information within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"avoid\" for collecting unnecessary personal information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves collecting unnecessary personal information. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: avoid collecting unnecessary personal information.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"avoid\" for collecting unnecessary personal information within these source conditions: Covered public services, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"avoid\" for collecting unnecessary personal information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-99485B54FC","version":2,"title":"Carefully review AI responses in security-sensitive situations.","text":"Users must review responses.","topic":"Privacy","intent":"review responses","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"brookline-genai","control":"Use, security-review bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"review","object":"responses","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"review\" for responses within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"review\" for responses while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves responses. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: review responses.","examples":{"meetsRule":"users performs the required action \"review\" for responses within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"review\" for responses while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E89D3740A1","version":2,"title":"Categorize sensitive attributes through biometrics","text":"AI operators must not categorize sensitive attributes through biometrics.","topic":"Privacy","intent":"categorize sensitive attributes through biometrics","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(g)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"categorize","object":"sensitive attributes through biometrics","condition":"Covered biometric categorization","exception":"Specified dataset labeling and law-enforcement exceptions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"categorize\" for sensitive attributes through biometrics while these conditions apply: Covered biometric categorization.","doesNotMeetRule":"AI operators performs the prohibited action \"categorize\" for sensitive attributes through biometrics while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves sensitive attributes through biometrics. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: categorize sensitive attributes through biometrics.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"categorize\" for sensitive attributes through biometrics while these conditions apply: Covered biometric categorization.","doesNotMeetRule":"AI operators performs the prohibited action \"categorize\" for sensitive attributes through biometrics while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-471437DC20","version":2,"title":"Correct inaccurate personal data","text":"Data controllers must correct inaccurate personal data.","topic":"Privacy","intent":"correct inaccurate personal data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 16","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"correct","object":"inaccurate personal data","condition":"On applicable data-subject request","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"correct\" for inaccurate personal data within these source conditions: On applicable data-subject request, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"correct\" for inaccurate personal data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves inaccurate personal data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: correct inaccurate personal data.","examples":{"meetsRule":"Data controllers performs the required action \"correct\" for inaccurate personal data within these source conditions: On applicable data-subject request, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"correct\" for inaccurate personal data while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-04A480E942","version":2,"title":"Erase personal data when required","text":"Data controllers must erase personal data when required.","topic":"Privacy","intent":"erase personal data when required","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 17(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"erase","object":"personal data when required","condition":"Subject to statutory exceptions","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"erase\" for personal data when required within these source conditions: Subject to statutory exceptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"erase\" for personal data when required while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal data when required. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: erase personal data when required.","examples":{"meetsRule":"Data controllers performs the required action \"erase\" for personal data when required within these source conditions: Subject to statutory exceptions, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"erase\" for personal data when required while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-231E86FCF1","version":2,"title":"Establish a lawful basis for training on personal information","text":"Covered GenAI service providers must establish a lawful basis for training on personal information.","topic":"Privacy","intent":"establish a lawful basis for training on personal information","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 7(3)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"establish","object":"a lawful basis for training on personal information","condition":"Consent or another legal basis","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"establish\" for a lawful basis for training on personal information within these source conditions: Consent or another legal basis, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"establish\" for a lawful basis for training on personal information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a lawful basis for training on personal information. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish a lawful basis for training on personal information.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"establish\" for a lawful basis for training on personal information within these source conditions: Consent or another legal basis, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"establish\" for a lawful basis for training on personal information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-C4036FF921","version":2,"title":"Examine AI privacy risks","text":"AI governance owners should examine AI privacy risks.","topic":"Privacy","intent":"examine ai privacy risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.10","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"examine","object":"AI privacy risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for AI privacy risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for AI privacy risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI privacy risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: examine AI privacy risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for AI privacy risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for AI privacy risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-65595252CE","version":2,"title":"Keep sensitive information out of third-party tools unless MSU security explicitly approves.","text":"Users must-not enter sensitive information.","topic":"Privacy","intent":"enter sensitive information","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"msu-genai-guidelines","control":"Non-Permissible Uses, paragraph 3","sourceVersion":"Approved August 12, 2025; no revisions listed","url":"https://ai.msu.edu/guidelines","actor":"users","modality":"must-not","action":"enter","object":"sensitive information","condition":"non-MSU enterprise tools","exception":"explicit security approval","timing":null,"authority":"organization-specific","jurisdiction":"Michigan State University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"enter\" for sensitive information within these source conditions: non-MSU enterprise tools, and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for sensitive information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves sensitive information. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enter sensitive information.","examples":{"meetsRule":"users performs the required action \"enter\" for sensitive information within these source conditions: non-MSU enterprise tools, and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for sensitive information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-40C4A84CA0","version":2,"title":"Limit personal-data retention","text":"Data controllers must limit personal-data retention.","topic":"Privacy","intent":"limit personal data retention","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(e)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"limit","object":"personal-data retention","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"limit\" for personal-data retention within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"limit\" for personal-data retention while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal-data retention. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: limit personal-data retention.","examples":{"meetsRule":"Data controllers performs the required action \"limit\" for personal-data retention within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"limit\" for personal-data retention while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5C638CD3DB","version":2,"title":"Maintain personal-data accuracy","text":"Data controllers must maintain personal-data accuracy.","topic":"Privacy","intent":"maintain personal data accuracy","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(d)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"maintain","object":"personal-data accuracy","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"maintain\" for personal-data accuracy within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"maintain\" for personal-data accuracy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal-data accuracy. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain personal-data accuracy.","examples":{"meetsRule":"Data controllers performs the required action \"maintain\" for personal-data accuracy within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"maintain\" for personal-data accuracy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5DE52C1C2C","version":2,"title":"Minimize personal data collected","text":"Data controllers must minimize personal data collected.","topic":"Privacy","intent":"minimize personal data collected","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(c)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"minimize","object":"personal data collected","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"minimize\" for personal data collected within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"minimize\" for personal data collected while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal data collected. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: minimize personal data collected.","examples":{"meetsRule":"Data controllers performs the required action \"minimize\" for personal data collected within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"minimize\" for personal data collected while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-FED6DB2BF6","version":2,"title":"Notify the authority of qualifying personal-data breaches","text":"Data controllers must notify the authority of qualifying personal-data breaches.","topic":"Privacy","intent":"notify the authority of qualifying personal data breaches","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 33(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"notify","object":"the authority of qualifying personal-data breaches","condition":"Without undue delay and where feasible within 72 hours","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"notify\" for the authority of qualifying personal-data breaches within these source conditions: Without undue delay and where feasible within 72 hours, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"notify\" for the authority of qualifying personal-data breaches while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves the authority of qualifying personal-data breaches. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: notify the authority of qualifying personal-data breaches.","examples":{"meetsRule":"Data controllers performs the required action \"notify\" for the authority of qualifying personal-data breaches within these source conditions: Without undue delay and where feasible within 72 hours, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"notify\" for the authority of qualifying personal-data breaches while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9752AE9F94","version":2,"title":"Obtain information-security/privacy risk assessment before vendor GenAI use.","text":"Users must obtain risk assessment.","topic":"Privacy","intent":"obtain risk assessment","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"harvard-genai-guidelines","control":"Use approved tools, bullet 3","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"must","action":"obtain","object":"risk assessment","condition":"Harvard work","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"obtain\" for risk assessment within these source conditions: Harvard work, and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for risk assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves risk assessment. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain risk assessment.","examples":{"meetsRule":"users performs the required action \"obtain\" for risk assessment within these source conditions: Harvard work, and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for risk assessment while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-75F300981F","version":2,"title":"Organizations should determine their authority to process personal information.","text":"Organization should determine PII processing authority.","topic":"Privacy","intent":"determine pii processing authority","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-53-r5","control":"PT-2(a)","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=257","actor":"Organization","modality":"should","action":"determine","object":"PII processing authority","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"determine\" for PII processing authority within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"determine\" for PII processing authority. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves PII processing authority. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: determine PII processing authority.","examples":{"meetsRule":"Organization follows the recommendation to \"determine\" for PII processing authority within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"determine\" for PII processing authority. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-70303212C7","version":2,"title":"Organizations should document their authority to process personal information.","text":"Organization should document PII processing authority.","topic":"Privacy","intent":"document pii processing authority","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-53-r5","control":"PT-2(a)","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=257","actor":"Organization","modality":"should","action":"document","object":"PII processing authority","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"document\" for PII processing authority within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"document\" for PII processing authority. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves PII processing authority. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document PII processing authority.","examples":{"meetsRule":"Organization follows the recommendation to \"document\" for PII processing authority within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"document\" for PII processing authority. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-6486E8DBA4","version":2,"title":"Organizations should protect the confidentiality, integrity and availability of transmitted data.","text":"Organization should protect transmitted data.","topic":"Privacy","intent":"protect transmitted data","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-csf-2","control":"PR.DS-02","sourceVersion":"CSWP 29 / 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf#page=25","actor":"Organization","modality":"should","action":"protect","object":"transmitted data","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"protect\" for transmitted data within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"protect\" for transmitted data. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves transmitted data. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect transmitted data.","examples":{"meetsRule":"Organization follows the recommendation to \"protect\" for transmitted data within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Organization omits the recommended action \"protect\" for transmitted data. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B39B348823","version":2,"title":"Organizations should restrict personal-information processing to authorized activities.","text":"Organization should restrict PII processing.","topic":"Privacy","intent":"restrict pii processing","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-800-53-r5","control":"PT-2(b)","sourceVersion":"SP 800-53 Rev.5 / Dec-2020 updates","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf#page=257","actor":"Organization","modality":"should","action":"restrict","object":"PII processing","condition":"Authorized activities","exception":null,"timing":null,"authority":"technical-controls-when-adopted","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Organization follows the recommendation to \"restrict\" for PII processing within these conditions: Authorized activities.","doesNotMeetRule":"Organization omits the recommended action \"restrict\" for PII processing. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves PII processing. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: restrict PII processing.","examples":{"meetsRule":"Organization follows the recommendation to \"restrict\" for PII processing within these conditions: Authorized activities.","doesNotMeetRule":"Organization omits the recommended action \"restrict\" for PII processing. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-386B595FB5","version":2,"title":"Process personal data lawfully","text":"Data controllers must process personal data lawfully.","topic":"Privacy","intent":"process personal data lawfully","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(a)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"process","object":"personal data lawfully","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"process\" for personal data lawfully within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"process\" for personal data lawfully while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal data lawfully. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: process personal data lawfully.","examples":{"meetsRule":"Data controllers performs the required action \"process\" for personal data lawfully within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"process\" for personal data lawfully while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-685E3BDEA7","version":2,"title":"Process personal-information rights requests","text":"Covered GenAI service providers must process personal-information rights requests.","topic":"Privacy","intent":"process personal information rights requests","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 11","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"process","object":"personal-information rights requests","condition":"Lawful requests for access, correction or deletion","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"process\" for personal-information rights requests within these source conditions: Lawful requests for access, correction or deletion, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"process\" for personal-information rights requests while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal-information rights requests. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: process personal-information rights requests.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"process\" for personal-information rights requests within these source conditions: Lawful requests for access, correction or deletion, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"process\" for personal-information rights requests while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-CC0117ACB7","version":2,"title":"Protect personal-data integrity and confidentiality","text":"Data controllers must protect personal-data integrity and confidentiality.","topic":"Privacy","intent":"protect personal data integrity and confidentiality","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 5(1)(f)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"protect","object":"personal-data integrity and confidentiality","condition":"All covered processing","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"protect\" for personal-data integrity and confidentiality within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"protect\" for personal-data integrity and confidentiality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal-data integrity and confidentiality. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect personal-data integrity and confidentiality.","examples":{"meetsRule":"Data controllers performs the required action \"protect\" for personal-data integrity and confidentiality within these source conditions: All covered processing, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"protect\" for personal-data integrity and confidentiality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5D8AD7CDE4","version":2,"title":"Protect personal-information rights","text":"Covered GenAI service providers must protect personal-information rights.","topic":"Privacy","intent":"protect personal information rights","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(4)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"protect","object":"personal-information rights","condition":"Covered service use and provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for personal-information rights within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for personal-information rights while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves personal-information rights. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect personal-information rights.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for personal-information rights within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for personal-information rights while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8EDD597B2C","version":2,"title":"Provide clear privacy information","text":"Data controllers must provide clear privacy information.","topic":"Privacy","intent":"provide clear privacy information","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 12(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"provide","object":"clear privacy information","condition":"Information to data subjects","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"provide\" for clear privacy information within these source conditions: Information to data subjects, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"provide\" for clear privacy information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves clear privacy information. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide clear privacy information.","examples":{"meetsRule":"Data controllers performs the required action \"provide\" for clear privacy information within these source conditions: Information to data subjects, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"provide\" for clear privacy information while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-974125D9F2","version":2,"title":"Safeguard international personal-data transfers","text":"Data controllers must safeguard international personal-data transfers.","topic":"Privacy","intent":"safeguard international personal data transfers","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 44","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"safeguard","object":"international personal-data transfers","condition":"Covered transfers to third countries","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"safeguard\" for international personal-data transfers within these source conditions: Covered transfers to third countries, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"safeguard\" for international personal-data transfers while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves international personal-data transfers. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: safeguard international personal-data transfers.","examples":{"meetsRule":"Data controllers performs the required action \"safeguard\" for international personal-data transfers within these source conditions: Covered transfers to third countries, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"safeguard\" for international personal-data transfers while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-3A61647692","version":2,"title":"Assess third-party AI supply-chain risks","text":"AI governance owners should assess third-party AI supply-chain risks.","topic":"Procurement","intent":"assess third party ai supply chain risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 6.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"assess","object":"third-party AI supply-chain risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assess\" for third-party AI supply-chain risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assess\" for third-party AI supply-chain risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves third-party AI supply-chain risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assess third-party AI supply-chain risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assess\" for third-party AI supply-chain risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"assess\" for third-party AI supply-chain risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5EF003576B","version":2,"title":"Avoid meeting assistants except approved tools with contractual protections.","text":"Users should-not use meeting assistants.","topic":"Procurement","intent":"use meeting assistants","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"harvard-genai-guidelines","control":"Use approved tools, bullet 2","sourceVersion":"Edition unspecified; prepared index checked 2026-09-28","url":"https://www.huit.harvard.edu/ai/guidelines","actor":"users","modality":"should-not","action":"use","object":"meeting assistants","condition":"Harvard meetings","exception":"approved protected tools","timing":null,"authority":"organization-specific","jurisdiction":"Harvard University, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"use\" for meeting assistants within these source conditions: Harvard meetings, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for meeting assistants while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves meeting assistants. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use meeting assistants.","examples":{"meetsRule":"users performs the required action \"use\" for meeting assistants within these source conditions: Harvard meetings, and retains evidence.","doesNotMeetRule":"users omits the required action \"use\" for meeting assistants while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E05F392822","version":2,"title":"Covered agencies must include contract terms enabling regular AI performance evaluation.","text":"Covered agency must include evaluation-enabling contract terms.","topic":"Procurement","intent":"include evaluation enabling contract terms","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-25-22","control":"4(d)(ii)(E)","sourceVersion":"M-25-22","url":"https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-22-Driving-Efficient-Acquisition-of-Artificial-Intelligence-in-Government.pdf#page=10","actor":"Covered agency","modality":"must","action":"include","object":"evaluation-enabling contract terms","condition":"Applicable AI contracts under §2","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"include\" for evaluation-enabling contract terms within these source conditions: Applicable AI contracts under §2, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"include\" for evaluation-enabling contract terms while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves evaluation-enabling contract terms. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: include evaluation-enabling contract terms.","examples":{"meetsRule":"Covered agency performs the required action \"include\" for evaluation-enabling contract terms within these source conditions: Applicable AI contracts under §2, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"include\" for evaluation-enabling contract terms while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-A80EF3B4B0","version":2,"title":"Covered agencies must request the vendor’s acceptable-use policy in LLM solicitations.","text":"Covered agency must request vendor acceptable-use policy.","topic":"Procurement","intent":"request vendor acceptable use policy","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-26-04","control":"Appendix A.1(A)(i)","sourceVersion":"M-26-04","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf#page=5","actor":"Covered agency","modality":"must","action":"request","object":"vendor acceptable-use policy","condition":"Covered LLM solicitations","exception":null,"timing":null,"authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"request\" for vendor acceptable-use policy within these source conditions: Covered LLM solicitations, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"request\" for vendor acceptable-use policy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves vendor acceptable-use policy. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: request vendor acceptable-use policy.","examples":{"meetsRule":"Covered agency performs the required action \"request\" for vendor acceptable-use policy within these source conditions: Covered LLM solicitations, and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"request\" for vendor acceptable-use policy while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-21AFA15D02","version":2,"title":"Covered agencies must update procurement procedures to include the required LLM terms.","text":"Covered agency must update LLM procurement procedures.","topic":"Procurement","intent":"update llm procurement procedures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"omb-m-26-04","control":"Agency Actions (c)","sourceVersion":"M-26-04","url":"https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf#page=3","actor":"Covered agency","modality":"must","action":"update","object":"LLM procurement procedures","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":"By 2026-03-11","authority":"binding-within-defined-federal-scope","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Covered agency performs the required action \"update\" for LLM procurement procedures within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"update\" for LLM procurement procedures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves LLM procurement procedures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: update LLM procurement procedures.","examples":{"meetsRule":"Covered agency performs the required action \"update\" for LLM procurement procedures within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"Covered agency omits the required action \"update\" for LLM procurement procedures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8312DD76DB","version":2,"title":"Establish contingency procedures for third-party failures","text":"AI governance owners should establish contingency procedures for third-party failures.","topic":"Procurement","intent":"establish contingency procedures for third party failures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 6.2","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"contingency procedures for third-party failures","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for contingency procedures for third-party failures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for contingency procedures for third-party failures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves contingency procedures for third-party failures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish contingency procedures for third-party failures.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for contingency procedures for third-party failures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for contingency procedures for third-party failures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-746FA0104C","version":2,"title":"Monitor third-party AI risks","text":"AI governance owners should monitor third-party AI risks.","topic":"Procurement","intent":"monitor third party ai risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 3.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"monitor","object":"third-party AI risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for third-party AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for third-party AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves third-party AI risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: monitor third-party AI risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"monitor\" for third-party AI risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"monitor\" for third-party AI risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-69B1D0BD8A","version":2,"title":"AI providers should maintain the ability to restore assets to a known-good state.","text":"AI provider should maintain known-good asset recovery.","topic":"Safety","intent":"maintain known good asset recovery","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cisa-ncsc-secure-ai-development","control":"Secure development / assets","sourceVersion":"1.0","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","actor":"AI provider","modality":"should","action":"maintain","object":"known-good asset recovery","condition":"Compromise","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"AI provider follows the recommendation to \"maintain\" for known-good asset recovery within these conditions: Compromise.","doesNotMeetRule":"AI provider omits the recommended action \"maintain\" for known-good asset recovery. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves known-good asset recovery. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: maintain known-good asset recovery.","examples":{"meetsRule":"AI provider follows the recommendation to \"maintain\" for known-good asset recovery within these conditions: Compromise.","doesNotMeetRule":"AI provider omits the recommended action \"maintain\" for known-good asset recovery. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4EB0C43D04","version":2,"title":"Communicate AI incidents to affected stakeholders","text":"AI governance owners should communicate AI incidents to affected stakeholders.","topic":"Safety","intent":"communicate ai incidents to affected stakeholders","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 4.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"communicate","object":"AI incidents to affected stakeholders","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"communicate\" for AI incidents to affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"communicate\" for AI incidents to affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI incidents to affected stakeholders. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: communicate AI incidents to affected stakeholders.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"communicate\" for AI incidents to affected stakeholders within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"communicate\" for AI incidents to affected stakeholders. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-EB5574CE22","version":2,"title":"Document incidents involving third-party GAI systems","text":"AI governance owners should document incidents involving third-party GAI systems.","topic":"Safety","intent":"document incidents involving third party gai systems","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-6.2-002","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"document","object":"incidents involving third-party GAI systems","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for incidents involving third-party GAI systems within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for incidents involving third-party GAI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves incidents involving third-party GAI systems. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: document incidents involving third-party GAI systems.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"document\" for incidents involving third-party GAI systems within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"document\" for incidents involving third-party GAI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E358CEFA41","version":2,"title":"Enable AI incident identification","text":"AI governance owners should enable AI incident identification.","topic":"Safety","intent":"enable ai incident identification","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 4.3","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"enable","object":"AI incident identification","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"enable\" for AI incident identification within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"enable\" for AI incident identification. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI incident identification. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enable AI incident identification.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"enable\" for AI incident identification within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"enable\" for AI incident identification. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0E39923F61","version":2,"title":"Establish a safety-first AI development culture","text":"AI governance owners should establish a safety-first AI development culture.","topic":"Safety","intent":"establish a safety first ai development culture","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 4.1","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"a safety-first AI development culture","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for a safety-first AI development culture within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for a safety-first AI development culture. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a safety-first AI development culture. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish a safety-first AI development culture.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for a safety-first AI development culture within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for a safety-first AI development culture. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-347AC3B548","version":2,"title":"Establish mechanisms to deactivate unsafe AI systems","text":"AI governance owners should establish mechanisms to deactivate unsafe AI systems.","topic":"Safety","intent":"establish mechanisms to deactivate unsafe ai systems","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Manage 2.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"mechanisms to deactivate unsafe AI systems","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for mechanisms to deactivate unsafe AI systems within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for mechanisms to deactivate unsafe AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves mechanisms to deactivate unsafe AI systems. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish mechanisms to deactivate unsafe AI systems.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for mechanisms to deactivate unsafe AI systems within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for mechanisms to deactivate unsafe AI systems. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-FC4DFA8060","version":2,"title":"Evaluate AI safety risks","text":"AI governance owners should evaluate AI safety risks.","topic":"Safety","intent":"evaluate ai safety risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.6","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"AI safety risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI safety risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI safety risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI safety risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate AI safety risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI safety risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI safety risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-EBC5423CFD","version":2,"title":"Follow incident protocols for suspected breaches or data-protection violations.","text":"Employees must follow incident protocols.","topic":"Safety","intent":"follow incident protocols","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, reporting, bullet 2","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"follow","object":"incident protocols","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"follow\" for incident protocols within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"follow\" for incident protocols while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves incident protocols. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: follow incident protocols.","examples":{"meetsRule":"employees performs the required action \"follow\" for incident protocols within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"follow\" for incident protocols while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F24F48122C","version":2,"title":"Plan a halt to unacceptable-risk GAI development","text":"AI governance owners should plan a halt to unacceptable-risk GAI development.","topic":"Safety","intent":"plan a halt to unacceptable risk gai development","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.3-007","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"plan","object":"a halt to unacceptable-risk GAI development","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for a halt to unacceptable-risk GAI development within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for a halt to unacceptable-risk GAI development. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves a halt to unacceptable-risk GAI development. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: plan a halt to unacceptable-risk GAI development.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"plan\" for a halt to unacceptable-risk GAI development within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"plan\" for a halt to unacceptable-risk GAI development. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-4EE1F0E0DF","version":2,"title":"Report serious incidents to authorities","text":"High-risk AI providers must report serious incidents to authorities.","topic":"Safety","intent":"report serious incidents to authorities","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 73(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"report","object":"serious incidents to authorities","condition":"Covered high-risk systems","exception":"Statutory incident category and deadline review required","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"report\" for serious incidents to authorities within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"report\" for serious incidents to authorities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves serious incidents to authorities. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: report serious incidents to authorities.","examples":{"meetsRule":"High-risk AI providers performs the required action \"report\" for serious incidents to authorities within these source conditions: Covered high-risk systems, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"report\" for serious incidents to authorities while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D711D2E5E0","version":2,"title":"Report serious incidents to the AI Office","text":"Systemic-risk GPAI providers must report serious incidents to the AI Office.","topic":"Safety","intent":"report serious incidents to the ai office","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 55(1)(c)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"report","object":"serious incidents to the AI Office","condition":"Covered systemic-risk models","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"report\" for serious incidents to the AI Office within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"report\" for serious incidents to the AI Office while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves serious incidents to the AI Office. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: report serious incidents to the AI Office.","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"report\" for serious incidents to the AI Office within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"report\" for serious incidents to the AI Office while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D1FFF5F35C","version":2,"title":"Use harmfully manipulative AI techniques","text":"AI operators must not use harmfully manipulative AI techniques.","topic":"Safety","intent":"use harmfully manipulative ai techniques","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(a)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"use","object":"harmfully manipulative AI techniques","condition":"Material distortion of behavior causing or likely to cause significant harm","exception":"Statutory elements must all be assessed","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"use\" for harmfully manipulative AI techniques while these conditions apply: Material distortion of behavior causing or likely to cause significant harm.","doesNotMeetRule":"AI operators performs the prohibited action \"use\" for harmfully manipulative AI techniques while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves harmfully manipulative AI techniques. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use harmfully manipulative AI techniques.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"use\" for harmfully manipulative AI techniques while these conditions apply: Material distortion of behavior causing or likely to cause significant harm.","doesNotMeetRule":"AI operators performs the prohibited action \"use\" for harmfully manipulative AI techniques while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-BB06F70AC1","version":2,"title":"Ensure adequate cybersecurity for models","text":"Systemic-risk GPAI providers must ensure adequate cybersecurity for models.","topic":"Security","intent":"ensure adequate cybersecurity for models","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 55(1)(d)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"Systemic-risk GPAI providers","modality":"must","action":"ensure","object":"adequate cybersecurity for models","condition":"Covered systemic-risk models","exception":"Including physical infrastructure","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"ensure\" for adequate cybersecurity for models within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"ensure\" for adequate cybersecurity for models while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves adequate cybersecurity for models. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure adequate cybersecurity for models.","examples":{"meetsRule":"Systemic-risk GPAI providers performs the required action \"ensure\" for adequate cybersecurity for models within these source conditions: Covered systemic-risk models, and retains evidence.","doesNotMeetRule":"Systemic-risk GPAI providers omits the required action \"ensure\" for adequate cybersecurity for models while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-63476788C2","version":2,"title":"Ensure cybersecurity of high-risk AI","text":"High-risk AI providers must ensure cybersecurity of high-risk AI.","topic":"Security","intent":"ensure cybersecurity of high risk ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 15(5)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"ensure","object":"cybersecurity of high-risk AI","condition":"Against unauthorized third-party alteration","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for cybersecurity of high-risk AI within these source conditions: Against unauthorized third-party alteration, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for cybersecurity of high-risk AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves cybersecurity of high-risk AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: ensure cybersecurity of high-risk AI.","examples":{"meetsRule":"High-risk AI providers performs the required action \"ensure\" for cybersecurity of high-risk AI within these source conditions: Against unauthorized third-party alteration, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"ensure\" for cybersecurity of high-risk AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B8B189C1E1","version":2,"title":"Evaluate AI security and resilience","text":"AI governance owners should evaluate AI security and resilience.","topic":"Security","intent":"evaluate ai security and resilience","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.7","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"evaluate","object":"AI security and resilience","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI security and resilience within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI security and resilience. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI security and resilience. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate AI security and resilience.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"evaluate\" for AI security and resilience within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"evaluate\" for AI security and resilience. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5D6EB58CC1","version":2,"title":"Exploit vulnerabilities through harmful AI manipulation","text":"AI operators must not exploit vulnerabilities through harmful AI manipulation.","topic":"Security","intent":"exploit vulnerabilities through harmful ai manipulation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 5(1)(b)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI operators","modality":"must not","action":"exploit","object":"vulnerabilities through harmful AI manipulation","condition":"Age, disability or specific social or economic situation","exception":"Statutory harm threshold applies","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI operators does not perform the prohibited action \"exploit\" for vulnerabilities through harmful AI manipulation while these conditions apply: Age, disability or specific social or economic situation.","doesNotMeetRule":"AI operators performs the prohibited action \"exploit\" for vulnerabilities through harmful AI manipulation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves vulnerabilities through harmful AI manipulation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: exploit vulnerabilities through harmful AI manipulation.","examples":{"meetsRule":"AI operators does not perform the prohibited action \"exploit\" for vulnerabilities through harmful AI manipulation while these conditions apply: Age, disability or specific social or economic situation.","doesNotMeetRule":"AI operators performs the prohibited action \"exploit\" for vulnerabilities through harmful AI manipulation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-80606F42F7","version":2,"title":"Implement appropriate data security measures","text":"Data controllers must implement appropriate data security measures.","topic":"Security","intent":"implement appropriate data security measures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-gdpr","control":"Article 32(1)","sourceVersion":"Regulation 2016/679","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","actor":"Data controllers","modality":"must","action":"implement","object":"appropriate data security measures","condition":"Appropriate to processing risks","exception":"See article-specific exceptions and safeguards","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Data controllers performs the required action \"implement\" for appropriate data security measures within these source conditions: Appropriate to processing risks, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"implement\" for appropriate data security measures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves appropriate data security measures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: implement appropriate data security measures.","examples":{"meetsRule":"Data controllers performs the required action \"implement\" for appropriate data security measures within these source conditions: Appropriate to processing risks, and retains evidence.","doesNotMeetRule":"Data controllers omits the required action \"implement\" for appropriate data security measures while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-49A6A9BEE4","version":2,"title":"Never enter passwords, API keys, or system-access secrets into GenAI.","text":"Users must-not enter access secrets.","topic":"Security","intent":"enter access secrets","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"brookline-genai","control":"Use, prohibited-data bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must-not","action":"enter","object":"access secrets","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"enter\" for access secrets within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for access secrets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves access secrets. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: enter access secrets.","examples":{"meetsRule":"users performs the required action \"enter\" for access secrets within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"enter\" for access secrets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-95F550699A","version":2,"title":"Notify supervisors and the agency security liaison about AI concerns.","text":"Employees must notify AI concerns.","topic":"Security","intent":"notify ai concerns","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, reporting, bullet 1","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"notify","object":"AI concerns","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"notify\" for AI concerns within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"notify\" for AI concerns while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI concerns. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: notify AI concerns.","examples":{"meetsRule":"employees performs the required action \"notify\" for AI concerns within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"employees omits the required action \"notify\" for AI concerns while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8D76274A01","version":2,"title":"Obtain CIO and security-liaison approval before submitting existing state or proprietary code.","text":"Employees must obtain approval.","topic":"Security","intent":"obtain approval","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nc-public-genai","control":"p.5, data sharing, bullet 3","sourceVersion":"1.1 — April 14, 2026","url":"https://it.nc.gov/documents/use-publicly-available-generative-artificial-intelligence/download?attachment=","actor":"employees","modality":"must","action":"obtain","object":"approval","condition":"code submission","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"North Carolina, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"employees performs the required action \"obtain\" for approval within these source conditions: code submission, and retains evidence.","doesNotMeetRule":"employees omits the required action \"obtain\" for approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}},{"sourceId":"brookline-genai","control":"Use, bullet 1","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"obtain","object":"approval","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"obtain\" for approval within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"obtain\" for approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves approval. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain approval.","examples":{"meetsRule":"employees performs the required action \"obtain\" for approval within these source conditions: code submission, and retains evidence.","doesNotMeetRule":"employees omits the required action \"obtain\" for approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0029859136","version":2,"title":"Perform required security assessments","text":"Covered GenAI service providers must perform required security assessments.","topic":"Security","intent":"perform required security assessments","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 17","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"perform","object":"required security assessments","condition":"Services with public-opinion attributes or social mobilization capability","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"perform\" for required security assessments within these source conditions: Services with public-opinion attributes or social mobilization capability, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"perform\" for required security assessments while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves required security assessments. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: perform required security assessments.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"perform\" for required security assessments within these source conditions: Services with public-opinion attributes or social mobilization capability, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"perform\" for required security assessments while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-D67362ED3A","version":2,"title":"Protect trade secrets","text":"Covered GenAI service providers must protect trade secrets.","topic":"Security","intent":"protect trade secrets","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(3)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"protect","object":"trade secrets","condition":"Covered service use and provision","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for trade secrets within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for trade secrets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves trade secrets. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: protect trade secrets.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"protect\" for trade secrets within these source conditions: Covered service use and provision, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"protect\" for trade secrets while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-50E6F7AEC2","version":2,"title":"Register proposed AI and obtain AITR/ISO, VITA/CIO, then Administration Secretary approval.","text":"Agencies must obtain sequential approval.","topic":"Security","intent":"obtain sequential approval","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"p.6, Approval Workflow / Exemptions","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must","action":"obtain","object":"sequential approval","condition":"before deployment","exception":"security defense; standard-software embedded AI; higher-education research/instruction","timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"obtain\" for sequential approval within these source conditions: before deployment, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"obtain\" for sequential approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves sequential approval. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: obtain sequential approval.","examples":{"meetsRule":"agencies performs the required action \"obtain\" for sequential approval within these source conditions: before deployment, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"obtain\" for sequential approval while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-59B6D94E34","version":2,"title":"Software producers should gather vulnerability reports from users, acquirers and public sources.","text":"Software producer should gather vulnerability reports.","topic":"Security","intent":"gather vulnerability reports","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ssdf-1-1","control":"RV.1.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=25","actor":"Software producer","modality":"should","action":"gather","object":"vulnerability reports","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"gather\" for vulnerability reports within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"gather\" for vulnerability reports. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves vulnerability reports. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: gather vulnerability reports.","examples":{"meetsRule":"Software producer follows the recommendation to \"gather\" for vulnerability reports within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"gather\" for vulnerability reports. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-BC2EBDF815","version":2,"title":"Software producers should investigate credible vulnerability reports.","text":"Software producer should investigate credible vulnerability reports.","topic":"Security","intent":"investigate credible vulnerability reports","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ssdf-1-1","control":"RV.1.1","sourceVersion":"SP 800-218 / SSDF 1.1","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf#page=25","actor":"Software producer","modality":"should","action":"investigate","object":"credible vulnerability reports","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"Software producer follows the recommendation to \"investigate\" for credible vulnerability reports within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"investigate\" for credible vulnerability reports. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves credible vulnerability reports. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: investigate credible vulnerability reports.","examples":{"meetsRule":"Software producer follows the recommendation to \"investigate\" for credible vulnerability reports within these conditions: Within the source scope; assess applicability before adoption..","doesNotMeetRule":"Software producer omits the recommended action \"investigate\" for credible vulnerability reports. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-F52DD6D81F","version":2,"title":"Assign responsibility for content provenance reviews","text":"AI governance owners should assign responsibility for content provenance reviews.","topic":"Transparency","intent":"assign responsibility for content provenance reviews","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.5-001","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"assign","object":"responsibility for content provenance reviews","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assign\" for responsibility for content provenance reviews within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"assign\" for responsibility for content provenance reviews. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves responsibility for content provenance reviews. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: assign responsibility for content provenance reviews.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"assign\" for responsibility for content provenance reviews within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"assign\" for responsibility for content provenance reviews. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9B0903C354","version":2,"title":"Define operable data-labeling rules","text":"Covered GenAI service providers must define operable data-labeling rules.","topic":"Transparency","intent":"define operable data labeling rules","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 8","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"define","object":"operable data-labeling rules","condition":"Data annotation during development","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"define\" for operable data-labeling rules within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"define\" for operable data-labeling rules while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves operable data-labeling rules. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: define operable data-labeling rules.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"define\" for operable data-labeling rules within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"define\" for operable data-labeling rules while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-B8A087CCC2","version":2,"title":"Design sufficiently transparent operation","text":"High-risk AI providers must design sufficiently transparent operation.","topic":"Transparency","intent":"design sufficiently transparent operation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 13(1)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"High-risk AI providers","modality":"must","action":"design","object":"sufficiently transparent operation","condition":"To enable deployer interpretation","exception":"Applicable statutory provisions","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"High-risk AI providers performs the required action \"design\" for sufficiently transparent operation within these source conditions: To enable deployer interpretation, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"design\" for sufficiently transparent operation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves sufficiently transparent operation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: design sufficiently transparent operation.","examples":{"meetsRule":"High-risk AI providers performs the required action \"design\" for sufficiently transparent operation within these source conditions: To enable deployer interpretation, and retains evidence.","doesNotMeetRule":"High-risk AI providers omits the required action \"design\" for sufficiently transparent operation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-8530787112","version":2,"title":"Disclose deepfake generation or manipulation","text":"AI deployers must disclose deepfake generation or manipulation.","topic":"Transparency","intent":"disclose deepfake generation or manipulation","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"eu-ai-act","control":"Article 50(4)","sourceVersion":"Regulation 2024/1689; 2026 amendments tracked separately","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","actor":"AI deployers","modality":"must","action":"disclose","object":"deepfake generation or manipulation","condition":"Covered synthetic media","exception":"Artistic and specified law-enforcement treatment applies","timing":null,"authority":"binding-within-scope","jurisdiction":"European Union","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI deployers performs the required action \"disclose\" for deepfake generation or manipulation within these source conditions: Covered synthetic media, and retains evidence.","doesNotMeetRule":"AI deployers omits the required action \"disclose\" for deepfake generation or manipulation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves deepfake generation or manipulation. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: disclose deepfake generation or manipulation.","examples":{"meetsRule":"AI deployers performs the required action \"disclose\" for deepfake generation or manipulation within these source conditions: Covered synthetic media, and retains evidence.","doesNotMeetRule":"AI deployers omits the required action \"disclose\" for deepfake generation or manipulation while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0A0DBE76B1","version":2,"title":"Establish transparent AI risk-management procedures","text":"AI governance owners should establish transparent AI risk-management procedures.","topic":"Transparency","intent":"establish transparent ai risk management procedures","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Govern 1.4","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"transparent AI risk-management procedures","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for transparent AI risk-management procedures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for transparent AI risk-management procedures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves transparent AI risk-management procedures. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish transparent AI risk-management procedures.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for transparent AI risk-management procedures within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for transparent AI risk-management procedures. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2C63EF342D","version":2,"title":"Establish transparent GAI acceptable-use policies","text":"AI governance owners should establish transparent GAI acceptable-use policies.","topic":"Transparency","intent":"establish transparent gai acceptable use policies","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-genai-profile","control":"GV-1.4-002","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","actor":"AI governance owners","modality":"should","action":"establish","object":"transparent GAI acceptable-use policies","condition":"Generative AI lifecycle; voluntary suggested action","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for transparent GAI acceptable-use policies within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for transparent GAI acceptable-use policies. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves transparent GAI acceptable-use policies. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: establish transparent GAI acceptable-use policies.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"establish\" for transparent GAI acceptable-use policies within these conditions: Generative AI lifecycle; voluntary suggested action.","doesNotMeetRule":"AI governance owners omits the recommended action \"establish\" for transparent GAI acceptable-use policies. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-0CD56857BE","version":2,"title":"Evaluate data-labeling quality","text":"Covered GenAI service providers must evaluate data-labeling quality.","topic":"Transparency","intent":"evaluate data labeling quality","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 8","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"evaluate","object":"data-labeling quality","condition":"Data annotation during development","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"evaluate\" for data-labeling quality within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"evaluate\" for data-labeling quality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data-labeling quality. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: evaluate data-labeling quality.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"evaluate\" for data-labeling quality within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"evaluate\" for data-labeling quality while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-2D2E913625","version":2,"title":"Examine AI transparency risks","text":"AI governance owners should examine AI transparency risks.","topic":"Transparency","intent":"examine ai transparency risks","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.8","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"examine","object":"AI transparency risks","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for AI transparency risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for AI transparency risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI transparency risks. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: examine AI transparency risks.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"examine\" for AI transparency risks within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"examine\" for AI transparency risks. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-BDE09E3088","version":2,"title":"Exclude unexplainable AI from decisions and approvals.","text":"Agencies must-not use unexplainable AI.","topic":"Transparency","intent":"use unexplainable ai","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"va-ai-ea400","control":"p.5, Ethical Use","sourceVersion":"EA400 — June 2026","url":"https://www.vita.virginia.gov/media/vitavirginiagov/it-governance/ea/pdf/Artificial-Intelligence-(AI)-Utilization-Policy.pdf","actor":"agencies","modality":"must-not","action":"use","object":"unexplainable AI","condition":"decision or approval","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Virginia, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"agencies performs the required action \"use\" for unexplainable AI within these source conditions: decision or approval, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"use\" for unexplainable AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves unexplainable AI. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: use unexplainable AI.","examples":{"meetsRule":"agencies performs the required action \"use\" for unexplainable AI within these source conditions: decision or approval, and retains evidence.","doesNotMeetRule":"agencies omits the required action \"use\" for unexplainable AI while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-87BEC56E72","version":2,"title":"Explain AI outputs in their use context","text":"AI governance owners should explain AI outputs in their use context.","topic":"Transparency","intent":"explain ai outputs in their use context","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"nist-ai-rmf-1","control":"Measure 2.9","sourceVersion":"AI RMF 1.0 (2023)","url":"https://nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf","actor":"AI governance owners","modality":"should","action":"explain","object":"AI outputs in their use context","condition":"AI lifecycle and deployment context; voluntary framework outcome","exception":null,"timing":null,"authority":"voluntary","jurisdiction":"United States","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"AI governance owners follows the recommendation to \"explain\" for AI outputs in their use context within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"explain\" for AI outputs in their use context. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI outputs in their use context. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: explain AI outputs in their use context.","examples":{"meetsRule":"AI governance owners follows the recommendation to \"explain\" for AI outputs in their use context within these conditions: AI lifecycle and deployment context; voluntary framework outcome.","doesNotMeetRule":"AI governance owners omits the recommended action \"explain\" for AI outputs in their use context. This is a recommendation gap, not by itself a statutory violation.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-5CE518437C","version":2,"title":"Improve transparency of GenAI services","text":"Covered GenAI service providers must improve transparency of GenAI services.","topic":"Transparency","intent":"improve transparency of genai services","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 4(5)","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"improve","object":"transparency of GenAI services","condition":"According to service characteristics","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for transparency of GenAI services within these source conditions: According to service characteristics, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for transparency of GenAI services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves transparency of GenAI services. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: improve transparency of GenAI services.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"improve\" for transparency of GenAI services within these source conditions: According to service characteristics, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"improve\" for transparency of GenAI services while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-1DD5F7B4C4","version":2,"title":"Label generated images and videos","text":"Covered GenAI service providers must label generated images and videos.","topic":"Transparency","intent":"label generated images and videos","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 12","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"label","object":"generated images and videos","condition":"As required by deep-synthesis provisions","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"label\" for generated images and videos within these source conditions: As required by deep-synthesis provisions, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"label\" for generated images and videos while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves generated images and videos. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: label generated images and videos.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"label\" for generated images and videos within these source conditions: As required by deep-synthesis provisions, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"label\" for generated images and videos while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-66E5FC0789","version":2,"title":"Label town-used AI content conspicuously, describing review and editing.","text":"Users must label AI content.","topic":"Transparency","intent":"label ai content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"brookline-genai","control":"Use, transparency bullet","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","actor":"users","modality":"must","action":"label","object":"AI content","condition":"Within the source scope; assess applicability before adoption.","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Brookline, Massachusetts, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"label\" for AI content within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"label\" for AI content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves AI content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: label AI content.","examples":{"meetsRule":"users performs the required action \"label\" for AI content within these source conditions: Within the source scope; assess applicability before adoption., and retains evidence.","doesNotMeetRule":"users omits the required action \"label\" for AI content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-7F72121E8B","version":2,"title":"Present notices in plain language","text":"Responsible senior federal officials must present notices in plain language.","topic":"Transparency","intent":"present notices in plain language","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.2","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"present","object":"notices in plain language","condition":"Prominently in service channels","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"present\" for notices in plain language within these source conditions: Prominently in service channels, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"present\" for notices in plain language while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves notices in plain language. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: present notices in plain language.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"present\" for notices in plain language within these source conditions: Prominently in service channels, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"present\" for notices in plain language while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-E28075A396","version":2,"title":"Prominently disclose externally shared GenAI content, identifying system and version.","text":"Users must disclose GenAI content.","topic":"Transparency","intent":"disclose genai content","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"pa-ai-2026","control":"5.2.4, pp.6–7","sourceVersion":"Revision January 13, 2026","url":"https://www.pa.gov/content/dam/copapwp-pagov/en/oa/documents/policies/it-policies/artificial%20intelligence%20policy.pdf","actor":"users","modality":"must","action":"disclose","object":"GenAI content","condition":"including partial generation","exception":null,"timing":null,"authority":"organization-specific","jurisdiction":"Pennsylvania, US","checkedAt":"2026-09-28","status":"interpretation-needs-review","examples":{"meetsRule":"users performs the required action \"disclose\" for GenAI content within these source conditions: including partial generation, and retains evidence.","doesNotMeetRule":"users omits the required action \"disclose\" for GenAI content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves GenAI content. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: disclose GenAI content.","examples":{"meetsRule":"users performs the required action \"disclose\" for GenAI content within these source conditions: including partial generation, and retains evidence.","doesNotMeetRule":"users omits the required action \"disclose\" for GenAI content while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-9F12707A1E","version":2,"title":"Provide notice of automated decision-making","text":"Responsible senior federal officials must provide notice of automated decision-making.","topic":"Transparency","intent":"provide notice of automated decision making","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"ca-automated-decisions","control":"6.2.1","sourceVersion":"Modified 2025-06-24","url":"https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32592","actor":"Responsible senior federal officials","modality":"must","action":"provide","object":"notice of automated decision-making","condition":"Before decisions; impact-level requirements apply","exception":"Directive scope and Appendix C apply","timing":null,"authority":"binding-within-federal-scope","jurisdiction":"Canada federal government","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"provide\" for notice of automated decision-making within these source conditions: Before decisions; impact-level requirements apply, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"provide\" for notice of automated decision-making while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves notice of automated decision-making. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: provide notice of automated decision-making.","examples":{"meetsRule":"Responsible senior federal officials performs the required action \"provide\" for notice of automated decision-making within these source conditions: Before decisions; impact-level requirements apply, and retains evidence.","doesNotMeetRule":"Responsible senior federal officials omits the required action \"provide\" for notice of automated decision-making while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"},{"id":"AIR-634CB1FAE6","version":2,"title":"Train data-labeling personnel","text":"Covered GenAI service providers must train data-labeling personnel.","topic":"Transparency","intent":"train data labeling personnel","status":"candidate","semanticStatus":"human-validation-required","variants":[{"sourceId":"cn-genai-interim","control":"Article 8","sourceVersion":"Order 15; effective 2023-08-15","url":"https://www.cac.gov.cn/2023-07/13/c_1690898327029107.htm","actor":"Covered GenAI service providers","modality":"must","action":"train","object":"data-labeling personnel","condition":"Data annotation during development","exception":"Article 2 scope and cross-referenced Chinese laws apply","timing":null,"authority":"binding-within-scope","jurisdiction":"China","checkedAt":"2026-10-03","status":"interpretation-needs-review","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"train\" for data-labeling personnel within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"train\" for data-labeling personnel while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."}}],"situation":"An AI system or employee activity involves data-labeling personnel. Confirm the actor and source conditions before using this template.","purpose":"Provide a traceable control for the action: train data-labeling personnel.","examples":{"meetsRule":"Covered GenAI service providers performs the required action \"train\" for data-labeling personnel within these source conditions: Data annotation during development, and retains evidence.","doesNotMeetRule":"Covered GenAI service providers omits the required action \"train\" for data-labeling personnel while those source conditions apply.","outOfScope":"The actor, activity, jurisdiction, or applicability conditions in this source variant do not match."},"evidence":["Dated record of the action","Responsible actor and approval, where required","Applicable source edition and scope"],"enforcement":{"mode":"policy-template","adapter":"Human or authorized system adapter required","machineExecutable":false},"limitations":["A rule card is an interpretation aid, not an applicability determination.","Equivalent intent does not make different source obligations interchangeable."],"createdAt":"2026-10-03","updatedAt":"2026-10-03"}],"gaps":[{"title":"ISO/IEC 42001","jurisdiction":"International","url":"https://www.iso.org/standard/81230.html","reason":"Licensed standard; metadata only","status":"not-extracted"},{"title":"ISO/IEC 23894","jurisdiction":"International","url":"https://www.iso.org/standard/77304.html","reason":"Licensed standard; metadata only","status":"not-extracted"},{"title":"OECD AI Principles","jurisdiction":"International","url":"https://oecd.ai/en/ai-principles","reason":"Updated principles; clause extraction pending","status":"not-extracted"},{"title":"UNESCO Recommendation on AI Ethics","jurisdiction":"International","url":"https://www.unesco.org/en/artificial-intelligence/recommendation-ethics","reason":"Normative recommendations; extraction pending","status":"not-extracted"},{"title":"OWASP LLM Top 10","jurisdiction":"Global","url":"https://genai.owasp.org/llm-top-10/","reason":"Security recommendations; atomic extraction pending","status":"not-extracted"},{"title":"OWASP Agentic Security","jurisdiction":"Global","url":"https://genai.owasp.org/","reason":"Agent controls discovery pending","status":"not-extracted"},{"title":"Singapore AI Verify","jurisdiction":"Singapore","url":"https://aiverifyfoundation.sg/","reason":"Testing framework; extraction pending","status":"not-extracted"},{"title":"Singapore Model AI Governance Framework","jurisdiction":"Singapore","url":"https://www.pdpc.gov.sg/help-and-resources/2020/01/model-ai-governance-framework","reason":"Framework editions need reconciliation","status":"not-extracted"},{"title":"UK AI Cyber Security Code","jurisdiction":"United Kingdom","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice","reason":"Official code extraction pending","status":"not-extracted"},{"title":"Australia AI Safety Standard","jurisdiction":"Australia","url":"https://www.industry.gov.au/publications/voluntary-ai-safety-standard","reason":"Voluntary controls extraction pending","status":"not-extracted"},{"title":"Japan AI Guidelines for Business","jurisdiction":"Japan","url":"https://www.meti.go.jp/english/policy/mono_info_service/ai/index.html","reason":"Latest edition and translation need verification","status":"not-extracted"},{"title":"South Korea AI Basic Act","jurisdiction":"South Korea","url":"https://www.law.go.kr/","reason":"Authoritative Korean text and commencement need verification","status":"not-extracted"},{"title":"Brazil AI legislation","jurisdiction":"Brazil","url":"https://www.camara.leg.br/","reason":"Legislative status must be verified; no adopted-law claim","status":"not-extracted"},{"title":"Colorado AI Act","jurisdiction":"Colorado, US","url":"https://leg.colorado.gov/bills/SB24-205","reason":"Current 2026 amendments and consolidated law need review","status":"not-extracted"},{"title":"California frontier AI law","jurisdiction":"California, US","url":"https://leginfo.legislature.ca.gov/","reason":"Current SB 53 and related law extraction pending","status":"not-extracted"},{"title":"New York City Local Law 144","jurisdiction":"New York City, US","url":"https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page","reason":"Employment bias-audit controls pending","status":"not-extracted"},{"title":"Texas Responsible AI Governance Act","jurisdiction":"Texas, US","url":"https://capitol.texas.gov/","reason":"Current enacted text extraction pending","status":"not-extracted"},{"title":"EU GPAI Code of Practice","jurisdiction":"European Union","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","reason":"Separate voluntary compliance code extraction pending","status":"not-extracted"},{"title":"EU AI Omnibus","jurisdiction":"European Union","url":"https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai","reason":"Reconcile 2026 amendments with individual AI Act clauses","status":"not-extracted"},{"title":"China AI-generated content labeling","jurisdiction":"China","url":"https://www.cac.gov.cn/","reason":"2025 labeling measure and technical standard pending","status":"not-extracted"},{"title":"India AI governance","jurisdiction":"India","url":"https://www.meity.gov.in/","reason":"Advisories, data-protection law and sectoral scope need review","status":"not-extracted"},{"title":"Saudi AI ethics","jurisdiction":"Saudi Arabia","url":"https://sdaia.gov.sa/","reason":"Official principles and sectoral scope pending","status":"not-extracted"},{"title":"Dubai AI ethics","jurisdiction":"UAE","url":"https://www.digitaldubai.ae/","reason":"Official guidance extraction pending","status":"not-extracted"},{"title":"African Union AI Strategy","jurisdiction":"African Union","url":"https://au.int/","reason":"Strategy recommendations, not binding universal rules","status":"not-extracted"},{"title":"US FDA AI device guidance","jurisdiction":"United States","url":"https://www.fda.gov/medical-devices/","reason":"Medical-device controls and draft/final distinction pending","status":"not-extracted"},{"title":"US EEOC AI employment guidance","jurisdiction":"United States","url":"https://www.eeoc.gov/","reason":"Employment-law controls pending","status":"not-extracted"},{"title":"Financial-sector AI controls","jurisdiction":"Multiple","url":"https://www.bis.org/","reason":"Sector-specific scope and regulator mapping pending","status":"not-extracted"},{"title":"NIST AI RMF Playbook","jurisdiction":"United States","url":"https://airc.nist.gov/airmf-resources/playbook/","reason":"Tactical action extraction pending","status":"not-extracted"},{"title":"NIST GenAI complete profile","jurisdiction":"United States","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf","reason":"Complete action-by-action atomic extraction pending","status":"not-extracted"},{"title":"Original RDL 91-source manifest","jurisdiction":"Original app","url":"https://rdl-policy-playground.bsharve.chatgpt.site/","reason":"Owner source export not received; migration incomplete","status":"not-extracted"}],"liveUpdatedAt":null,"liveDiscovery":{"findings":[{"id":"finding-09c6c213bf7d4a66fdd5911929a14cf457ac5234e3899bf59dd1c5c4754428b8","kind":"rule-candidate","status":"pending","body":{"title":"Record unresolvable evaluation failures","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(3), final submission-content paragraph, failure-recording limb; PDF page 31 (printed page 27)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"record","object":"unresolvable PCCP performance-evaluation failures","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. The protocol should affirm failures will be recorded when a specific modification's performance evaluation has an unresolvable failure, such as unmet pre-defined criteria.","timing":"When an unresolvable evaluation failure occurs","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. If root-cause analysis shows the failure is unrelated to specific PCCP aspects, it is not considered unresolvable and testing may be repeated.","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=31","ruleId":"AIR-9D8B4C021B","intent":"record unresolvable pccp performance evaluation failures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-365c5ecdad2a8a76cff6c2f6f08a987049e7bb9c16f088fbe98cbd6ef0b5fb15","kind":"rule-candidate","status":"pending","body":{"title":"Specify expected device-update frequency","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VI.B, update-frequency sentence; PDF page 25 (printed page 21)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"specify","object":"expected PCCP device-update frequency","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Describe the expected frequency of modifications, whether infrequent locked-model changes or continuous adaptation.","timing":"When describing planned modifications","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=25","ruleId":"AIR-D212B365EB","intent":"specify expected pccp device update frequency","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-3bc7ec1bf2e8c76f9e24556ece3344a48ca99cf7a10317f38e12dc1b5d40dbb6","kind":"rule-candidate","status":"pending","body":{"title":"Summarize previously implemented PCCP changes","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"V.F, paragraph beginning 'Over time'; PDF page 24 (printed page 20)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"summarize","object":"previously implemented authorized PCCP modifications","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. A later marketing submission is made for additional changes; include the modifications previously implemented consistently with the authorized PCCP so the current device is understandable.","timing":"In the later marketing submission","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=24","ruleId":"AIR-CA3B1AEBD0","intent":"summarize previously implemented authorized pccp modifications","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-3e7e657af0690d41ac1241619133be68a20c533357fe24003342d4d814223cfb","kind":"rule-candidate","status":"pending","body":{"title":"Submit the revised PCCP clean copy","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"V.F, paragraph beginning 'As described in Section V.C.'; PDF page 23 (printed page 19)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"submit","object":"a clean version-identified revised PCCP","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. The PCCP has been revised during FDA review; provide a clean final copy with title and current version number.","timing":"After review revisions and before PCCP authorization","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=23","ruleId":"AIR-32E06D4340","intent":"submit a clean version identified revised pccp","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-4ccce89890c88d39bf0eb24fe40140bbdea0eb5ae82091b824704b0730c1eedb","kind":"rule-candidate","status":"pending","body":{"title":"Define modification acceptance criteria","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(3), first paragraph; PDF page 31 (printed page 27)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"define","object":"AI acceptance criteria","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Predefine criteria for each planned device modification alongside appropriate metrics, study design and statistics. Same reusable intent as the existing acceptance-criteria rule; device/PCCP scope remains a distinct mapping.","timing":"Before evaluating planned modifications","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=31","ruleId":"AIR-07E86EC44F","intent":"define ai acceptance criteria","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-5710e7dfd93ecba84f8907d4349e8913b86b45056a11e2d59a287fb3d1680c78","kind":"rule-candidate","status":"pending","body":{"title":"Enumerate proposed device changes","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VI.B, opening paragraph; PDF page 25 (printed page 21)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"enumerate","object":"individual proposed PCCP device modifications","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. In the Description of Modifications, list each planned modification. Rationale, testing and implementation methods remain separate source actions.","timing":"When preparing the proposed PCCP","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=25","ruleId":"AIR-263476C75F","intent":"enumerate individual proposed pccp device modifications","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-65338599b0ac85b51dd21e5c43f58d9aa39c3ea120ce067273c63591be2917f8","kind":"rule-candidate","status":"pending","body":{"title":"Describe communications about device updates","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(4), 'What manufacturers should include in a submission', item 4; PDF page 33 (printed page 29)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"document","object":"PCCP device-update communications to users","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Describe how modifications will be communicated, including performance/input differences and addressed known issues; performance-change communications are consistent with the protocol's evaluation.","timing":"In the update procedures before rollout","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=33","ruleId":"AIR-22FFBCB55A","intent":"document pccp device update communications to users","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-6699a30d3f0258ac06aa50c2cf78d831d7dd176199b2b50cf92d7fdbdd952247","kind":"rule-candidate","status":"pending","body":{"title":"Describe test-data access restrictions","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(1), final clause of submission-content paragraph; PDF page 30 (printed page 26)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"document","object":"performance-test-data access restrictions","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Describe protocols preventing access during training, tuning and testing to the data reserved for performance testing; preserve the source's specified purpose and scope.","timing":"In the Modification Protocol","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=30","ruleId":"AIR-F69D7851A2","intent":"document performance test data access restrictions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-86ac83f3e8921a3b5205196762b9953229d1d0ccc79b09147f8e405b090983f0","kind":"rule-candidate","status":"pending","body":{"title":"Assess combined modification effects","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VIII, Impact Assessment item 5; PDF page 34 (printed page 30)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"assess","object":"cumulative impact of all PCCP modifications","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. The Impact Assessment describes the combined effects of implementing all planned modifications, separately from each modification's individual risks.","timing":"During the PCCP impact assessment","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=34","ruleId":"AIR-0A2F580F9A","intent":"assess cumulative impact of all pccp modifications","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-87907e8914af87adb80d90c1ed4dc779be776eb8edfac202097a2d446536ef2a","kind":"rule-candidate","status":"pending","body":{"title":"Withhold modifications that fail evaluation","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(3), final submission-content paragraph, non-implementation limb; PDF page 31 (printed page 27)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"withhold","object":"AI-device modifications with unresolvable evaluation failures","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. The protocol should affirm that the specific modification will not be implemented if its performance evaluation has an unresolvable failure. This is not a statement that all resolved or unrelated failures permanently prohibit updates.","timing":"Before implementation of a modification with unresolvable evaluation failure","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. A root-cause analysis showing failure unrelated to specific PCCP aspects permits repeat performance testing under the stated guidance.","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=31","ruleId":"AIR-B67DF35C10","intent":"withhold ai device modifications with unresolvable evaluation failures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-95cc50b36c1f1e9f84719dcb4c8c180454b6fad84c8db161698a02f22aebcb92","kind":"rule-candidate","status":"pending","body":{"title":"Describe local adaptation triggers","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VI.B, paragraph beginning 'The Description of Modifications should also clearly specify'; PDF page 25 (printed page 21)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"document","object":"local AI-device adaptation triggers","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. If the proposed PCCP includes local rather than uniform/global adaptations, describe factors or conditions warranting the local change.","timing":"In the proposed PCCP before local adaptations","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=25","ruleId":"AIR-5BEDB33F22","intent":"document local ai device adaptation triggers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-a88d487ed401b40d2a60b01dbd2cbed0575f361fd2a1a65e06779f32129a4984","kind":"rule-candidate","status":"pending","body":{"title":"Document train/tune/test separation","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(1), 'What manufacturers should include in a submission'; PDF page 30 (printed page 26)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"document","object":"training tuning and test-data separation strategies","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Describe sequestration during collection for the modification's training, tuning and test sets; this candidate is for documentation, not proof of implemented separation.","timing":"In the Modification Protocol before modification testing","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=30","ruleId":"AIR-111A3152CD","intent":"document training tuning and test data separation strategies","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-ce3e2c5f322ef4451839b6ff66a2a3644989e0cf03c789ef24059e15839bdb8e","kind":"rule-candidate","status":"pending","body":{"title":"Identify retraining triggers","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(2), submission-content paragraph continued onto printed p.27; PDF page 31 (printed page 27)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"identify","object":"AI-device retraining triggers","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Triggers may include volume of new data or observed drift; these are examples rather than universally required trigger values.","timing":"When defining retraining practices","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=31","ruleId":"AIR-FB999AE28F","intent":"identify ai device retraining triggers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-d1f271f786194a8fe561cabdd84e67382b1d73e24480a80a8bf78adc9755b67d","kind":"rule-candidate","status":"pending","body":{"title":"Trace modifications to protocol methods","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.C, opening paragraph; PDF page 33 (printed page 29)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"map","object":"PCCP modifications to supporting protocol methods","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Clearly identify which data-management, retraining, performance-evaluation and update-procedure methods apply to each described modification. A traceability table is an example, not the only permitted representation.","timing":"When assembling or revising a PCCP","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=33","ruleId":"AIR-7EA3DA63D9","intent":"map pccp modifications to supporting protocol methods","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"change-eu-ai-act-33400cad7f7b19a58e6d418f0d8539b8c1c41cbd9465061c5b36fd175a996e18","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-18T13:03:10.096Z","fingerprint":"33400cad7f7b19a58e6d418f0d8539b8c1c41cbd9465061c5b36fd175a996e18","previousFingerprint":"3dd0cecff16f621ca02e49038f6f44f1754414c8ae8ea2c3f3f91fafcbe456d4","bytes":1535221,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-18T13:03:10.096Z","reviewed_at":null},{"id":"change-eu-gdpr-4f25679303fc908879f9a3c6eb190add841227bdf553c7dc991f3103e595ee2d","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-18T13:03:10.096Z","fingerprint":"4f25679303fc908879f9a3c6eb190add841227bdf553c7dc991f3103e595ee2d","previousFingerprint":"32a0b17e91313c79b22d5c41eecb1d2220a48bc45af860134c46c0136af5a2fb","bytes":1071070,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-18T13:03:10.096Z","reviewed_at":null},{"id":"finding-13c7fbd1b72599bea21d3ad6540c5dcafd7c68762ef1022516440558dcf4b87c","kind":"rule-candidate","status":"pending","body":{"title":"Analyze AI logs for anomalous behavior","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 12.2","actor":"System Operators","modality":"should","action":"analyze","object":"AI system logs","condition":"Within the voluntary Code's AI-system scope. Use logs to check continued desired output and detect anomalies, breaches or unexpected behavior, including drift or poisoning.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"Over time during operation","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-12-monitor-your-systems-behaviour","ruleId":"AIR-E79CF56C27","intent":"analyze ai system logs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-14df702d3e9d2bcd82976f0a783fbe5a520d05fd6deea215c5cee6ca47782492","kind":"rule-candidate","status":"pending","body":{"title":"Assess poorly documented or unsecured AI components","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 7.2.1 — assessment limb","actor":"Developers and System Operators","modality":"must","action":"assess","object":"third-party AI supply-chain risks","condition":"Within the voluntary Code's AI-system scope. The clause 7.2 situation applies: a model or component used or adapted is not well documented or secured. Mitigating controls are a separate companion action.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"When choosing or adapting those components","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty. Shares the existing supply-chain risk-assessment intent; the poorly-documented/unsecured-component trigger, actors and force remain a distinct variant.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-7-secure-your-supply-chain","ruleId":"AIR-3A61647692","intent":"assess third party ai supply chain risks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-2079b6ff138eeb152a3d51e3bcaec46ade4705324e0392b9d60bba8e6e1f5dcd","kind":"rule-candidate","status":"pending","body":{"title":"Define deployment acceptance criteria","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"5.1.2 — acceptance-criteria limb","actor":"Organizations developing or deploying AI systems","modality":"should","action":"define","object":"AI acceptance criteria","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Reflect intended use, deployment context and risks identified under Essential Practice 3. Test methods, communicating criteria and conducting tests are separate actions.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"Before deployment","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-07E86EC44F","intent":"define ai acceptance criteria","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-209e03aba5f12531b29845ede7b959b05c9b4dc5a6e484e5a63db9c4d0b3c7eb","kind":"rule-candidate","status":"pending","body":{"title":"Monitor internal states when useful for security","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 12.3","actor":"System Operators and Developers","modality":"should","action":"monitor","object":"AI internal states","condition":"Within the voluntary Code's AI-system scope. Do so where it could improve handling of security threats or enable future security analytics; not an unconditional demand for all internal states.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"During operation where the security-benefit condition applies","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-12-monitor-your-systems-behaviour","ruleId":"AIR-0B81A2B5B4","intent":"monitor ai internal states","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-20df3e2b9d565a19bb13012628d180ef352c614b9f90e6e0946af10cf46aa48e","kind":"rule-candidate","status":"pending","body":{"title":"Share justification for risky component choices","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 7.2.2","actor":"System Operators","modality":"must","action":"share","object":"component risk-acceptance documentation with End-users","condition":"Within the voluntary Code's AI-system scope. The clause 7.2 choice has been made; share the documentation accessibly. This does not itself authorize the component choice.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"When using or adapting those components","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-7-secure-your-supply-chain","ruleId":"AIR-2AEA7C34AC","intent":"share component risk acceptance documentation with end users","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-22f9046eba62e7c0a861a8cfacb276c252965c88de8c190bfb48a4ed1bd51a86","kind":"rule-candidate","status":"pending","body":{"title":"Document each AI system's use context","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"2.1.4","actor":"Organizations developing or deploying AI systems","modality":"should","action":"document","object":"intended AI use contexts","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. For each AI system, scope documentation includes intended uses, foreseeable misuse, capabilities, limitations and expected context.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"For each AI system","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-F61F6AC2CB","intent":"document intended ai use contexts","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-49d53ffb158fe19c9e2bb47350b3f58319f5c87ce39191e7b6585b98cfad764f","kind":"rule-candidate","status":"pending","body":{"title":"Triage high-risk AI systems","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"3.2.1","actor":"Organizations developing or deploying AI systems","modality":"should","action":"establish","object":"AI system risk triage","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Determine which systems may present enhanced or unacceptable risks using the organization's context and risk tolerance.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"During AI system risk assessment","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-C2B1B0D97A","intent":"establish ai system risk triage","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-52b71fea73580a43cb5383458e0679e9bfe66a610af3217f2ef37cff06e1e34e","kind":"rule-candidate","status":"pending","body":{"title":"Record public training data provenance","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 8.2","actor":"Developers","modality":"must","action":"document","object":"public training data provenance","condition":"Within the voluntary Code's AI-system scope. Training data comes from publicly available sources; documentation covers acquisition method, origin and use in the model.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"When publicly sourced training data is used","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-8-document-your-data-models-and-prompts","ruleId":"AIR-2B88FB47B2","intent":"document public training data provenance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-693d7fa9626a40c6af18969d510255d48b283c1dd6c229a8884f03f405bf2a2a","kind":"rule-candidate","status":"pending","body":{"title":"Assess AI supply-chain risk","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"3.1.2 — assessment limb","actor":"Organizations developing or deploying AI systems","modality":"should","action":"assess","object":"third-party AI supply-chain risks","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Risk processes cover other developers and deployers; both providers and consumers consider open-source model, system and component risks.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"Across AI supply-chain risk management","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-3A61647692","intent":"assess third party ai supply chain risks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-7da53506c96698c0b198732950e17422c3040f415517eaa26da59d22f5d782f8","kind":"rule-candidate","status":"pending","body":{"title":"Evaluate outputs for reverse-engineering exposure","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 9.4","actor":"Developers","modality":"should","action":"evaluate","object":"outputs for non-public model or training-data disclosure","condition":"Within the voluntary Code's AI-system scope. Assess whether outputs let System Operators or End-users reverse engineer non-public model aspects or training data.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"During output security evaluation","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-9-conduct-appropriate-testing-and-evaluation","ruleId":"AIR-84C8BD3E44","intent":"evaluate outputs for non public model or training data disclosure","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-7e6142af874768d30aa5d2f8edde0624228e626e368e400e320d11712f93c568","kind":"rule-candidate","status":"pending","body":{"title":"Record organizational AI risk tolerance","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"3.1.1 — risk-tolerance limb","actor":"Organizations developing or deploying AI systems","modality":"should","action":"document","object":"AI risk tolerance","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Define organizational acceptable/unacceptable risk criteria with likelihood and significance of harms, aligned to AI policy and objectives.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"When establishing and revising AI risk management","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-9EE4AB873B","intent":"document ai risk tolerance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-8a6e8e02d73762e294cb72f68ab4b4067d07f78f199f7861196ba8942758fc99","kind":"rule-candidate","status":"pending","body":{"title":"Plan mitigations when patching is unavailable","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 11.1.1","actor":"Developers","modality":"must","action":"maintain","object":"AI security contingency mechanisms","condition":"Within the voluntary Code's AI-system scope. Mitigate security risks, particularly when updates cannot be provided; mechanisms and contingency plans should cover this case.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"During maintenance, particularly where updates cannot be provided","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-11-maintain-regular-security-updates-patches-and-mitigations","ruleId":"AIR-7D7800B6DD","intent":"maintain ai security contingency mechanisms","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-90f547c0991e25c594bc26b8912747a74a3c1370b18adff48292e78f1aa0954b","kind":"rule-candidate","status":"pending","body":{"title":"Retest major AI updates","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 11.2","actor":"Developers","modality":"should","action":"security-test","object":"major AI system updates","condition":"Within the voluntary Code's AI-system scope. Treat a major update as a newly developed model version and undertake a fresh security testing/evaluation process.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"For major AI system updates","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-11-maintain-regular-security-updates-patches-and-mitigations","ruleId":"AIR-4616E50FCE","intent":"security test major ai system updates","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-bfb59a1748e25a9075180f5c6defb5027c7213ded1de2191d6d4623a69fa8070","kind":"rule-candidate","status":"pending","body":{"title":"Provide available AI security updates","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 11.1 — Developer patch limb","actor":"Developers","modality":"must","action":"provide","object":"AI security updates and patches","condition":"Within the voluntary Code's AI-system scope. Updates and patches can be provided. Notification to System Operators and delivery by System Operators remain separate source actions.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. The source expressly qualifies provision with 'where possible'; do not erase that limitation.","timing":"During secure maintenance, where possible","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-11-maintain-regular-security-updates-patches-and-mitigations","ruleId":"AIR-3480DB4BB0","intent":"provide ai security updates and patches","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-ce66a59ee02ca65590afe62b8a46c724460c7e25c7caae5c10c0dab6bf905343","kind":"rule-candidate","status":"pending","body":{"title":"Document AI training needs","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"1.3.1 — training-needs documentation limb","actor":"Organizations developing or deploying AI systems","modality":"should","action":"document","object":"organizational AI training needs","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Assess broad AI understanding and accountability culture; delivering training and checking skills are separate actions.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"As AI development and deployment evolves","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-940E938C1F","intent":"document organizational ai training needs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-e59b0a77d894ac1f1f876a49c35436053d1d337d79ceba7e20fd5e595ce2c75d","kind":"rule-candidate","status":"pending","body":{"title":"Document AI data usage rights","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"5.4.2 — data-usage-rights bullet","actor":"Organizations developing or deploying AI systems","modality":"should","action":"document","object":"AI data usage rights","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. For each use case, include intellectual property/copyright, Indigenous Data Sovereignty, privacy, confidentiality and contractual rights.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"For each AI use case","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-DD6C2FB7A7","intent":"document ai data usage rights","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-e5ddfeb448373433476dd867a5fc7519c95148994ff7521b623a1a3edace1c1f","kind":"rule-candidate","status":"pending","body":{"title":"Monitor sensitive-data leakage from AI","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"5.4.2 — leakage-monitoring bullet","actor":"Organizations developing or deploying AI systems","modality":"should","action":"monitor","object":"personal and sensitive information leakage from AI models and systems","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Monitor for leakage of personal and sensitive information; detection and incident handling need appropriate mechanisms and authority.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"During model and system use","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-5FC6C99AD4","intent":"monitor personal and sensitive information leakage from ai models and systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-ec3de3163d9f647b4e2753671d527e83855a169693482a946192f13fb53b373a","kind":"rule-candidate","status":"pending","body":{"title":"Delete applicable assets when decommissioning","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 13.2 — deletion limb","actor":"Developers or System Operators deciding to decommission a model or system","modality":"must","action":"delete","object":"decommissioned AI data and configuration","condition":"Within the voluntary Code's AI-system scope. Decommissioning is decided; securely delete applicable data and configuration details with Data Custodian involvement.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. Only applicable data and configuration are covered; this is not a blanket authorization to delete unrelated records.","timing":"On model or system decommissioning","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-13-ensure-proper-data-and-model-disposal","ruleId":"AIR-2B0E2D9575","intent":"delete decommissioned ai data and configuration","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-fcfa79b40f36f7174e894eb1ee55ad9af228c5ac8a32caca51cedfd66ad73a0b","kind":"rule-candidate","status":"pending","body":{"title":"Evaluate outputs for unintended system influence","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 9.4.1","actor":"Developers","modality":"should","action":"evaluate","object":"outputs for unintended system influence","condition":"Within the voluntary Code's AI-system scope. Assess whether model outputs give System Operators or End-users unintended influence over the system.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"During output security evaluation","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-9-conduct-appropriate-testing-and-evaluation","ruleId":"AIR-E39D075503","intent":"evaluate outputs for unintended system influence","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-ff40fabdc11ce238d4582eb151d3d133df08d45b929a5b649198bbf502455222","kind":"rule-candidate","status":"pending","body":{"title":"Mitigate attacks through externally offered AI APIs","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 6.2","actor":"Developers offering an AI API to external customers or collaborators","modality":"must","action":"apply","object":"AI API attack mitigations","condition":"Within the voluntary Code's AI-system scope. An API is offered externally; controls address attacks through that API. Rate limits are an example, not a universally mandated control.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"When offering the external API","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-6-secure-your-infrastructure","ruleId":"AIR-5A9E810E50","intent":"apply ai api attack mitigations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"change-eu-ai-act-3dd0cecff16f621ca02e49038f6f44f1754414c8ae8ea2c3f3f91fafcbe456d4","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-17T13:00:32.672Z","fingerprint":"3dd0cecff16f621ca02e49038f6f44f1754414c8ae8ea2c3f3f91fafcbe456d4","previousFingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","bytes":1535183,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-17T13:00:32.672Z","reviewed_at":null},{"id":"change-eu-gdpr-32a0b17e91313c79b22d5c41eecb1d2220a48bc45af860134c46c0136af5a2fb","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-17T13:00:32.672Z","fingerprint":"32a0b17e91313c79b22d5c41eecb1d2220a48bc45af860134c46c0136af5a2fb","previousFingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","bytes":1071030,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-17T13:00:32.672Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-db41f2bc66f43a9dd344d6b68fcb32480d564066b8518f8565af7a28220fb398","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-17T13:00:32.672Z","fingerprint":"db41f2bc66f43a9dd344d6b68fcb32480d564066b8518f8565af7a28220fb398","previousFingerprint":"a52faac3cc4647c69c3dbf34092a05b07955111a8190153c82789f5c677e1efa","bytes":706968,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-17T13:00:32.672Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-ce44a7cc4771a4d57db5c0b4d3f602fb42c1f51a2eb3af066b01e0b9467c852e","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-17T13:00:27.359Z","fingerprint":"ce44a7cc4771a4d57db5c0b4d3f602fb42c1f51a2eb3af066b01e0b9467c852e","previousFingerprint":"67dbd2fc3af682ed557176113d621ce2ed770c11ed69ec3f8412de6ab94860e2","bytes":235216,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-17T13:00:27.359Z","reviewed_at":null},{"id":"finding-009c977ad2f8be2f84f2ff72bc526800e74109d919f6a0209e11a54fdac50b84","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred. Article 9 permits requested supply without explicit labels only after agreement-based clarification of labeling obligations and use responsibilities and at least six months of relevant logs; it does not waive Article 5 metadata duties.","condition":"Network information service providers conducting labeling activities within Article 2; services fall within Deep Synthesis Provisions Article 17(1). Add a prominent cue at an appropriate image location.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Label generated images conspicuously","control":"Article 4(3)","actor":"Covered generation/synthesis service providers","action":"label","object":"generated images","ruleId":"AIR-EDEC4DCB77","intent":"label generated images","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-04c4307c79ba50ec7bd97abfdc4aa66aff141aa85fd92f139d3b1ff4a9ef3c0e","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred. Article 9 permits requested supply without explicit labels only after agreement-based clarification of labeling obligations and use responsibilities and at least six months of relevant logs; it does not waive Article 5 metadata duties.","condition":"Network information service providers conducting labeling activities within Article 2; services fall within Deep Synthesis Provisions Article 17(1). Place text/symbol cues at suitable text positions or prominent cues in the interface or around the text.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Label generated text visibly","control":"Article 4(1)","actor":"Covered generation/synthesis service providers","action":"label","object":"generated text visibly","ruleId":"AIR-23EE43CF93","intent":"label generated text visibly","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-05241de6ca242fd9f8c606c9a2f451d88209e390ca5cec87d5287406f4eda5d7","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; user service agreements must specify the labeling methods, styles and related specifications.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Describe labeling in user agreements","control":"Article 8 first limb","actor":"Covered service providers","action":"describe","object":"generated-content labeling methods and styles in user agreements","ruleId":"AIR-6D3C8487ED","intent":"describe generated content labeling methods and styles in user agreements","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-17a3bf1a8236a122c2b198b02161ed3b889c4084f0aa231eaf8cfd4dfa87bfd9","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred. Article 9 permits requested supply without explicit labels only after agreement-based clarification of labeling obligations and use responsibilities and at least six months of relevant logs; it does not waive Article 5 metadata duties.","condition":"Network information service providers conducting labeling activities within Article 2; services fall within Deep Synthesis Provisions Article 17(1). Prominent cues are required in the starting frame and around playback; intermediate/end cues are optional.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Label generated video at required locations","control":"Article 4(4)","actor":"Covered generation/synthesis service providers","action":"label","object":"generated video","ruleId":"AIR-2A37BD45F4","intent":"label generated video","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-3d15ef331a6b57a435235351556d6ea2b20fcd787c59970fe629fd0488f10599","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; app provider offers AI generation/synthesis services; during listing or launch review.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Verify app labeling materials","control":"Article 7 sentence 2","actor":"Internet application distribution platforms","action":"verify","object":"app generated-content labeling materials","ruleId":"AIR-DA28C8B948","intent":"verify app generated content labeling materials","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-414dd46daa7b507e72e8377382050c9b39a9f6ecd0b4e36f0af445c6f0a90a21","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved 12 August 2025; History says not revised to date; official page checked 16 October 2026","authority":"Organization-specific MSU institutional guidance; not a general statutory duty","jurisdiction":"Michigan State University, Michigan, US","url":"https://ai.msu.edu/guidelines","modality":"must not","exception":"Apply only within MSU's institutional scope; no automatic adoption into other organizations.","timing":"While the approved guidelines apply; approved 12 August 2025","evidenceSummary":"Official MSU page, History and exact subsection checked 16 October 2026. Today's byte-change signal does not establish a substantive revision.","title":"Do not use detector output as sole decision basis","control":"Permissible Uses / Teaching and Learning / detection-tools paragraph","actor":"MSU instructors using generative AI detection tools","action":"rely","object":"detector output","condition":"An instructor chooses a generative AI detector; its output is only a potential indicator of misuse. The prohibited reliance is using detector output as the sole basis for academic or grading decisions; this does not prohibit considering it as one potential indicator.","ruleId":"AIR-1A04293BCD","intent":"rely detector output","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-46590490c44f39d59c1bf6b008ced466a346280603cbfde7b8181fb17271b325","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; file metadata explicitly identifies generated/synthetic content. Add a prominent adjacent notice that the content is generated/synthetic.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Identify metadata-confirmed generated content","control":"Article 6(1), second limb","actor":"Network information content dissemination service providers","action":"label","object":"metadata-confirmed generated content","ruleId":"AIR-9E039F1858","intent":"label metadata confirmed generated content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-46593e5c95df0c4965d70c2d75c74ab6580926cb48624be11aaa618237221aaf","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; one of Article 6(1)-(3) applies. Include generation attributes, dissemination-platform name or code, and content identifier.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Add dissemination provenance metadata","control":"Article 6 final paragraph","actor":"Network information content dissemination service providers","action":"add","object":"dissemination provenance metadata","ruleId":"AIR-3FF151277F","intent":"add dissemination provenance metadata","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-513eb3973637d08950f6809fe882c2702eb6fd1dc74e06b0ca923709c0141f8d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; publishing generated/synthetic content through dissemination services; use the provider's labeling functions.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Label generated content when publishing","control":"Article 10 paragraph 1, labeling limb","actor":"Users of network information content dissemination services","action":"label","object":"AI content","ruleId":"AIR-66E5FC0789","intent":"label ai content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-6da124847cdefa6ba7f3146402e4bfc5568a224b5e584cf8f65af221ce305a40","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; no implicit label is verified but the user declares generated/synthetic content. Add a prominent adjacent possible-generation notice.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Identify user-declared possible generated content","control":"Article 6(2)","actor":"Network information content dissemination service providers","action":"label","object":"user-declared possibly generated content","ruleId":"AIR-2A5EA1B6EE","intent":"label user declared possibly generated content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-78f4d8f16bfce462072aff539ba689b7da1bef47f48861d3c58f9b0a7803095f","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; neither metadata verification nor user declaration identifies generation, but explicit marks or other generation traces are detected. Add a prominent adjacent suspicion notice.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Identify suspected generated content","control":"Article 6(3)","actor":"Network information content dissemination service providers","action":"label","object":"suspected generated content","ruleId":"AIR-2BA8F53223","intent":"label suspected generated content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-a446d757e292fe8fba359309141d8ed6248e66640de5ecb7527ada6651a11c43","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; reviewing app listing or launch. Require app providers to state whether their app offers AI generation/synthesis services.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Request AI-service disclosure during app review","control":"Article 7 sentence 1","actor":"Internet application distribution platforms","action":"request","object":"AI generation service disclosure from app providers","ruleId":"AIR-D10223F924","intent":"request ai generation service disclosure from app providers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-a69a5db12dc405f6c47fcac33777f6d2ae6b9e4cc291d9e7bd2038e33d0dcfe6","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved 12 August 2025; History says not revised to date; official page checked 16 October 2026","authority":"Organization-specific MSU institutional guidance; not a general statutory duty","jurisdiction":"Michigan State University, Michigan, US","url":"https://ai.msu.edu/guidelines","modality":"must","exception":"Apply only within MSU's institutional scope; no automatic adoption into other organizations.","timing":"Before access, license procurement or sign-up","evidenceSummary":"Official MSU page, History and exact subsection checked 16 October 2026. Today's byte-change signal does not establish a substantive revision.","title":"Consult IT before registering AI tools with MSU credentials","control":"Procuring or Registering for Available Generative AI Tools / second paragraph","actor":"MSU individuals and units using MSU credentials","action":"consult","object":"IT Services","condition":"Intending to use MSU credentials to access, license or sign up for a generative AI-enabled product or service; includes free and open-source tools.","ruleId":"AIR-242001C9D0","intent":"consult it services","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-c763851c853da877ec79a436534e430b02471cb34665f1e05da311a920d1db0b","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; under Deep Synthesis Provisions Article 16. File metadata must identify generated/synthetic attributes, provider name or code, and content identifier.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Mark generated content through file metadata","control":"Article 5 paragraph 1","actor":"Covered service providers","action":"mark","object":"generated content in machine-readable form","ruleId":"AIR-5C96C1D94B","intent":"mark generated content in machine readable form","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-d616efe2294bca885821737bb8753ae3abfd33fc3687f3eb0650179016712b38","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred. Article 9 permits requested supply without explicit labels only after agreement-based clarification of labeling obligations and use responsibilities and at least six months of relevant logs; it does not waive Article 5 metadata duties.","condition":"Network information service providers conducting labeling activities within Article 2; services fall within Deep Synthesis Provisions Article 17(1). Use speech/rhythm cues at suitable audio positions or a prominent interface cue.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Label generated audio visibly or audibly","control":"Article 4(2)","actor":"Covered generation/synthesis service providers","action":"label","object":"generated audio","ruleId":"AIR-517579FC73","intent":"label generated audio","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-eebccfebe03ae567afaa1d6fd3b5995d8edd96a44c19a4cb3ea603113e6033a3","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025; retain relevant logs for at least six months","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; a user requests content without explicit labels and the provider supplies it after clarifying the user's labeling obligations and usage responsibilities through the user agreement.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Retain logs for content without explicit labels","control":"Article 9","actor":"Covered service providers","action":"retain","object":"recipient information and related unlabeled-content logs","ruleId":"AIR-78F3C16946","intent":"retain recipient information and related unlabeled content logs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-ef2b7db9ee53d4022eafdcfc58b38052c8329bfdd568ec5f0da6b2e5ad4f67d5","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; disseminating content; inspect file metadata for implicit labeling.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Check file metadata for implicit labels","control":"Article 6(1), first limb","actor":"Network information content dissemination service providers","action":"verify","object":"implicit labels in content file metadata","ruleId":"AIR-D875748735","intent":"verify implicit labels in content file metadata","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-f821c1692bea60f81be8cf9b4ec3dc7ab9d4ede90761724921e9bbc7e8e03194","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred. Article 9 permits requested supply without explicit labels only after agreement-based clarification of labeling obligations and use responsibilities and at least six months of relevant logs; it does not waive Article 5 metadata duties.","condition":"Network information service providers conducting labeling activities within Article 2; download, copy or export functions are provided. Files must contain compliant explicit labels.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Preserve explicit labels in exported files","control":"Article 4 final paragraph","actor":"Covered generation/synthesis service providers","action":"preserve","object":"explicit labels in downloaded copied or exported generated files","ruleId":"AIR-D0197E474F","intent":"preserve explicit labels in downloaded copied or exported generated files","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-a52faac3cc4647c69c3dbf34092a05b07955111a8190153c82789f5c677e1efa","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-16T13:07:03.884Z","fingerprint":"a52faac3cc4647c69c3dbf34092a05b07955111a8190153c82789f5c677e1efa","previousFingerprint":"a846fd3339fc751dfed295eaaa686ae188114b9b6504cac6cd03ffe131c339c6","bytes":706968,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-16T13:07:03.884Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-67dbd2fc3af682ed557176113d621ce2ed770c11ed69ec3f8412de6ab94860e2","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-16T13:07:00.291Z","fingerprint":"67dbd2fc3af682ed557176113d621ce2ed770c11ed69ec3f8412de6ab94860e2","previousFingerprint":"67293a0fe467a4278e31b98b0fac930419cc9fcfd1f5415d9b1661e88fb0cc75","bytes":235216,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-16T13:07:00.291Z","reviewed_at":null},{"id":"finding-06cddb029f18475f193edc616d373b81c3d49f890e148e11c63900f21fa6683a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Collect content-authenticity feedback from users","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"collect","object":"feedback from affected stakeholders","control":"MS-2.7-003 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Survey GAI users about satisfaction and perceived content authenticity; examine provenance concerns and understanding of content labels","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During user-feedback and security/resilience assessment","evidenceSummary":"User surveys collect satisfaction and authenticity perceptions and help identify provenance literacy concerns.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-E7F9A07274","intent":"collect feedback from affected stakeholders","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-07948c887997db39ad12b9fb6c940689510a727899d83b3a6d3f50247a44a175","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Review guardrails in novel operating circumstances","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"review","object":"GAI safety and security guardrails in novel operating circumstances","control":"MS-2.5-006 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Also revisit the rationale underlying the original safe-deployment assessment","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"Regularly, especially in novel circumstances","evidenceSummary":"Regular review includes guardrails and the reasons deployment was originally judged safe.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-21A69129AF","intent":"review gai safety and security guardrails in novel operating circumstances","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-08e35c00358754a28f2f19a52a051e17e64c22291a568158f36b01e6c500ce28","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Assess incident-driven adaptation speed","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"assess","object":"speed of GAI adaptation after security incidents and feedback","control":"MS-2.7-006 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Based on security-incident lessons and feedback","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"Following security incidents or feedback","evidenceSummary":"Assess how quickly the system adapts and improves after relevant security evidence.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-11CDA6B848","intent":"assess speed of gai adaptation after security incidents and feedback","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-110bd4a348545cfa65023dcbdff1035b12d9f53955676b99ff71018bcb0150e5","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Re-evaluate fine-tuned safety above risk tolerance","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"re evaluate","object":"fine tuned model safety when negative risk exceeds tolerance","control":"MS-2.6-003 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. When negative risk exceeds the organisation's risk tolerance","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"On exceeding organisational risk tolerance","evidenceSummary":"Reassess the safety features of a fine-tuned model when its negative risk exceeds the organisation's tolerance.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-C37BCC7CB3","intent":"re evaluate fine tuned model safety when negative risk exceeds tolerance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-31db51fd03e114a48b423acd6058e2b50e822b8541ced6be43f62f27197fc29c","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Define security-effectiveness metrics","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"define","object":"metrics of GAI security measure effectiveness","control":"MS-2.7-004 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Examples include provenance verification and unauthorised access or extraction attempts","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"When designing security measurement","evidenceSummary":"Identify measures that reflect how effectively security controls operate.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-31E0F1A846","intent":"define metrics of gai security measure effectiveness","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-32a2e557ca350d843a111a5e14ea20be66cc8d0904327282f8066c542e7112ec","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify generated-output validity and safety","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"verify","object":"outputs","control":"MS-2.6-004 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Review GAI outputs for validity and safety, including generated code and downstream decision risks","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During output review","evidenceSummary":"Review outputs for validity and safety and assess generated-code risks to downstream decisions. This mapping preserves NIST's voluntary force.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-7899BD6734","intent":"verify outputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-50e0390892b22be4aed943bd863cba161905096fec7c0106bdde3fa2722149e3","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify handling of misuse-enabling queries","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"verify","object":"handling of queries that enable malicious or illegal GAI use","control":"MS-2.6-006 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Examples include manipulation, extortion, impersonation, cyber-attacks and weapons-related misuse; this is defensive assurance","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During misuse-risk assessment and testing","evidenceSummary":"Check that the system handles queries that may facilitate inappropriate, malicious or illegal usage.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-1AAD1432EB","intent":"verify handling of queries that enable malicious or illegal gai use","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-5e14c5ffffbd310cd6a8c1138c669f7b3a4beb77c8358b4d0052795422b3a2fd","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Assess harmful-content exposure impacts on AI workers","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"assess","object":"health and wellbeing impacts of harmful content exposure on AI actors","control":"MS-2.6-001 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Value-chain or other AI actors exposed to sexually explicit, offensive or violent information in training or maintenance","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During GAI training and maintenance risk assessment","evidenceSummary":"Assess adverse impacts on people exposed to harmful material as part of GAI work.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-2F2F1B55B0","intent":"assess health and wellbeing impacts of harmful content exposure on ai actors","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-6221064e97819dcb57502c40a80c2b777a7c2712610c59536f07c9a559529e66","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Benchmark content-provenance security and resilience","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"benchmark","object":"GAI content provenance security and resilience","control":"MS-2.7-002 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Against industry standards, best practices and state-of-the-art provenance methods","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During security and resilience evaluation","evidenceSummary":"Compare provenance-related security and resilience with relevant industry baselines.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-D7FE687D05","intent":"benchmark gai content provenance security and resilience","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-79427325c4b51b3386cbec4eaa892ddd0973cbba6134270a7fdd572e5b2fe5c2","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify continuing security-control effectiveness","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"verify","object":"continuing effectiveness and integrity of GAI security measures","control":"MS-2.7-009 · PDF page 38","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Assess whether security measures remain effective and uncompromised","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"Regularly","evidenceSummary":"Check continuing effectiveness and absence of compromise rather than relying solely on an initial assessment.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=38","ruleId":"AIR-7D1FAC43F3","intent":"verify continuing effectiveness and integrity of gai security measures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-7be858bf38a0cd2716ee7f4a1dccd4d00484a4d0171a0762765198c855e414fc","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Document human-domain-knowledge contributions","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"document","object":"human domain knowledge used to improve GAI performance","control":"MS-2.5-002 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Includes knowledge contributed through RLHF, fine-tuning, RAG, moderation and business rules","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"When documenting GAI performance improvements","evidenceSummary":"Record the extent of human domain knowledge used in improving system performance.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-BE0700F5CB","intent":"document human domain knowledge used to improve gai performance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-840eb4d6006799c36f3e4d22879ca85f3074e2642cee3338a808d31106daeb0a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify fine-tuning preserves safety controls","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"verify","object":"fine tuning preservation of safety and security controls","control":"MS-2.7-008 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. When a GAI model is fine-tuned","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During fine-tuning assurance","evidenceSummary":"Verify that fine-tuning has not compromised safety or security controls.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-2B9003A861","intent":"verify fine tuning preservation of safety and security controls","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-88f3af26511a49e7d6905728e6cc1b2f0cb42abc36e78e8b60b555e2745dae45","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Measure implementation of security recommendations","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"measure","object":"implementation rate of recommendations from security checks and incidents","control":"MS-2.7-006 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Recommendations generated by security checks or incidents","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During security improvement assessment","evidenceSummary":"Measure the rate at which security recommendations are implemented; do not substitute an assertion that lessons were learned.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-CC045735D8","intent":"measure implementation rate of recommendations from security checks and incidents","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-8d0dd08ba1f8e52ec89aa5d2b013e80e494f142dcbbbfee72b549196c1a3780a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Measure content-authentication error rates","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"measure","object":"content authentication false positive and false negative rates","control":"MS-2.7-005 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. For methods such as watermarks, signatures and fingerprints; evaluate true results as well","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During content-provenance reliability assessment","evidenceSummary":"Assess reliability using false-positive and false-negative rates alongside true positives and negatives.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-F2E27A486E","intent":"measure content authentication false positive and false negative rates","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-8fe4aed1bdf86542137c9e008e11128fa698a0d39b424fe6e2d49ed4dbdd4d4f","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Include independent AI evaluators","actor":"AI actors performing AI Design tasks","action":"involve","object":"independent assessors in AI evaluation","control":"GV-3.2-001 · PDF page 22","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Policies should support independent evaluations or assessments with type and robustness proportionate to identified risk","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"When establishing oversight and evaluation policy","evidenceSummary":"Independent evaluations bolster oversight; the evaluation design should match the risk.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=22","ruleId":"AIR-DFA60F69C7","intent":"involve independent assessors in ai evaluation","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-c0ab778586de7738a1bd348f024341ac5137e7adc8cf9ef6abdefee2af45e4a5","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Document interface anthropomorphization","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"document","object":"instances of anthropomorphization in GAI interfaces","control":"MS-2.5-004 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Examples include human imagery and mentions of human feelings; this is documentation, not a blanket ban","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During interface assessment","evidenceSummary":"Track and document humanlike features in GAI interfaces.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-1CA9890252","intent":"document instances of anthropomorphization in gai interfaces","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-c41cc914d628e54a8e15aa856e58e4d3398c827c660d3076968cc823417c3fcd","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Avoid anecdotal capability extrapolation","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"avoid","object":"extrapolating GAI performance from narrow anecdotal assessments","control":"MS-2.5-001 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. When assessing GAI performance or capabilities","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During capability and performance assessment","evidenceSummary":"NIST advises against extending narrow, non-systematic or anecdotal results into broader performance claims.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-4F4595BF99","intent":"avoid extrapolating gai performance from narrow anecdotal assessments","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-dfe573c1f133fffdeb5d5c40971477b9b39b929e82198ff638759c4882a1054c","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify grounding of fine-tuning and RAG data","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"verify","object":"grounding of fine tuning and retrieval augmented generation data","control":"MS-2.5-005 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. When those data are used by the GAI system","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During verification of fine-tuning or RAG datasets","evidenceSummary":"The action separately calls for checking that fine-tuning or retrieval-augmentation data are grounded.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-051CDCD71D","intent":"verify grounding of fine tuning and retrieval augmented generation data","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-eaadee02fdb7b9cd654aface06199398ecf52df674521ac1af53e01b11e8cd50","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify architectural error-recovery capability","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"verify","object":"GAI architecture capability to recover from detected security errors","control":"MS-2.6-005 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. When security anomalies, threats or impacts are detected; related monitoring and repair capabilities remain part of the source context","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During architecture assurance and relevant incident testing","evidenceSummary":"Verify that the system architecture supports handling and recovering from errors under detected security problems.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-F9A744D2EF","intent":"verify gai architecture capability to recover from detected security errors","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-f6fcadd687afc7aa544ac14ffa67ecb0d9bc1fd8892e40ad9894ea82a5f87cc5","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify sources and citations in GAI outputs","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"verify","object":"sources and citations in GAI outputs","control":"MS-2.5-003 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Within pre-deployment risk measurement and ongoing monitoring","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"Before deployment and during ongoing monitoring","evidenceSummary":"Check the sources and citations supplied in generated outputs rather than treating them as reliable by default.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-7C84EFA973","intent":"verify sources and citations in gai outputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-f97632481694d3e8ae8721c0f34688429dad51e4556b380e63ec93711f1ca5ab","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Evaluate safety-measure circumvention vulnerabilities","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"evaluate","object":"GAI vulnerabilities to safety measure circumvention","control":"MS-2.6-007 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Within authorised defensive evaluation","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"Regularly","evidenceSummary":"Assess susceptibility to circumvention of safety measures.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-FD39ED404D","intent":"evaluate gai vulnerabilities to safety measure circumvention","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-ff0379325bf586b22b4f04020cd8d8d3ef45466d8e11ad44ed3c236b7da68666","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify training and evaluation data provenance","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"verify","object":"provenance of GAI training and evaluation data","control":"MS-2.5-005 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. TEVV data includes testing, evaluation, validation and verification data","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During data verification for risk measurement","evidenceSummary":"Verify provenance of training and TEVV datasets. This is distinct from a claim that all dataset risks are resolved.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-37F8B8D4E2","intent":"verify provenance of gai training and evaluation data","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-67293a0fe467a4278e31b98b0fac930419cc9fcfd1f5415d9b1661e88fb0cc75","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-15T13:05:22.316Z","fingerprint":"67293a0fe467a4278e31b98b0fac930419cc9fcfd1f5415d9b1661e88fb0cc75","previousFingerprint":"8ac1ad46eff429e29577ee47b3a85199e5ffa654bc5e52891f9e1ae5bf6d347f","bytes":235216,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-15T13:05:22.316Z","reviewed_at":null},{"id":"finding-13c2be5c6aea82b3834d25446c13de7ed1f583ead4cb145056f69cfc8920bd0b","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Document rationale for departures from corporate values","control":"3.12, p.29","action":"document","object":"rationale for AI deployment deviations from corporate values","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. A rationale does not authorize unlawful deployment.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When deciding on an inconsistent deployment or model","evidenceSummary":"Inconsistencies between AI deployment and corporate values should be conscious decisions with a clear documented rationale.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=29","ruleId":"AIR-6BD6A06201","intent":"document rationale for ai deployment deviations from corporate values","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-15abbd714d6bd45b40f5e6184d45257029979e0dd7e09526ee3a7bf0040c8d9d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Test models against dynamic production conditions","control":"3.35, p.48","action":"test","object":"AI models under dynamic production conditions","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Wherever possible; safety testing needs depend on context.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"During testing before and around deployment","evidenceSummary":"Where possible, testing should reflect production variability to assess generalisation and graceful failure.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=48","ruleId":"AIR-6CD9D072C7","intent":"test ai models under dynamic production conditions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-176dafe5a36f288d28100133f53ee6c8dd1a5847e6ba6c665320baf7b87ec327","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Transfer AI-governance knowledge when personnel change","control":"3.7(2)(b)(iii), p.24","action":"transfer","object":"AI governance knowledge during key personnel changes","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Whenever key AI personnel change","evidenceSummary":"Proper knowledge transfer reduces gaps in AI governance caused by movement of key staff.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=24","ruleId":"AIR-B744BB72AD","intent":"transfer ai governance knowledge during key personnel changes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-1c8e1f5fceb82c12933144277c11ca9deb10e692d4e043a7f0c4e46e126963cb","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Tell users when responses will train AI","control":"3.55, p.57","action":"inform","object":"individuals when their responses will train AI systems","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Applies when responses will be used for training; does not itself establish a legal basis to process them.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When collecting responses for AI training","evidenceSummary":"Where applicable, inform users that their responses will train the AI system.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=57","ruleId":"AIR-6E85F08651","intent":"inform individuals when their responses will train ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-2256abf579327c93428d21ca055f99a842abdacefbce5800868c090ef2e8bc95","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Test AI user interfaces before deployment","control":"3.55, p.57","action":"test","object":"AI user interfaces for usability before deployment","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Before deployment","evidenceSummary":"Test the interface and resolve usability problems before deployment so it serves its intended purpose.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=57","ruleId":"AIR-FBA2E9CEBB","intent":"test ai user interfaces for usability before deployment","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-277fa9be029217d4d50ed78fc8684a3203227e0870ff4133a93702ac38176c47","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Provide appeals for material AI decisions","control":"3.54(b), p.57","action":"establish","object":"mechanisms to appeal AI outcomes","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. This voluntary recommendation is additional to existing review obligations; not a universal appeal entitlement.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"After material decisions affecting an individual","evidenceSummary":"Consider an avenue for affected people to request review of material AI decisions; human review is reasonable for materially consequential autonomous decisions.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=57","ruleId":"AIR-6E499BCE84","intent":"establish mechanisms to appeal ai outcomes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-38b0f25ef5ac27b572cb854cb1fa4e08f85c3b088bd11ed6b69a0d53c9b47bec","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Train personnel in AI-risk responsibilities","control":"3.7(1)(b), p.22","action":"train","object":"personnel in their AI risk responsibilities","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Before and while discharging AI governance duties","evidenceSummary":"Internal AI governance personnel should understand their roles and receive suitable training, guidance and resources.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=22","ruleId":"AIR-E528E1DA42","intent":"train personnel in their ai risk responsibilities","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-44f1d9251394512e5a2b757516e8a300059510c5fecaeb294de8da10c47c9b00","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Ask AI suppliers about model reproducibility","control":"3.40(d), p.50","action":"ask","object":"AI solution providers whether procured model results are reproducible","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Concerns procurement of AI systems; distinguish from merely updating software that happens to add AI features under 2.2.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"During procurement or reproducibility assessment","evidenceSummary":"Organisations procuring off-the-shelf AI systems can check reproducibility of results with the original solution provider.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=50","ruleId":"AIR-DF06DD0948","intent":"ask ai solution providers whether procured model results are reproducible","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-4ff95725544f0f9ec22b943aaee4fc7d9483786b92a611ee3babd241a9031d58","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Enable human oversight of safety-critical AI","control":"3.18, p.31","action":"enable","object":"effective human oversight","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. If human control is not possible, sufficient information should support safe shutdown.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When operating safety-critical systems","evidenceSummary":"For safety-critical systems, allow a person to assume control and provide enough information for meaningful decisions or safe shutdown.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=31","ruleId":"AIR-9F0606F820","intent":"enable effective human oversight","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-58993f9dc6d928549470cdba57b58a0bbc1e4152ca151755e34c4de5b93cd41a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Assess risks of data with uncertain provenance","control":"3.23(a), p.37","action":"assess","object":"risks of using data with uncertain provenance","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Trusted third-party supply does not itself establish provenance.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Before and during use of data whose origin is uncertain","evidenceSummary":"Where origins are difficult to establish, including commingled third-party data, assess the risks of using the data.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=37","ruleId":"AIR-53EC5139B9","intent":"assess risks of using data with uncertain provenance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-5af70fc5e8250fd18712c9b09e2c92f4708986acdc14a050595d3536c5634e08","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Ensure AI-dataset traceability","control":"3.23(a), p.37","action":"ensure","object":"AI dataset traceability","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Data origin may be difficult to establish; assess and manage the resulting risk rather than assert complete provenance.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"During data management and model development","evidenceSummary":"Data accountability practices include understanding data origin, curation, transformation and movement; provenance records support tracing errors.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=37","ruleId":"AIR-B560A4296B","intent":"ensure ai dataset traceability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-6671a1804218c64a1faf6fbfb0f4c149caf3b272a7e406759f12fae3ed5d388a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Assign AI-system accountability","control":"3.7(1)(a), p.22","action":"assign","object":"AI system accountability","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"At allocation of AI deployment responsibilities","evidenceSummary":"Allocate oversight of deployment stages to appropriate personnel or departments; a coordinating body is conditional on need and feasibility.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=22","ruleId":"AIR-A332E21BFB","intent":"assign ai system accountability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-6aad6db8d94b1a5e2a14fc945fa08a63f2a83ee7269c661fc3d328c2d51caf2a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Develop an AI-explanation policy","control":"3.48, p.53","action":"develop","object":"a policy defining AI explanations and their timing","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Explanations may be general or specific on request; tailor to purpose and context.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Before and during stakeholder communication","evidenceSummary":"An explanation policy specifies what to explain, when and organisational responsibilities; equivalent human decisions guide disclosure standards.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=53","ruleId":"AIR-E6D1E07495","intent":"develop a policy defining ai explanations and their timing","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-8c60987f5f9dca22446cb1ecb9144662821796a76623243c37722d03f6709deb","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Establish a regular model-tuning policy","control":"3.34, p.48","action":"establish","object":"a policy for regular AI model tuning","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Tuning must remain appropriate to the deployed system and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Regularly; also when objectives, risks or corporate values change","evidenceSummary":"An internal policy and process for regular tuning helps deployed models respond to changing customer behavior and updated data.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=48","ruleId":"AIR-06075B5F24","intent":"establish a policy for regular ai model tuning","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-8d9f08d38bafc1c0aff08078f36c53dbcaf5535a85ab39e615e6d3503423f728","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Review AI governance after structural changes","control":"3.7(2)(b)(iv), p.24","action":"review","object":"AI governance structures after organisational or key personnel changes","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"On significant organisational or key-personnel change","evidenceSummary":"Review internal governance structures and measures following significant organisational or key-personnel changes.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=24","ruleId":"AIR-80D754CF92","intent":"review ai governance structures after organisational or key personnel changes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-9878a9f67108d8dd5c0530b65da745bedb1e46ebea5d485d66bb6fe46d803c37","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Assess whether to offer an AI opt-out","control":"3.52, p.56","action":"assess","object":"whether to offer an AI opt out","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. No universal opt-out mandate; if none is provided, consider review or recourse under 3.53.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When deciding whether and how to offer opt-out","evidenceSummary":"Consider opt-out availability and default versus on-request delivery against harm, reversibility, alternatives, costs and feasibility.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=56","ruleId":"AIR-50720EFBE6","intent":"assess whether to offer an ai opt out","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-be3cac7f934fd48781d050445e3654ce97fc27995543a4cc5e76a1e9d3bd171d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Monitor deployed AI-model behavior","control":"3.7(1)(c)(ii), p.23; 3.7(2)(b)(ii), p.24","action":"monitor","object":"AI behavior in production","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Monitoring design is proportionate; autonomous monitoring is optional where appropriate.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"During deployment","evidenceSummary":"Governance roles cover deployed-model monitoring and review; management reporting should surface performance and other issues.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=23","ruleId":"AIR-F6290E21EB","intent":"monitor ai behavior in production","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-c34820308e4e1d4c45576be47765fd0f63ed12766a30b5e4a851fd76df8a83a6","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Make model replication files available for testing","control":"3.40(c), p.50","action":"make available","object":"AI model replication files for reproducibility testing","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. External reproducibility testing can target a risk-selected subset of AI features (3.39); not a public release mandate.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When undertaking reproducibility testing","evidenceSummary":"Replication files that reconstruct development steps facilitate testing and reproduction of behavior.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=50","ruleId":"AIR-0B7460B97C","intent":"make available ai model replication files for reproducibility testing","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-e127e120e2fa2158fe9a4426a9a63553613ae1e75466a2babc24f0e737ee435a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Determine human involvement using harm probability and severity","control":"3.15-3.17, p.31","action":"determine","object":"human involvement using probability and severity of AI harm","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. These are not the only factors: nature and reversibility of harm, recourse and operational feasibility also matter (3.17 footnote 4).","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When selecting or reassessing human involvement","evidenceSummary":"A proposed matrix helps select human involvement using likelihood and severity of harm.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=31","ruleId":"AIR-842F4DF31B","intent":"determine human involvement using probability and severity of ai harm","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-e8da1f2bbf50529ffd909f34da52b790da64589b31f38f68034be8abbcd093cb","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Retain AI traceability records for relevant durations","control":"3.37(c), p.49","action":"retain","object":"AI traceability records for industry relevant durations","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. No fixed retention duration is prescribed; contextual selection under 3.38 remains necessary.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"For industry-relevant retention durations","evidenceSummary":"Traceability data should be retained for durations relevant to the industry rather than a universal period.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=49","ruleId":"AIR-1CA65C58B8","intent":"retain ai traceability records for industry relevant durations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-f34717a48cab02e427a0a2076b6739dc92e6f6a1a86c849741f4738c029d8f37","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Maintain a response plan for failed AI-risk mitigations","control":"3.13, p.29","action":"maintain","object":"a response plan for failed AI risk mitigations","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Semantically related to existing risk-response planning; owner review should assess overlap before adoption.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Throughout the iterative deployment-risk process","evidenceSummary":"The iterative risk-management process includes maintaining a plan for cases where mitigation fails.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=29","ruleId":"AIR-0D19E4E892","intent":"maintain a response plan for failed ai risk mitigations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-fcc93b61a733458d5bc21f59cf492241557d88310912b47b2161bedc9a295bf1","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Protect AI traceability records from alteration","control":"3.37(c), p.49","action":"protect","object":"AI traceability records from degradation or alteration","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Select traceability measures and product features proportionately to harm, experience and regulatory needs (3.38).","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"During storage of traceability data","evidenceSummary":"Store traceability data appropriately so it does not degrade or change.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=49","ruleId":"AIR-66817D6B0A","intent":"protect ai traceability records from degradation or alteration","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-a846fd3339fc751dfed295eaaa686ae188114b9b6504cac6cd03ffe131c339c6","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-14T12:58:12.923Z","fingerprint":"a846fd3339fc751dfed295eaaa686ae188114b9b6504cac6cd03ffe131c339c6","previousFingerprint":"d8483523ef2e20efe11bd41752c6cf80915acac37d3598592539445f84443056","bytes":706968,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-14T12:58:12.923Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-8ac1ad46eff429e29577ee47b3a85199e5ffa654bc5e52891f9e1ae5bf6d347f","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-14T12:58:10.210Z","fingerprint":"8ac1ad46eff429e29577ee47b3a85199e5ffa654bc5e52891f9e1ae5bf6d347f","previousFingerprint":"9e70446e08f90873fce594e89339839ed1c9123de6c0c060670bb752c3b47c05","bytes":235219,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-14T12:58:10.210Z","reviewed_at":null},{"id":"finding-03ec1911de65548efcf04c70b5cfb6f53d60817140aeb26a215319b8dfffdb83","kind":"rule-candidate","status":"pending","body":{"title":"Separate tasks by authorization context","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM08:2026 Prevention Strategy 3","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"separate","object":"tasks by authorization context","condition":"When LLM tasks require different access levels.","evidenceSummary":"The guidance separates tasks and grants each context only the privileges it needs.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Authorization must be deterministic and auditable.","timing":"Before execution","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-CBC4109CB3","intent":"separate tasks by authorization context","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-07557cc3dbe6a572b39fc4325a6ecf4f34619bf21bda29249699fc31f76ede2b","kind":"rule-candidate","status":"pending","body":{"title":"Verify model provenance and integrity","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM04:2026 Prevention Strategy 5","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"model provenance and integrity","condition":"Before promoting a model from an external or shared source.","evidenceSummary":"The guidance combines verifiable sources, signatures, hashes, immutable references and release gates.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"A valid signature proves origin and integrity, not model safety.","timing":"Before deployment and continuously upstream","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-20E5C620DA","intent":"verify model provenance and integrity","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-07ab644d67a9314e6cd0ef4dd13b9f5d176b074636e7de7b3bce2e779909d9e0","kind":"rule-candidate","status":"pending","body":{"title":"Use parameterized queries for model-generated database operations","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM10:2026 Prevention Strategy 5","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"use","object":"parameterized queries for model-generated database operations","condition":"When LLM output influences a database query.","evidenceSummary":"The guidance requires parameterized queries or prepared statements.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Parameterization does not authorize an otherwise prohibited operation.","timing":"Before database execution","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-BA72D5E60A","intent":"use parameterized queries for model generated database operations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-11ecf381e1e891ef80a91037416d292f29063a2e0a8ca8d3d0b765cbcb7ebd97","kind":"rule-candidate","status":"pending","body":{"title":"Enforce behavior controls outside the model","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM08:2026 Prevention Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"enforce","object":"behavior controls outside the model","condition":"When a critical behavior or safety boundary must be reliable.","evidenceSummary":"The guidance uses deterministic external safeguards rather than hidden instructions as the primary control.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Fine-tuning may reduce risk but provides no consistent guarantee.","timing":"At every relevant decision point","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-B25B8057B5","intent":"enforce behavior controls outside the model","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-18edebc8a1aa3f8a6c32463a56e9913412536fdd0a3a60f5edf327737c9e29ab","kind":"rule-candidate","status":"pending","body":{"title":"Detect recursive or resource-intensive agent actions","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM06:2026 Prevention Strategy 8","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"detect","object":"recursive or resource-intensive agent actions","condition":"When agent-tool interaction deviates from established normal consumption patterns.","evidenceSummary":"The guidance monitors sessions for loops and resource-heavy tool behavior without a clear end state.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Baselines must be maintained as tools and workloads change.","timing":"Continuously during agent runs","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-49A72C4549","intent":"detect recursive or resource intensive agent actions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-1bd1cfc43e31f544dcc00ca1d0a24b8c75df353c6711e5699fcd7ac40960ead8","kind":"rule-candidate","status":"pending","body":{"title":"Validate every model response in trusted code","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM01:2026 Prevention and Mitigation Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"validate","object":"every model response in trusted application code","condition":"Before any downstream system acts on an LLM response.","evidenceSummary":"The guidance calls for structural validation in trusted code rather than a second model call.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Structural validation catches format violations but not necessarily semantic manipulation.","timing":"Before downstream use","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-4E0B5E4900","intent":"validate every model response in trusted application code","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-1d8ad63a4a84bd74baf84657ac3813695c213a7b27437bb6df341430ca4c5eff","kind":"rule-candidate","status":"pending","body":{"title":"Strip invisible Unicode at ingest and render boundaries","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM01:2026 Prevention and Mitigation Strategy 5","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"strip","object":"invisible Unicode at ingest and render boundaries","condition":"When ingesting or rendering content that may reach or leave an LLM context.","evidenceSummary":"The guidance identifies tag-block, variation-selector and zero-width characters as smuggling channels.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"This does not address visible-text payloads or future steganographic classes.","timing":"At every ingest and render boundary","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-23C6FB27BE","intent":"strip invisible unicode at ingest and render boundaries","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-2466cd6e96527ce36718aca579bd1c878e93c2d53030ad73176d144d426c7804","kind":"rule-candidate","status":"pending","body":{"title":"Enforce tenant scope inside vector queries","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM09:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"enforce","object":"tenant scope inside vector queries","condition":"When a shared retrieval system serves multiple tenants or trust zones.","evidenceSummary":"The guidance validates tenant scope server-side within the index query.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"High-sensitivity workloads may require physically separate indexes.","timing":"At query time","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-31CFFA6E61","intent":"enforce tenant scope inside vector queries","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-309f564c9feaac4005af882c8d83219a2a5ec70d15093c5957112b84dd2b048e","kind":"rule-candidate","status":"pending","body":{"title":"Enforce hard AI spending caps","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM06:2026 Prevention Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"enforce","object":"hard AI spending caps","condition":"For each API key, user, team and cloud account consuming paid inference.","evidenceSummary":"The guidance requires non-overridable ceilings that stop inference when exceeded.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Caps should account for modality and tool-protocol cost differences.","timing":"Continuously during inference","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-0527253C36","intent":"enforce hard ai spending caps","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-346b80433436c35ad69331e132d7d636f2f5f4219737e7addbcaada12af070c1","kind":"rule-candidate","status":"pending","body":{"title":"Govern automated retraining loops","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM05:2026 Prevention Strategy 9","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"govern","object":"automated retraining and feedback loops","condition":"When preference signals or user feedback can change a model automatically.","evidenceSummary":"The guidance validates inputs, requires human oversight and rate-limits feedback-driven updates.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Controls address gradual poisoning but do not eliminate all manipulation.","timing":"Before accepting feedback and before retraining","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-799E96112C","intent":"govern automated retraining and feedback loops","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-4206d8e88bd140ab04c2a22fc58cb8f910d6d611be83cf0b414e478495e50830","kind":"rule-candidate","status":"pending","body":{"title":"Version datasets for rollback","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM05:2026 Prevention Strategy 8","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"version","object":"datasets for rollback and forensic analysis","condition":"Across training, fine-tuning and embedding data pipelines.","evidenceSummary":"The guidance uses data version control to track changes and support rollback after poisoning.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Versioning must be paired with access and integrity controls.","timing":"Continuously across dataset changes","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-9168F8CFD2","intent":"version datasets for rollback and forensic analysis","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-42cc8e5e2d605af8301fa8ad5eda676ee9bf94706f7046352fa1e4edb79594ec","kind":"rule-candidate","status":"pending","body":{"title":"Verify claims before execution","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM07:2026 Prevention Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"LLM-generated claims before execution","condition":"When generated claims would trigger a tool, workflow or external action.","evidenceSummary":"The guidance separates claim generation from execution and inserts verification.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Verification should use independent evidence and current system state.","timing":"Before acting","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-E7BF5547F0","intent":"verify llm generated claims before execution","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-5bb606ab629ae76dbbcb641b1b57a74050bdd6ebab2cf79798bc16ccccf3feb2","kind":"rule-candidate","status":"pending","body":{"title":"Require human confirmation before privileged actions","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM01:2026 Prevention and Mitigation Strategy 7","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"require","object":"human confirmation before privileged actions","condition":"For privileged, irreversible or externally visible actions proposed by an LLM application.","evidenceSummary":"The guidance requires confirmation against the exact rendered action.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Approval fatigue can degrade review quality.","timing":"Immediately before action execution","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-67CAE3665A","intent":"require human confirmation before privileged actions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-620cc55d77c3c8b6e3bf33a3ef6f766cd89d135d47c7378bc1decc8696810193","kind":"rule-candidate","status":"pending","body":{"title":"Mediate downstream actions independently of the LLM","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM03:2026 Prevention Strategy 7","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"mediate","object":"downstream actions independently of the LLM","condition":"Whenever an LLM proposes an action against a downstream system.","evidenceSummary":"The guidance validates every request at a deterministic policy point or downstream system.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Graduated policies may auto-approve low-consequence reversible actions.","timing":"Before each downstream action","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-0376A55328","intent":"mediate downstream actions independently of the llm","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-64484b5f3ae210bdb8ffe25d37567d495fb7faca16ba414d22b73f0c52084c23","kind":"rule-candidate","status":"pending","body":{"title":"Block automatic outbound requests from rendered model output","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM10:2026 Prevention Strategy 9","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"block","object":"automatic outbound requests from rendered model output","condition":"When chat, IDE, email or mobile clients render LLM-generated content.","evidenceSummary":"The guidance disables automatic images, previews, iframes and similar fetches by default.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"If fetching is required, use an origin allowlist or a server-side proxy that strips data-bearing parameters.","timing":"At render time","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-19242DD653","intent":"block automatic outbound requests from rendered model output","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-658efaa31aa02be1264281c5ad8484cf776364f01939d140d1f0db2eafd2adf3","kind":"rule-candidate","status":"pending","body":{"title":"Minimize context sent to external providers","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM02:2026 Tier 1 Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"minimize","object":"context sent to external model providers","condition":"When an application sends user or organizational data to an external model provider.","evidenceSummary":"The guidance limits provider context to task-required fields and requires justification for auto-context features.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Additional context may be justified when documented and controlled.","timing":"Before each external model request","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-7D56E83B4D","intent":"minimize context sent to external model providers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-67a01c9bf0d63ccf3059b48d5a2971e972f40ed312fba5ef6d93e19115f1873c","kind":"rule-candidate","status":"pending","body":{"title":"Validate model outputs before backend use","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM10:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"validate","object":"model outputs before backend use","condition":"When model output is passed to a backend function or downstream component.","evidenceSummary":"The guidance treats model output as untrusted user input.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Validation must be appropriate to the receiving function.","timing":"Before backend processing","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-91F1E724D7","intent":"validate model outputs before backend use","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-6824ea4c6492ff59245d49dd8b0796cd7451d19687b2ff47dc6a62432aa9a1f8","kind":"rule-candidate","status":"pending","body":{"title":"Reject oversized inputs before inference","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM06:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"reject","object":"oversized inputs before inference","condition":"When an input exceeds the application's documented size or token limits.","evidenceSummary":"The guidance uses pre-flight token estimation and input-size validation.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Limits should be risk- and workload-appropriate.","timing":"Before inference begins","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-B02AAFF7C0","intent":"reject oversized inputs before inference","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-6aba5353e0925ff7fc8f929bf8f3e9249709ff14952820ed7402e9e172b35c67","kind":"rule-candidate","status":"pending","body":{"title":"Avoid open-ended agent tools","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM03:2026 Prevention Strategy 3","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"avoid","object":"open-ended agent tools","condition":"When a specific narrow operation can replace shell, arbitrary URL or equivalent open-ended functionality.","evidenceSummary":"The guidance prefers granular tools with strict parameter schemas.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Open-ended tools may remain only where no safer granular alternative meets the need.","timing":"During tool selection and design","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-8F98427AF2","intent":"avoid open ended agent tools","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-6d73b2176b5d849b51beaab60d524ddc3ff162a0acfbdff871fb84f4ca8ee0d5","kind":"rule-candidate","status":"pending","body":{"title":"Reassess suppliers after security or contract changes","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM04:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"reassess","object":"AI suppliers after security or contract changes","condition":"When a supplier's security posture, access model, terms or privacy policy changes.","evidenceSummary":"The guidance requires recurring supplier review and change-triggered reassessment.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Only trusted suppliers should remain in use.","timing":"After relevant supplier changes","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-5BFA4011AC","intent":"reassess ai suppliers after security or contract changes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-6e28d8550e6e3e21c03049e1b50801cf8c240e55b40c40c20ba5085e068d825f","kind":"rule-candidate","status":"pending","body":{"title":"Limit agent-tool functions","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM03:2026 Prevention Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"limit","object":"agent-tool functions to necessary operations","condition":"When designing or selecting tools for an LLM agent.","evidenceSummary":"The guidance limits each tool to the operations required by the use case.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Separate narrowly scoped tools may replace multifunction tools.","timing":"During tool design and configuration","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-D3CFB869C0","intent":"limit agent tool functions to necessary operations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-71d03c842f1ff18f65bbd03bb8856d507779b4cbc87ceed289b58498268bb982","kind":"rule-candidate","status":"pending","body":{"title":"Keep credentials outside the model","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM01:2026 Prevention and Mitigation Strategy 4","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"keep","object":"credentials and state-change capability outside the model","condition":"For any privileged or state-changing operation exposed to an LLM application.","evidenceSummary":"The guidance places credentials and state-change authority in deterministic application code.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Broad downstream permissions or agent hops can reintroduce the risk.","timing":"During design and execution","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-E9A76989D8","intent":"keep credentials and state change capability outside the model","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-7f5cd4596f4af82470099c7b77908b71cc97a7f93a6f221df52e3e22bd18d2b4","kind":"rule-candidate","status":"pending","body":{"title":"Limit agent tools to the necessary set","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM03:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"limit","object":"agent tools to the necessary set","condition":"When configuring tools available to an LLM agent.","evidenceSummary":"The guidance removes tools that are unnecessary for the intended task.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"No broader tool set is justified by convenience alone.","timing":"Before deployment and when capabilities change","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-B8045D5BEB","intent":"limit agent tools to the necessary set","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-8766289bb7e4ee66d6d0b128cada1e14af85543ff24d4295906b4a3adeaf7e94","kind":"rule-candidate","status":"pending","body":{"title":"Verify MCP servers and third-party tool packages","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM01:2026 Prevention and Mitigation Strategy 10","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"MCP servers and third-party tool packages","condition":"Before connecting an MCP server or third-party tool package to an LLM application.","evidenceSummary":"The guidance calls for pinning, signing, verification and tool-description review.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Verification establishes provenance and integrity, not safety by itself.","timing":"Before installation and continuously after changes","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-E91FEB58FC","intent":"verify mcp servers and third party tool packages","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-881e7e23d4fabe9144285414adf707b50cded3b5124a5d6946f395e2971be644","kind":"rule-candidate","status":"pending","body":{"title":"Probe models for backdoors after alignment","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM05:2026 Prevention Strategy 10","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"probe","object":"models for backdoors after alignment","condition":"After each model alignment cycle and before deployment.","evidenceSummary":"The guidance requires trigger-focused testing rather than assuming alignment removes backdoors.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"General red teaming does not replace dedicated trigger probing.","timing":"After every alignment cycle","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-727C1A6948","intent":"probe models for backdoors after alignment","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-9540ffa541181c12c90f84ae8ac51317cc546228718529eb979db85d19dd5513","kind":"rule-candidate","status":"pending","body":{"title":"Enforce agent execution limits","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM06:2026 Prevention Strategy 9","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"enforce","object":"agent step recursion time and cost limits","condition":"For every autonomous or semi-autonomous agent execution.","evidenceSummary":"The guidance sets bounded steps, recursion depth, duration and per-run cost.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"State hashing is recommended to detect recursive loops.","timing":"At the start and throughout each run","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-341F31DDFD","intent":"enforce agent step recursion time and cost limits","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-96ce9efa8cceaf50e6888fbe4f7fdf664611311b5b1f5854b7c734b77cae54da","kind":"rule-candidate","status":"pending","body":{"title":"Redact reasoning traces before observability ingestion","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM02:2026 Tier 2 Strategy 11","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"redact","object":"reasoning traces before observability ingestion","condition":"When reasoning traces are logged, exported or sent to observability systems.","evidenceSummary":"The guidance treats reasoning traces as first-class output and bars unrestricted raw-trace logging.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Reasoning traces may be retained only within appropriately restricted handling paths.","timing":"Before logging or export","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-FA8BA326DF","intent":"redact reasoning traces before observability ingestion","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-981a7980af2a0d2ae9aac69b4aaaf1d271a106fcdb95fdde1d9e1cc8e7569203","kind":"rule-candidate","status":"pending","body":{"title":"Delete embeddings with deleted source documents","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM09:2026 Prevention Strategy 5","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"delete","object":"embeddings when source documents are deleted","condition":"When a source document is removed under retention, privacy or access policy.","evidenceSummary":"The guidance applies bounded deletion and reconciliation audits to derived embeddings.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Backups retain the same sensitivity as the source data.","timing":"Within the defined deletion period","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-E7A8BF872F","intent":"delete embeddings when source documents are deleted","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-99e296d9ab99a723fc6e35c55bcc32f1defa49fec2af09aeb4d275bf8e01f3b2","kind":"rule-candidate","status":"pending","body":{"title":"Require structured outputs with mandatory fields","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM07:2026 Prevention Strategy 6","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"require","object":"structured outputs with mandatory fields","condition":"When omissions could cause unsafe or incomplete downstream decisions.","evidenceSummary":"The guidance uses mandatory output fields to detect omission failures.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"A complete structure may still contain incorrect content.","timing":"Before accepting the output","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-3BD5F7160D","intent":"require structured outputs with mandatory fields","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-a21462daa7d4fe702824129ddf6359e86166b90a3cd2f62a2ed93c653f7c30f8","kind":"rule-candidate","status":"pending","body":{"title":"Exclude sensitive data from hidden context","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM08:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"exclude","object":"sensitive data from hidden model context","condition":"When constructing system prompts or other hidden context.","evidenceSummary":"The guidance assumes hidden context may become visible to users and removes secrets and security-critical configuration.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Sensitive operations should remain in systems the model cannot directly access.","timing":"Before model invocation","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-FAD77512B0","intent":"exclude sensitive data from hidden model context","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-a7a2ceb17b1a246f130bbf005f488e0bf6156ff8447a2ebd5725318259dde1a7","kind":"rule-candidate","status":"pending","body":{"title":"Encode model outputs for destination context","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM10:2026 Prevention Strategies 3–4","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"encode","object":"model outputs for the destination context","condition":"When rendering or passing model output to HTML, JavaScript or another interpreting context.","evidenceSummary":"The guidance applies context-aware output encoding to prevent code execution.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Encoding depends on the exact destination context.","timing":"Before rendering or interpretation","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-C295975FAC","intent":"encode model outputs for the destination context","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-a828081330940b0de0ccc9142c330c314c8f23295ef069221301d7b3bbc2374b","kind":"rule-candidate","status":"pending","body":{"title":"Authorize retrieval inside index queries","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM02:2026 Tier 1 Strategy 3","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"enforce","object":"authorization inside retrieval queries","condition":"When an LLM application retrieves documents or chunks from an index.","evidenceSummary":"The guidance places document- and chunk-level authorization inside the query rather than after retrieval.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"High-sensitivity workloads may require per-tenant indexes.","timing":"At retrieval time","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-7D6FAD1C1A","intent":"enforce authorization inside retrieval queries","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-b0eeb815877caa53dd4f8419512f60958c08f2e6a041d677390929d7a2952ef0","kind":"rule-candidate","status":"pending","body":{"title":"Verify inference artifacts before deployment","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM05:2026 Prevention Strategy 12","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"inference artifacts before deployment","condition":"For chat templates, tokenizer configurations, adapters and quantization artifacts.","evidenceSummary":"The guidance treats inference artifacts as security-relevant code and requires signatures, hashes, diffs and static analysis.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Verification must cover configuration artifacts as well as model weights.","timing":"Before deployment","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-BE76435EC8","intent":"verify inference artifacts before deployment","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-e527346d3933705bca5f6601fc18406dcf233600ab7eb93276ea0d6f19de3905","kind":"rule-candidate","status":"pending","body":{"title":"Log vector retrieval activity immutably","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM09:2026 Prevention Strategy 6","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"log","object":"vector retrieval activity immutably","condition":"For production retrieval requests involving vector or embedding stores.","evidenceSummary":"The guidance records tenant scope, query, returned identifiers and similarity scores for monitoring and response.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Logs remain sensitive and require their own access controls.","timing":"Continuously during retrieval","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-75C206D795","intent":"log vector retrieval activity immutably","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-ee3982593e3859a5ac72590265c05532bb8dcaf9432b62b023510a67e7d5b421","kind":"rule-candidate","status":"pending","body":{"title":"Ground outputs in current authoritative sources","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM07:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"ground","object":"LLM outputs in current authoritative sources","condition":"Before an LLM output informs a material decision or action.","evidenceSummary":"The guidance requires authoritative and current evidence for generated claims.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Grounding does not by itself prove the claim is correct.","timing":"Before action or decision","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-96D2CD94EC","intent":"ground llm outputs in current authoritative sources","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-ee68e130f796a03795603cee4dc0032b2d8bcc379d20d63509c49e0d5cb8f9e4","kind":"rule-candidate","status":"pending","body":{"title":"Preserve user authorization across chained calls","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM03:2026 Prevention Strategy 5","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"preserve","object":"user authorization across chained tool and agent calls","condition":"When an LLM system delegates work through tools or multiple agents on a user's behalf.","evidenceSummary":"The guidance carries the originating user's authorization scope through the chain.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Service identities must not silently expand the user's scope.","timing":"Throughout delegated execution","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-EEED31C620","intent":"preserve user authorization across chained tool and agent calls","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-f080b60b8666f516ddeea1710ceec006a4dbd93bba20ecc8d1c68960dd594a42","kind":"rule-candidate","status":"pending","body":{"title":"Verify erasure across sensitive AI artifacts","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM02:2026 Tier 3 Strategy 16","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"erasure across raw data embeddings checkpoints and adapters","condition":"When sensitive or regulated data must be removed from an AI system.","evidenceSummary":"The guidance requires erasure across major artifact classes with post-removal extraction and membership probes.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Verification must cover derived artifacts, not only the source record.","timing":"After deletion or unlearning","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-FE2D83FBFC","intent":"verify erasure across raw data embeddings checkpoints and adapters","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-f24a1c45fa60db88b20d1c8f26d102e6519438bdbd760388638222e6bbd3169e","kind":"rule-candidate","status":"pending","body":{"title":"Maintain a signed AI bill of materials","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM04:2026 Prevention Strategy 4","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"maintain","object":"a signed AI bill of materials","condition":"For models, adapters, datasets and software components used by an LLM application.","evidenceSummary":"The guidance extends component inventories to AI artifacts and their licenses.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Inventory does not establish that components are safe.","timing":"Continuously; audit regularly","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-A87B8A4534","intent":"maintain a signed ai bill of materials","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-f5ec7266f080f7ee9e623ab024f594ec15839b78fdcc018e972928d0d69f27bf","kind":"rule-candidate","status":"pending","body":{"title":"Verify AI-suggested dependencies","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM04:2026 Prevention Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"AI-suggested software dependencies","condition":"Before adopting a package or component recommended by an AI system.","evidenceSummary":"The guidance checks that suggested dependencies exist and are the intended package.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Verification supplements vulnerability management and patching.","timing":"Before installation or adoption","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-A4915FB892","intent":"verify ai suggested software dependencies","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-fe9b1f05309e05ab662b630385df68d6566d5809a1bff44bd89eb0a18ce2ee05","kind":"rule-candidate","status":"pending","body":{"title":"Segregate vector indexes by trust tier","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM09:2026 Prevention Strategy 3","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"segregate","object":"vector indexes by trust tier","condition":"When external, partner and confidential content have different trust levels.","evidenceSummary":"The guidance uses index-level isolation instead of classification tags on a shared index.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Mixed-trust content should not share an index without hard isolation.","timing":"Before embedding and retrieval","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-4BD004C832","intent":"segregate vector indexes by trust tier","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-d8483523ef2e20efe11bd41752c6cf80915acac37d3598592539445f84443056","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-13T13:07:51.702Z","fingerprint":"d8483523ef2e20efe11bd41752c6cf80915acac37d3598592539445f84443056","previousFingerprint":"e8425ab97d884bb531c36eefb28b74372aabf460e0fa8cae48d732265f90a19d","bytes":708342,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-13T13:07:51.702Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-9e70446e08f90873fce594e89339839ed1c9123de6c0c060670bb752c3b47c05","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-13T13:07:43.620Z","fingerprint":"9e70446e08f90873fce594e89339839ed1c9123de6c0c060670bb752c3b47c05","previousFingerprint":"ff6b00a00ce1f1afb385710a026bff767bc2a854527a6d768830515c0eefa22f","bytes":235219,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-13T13:07:43.620Z","reviewed_at":null},{"id":"finding-031dbf13a624bfdb2439df957bfe272c741d7b5e2bfbc5a5d7dcc88ae3b02429","kind":"rule-candidate","status":"pending","body":{"title":"Retain prior model documentation","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.1, PDF page 5","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"retain","object":"prior versions of model documentation","condition":"After documenting a general-purpose AI model placed on the Union market.","evidenceSummary":"Measure 1.1 commits signatories to keep prior documentation versions for a ten-year period.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The Article 53(2) open-source exception applies unless the model has systemic risk.","timing":"Until 10 years after the model is placed on the market","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-8DE80BBC1E","intent":"retain prior versions of model documentation","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-0337625108f2237b5d292425ed2a71c9ec66e7832627dd5a337cba4e2cd08979","kind":"rule-candidate","status":"pending","body":{"title":"Implement a copyright compliance policy","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.1(1), PDF page 4","actor":"Signatory providers placing general-purpose AI models on the Union market","modality":"should","action":"implement","object":"a copyright compliance policy","condition":"For every general-purpose AI model the signatory places on the Union market.","evidenceSummary":"Measure 1.1 commits signatories to draw up, update and implement a single-document policy addressing Union copyright law.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The measure demonstrates a policy obligation but does not itself establish compliance with Union copyright law.","timing":"Before and while placing covered models on the Union market","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-9A5BD1A87A","intent":"implement a copyright compliance policy","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-05f7ce79729141ff09acd41a89d03bfd940aef99f792dddc47a0f35d9bbfedc6","kind":"rule-candidate","status":"pending","body":{"title":"Assess systemic risks","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 1, Measure 1.2, PDF page 8","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"assess","object":"systemic risks","condition":"Through a full identification, analysis, acceptance and mitigation cycle before market placement and on specified material-change triggers.","evidenceSummary":"Measure 1.2 requires a full systemic-risk assessment and mitigation process before the model enters the market and at later triggers.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Still-appropriate portions of earlier assessments need not be duplicated.","timing":"At least before market placement and whenever Measure 7.6 trigger conditions are met","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-9E7F166E73","intent":"assess systemic risks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-0dade33246b6b826d3aea9043e521b8fdfca633bf3b8bfab0428d04bc17f07fc","kind":"rule-candidate","status":"pending","body":{"title":"Provide requested model documentation to the AI Office","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.2, PDF page 5","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"provide","object":"requested model documentation to the AI Office","condition":"Upon an AI Office request under Articles 91 or 75(3) for information necessary to perform AI Act tasks.","evidenceSummary":"Measure 1.2 commits signatories to supply the requested information in its most current form.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The request must identify a lawful purpose and concern information necessary for the relevant supervisory task.","timing":"Within the period specified in the AI Office request","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-422B3BFDBA","intent":"provide requested model documentation to the ai office","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-0fcfe4cd4ae526a8a831b4953915dd26502fae744d479eccb297a961d8ac6f3b","kind":"rule-candidate","status":"pending","body":{"title":"Develop scenarios for identified systemic risks","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 2, Measure 2.2, PDF page 11","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"develop","object":"scenarios for identified systemic risks","condition":"After identifying systemic risks stemming from the model.","evidenceSummary":"Measure 2.2 requires an appropriate number and level of detail of scenarios for each identified systemic risk.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Scenario number and detail are proportionate to the risk.","timing":"During systemic-risk identification and before acceptance determination","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-634ED1EFE9","intent":"develop scenarios for identified systemic risks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-17e0664153cd38998834437df950d83be74af79b4c88e4a650c756b7726962d0","kind":"rule-candidate","status":"pending","body":{"title":"Retain serious-incident documentation","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 9, Measure 9.4, PDF page 27","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"retain","object":"serious-incident documentation","condition":"For relevant information gathered under the Code's serious-incident commitment.","evidenceSummary":"Measure 9.4 establishes a minimum five-year retention period measured from the later of documentation or incident date.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Other applicable Union law may impose additional constraints.","timing":"At least five years from documentation or incident date, whichever is later","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-F812056EAF","intent":"retain serious incident documentation","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-1f1824cbeac327f2ff929f276136c354b20a7f92cb28daa5e5c171ac5c200a0a","kind":"rule-candidate","status":"pending","body":{"title":"Answer necessary downstream information requests","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.2, PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"provide","object":"additional information necessary for downstream AI Act compliance","condition":"Upon a downstream provider request for information necessary to understand relevant model capabilities and limitations or comply with the AI Act.","evidenceSummary":"Measure 1.2 sets a reasonable-time response commitment capped at fourteen days absent exceptional circumstances.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Exceptional circumstances may justify more than 14 days; intellectual-property and confidentiality protections remain applicable.","timing":"Within a reasonable timeframe and no later than 14 days after the request","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-8BA004AE3B","intent":"provide additional information necessary for downstream ai act compliance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-23b28331c5952314fbcd27fa10d918f270e77215da5846182a8e7bc924d59b0b","kind":"rule-candidate","status":"pending","body":{"title":"Prevent infringing reproduction of training content","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.4(1)(a), PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"prevent","object":"copyright-infringing reproduction of training content","condition":"When downstream systems generate outputs from the signatory's model.","evidenceSummary":"Measure 1.4(a) commits signatories to appropriate, proportionate technical safeguards against infringing reproduction.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Safeguards are proportionate; the measure applies whether the model is vertically integrated or supplied contractually.","timing":"Before deployment and during model operation","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-3DE78E9151","intent":"prevent copyright infringing reproduction of training content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-23d4a92b292fcd3aac6aca3df6b67c8e8a84ba8c02e386708ebeac4f3ec1ed16","kind":"rule-candidate","status":"pending","body":{"title":"Create a safety and security framework","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 1, Measure 1.1, PDF pages 6–7","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"create","object":"a safety and security framework","condition":"For covered models being developed, placed on the market or used by the signatory.","evidenceSummary":"Measure 1.1 requires a state-of-the-art framework describing systemic-risk assessment and mitigation processes.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The chapter applies to providers of GPAI models with systemic risk; proportional simplifications may apply to SMEs and small mid-caps.","timing":"During development and before market placement","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-BD536D5F40","intent":"create a safety and security framework","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-2e4f3a17b975ab7c06562a349aa02a33ac9ef21e5c55def206db51ada46935be","kind":"rule-candidate","status":"pending","body":{"title":"Withhold models with unacceptable systemic risk","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 4, Measure 4.2, PDF page 16","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"withhold","object":"models with unacceptable systemic risk","condition":"The model's systemic risks are not acceptable or are reasonably foreseeable soon to become unacceptable.","evidenceSummary":"Measure 4.2 requires the provider not to proceed and, as necessary, not to market, restrict, withdraw or recall the model until risk is acceptable.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Appropriate safety or security mitigations and reassessment may support later proceeding once risk is acceptable.","timing":"Before development continues, market placement or use","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-677FAA1CCA","intent":"withhold models with unacceptable systemic risk","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-36c6266fc7586914199f6492f8fe1ebbbcdb9178c788847ebe1ba6685cc0cceb","kind":"rule-candidate","status":"pending","body":{"title":"Define systemic-risk acceptance criteria","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 4, Measure 4.1, PDF pages 15–16","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"define","object":"systemic-risk acceptance criteria","condition":"For each identified systemic risk and the overall risk determination.","evidenceSummary":"Measure 4.1 requires measurable tiers or other appropriate criteria and a justified safety margin that accounts for uncertainty.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Other criteria may replace tiers when tiers are unsuitable and the risk is not a specified Appendix 1.4 risk.","timing":"Before deciding whether to continue development, market placement or use","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-F1F56E4EAE","intent":"define systemic risk acceptance criteria","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-37ad0e370cf101fcd942b1dafb93dc100dcaa7d7a0e1b11bb7986134ad22d0ae","kind":"rule-candidate","status":"pending","body":{"title":"Assign copyright-policy responsibility","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.1(1), PDF page 4","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"assign","object":"responsibility for copyright-policy implementation and oversight","condition":"When establishing the signatory's Union copyright compliance policy.","evidenceSummary":"Measure 1.1 separately commits signatories to assign implementation and oversight responsibilities within the organisation.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Organisational form is not prescribed.","timing":"When establishing and maintaining the policy","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-012BD71EC6","intent":"assign responsibility for copyright policy implementation and oversight","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-3fa415c35257ea0760e0ab064a71cc60cf60bc210226e41a58f2c3633fdfe8db","kind":"rule-candidate","status":"pending","body":{"title":"Define systemic-risk management responsibilities","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 8, Measure 8.1, PDF pages 23–24","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"define","object":"systemic-risk management responsibilities","condition":"Across supervisory, executive, operational and assurance levels appropriate to the organisation.","evidenceSummary":"Measure 8.1 requires clear allocation of oversight, ownership, support, monitoring and assurance responsibilities.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"SMEs and small mid-caps may use simplified allocations suited to their governance structure.","timing":"Before and throughout covered model development and operation","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-4053E5A771","intent":"define systemic risk management responsibilities","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-4949bb67929de99fa9292a88792be595f18ca4933db6e37050c0b639707caeec","kind":"rule-candidate","status":"pending","body":{"title":"Exclude persistently infringing websites from AI crawling","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.2(1)(b), PDF pages 4–5","actor":"Signatory providers using web crawlers directly or through another party","modality":"should","action":"exclude","object":"persistently infringing websites from AI web crawling","condition":"A court or public authority in the EU or EEA recognises the website as persistently and repeatedly infringing copyright commercially at crawl time.","evidenceSummary":"Measure 1.2(b) commits signatories to exclude listed commercial-scale infringing sites from training-data crawling.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The recognition must come from the specified courts or public authorities and apply at the time of crawling.","timing":"At each applicable web crawl","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union and European Economic Area","ruleId":"AIR-68AE3CE50C","intent":"exclude persistently infringing websites from ai web crawling","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-498ef747aff7bee5c695423778ede85c010461cf40b2696714f5770e7d9b4cac","kind":"rule-candidate","status":"pending","body":{"title":"Notify rightsholders of crawler-information updates","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.3(4), PDF page 6","actor":"Signatory providers using web crawlers","modality":"should","action":"notify","object":"affected rightsholders of crawler-information updates","condition":"When published information about crawler features or rights-reservation measures changes.","evidenceSummary":"Measure 1.3(4) calls for an automated notification means, such as a syndicated web feed.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The mechanism may use a feed or another automatic method.","timing":"When the published crawler information is updated","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-0586B4E6D4","intent":"notify affected rightsholders of crawler information updates","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-4ca6f1e19b48a392e422e6da72122bf4d74c8d81d067d7e209f9d5ea441d24f0","kind":"rule-candidate","status":"pending","body":{"title":"Do not circumvent access-control technologies when crawling","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.2(1)(a), PDF page 4","actor":"Signatory providers using web crawlers directly or through another party","modality":"must not","action":"circumvent","object":"technological access controls on copyright-protected content","condition":"When web crawling for text and data mining and general-purpose AI model training.","evidenceSummary":"Measure 1.2(a) commits signatories not to bypass effective technological measures, including subscription and paywall restrictions.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The measure is tied to effective technological measures under Article 6(3) of Directive 2001/29/EC.","timing":"At web-crawl access time","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-4C41C35712","intent":"circumvent technological access controls on copyright protected content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-534a784efed01ce0c3695778c9404d0d28d8165dc0241cc8c992333d47e72541","kind":"rule-candidate","status":"pending","body":{"title":"Follow robots.txt rights reservations","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.3(1)(a), PDF page 5","actor":"Signatory providers using web crawlers directly or through another party","modality":"should","action":"follow","object":"robots.txt rights-reservation instructions","condition":"When crawling publicly available online content for text and data mining and model training.","evidenceSummary":"Measure 1.3(a) commits signatories to crawlers that read and follow RFC 9309 robots.txt instructions and feasible successor versions.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Successor protocol versions apply when the IETF shows they are technically feasible and implementable for providers and rightsholders.","timing":"At crawl time","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-C683FD122D","intent":"follow robots txt rights reservation instructions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-5c36b53977e2287a08901caf313f160f9169e00c83240f626fe60a9ebdc07489","kind":"rule-candidate","status":"pending","body":{"title":"Designate a rightsholder contact","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.5(1), PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"designate","object":"an electronic rightsholder contact","condition":"For affected rightsholders to communicate with the provider.","evidenceSummary":"Measure 1.5(1) requires a designated electronic contact and easily accessible contact information.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"No clause-specific exception is stated.","timing":"While the covered model is available","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-99CC893DDC","intent":"designate an electronic rightsholder contact","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-608005629e283a302bb42d8b4ca98604edec0241a5a49f3ed2a3c3e1544ee94d","kind":"rule-candidate","status":"pending","body":{"title":"Implement mitigations that meet the model-security goal","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 6, Measure 6.2, PDF page 18","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"implement","object":"mitigations that meet the model-security goal","condition":"While protected model parameters remain non-public and not securely deleted.","evidenceSummary":"Measure 6.2 requires appropriate Appendix 4 mitigations or alternatives that achieve the same objectives.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Equivalent alternative mitigations may be used when listed measures do not fit the organisational or technical context.","timing":"Throughout the lifecycle until parameters are public or securely deleted","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-F1C44EBF07","intent":"implement mitigations that meet the model security goal","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-66465f258871c3f90476af387059ad1be905c4f8867e6ccca830bf0f427e6dcd","kind":"rule-candidate","status":"pending","body":{"title":"Publish AI web-crawler compliance information","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.3(4), PDF page 6","actor":"Signatory providers using web crawlers","modality":"should","action":"publish","object":"AI web-crawler rights-reservation compliance information","condition":"For crawlers and measures used to identify and comply with Article 4(3) rights reservations.","evidenceSummary":"Measure 1.3(4) commits signatories to make crawler identities, robots.txt features and other reservation-compliance measures public.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The measure is without prejudice to the information right under Directive 2004/48/EC Article 8.","timing":"While the crawler and measures are in use","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-D511525F2C","intent":"publish ai web crawler rights reservation compliance information","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-670775fe4a2ff80ec0705b1327ac97faf4bd9baa0d74ca720ef7b9f31148f9c3","kind":"rule-candidate","status":"pending","body":{"title":"Provide current model documentation to downstream providers","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.2, PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"provide","object":"current model documentation to downstream providers","condition":"For information in the Model Documentation intended for downstream providers integrating the model.","evidenceSummary":"Measure 1.2 commits signatories to provide the most current downstream-facing documentation.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Confidentiality safeguards and protection of intellectual property, confidential business information and trade secrets apply.","timing":"When supporting downstream integration and compliance","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-5C65C34756","intent":"provide current model documentation to downstream providers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-6e7e7c3f07158a09a63b4538903d1cd4f4d94c92ba161a69aa74b1cb9fd35683","kind":"rule-candidate","status":"pending","body":{"title":"Comply with other machine-readable rights reservations","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.3(1)(b), PDF page 5","actor":"Signatory providers using web crawlers directly or through another party","modality":"should","action":"comply","object":"machine-readable copyright rights reservations","condition":"When appropriate reservation protocols are standardised or are technically implementable, state of the art, widely adopted and generally agreed through an inclusive EU process.","evidenceSummary":"Measure 1.3(b) covers qualifying asset-based and location-based reservation protocols beyond robots.txt.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The protocol must meet the measure's standardisation or state-of-the-art, implementability, adoption and consensus conditions.","timing":"At crawl time","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-A82ECCFA13","intent":"comply machine readable copyright rights reservations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-78033c7c8395da6f900eb353d96fd30f2febe34b67b9dd8aee2d16dab20d5b6f","kind":"rule-candidate","status":"pending","body":{"title":"Create a safety and security model report","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 7, Measures 7.1–7.5, PDF pages 18–21","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"create","object":"a safety and security model report","condition":"For a covered model and its systemic-risk assessment and mitigation evidence.","evidenceSummary":"Commitment 7 requires a Model Report describing the model, reasons to proceed, risk work, external reports and material changes.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"SMEs and small mid-caps may reduce detail to reflect size and capacity; cross-references and multi-model reports are permitted where appropriate.","timing":"Before placing the model on the market","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-AC0E8FFF57","intent":"create a safety and security model report","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-7e4f0a10a5cd01dde4d937b9040f941ca9980760e25accfddb76ed87b4341dc3","kind":"rule-candidate","status":"pending","body":{"title":"Perform model evaluations","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 3, Measure 3.2, PDF pages 12–13","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"perform","object":"model evaluations","condition":"For modalities relevant to each identified systemic risk, using methods appropriate to the model and risk.","evidenceSummary":"Measure 3.2 requires at least state-of-the-art evaluations, including open-ended testing to identify unexpected behaviour and capability boundaries.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Evaluation design is risk- and model-specific and informed by model-independent information.","timing":"During systemic-risk analysis and at relevant lifecycle triggers","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-95915B3947","intent":"perform model evaluations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-7f83426dfa8c901061dbb120ed761dfd304eb7da64d54ed723862c1b68e3df6a","kind":"rule-candidate","status":"pending","body":{"title":"Protect model documentation from unintended alteration","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.3, PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"protect","object":"model documentation from unintended alteration","condition":"While drawing up, updating, retaining and evidencing model documentation.","evidenceSummary":"Measure 1.3 requires quality and integrity controls and protection against unintended changes.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"No clause-specific exception is stated.","timing":"Throughout documentation creation, maintenance and retention","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-D6481064E5","intent":"protect model documentation from unintended alteration","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-877c97e8813ced1651cef819ad7b133c454fb834f9f3b667303d9793bd37bc71","kind":"rule-candidate","status":"pending","body":{"title":"Report serious incidents to the AI Office","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 9, Measures 9.2–9.3, PDF pages 25–27","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"report","object":"serious incidents to the AI Office","condition":"When the provider establishes or reasonably suspects the model directly or indirectly caused a qualifying serious incident.","evidenceSummary":"Measures 9.2 and 9.3 specify report content and risk-specific initial deadlines, followed by intermediate and final reports.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Information may be redacted as necessary for other applicable Union law; exceptional circumstances may affect initial timing.","timing":"Initial report within 2, 5, 10 or 15 days by incident type; updates every four weeks; final report within 60 days after resolution","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-D711D2E5E0","intent":"report serious incidents to the ai office","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-8f98f1c52956a7e6cd654f31bb1a322424cd68f3f1c42e9af4de2c5373f75c61","kind":"rule-candidate","status":"pending","body":{"title":"Document general-purpose AI models","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.1, PDF page 5","actor":"Signatory providers placing general-purpose AI models on the Union market","modality":"should","action":"document","object":"general-purpose AI models","condition":"When placing a general-purpose AI model on the Union market under the voluntary Code.","evidenceSummary":"Measure 1.1 commits signatories to document at least the information listed in the Model Documentation Form.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The measure does not apply to qualifying free-and-open-source providers under Article 53(2), unless the model has systemic risk.","timing":"By the time the model is placed on the Union market","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance; not an additional legal obligation","jurisdiction":"European Union","ruleId":"AIR-EE45A1F342","intent":"document general purpose ai models","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-91ce894c964c682d4d5e34eb887b2dd4fbf4ecdcd040a44474f40c3339ce231f","kind":"rule-candidate","status":"pending","body":{"title":"Confirm the systemic-risk framework before market placement","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 1, Measure 1.1, PDF page 7","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"confirm","object":"the systemic-risk framework before market placement","condition":"After notifying the Commission under AI Act Article 52(1) and before placing the model on the market.","evidenceSummary":"Measure 1.1 specifies both a post-notification and pre-market confirmation deadline.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Both deadlines apply; the earlier practical deadline controls.","timing":"No later than four weeks after Article 52(1) notification and no later than two weeks before market placement","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-622DE8A4D9","intent":"confirm the systemic risk framework before market placement","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-a4b34c5d0152952a16f630d9e5ec6c402b3bc17d4bf7b9b0ac395a365a97b20d","kind":"rule-candidate","status":"pending","body":{"title":"Provide an electronic copyright-complaint mechanism","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.5(2), PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"provide","object":"an electronic copyright-complaint mechanism","condition":"For affected rightsholders and authorised representatives to submit precise, substantiated Code-compliance complaints.","evidenceSummary":"Measure 1.5(2) calls for electronic submission and easily accessible mechanism information.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The mechanism does not replace statutory copyright remedies.","timing":"While the covered model is available","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-401F58C1AD","intent":"provide an electronic copyright complaint mechanism","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-a59db682a24cda879025969026c3dc7d30b5630fc670b949c35a831798b6d9cb","kind":"rule-candidate","status":"pending","body":{"title":"Publish systemic-risk framework and model-report summaries","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 10, Measure 10.2, PDF page 28","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"publish","object":"systemic-risk framework and model-report summaries","condition":"Insofar as publication is necessary to assess or mitigate systemic risks.","evidenceSummary":"Measure 10.2 calls for public summaries and updates, including high-level risk results and mitigations, with safety and confidentiality removals.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Publication may omit information to protect mitigation effectiveness and sensitive commercial information and is unnecessary for qualifying similarly-safe-or-safer models under Appendix 2.2.","timing":"When necessary to assess or mitigate systemic risk and when summaries are updated","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-766D44E977","intent":"publish systemic risk framework and model report summaries","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-b5fa4cafdff2b59090d9f521833a75538391c586e7e4fabe81e09542d5d5e92d","kind":"rule-candidate","status":"pending","body":{"title":"Implement adversarially robust safety mitigations","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 5, Measure 5.1, PDF page 17","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"implement","object":"adversarially robust safety mitigations","condition":"Throughout the lifecycle, taking account of the model's release and distribution strategy.","evidenceSummary":"Measure 5.1 requires appropriate safety mitigations that remain sufficiently robust to attacks such as jailbreaks and hostile fine-tuning.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The selected mitigations are proportionate to the model and systemic risks.","timing":"Throughout the model lifecycle","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-2A16933CC6","intent":"implement adversarially robust safety mitigations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-bf883d9aeb8be63d4e3523636984f7429cc2618743e1d67a629bcb7b24849308","kind":"rule-candidate","status":"pending","body":{"title":"Process substantiated copyright complaints diligently","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.5(2), PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"process","object":"substantiated copyright complaints diligently","condition":"After receiving a sufficiently precise and adequately substantiated complaint under the Code.","evidenceSummary":"Measure 1.5(2) requires diligent, non-arbitrary action within a reasonable time.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The provider need not repeat a response to an identical complaint from the same rightsholder and may reject manifestly unfounded complaints.","timing":"Within a reasonable time after receipt","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-54E3B89D3D","intent":"process substantiated copyright complaints diligently","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-c59b93f61445335c54cd51796ef0569863aeba9ebda60a6c2f1fc13c15cea1d2","kind":"rule-candidate","status":"pending","body":{"title":"Update the systemic-risk framework","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 1, Measure 1.3, PDF pages 9–10","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"update","object":"the systemic-risk framework","condition":"When a framework assessment finds an update appropriate or material adequacy or adherence concerns arise.","evidenceSummary":"Measure 1.3 requires updates, a versioned changelog and periodic or event-triggered framework assessments.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"No update is needed when the assessment supports the current framework, but the annual-or-sooner assessment cadence remains.","timing":"Without undue delay after an assessment; assess at least every 12 months or sooner on reasonable grounds","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-79B6F75D3C","intent":"update the systemic risk framework","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-cde3f484ee3d7e76dd5db89cf66c01e5b07a4226e838e0f544647ec3e495e55e","kind":"rule-candidate","status":"pending","body":{"title":"Publish documentation-request contact information","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.2, PDF page 5","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"publish","object":"contact information for model-documentation requests","condition":"When placing a general-purpose AI model on the Union market.","evidenceSummary":"Measure 1.2 calls for website or other appropriate contact information for AI Office and downstream-provider requests.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"A provider without a website may use another appropriate public means.","timing":"When placing the model on the market","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-22EC51C7C3","intent":"publish contact information for model documentation requests","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-d316516f6932ee70363a514e09c318fb11c40c537c0815a9297607f4ffb3e8df","kind":"rule-candidate","status":"pending","body":{"title":"Provide independent evaluators free model access","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 3, Measure 3.5, PDF page 14","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"provide","object":"independent evaluators free access to relevant model versions","condition":"To facilitate post-market monitoring of covered systemic risks.","evidenceSummary":"Measure 3.5 requires adequate free access for an adequate number of evaluators to capable and minimally mitigated versions and available chains of thought.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The access commitment does not apply when the model qualifies as similarly safe or safer for the same systemic risk under Appendix 2.2.","timing":"During post-market monitoring","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-695F78887A","intent":"provide independent evaluators free access to relevant model versions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-d507f17f6ce0abc1c129ebf2a5c2b52224cd18fdad6ea73e3465504b1b35f88e","kind":"rule-candidate","status":"pending","body":{"title":"Provide the systemic-risk framework to the AI Office","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 1, Measure 1.4, PDF page 10","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"provide","object":"the systemic-risk framework to the AI Office","condition":"After confirming the framework or an update.","evidenceSummary":"Measure 1.4 requires unredacted AI Office access to confirmed frameworks and updates.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"No clause-specific redaction exception is stated for this measure.","timing":"Within five business days after confirmation","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-A0C58383B9","intent":"provide the systemic risk framework to the ai office","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-d69059a0c621773f651fd07b8a5fe18fd653d1d07824dccc0fa49f2bab62b193","kind":"rule-candidate","status":"pending","body":{"title":"Establish a post-market monitoring system","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 3, Measure 3.5, PDF pages 13–14","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"establish","object":"a post-market monitoring system","condition":"After a covered model is placed on the market.","evidenceSummary":"Measure 3.5 requires monitoring information relevant to risk acceptability and Model Report updates.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Monitoring methods are selected proportionately; signatory-deployed systems integrating the model are included.","timing":"Continuously after market placement","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-96F8E30D4E","intent":"establish a post market monitoring system","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-db669283bf4ba41594cade37583f29d7869a6c631fb5d9307c2dd9edf9d0ff1d","kind":"rule-candidate","status":"pending","body":{"title":"Prohibit copyright-infringing model uses","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.4(1)(b), PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"prohibit","object":"copyright-infringing model uses","condition":"In acceptable-use policies, terms or equivalent model-governance documents.","evidenceSummary":"Measure 1.4(b) commits signatories to prohibit infringing uses or warn users in documentation for free and open-source models.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"For free and open-source models, accompanying documentation may alert users to the prohibition without changing the licence's open-source nature.","timing":"Before making the model available and throughout availability","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-34CAEED939","intent":"prohibit copyright infringing model uses","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-df33c21c150e62cc8765918b83ccae588eebeb02069d7c8d678cbfdd195ebb15","kind":"rule-candidate","status":"pending","body":{"title":"Define a model-security threat-actor goal","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 6, Measure 6.1, PDF page 18","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"define","object":"a model-security threat-actor goal","condition":"For models covered by the Code's systemic-risk security commitment.","evidenceSummary":"Measure 6.1 requires a security goal covering non-state external, insider and other expected threat actors in light of current and expected capabilities.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The commitment does not apply where model capabilities are inferior to at least one model whose parameters are publicly downloadable.","timing":"Before selecting and implementing security mitigations","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-5E0C8818B2","intent":"define a model security threat actor goal","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-ff9d79c1a9f6e51c9d08ce547ba922854a7719142d30b0d6b0e5fea9104ec479","kind":"rule-candidate","status":"pending","body":{"title":"Allocate resources for systemic-risk management","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 8, Measure 8.2, PDF page 24","actor":"Management bodies of signatory providers of systemic-risk GPAI models","modality":"should","action":"allocate","object":"resources for systemic-risk management","condition":"To people assigned responsibilities under Measure 8.1 and proportionate to the model's systemic risks.","evidenceSummary":"Measure 8.2 covers human, financial, information, knowledge and computational resources.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Resource levels are proportionate to the systemic risks.","timing":"Throughout systemic-risk assessment and mitigation","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-DF3CA2B6CF","intent":"allocate resources for systemic risk management","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-e8425ab97d884bb531c36eefb28b74372aabf460e0fa8cae48d732265f90a19d","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-12T13:13:08.595Z","fingerprint":"e8425ab97d884bb531c36eefb28b74372aabf460e0fa8cae48d732265f90a19d","previousFingerprint":"6eea7382848332286deaadfa923a4fccb85184b52867f1097cbc63b19943863c","bytes":708342,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-12T13:13:08.595Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-ff6b00a00ce1f1afb385710a026bff767bc2a854527a6d768830515c0eefa22f","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-12T13:13:00.506Z","fingerprint":"ff6b00a00ce1f1afb385710a026bff767bc2a854527a6d768830515c0eefa22f","previousFingerprint":"503fc5dcc843e7fb433e1cda18709296ac7528b890bad601f188ba5a787d4cf3","bytes":235219,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-12T13:13:00.506Z","reviewed_at":null},{"id":"finding-0f24246ba7041e243ee57c2d6ed288d6e48f1454b9a472836f7a3b9e40713fc8","kind":"rule-candidate","status":"pending","body":{"title":"Allow refusal of human-mimicking AI and human intervention","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 127","actor":"UNESCO Member States and AI actors","modality":"should","action":"allow","object":"refusal of human mimicking AI and human intervention","condition":"When users interact with an AI system imitating human or animal characteristics.","evidenceSummary":"Paragraph 127 calls for users to be able to refuse the AI interaction and request human intervention effectively.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"The Recommendation does not state an exception.","timing":"Throughout the interaction","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-4D0E0234A5","intent":"allow refusal of human mimicking ai and human intervention","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-106e578c98b205a949738c969493f76356cda6e5d0e88d6ecac87c7c8a66f1e6","kind":"rule-candidate","status":"pending","body":{"title":"Inform people that they are interacting with AI","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 127","actor":"UNESCO Member States and AI actors","modality":"should","action":"inform","object":"people they are interacting with AI","condition":"When an AI system imitates human or animal characteristics.","evidenceSummary":"Paragraph 127 calls for users to be able to identify easily whether they are interacting with a living being or an AI system.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"None stated for identification of the interaction.","timing":"At the start and during the interaction","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-86AF529571","intent":"inform people they are interacting with ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-15abe5d56ce8bfa06daa4f08c2afa766abb6119185db06437629b04bed9a5012","kind":"rule-candidate","status":"pending","body":{"title":"Support workers displaced by AI","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 118","actor":"UNESCO Member States","modality":"should","action":"support","object":"workers displaced by AI","condition":"During AI-driven labour transitions affecting at-risk employees.","evidenceSummary":"Paragraph 118 calls for fair-transition measures including reskilling, retention, safety nets, social protection and sufficient public funding.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Measures should be developed with companies, civil society, workers and unions and adapted to national conditions.","timing":"Before and during workforce transitions","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-C810ED9CC5","intent":"support workers displaced by ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-19f6b1493553854bc8f23afdad207140d3874988866f86a2b41364feb8087bcd","kind":"rule-candidate","status":"pending","body":{"title":"Evaluate training-data quality continuously","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 71","actor":"UNESCO Member States","modality":"should","action":"evaluate","object":"training data quality continuously","condition":"Within AI data-governance strategies, including collection, selection, security, protection and feedback processes.","evidenceSummary":"Paragraph 71 calls for continual evaluation of training-data quality and the adequacy of collection and selection processes.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Methods should match the dataset, sector and system context.","timing":"Continuously throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-B9421D0247","intent":"evaluate training data quality continuously","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-1b37ed980c194fc23a070da96b24508ec75fa3f4bcef24b2eb199185065e9227","kind":"rule-candidate","status":"pending","body":{"title":"Explain factors, processes and logic behind AI outputs","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 40","actor":"AI actors","modality":"should","action":"explain","object":"factors, processes and logic behind AI outputs","condition":"For non-temporary, difficult-to-reverse or more-than-low-risk decisions affecting end users.","evidenceSummary":"Paragraph 40 calls for explainable algorithms and a meaningful explanation accompanying higher-impact decisions.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Explainability should be appropriate to context and balanced with privacy, safety and security.","timing":"With the consequential decision","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-F193592F11","intent":"explain factors processes and logic behind ai outputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-1b7ea3899b5340c63aaf09a60c7fb1cd225c3737bb9424200052a7013db0dd3e","kind":"rule-candidate","status":"pending","body":{"title":"Minimize discriminatory or biased AI outcomes","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 29","actor":"AI actors","modality":"should","action":"minimize","object":"discriminatory or biased AI outcomes","condition":"Throughout the AI-system lifecycle.","evidenceSummary":"Paragraph 29 asks AI actors to make reasonable efforts to minimize and avoid reinforcing or perpetuating discriminatory or biased applications and outcomes.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"The Recommendation frames the duty as all reasonable efforts.","timing":"Throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-89F2838F2B","intent":"minimize discriminatory or biased ai outcomes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-1e47541f8f814223ae14d0fe87214894af5a340026cfefc61819e25bf4cd84be","kind":"rule-candidate","status":"pending","body":{"title":"Require human final diagnosis and treatment decisions","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 123(e)","actor":"UNESCO Member States and health-care providers","modality":"should","action":"require","object":"human final diagnosis and treatment decisions","condition":"When AI assists health-care prediction, detection, diagnosis or treatment.","evidenceSummary":"Paragraph 123(e) calls for human care and final diagnosis and treatment decisions always to be taken by humans, while allowing AI assistance.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"AI systems may assist health professionals but do not replace the final human decision.","timing":"At diagnosis and treatment decision time","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-B40AC286CA","intent":"require human final diagnosis and treatment decisions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-202dc103681e14056b9948ee92199cba17d406cbea2977987f330e5f14d0a270","kind":"rule-candidate","status":"pending","body":{"title":"Justify the selected AI method","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 26(a)-(c)","actor":"AI actors and UNESCO Member States","modality":"should","action":"justify","object":"the selected AI method","condition":"When choosing whether and how to use an AI system.","evidenceSummary":"Paragraph 26 calls for an AI method to be appropriate and proportionate to a legitimate aim, consistent with the Recommendation's values and human rights, context-appropriate, and scientifically grounded.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"The method may vary by legitimate aim and context, but it must not violate or abuse human rights.","timing":"Before selecting or deploying an AI method","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-E052965EDE","intent":"justify the selected ai method","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-2066c1c4ca6b2866f089c2c69b25e4ae46332539b878b7bdb0d9d9cad6aea2da","kind":"rule-candidate","status":"pending","body":{"title":"Test human-rights-risk AI before market release","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 51","actor":"AI actors","modality":"should","action":"test","object":"human-rights-risk AI before market release","condition":"When an AI system is identified as posing potential risks to human rights.","evidenceSummary":"Paragraph 51 calls for broad testing, including real-world testing when needed, as part of an ethical impact assessment before market release.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Real-world conditions are used when needed and remain subject to applicable safeguards.","timing":"Before market release","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-5A829F7830","intent":"test human rights risk ai before market release","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-24156d582554536870e3e2dacb15a905bcd0536c779dce853dc85d19f0ec7264","kind":"rule-candidate","status":"pending","body":{"title":"Obtain informed consent for health-data analysis","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 123(d)","actor":"UNESCO Member States and health-AI actors","modality":"should","action":"obtain","object":"informed consent for health data analysis","condition":"When personal data is analyzed by AI for prediction, detection or treatment in health care.","evidenceSummary":"Paragraph 123(d) calls for effective mechanisms so data subjects are aware of and consent to use and analysis of their personal data.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Consent mechanisms should not prevent access to health care and remain subject to applicable law.","timing":"Before use or analysis of personal health data","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-69428D74D8","intent":"obtain informed consent for health data analysis","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-2f63183763fe1be93fc6386b89edfeaab8a70c50f5f5b594dd547e0cba5a3928","kind":"rule-candidate","status":"pending","body":{"title":"Regulate health AI for safety and clinical evidence","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 122","actor":"UNESCO Member States","modality":"should","action":"regulate","object":"health AI for safety and clinical evidence","condition":"For development and deployment of AI systems related to physical or mental health, with attention to children and youth.","evidenceSummary":"Paragraph 122 calls for health AI to be safe, effective, efficient, scientifically and medically proven and supportive of evidence-based innovation.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Regulation should remain consistent with evidence-based innovation and medical progress.","timing":"Before clinical deployment and during operation","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-0CEAB16BD8","intent":"regulate health ai for safety and clinical evidence","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-31acfcdef222251837bc7099f4afcd60e4fb3fad041ebd29f99242dbf3d11d37","kind":"rule-candidate","status":"pending","body":{"title":"Redress harms caused by AI systems","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 55","actor":"UNESCO Member States and private- and public-sector companies","modality":"should","action":"redress","object":"harms caused by AI systems","condition":"When investigation establishes AI-related harm.","evidenceSummary":"Paragraph 55 calls for remedial actions and remediation mechanisms to redress AI harms and protect human rights and the rule of law.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Remediation should follow applicable legal and institutional processes.","timing":"After harm is established","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-2683D90976","intent":"redress harms caused by ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-4db0629c51fc8c13b884c25417d8d515cea88d76408b8b9a696ec11b0de88e6d","kind":"rule-candidate","status":"pending","body":{"title":"Monitor every AI-system lifecycle phase","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 52","actor":"UNESCO Member States and business enterprises","modality":"should","action":"monitor","object":"all AI system lifecycle phases","condition":"Including decision algorithms, data and involved AI actors, especially in public services and direct-user contexts.","evidenceSummary":"Paragraph 52 calls for measures to monitor all lifecycle phases as part of ethical impact assessment.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Monitoring measures should reflect the system and use context.","timing":"Continuously throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-1EEC637757","intent":"monitor all ai system lifecycle phases","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-567d15be52cd2b910d6846d9838b06155f34e06638a2a0b3438904045518f389","kind":"rule-candidate","status":"pending","body":{"title":"Do not cede life-and-death decisions to AI","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraphs 26 and 36","actor":"AI actors and UNESCO Member States","modality":"must not","action":"cede","object":"life-and-death decisions to AI systems","condition":"Where a decision may be irreversible, difficult to reverse, or involve life and death.","evidenceSummary":"Paragraphs 26 and 36 reserve final determination for humans in irreversible or life-and-death contexts and state that such decisions should not be ceded to AI systems.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"AI may assist human decision-making, but ultimate responsibility remains human.","timing":"At decision time","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-FE48418DC7","intent":"cede life and death decisions to ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-5e27b96aa2f4dd415e2a0f3e7a6824722432f3e899843377b0c98ef75b50a070","kind":"rule-candidate","status":"pending","body":{"title":"Introduce ethical-impact-assessment frameworks","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 50","actor":"UNESCO Member States","modality":"should","action":"introduce","object":"ethical impact assessment frameworks","condition":"For AI systems and their human-rights, labour, environmental, ethical and social impacts.","evidenceSummary":"Paragraph 50 calls for assessment frameworks that identify benefits, concerns and risks and define prevention, mitigation, monitoring and assurance measures.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Frameworks should reflect national circumstances and facilitate citizen participation.","timing":"Before deployment and during monitoring","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-D235002FA2","intent":"introduce ethical impact assessment frameworks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-5e4ca39564a4f1ca2f6befc4d3275f68a76bc521249e39ef702c85e668799345","kind":"rule-candidate","status":"pending","body":{"title":"Self-assess existing and proposed public AI systems","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 57","actor":"UNESCO Member States and public authorities","modality":"should","action":"self-assess","object":"existing and proposed public AI systems","condition":"Before deciding whether adoption is appropriate and during review of existing systems.","evidenceSummary":"Paragraph 57 calls for transparent self-assessment of existing and proposed AI systems, including whether adoption and the selected method are appropriate.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Assessment depth should reflect the system's context and potential human-rights impact.","timing":"Before adoption and during periodic review","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-F3DC6726AA","intent":"self assess existing and proposed public ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-5e651364ad04542e190470187cab7fa30442fa6a6a36eee13825b040dcad7a69","kind":"rule-candidate","status":"pending","body":{"title":"Attribute AI responsibility to persons or legal entities","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 35","actor":"UNESCO Member States","modality":"should","action":"attribute","object":"AI ethical and legal responsibility to persons or legal entities","condition":"For every lifecycle stage and remedy involving an AI system.","evidenceSummary":"Paragraph 35 calls for ethical and legal responsibility to remain attributable to physical persons or existing legal entities.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Oversight may be individual or inclusive public oversight as appropriate.","timing":"Throughout the lifecycle and during remedy","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-60A1D85D1C","intent":"attribute ai ethical and legal responsibility to persons or legal entities","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-6116d662a6bfc18835123f7c1754b0ca25877e1a3322ddc19e97367eef815e5d","kind":"rule-candidate","status":"pending","body":{"title":"Do not apply prohibited social scoring","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 26","actor":"AI actors and UNESCO Member States","modality":"must not","action":"apply","object":"prohibited social scoring","condition":"When selecting or using AI methods.","evidenceSummary":"Paragraph 26 states that AI systems should not be used for social scoring purposes.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"None stated for social scoring in the Recommendation.","timing":"Throughout selection, deployment and use","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-342C0977BB","intent":"apply prohibited social scoring","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-6934a1adfdc69e62923520b060bacfc58138a37b39d44d1856387ab0501a8d15","kind":"rule-candidate","status":"pending","body":{"title":"Evaluate AI sustainability impacts continuously","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 31","actor":"UNESCO Member States and AI actors","modality":"should","action":"evaluate","object":"AI sustainability impacts continuously","condition":"Across human, social, cultural, economic and environmental dimensions.","evidenceSummary":"Paragraph 31 calls for continuous assessment of AI's impacts on sustainability, informed by evolving objectives such as the UN Sustainable Development Goals.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Assessment dimensions evolve with sustainability goals and system context.","timing":"Continuously throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-CCA033749A","intent":"evaluate ai sustainability impacts continuously","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-6ba575c4453c8a3a77c88b5fac0f90cf3f0cbb14e2ee283c458ad4acbc352685","kind":"rule-candidate","status":"pending","body":{"title":"Combat stereotypes in AI outputs","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 66","actor":"UNESCO Member States and AI actors","modality":"should","action":"combat","object":"stereotypes in AI outputs","condition":"Whether stereotypes arise by design or negligence, with particular attention to data-scarce regions.","evidenceSummary":"Paragraph 66 calls for mechanisms requiring AI actors to disclose and combat stereotyping in AI-system outcomes and data.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Implementation should respect freedom of expression and access to information.","timing":"During development, evaluation and operation","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-38F34770A2","intent":"combat stereotypes in ai outputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-6dd1ba79f9f79b759464fd40ff2a60a83649ed783319253354cfd5efe33ed78c","kind":"rule-candidate","status":"pending","body":{"title":"Prohibit AI use that violates human-rights obligations","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 57","actor":"UNESCO Member States and public authorities","modality":"must not","action":"use","object":"AI that violates human rights obligations","condition":"When a transparent self-assessment finds that adoption would cause violations or abuses of human-rights obligations.","evidenceSummary":"Paragraph 57 calls for public authorities to prohibit AI use when assessment shows that adoption would violate or abuse the State's human-rights obligations.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"The prohibition follows a documented assessment under the Member State's legal framework.","timing":"Before adoption or continued use","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-BE5C54B56C","intent":"use ai that violates human rights obligations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-7272e160b2c9766396f4f07b786db5773c76c54ec4db1746d900dd284e10949e","kind":"rule-candidate","status":"pending","body":{"title":"Implement data protection by design","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 34","actor":"AI actors","modality":"should","action":"implement","object":"data protection by design","condition":"When designing and implementing AI systems that process personal information.","evidenceSummary":"Paragraph 34 calls for an innovative privacy-by-design approach and accountability for protecting personal information throughout the AI lifecycle.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Implementation should be proportionate to the system and processing context.","timing":"From design through end-of-use","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-6BBD510385","intent":"implement data protection by design","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-72b54400f50bbfd45929486180740b9def20b15fa633aff6183e79a5a175379c","kind":"rule-candidate","status":"pending","body":{"title":"Establish public-sector ethical-impact-assessment procedures","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 53","actor":"Governments","modality":"should","action":"establish","object":"public sector ethical impact assessment procedures","condition":"Particularly for public authorities adopting or deploying AI systems.","evidenceSummary":"Paragraph 53 calls for a regulatory procedure for public authorities to predict consequences, mitigate risks, avoid harms, support participation and address societal challenges.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Assessments may be public where appropriate and should be multidisciplinary, pluralistic and inclusive.","timing":"Before adoption and throughout monitoring","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-E33B4DC8D1","intent":"establish public sector ethical impact assessment procedures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-84965ff4df6029b27b4501be10428b00d6df52ce31ac0a0902ebdbc42da78840","kind":"rule-candidate","status":"pending","body":{"title":"Provide an effective remedy for algorithmic discrimination","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 29","actor":"UNESCO Member States and AI actors","modality":"should","action":"provide","object":"an effective remedy against algorithmic discrimination","condition":"When discrimination or biased algorithmic determination occurs.","evidenceSummary":"Paragraph 29 states that an effective remedy should be available against discrimination and biased algorithmic determination.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Remedy mechanisms operate under applicable national and international law.","timing":"When affected persons challenge discriminatory outcomes","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-5987C9FFC0","intent":"provide an effective remedy against algorithmic discrimination","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-86d8b5827f14decf03a304cf344aecc9fbc8829d2f4990105d18aded5b35e0c7","kind":"rule-candidate","status":"pending","body":{"title":"Appoint an independent AI Ethics Officer","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 58","actor":"Public entities, private-sector companies and civil-society organizations","modality":"may","action":"appoint","object":"an independent AI Ethics Officer","condition":"To oversee ethical impact assessment, auditing, continuous monitoring and ethical guidance.","evidenceSummary":"Paragraph 58 encourages organizations to consider an independent AI Ethics Officer or equivalent mechanism for oversight.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"An equivalent oversight mechanism may be used instead of a named officer.","timing":"Before and during AI governance activities","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-3C84D30D8C","intent":"appoint an independent ai ethics officer","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-8828b5520fc1d7ed297a5735e859aef00a05d9e84ae7058d32c004c7a7cbf2bb","kind":"rule-candidate","status":"pending","body":{"title":"Investigate harms caused by AI systems","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 55","actor":"UNESCO Member States","modality":"should","action":"investigate","object":"harms caused by AI systems","condition":"When AI systems may have caused harm in digital or physical contexts.","evidenceSummary":"Paragraph 55 calls for AI harms to be investigated through strong enforcement mechanisms and institutional capacity.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Investigation should comply with applicable law and due process.","timing":"After suspected or reported harm","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-CC0AFE2F97","intent":"investigate harms caused by ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-8ee46d2d708661cda8c5610a686389cd6f4120c02afe347dba3c56bb3b426600","kind":"rule-candidate","status":"pending","body":{"title":"Assess lifecycle environmental impacts of AI","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 84","actor":"UNESCO Member States and business enterprises","modality":"should","action":"assess","object":"direct and indirect AI lifecycle environmental impacts","condition":"Including carbon footprint, energy use and raw-material extraction supporting AI technologies.","evidenceSummary":"Paragraph 84 calls for lifecycle assessment and reduction of AI-system and data-infrastructure environmental impacts.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Assessment should reflect direct and indirect impacts and applicable environmental law.","timing":"Throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-E2FCA42DFE","intent":"assess direct and indirect ai lifecycle environmental impacts","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-9078a029da7c24c9df4e1f6bf145a94daefd377fde1256e7129d0e4e6f82134e","kind":"rule-candidate","status":"pending","body":{"title":"Perform a data-protection impact assessment","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 34","actor":"AI actors","modality":"should","action":"perform","object":"a data protection impact assessment","condition":"For algorithmic systems that process personal information.","evidenceSummary":"Paragraph 34 calls for adequate privacy impact assessments that include societal and ethical considerations.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Scope should reflect the system's use and personal-data processing context.","timing":"Before deployment and when processing changes materially","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-54647B2218","intent":"perform a data protection impact assessment","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-9692673835adb623c1fcd6775fb14d5ffcac5b0fcc96de116e8dd2955a3f3e2e","kind":"rule-candidate","status":"pending","body":{"title":"Disclose AI interaction","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 38","actor":"AI actors","modality":"should","action":"disclose","object":"AI interaction","condition":"When a product or service is provided directly by or with the assistance of AI.","evidenceSummary":"Paragraph 38 calls for users to be informed properly and promptly when AI directly provides or assists a product or service.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Disclosure depth should reflect context and impact.","timing":"Properly and promptly during the interaction","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-C8E01637B6","intent":"disclose ai interaction","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-a4dba778f45c56b2075db4e8f4ffac87a753c3848b2e259ca32e739175cfab7b","kind":"rule-candidate","status":"pending","body":{"title":"Inform people about AI-based decisions","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 38","actor":"Relevant AI actors and public-sector institutions","modality":"should","action":"inform","object":"people of decisions informed by AI","condition":"When a decision is informed by or based on AI, especially where safety or human rights are affected.","evidenceSummary":"Paragraph 38 says people should be fully informed when a decision is informed by or made on the basis of AI algorithms.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"The transparency level may be balanced against privacy, safety and security according to context and impact.","timing":"At or before communicating the decision","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-D1348F48FB","intent":"inform people of decisions informed by ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-b3acf33e982f54a3059fb75da8bf84932bc907ba20284fc3f7f6990477ba8e83","kind":"rule-candidate","status":"pending","body":{"title":"Promote public AI-literacy education","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 44","actor":"Governments, intergovernmental organizations, civil society, academia, media, community leaders and the private sector","modality":"should","action":"promote","object":"public AI literacy education","condition":"For diverse technical and non-technical publics.","evidenceSummary":"Paragraph 44 calls for open and accessible education, civic engagement, digital skills, AI-ethics training and media and information literacy.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Programs should account for linguistic, social and cultural diversity.","timing":"Ongoing","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-0E2968834F","intent":"promote public ai literacy education","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-cab1670be9880a87a14700c71d4fd05a2a4ee4608072030f2bea94c7d0edd3ec","kind":"rule-candidate","status":"pending","body":{"title":"Secure sensitive personal data","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 74","actor":"UNESCO Member States","modality":"should","action":"secure","object":"sensitive personal data","condition":"Where disclosure may cause exceptional damage, injury or hardship.","evidenceSummary":"Paragraph 74 calls for data policies or equivalent frameworks that ensure full security for personal and sensitive data.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Examples include offence, biometric, genetic, health and protected-characteristic data; applicable law controls classification.","timing":"Throughout collection, use, sharing, storage and deletion","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-71AB7A284C","intent":"secure sensitive personal data","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-d20f4f57c7191ee40db2f304d9f1b55b865885b04e622506f7b0e8438e403a80","kind":"rule-candidate","status":"pending","body":{"title":"Ensure AI-process traceability","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 43","actor":"AI actors and UNESCO Member States","modality":"should","action":"ensure","object":"AI process traceability","condition":"To support accountability and identify conflicts with human-rights norms or environmental well-being.","evidenceSummary":"Paragraph 43 calls for technical and institutional designs that make AI systems auditable and traceable throughout their lifecycle.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Designs should account for applicable privacy, security and legal limits.","timing":"Throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-A26D278094","intent":"ensure ai process traceability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-d45ac8cfddbd64f61e22c945ce58ab5404be2c702bf46307bb24eee075136924","kind":"rule-candidate","status":"pending","body":{"title":"Develop AI human-rights due-diligence mechanisms","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 51","actor":"UNESCO Member States and private-sector companies","modality":"should","action":"develop","object":"AI human rights due diligence mechanisms","condition":"To identify, prevent, mitigate and account for AI impacts on human rights, the rule of law and inclusive societies.","evidenceSummary":"Paragraph 51 calls for due-diligence and oversight mechanisms covering identification, prevention, mitigation and accountability for AI impacts.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Mechanisms should be tailored to the actor's role and system context.","timing":"Before release and throughout operation","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-FDFFEEE98F","intent":"develop ai human rights due diligence mechanisms","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-d8af7557e83a9b59f6c17a937c4473e909e05a231a20e145aaeeaafa66ca33e1","kind":"rule-candidate","status":"pending","body":{"title":"Monitor acquired AI in human-rights-sensitive uses","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 62","actor":"UNESCO Member States acquiring AI systems","modality":"should","action":"monitor","object":"acquired AI in human rights sensitive use cases","condition":"For uses such as law enforcement, welfare, employment, media, health care and the judiciary.","evidenceSummary":"Paragraph 62 calls for appropriate oversight authorities to monitor the social and economic impact of acquired AI in human-rights-sensitive use cases.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Oversight can be performed by data-protection, sectoral or other public oversight bodies.","timing":"During procurement, deployment and operation","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-BACFD21F80","intent":"monitor acquired ai in human rights sensitive use cases","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-fbc675d433f2de53bdc548a3a1edf04e428cbe4984e666a135a022517f4a16af","kind":"rule-candidate","status":"pending","body":{"title":"Maintain AI-system robustness, security and safety","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 27","actor":"AI actors","modality":"should","action":"maintain","object":"AI system robustness, security and safety","condition":"Across the AI-system lifecycle.","evidenceSummary":"Paragraph 27 calls for safety harms and security vulnerabilities to be avoided, addressed, prevented and eliminated throughout the AI lifecycle.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Measures should remain proportionate to the system and context.","timing":"Continuously throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-F634CFE326","intent":"maintain ai system robustness security and safety","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"change-eu-ai-act-d32741d8f24e35430c54acdc6fef90be02cf2989bdc8cbbd516036caa3776117","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-11T13:02:32.325Z","fingerprint":"d32741d8f24e35430c54acdc6fef90be02cf2989bdc8cbbd516036caa3776117","previousFingerprint":"131b49699f7f9f7d911d511e1ac6eeed9109576c33f1492aa5321ab07b92273b","bytes":1534741,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-11T13:02:32.325Z","reviewed_at":null},{"id":"change-eu-gdpr-c1db6de6e2eacd1b35a45fad77332fa761f2205912aa7e4f166a5ffd3e34f8bc","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-11T13:02:32.325Z","fingerprint":"c1db6de6e2eacd1b35a45fad77332fa761f2205912aa7e4f166a5ffd3e34f8bc","previousFingerprint":"f9f622ce4ac6b1148dd0935711ecb56f8fac6ff65d8e6d68a906942e93b6d114","bytes":1071098,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-11T13:02:32.325Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-6eea7382848332286deaadfa923a4fccb85184b52867f1097cbc63b19943863c","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-11T13:02:32.325Z","fingerprint":"6eea7382848332286deaadfa923a4fccb85184b52867f1097cbc63b19943863c","previousFingerprint":"93bb4040ed7ccd48aa107314ac0f0d630cf5141e3a6f980149e1b771d8f57c1c","bytes":708514,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-11T13:02:32.325Z","reviewed_at":null},{"id":"finding-01e224a495c23605319f42e0e1e5a0bee13ad5df854268f2aa43f6b38ed085c1","kind":"rule-candidate","status":"pending","body":{"title":"Support workers displaced by AI","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.4(b)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"support","object":"workers displaced by AI","condition":"As AI is deployed and affects labour-market transitions.","evidenceSummary":"Recommendation 2.4(b) recommends support for people affected by displacement, including social protection and access to new opportunities.","url":"https://oecd.ai/en/ai-principles","exception":"Measures may include training, social protection and labour-market opportunities and should be shaped through social dialogue.","timing":"During AI-driven labour transitions","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-C810ED9CC5","intent":"support workers displaced by ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-0d41db6d12f1f56327cb5deddf8f2bf2378a8009f156fa2269893ae3b4b40649","kind":"rule-candidate","status":"pending","body":{"title":"Establish mechanisms to appeal AI outcomes","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.3(iv)","actor":"AI actors","modality":"should","action":"establish","object":"mechanisms to appeal AI outcomes","condition":"When a person is adversely affected by an AI system output.","evidenceSummary":"Principle 1.3(iv) recommends information that enables adversely affected people to challenge an AI output.","url":"https://oecd.ai/en/ai-principles","exception":"Mechanism and information should be appropriate to context and consistent with the state of the art.","timing":"After or in connection with an adverse AI output","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-6E499BCE84","intent":"establish mechanisms to appeal ai outcomes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-314a7b9c7515fdf90097a17855536fbf98bad5ca691957c7da0d6a596f551922","kind":"rule-candidate","status":"pending","body":{"title":"Disclose AI capabilities and limitations","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.3(i)","actor":"AI actors","modality":"should","action":"disclose","object":"AI system capabilities and limitations","condition":"When meaningful information can foster general understanding of the AI system.","evidenceSummary":"Principle 1.3(i) calls for meaningful information that supports understanding of system capabilities and limitations.","url":"https://oecd.ai/en/ai-principles","exception":"Information should be appropriate to context and consistent with the state of the art.","timing":"When communicating about or making the AI system available","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-3A544071D1","intent":"disclose ai system capabilities and limitations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-373bc73aa3f3e1277d2b8e0fa92652fc4b87a15b69ed0a89fa600a29ff1839d0","kind":"rule-candidate","status":"pending","body":{"title":"Define safe AI decommissioning procedures","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.4(b)","actor":"AI actors","modality":"should","action":"define","object":"safe AI decommissioning procedures","condition":"For AI systems that risk undue harm or exhibit undesired behavior.","evidenceSummary":"Principle 1.4(b) recommends mechanisms that allow AI systems to be decommissioned safely as needed.","url":"https://oecd.ai/en/ai-principles","exception":"As appropriate to the system and context.","timing":"Before deployment and available when decommissioning becomes necessary","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-B098FE0267","intent":"define safe ai decommissioning procedures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-428970aef084bfe451a8d1f878bf8ffb0511eaf3e3bce816e5ab719516ab3e17","kind":"rule-candidate","status":"pending","body":{"title":"Apply ongoing systematic AI risk management","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.5(c)","actor":"AI actors","modality":"should","action":"apply","object":"ongoing systematic AI risk management","condition":"To each AI lifecycle phase, based on role, context and ability to act.","evidenceSummary":"Principle 1.5(c) recommends an ongoing systematic risk-management approach across the AI lifecycle.","url":"https://oecd.ai/en/ai-principles","exception":"Risk treatment is role-, context- and capability-dependent.","timing":"Ongoing across every lifecycle phase","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-175EC9774A","intent":"apply ongoing systematic ai risk management","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-5da30aa402de13696a9ad4976db356468e31b15b5c346e5da2ec16454b30bf6b","kind":"rule-candidate","status":"pending","body":{"title":"Invest in representative privacy-respecting open datasets","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.1(b)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"invest","object":"representative privacy-respecting open datasets","condition":"To support AI research and development that is free from harmful bias and improves interoperability and standards use.","evidenceSummary":"Recommendation 2.1(b) recommends public investment and encouragement of private investment in representative, privacy-respecting open datasets.","url":"https://oecd.ai/en/ai-principles","exception":"Governments are asked to consider public investment and encourage private investment; privacy and data-protection constraints remain.","timing":"As part of AI research and development policy","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-7E9156278D","intent":"invest representative privacy respecting open datasets","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-721f3ec1f140b00b50d75ba8ad8ec03025afbaabbd2372a5c20124594919a1b0","kind":"rule-candidate","status":"pending","body":{"title":"Enable safe AI-system override","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.4(b)","actor":"AI actors","modality":"should","action":"enable","object":"safe override of harmful AI behavior","condition":"When an AI system risks undue harm or exhibits undesired behavior.","evidenceSummary":"Principle 1.4(b) recommends mechanisms that permit safe override when AI risks undue harm or behaves undesirably.","url":"https://oecd.ai/en/ai-principles","exception":"As appropriate to the system and context.","timing":"Available during operation and incident response","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-818859099F","intent":"enable safe override of harmful ai behavior","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-78e17c1cb390ada2172749fcf01222c6388b3ce6a8db653efbaaaafa12f2a99c","kind":"rule-candidate","status":"pending","body":{"title":"Develop global technical standards for trustworthy AI","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.5(c)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"develop","object":"global technical standards for trustworthy AI","condition":"Through multi-stakeholder and consensus-driven processes.","evidenceSummary":"Recommendation 2.5(c) recommends promoting global technical standards for interoperable and trustworthy AI.","url":"https://oecd.ai/en/ai-principles","exception":"Standards should be multi-stakeholder, consensus-driven, interoperable and global.","timing":"Through ongoing international cooperation","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-FADE655905","intent":"develop global technical standards for trustworthy ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-8051e6c48381365d7f52d81d8b100d494fba0596d45029dbd659a89314b47ade","kind":"rule-candidate","status":"pending","body":{"title":"Enable controlled environments for AI testing","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.3(a)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"enable","object":"controlled environments for AI testing","condition":"When supporting trustworthy AI transition from research and development to deployment and operation.","evidenceSummary":"Recommendation 2.3(a) says governments should consider experimentation in controlled environments for testing and scaling trustworthy AI.","url":"https://oecd.ai/en/ai-principles","exception":"Use experimentation and scaling only as appropriate; prefer outcome-based and interoperable approaches.","timing":"Before or during transition to deployment","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-00C55B6E08","intent":"enable controlled environments for ai testing","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-8164bd45e3f0b09cb5901178411547c84eea3f516381edeb8d10eb0259051534","kind":"rule-candidate","status":"pending","body":{"title":"Enable repair of harmful AI behavior","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.4(b)","actor":"AI actors","modality":"should","action":"enable","object":"repair of harmful AI behavior","condition":"When an AI system risks undue harm or exhibits undesired behavior.","evidenceSummary":"Principle 1.4(b) recommends mechanisms that permit repair when AI risks undue harm or behaves undesirably.","url":"https://oecd.ai/en/ai-principles","exception":"As appropriate to the system and context.","timing":"Available during operation and incident response","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-6C4AF0912E","intent":"enable repair of harmful ai behavior","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-8adcb8c7111044230241ba4804e36bddf9876e652a7d6b59090a13c125826500","kind":"rule-candidate","status":"pending","body":{"title":"Adapt policy frameworks for trustworthy AI","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.3(b)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"adapt","object":"policy frameworks for trustworthy AI","condition":"After reviewing how existing policy and regulatory frameworks and assessment mechanisms apply to AI systems.","evidenceSummary":"Recommendation 2.3(b) recommends reviewing and adapting frameworks to encourage trustworthy-AI innovation and competition.","url":"https://oecd.ai/en/ai-principles","exception":"Adaptation is required only as appropriate after review.","timing":"Periodically as AI systems and evidence evolve","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-258BC7584E","intent":"adapt policy frameworks for trustworthy ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-8bbdfd0dca5c4a80a6b5a9808cac48effb9572ca2f6fb5e7b99ebeba953eba88","kind":"rule-candidate","status":"pending","body":{"title":"Ensure AI-process traceability","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.5(b)","actor":"AI actors","modality":"should","action":"ensure","object":"AI process traceability","condition":"Where traceability supports analysis of outputs and responses to inquiry.","evidenceSummary":"Principle 1.5(b) includes process traceability as an accountability mechanism.","url":"https://oecd.ai/en/ai-principles","exception":"Appropriate to context and consistent with the state of the art.","timing":"Throughout relevant lifecycle phases","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-A26D278094","intent":"ensure ai process traceability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-a0a14a297a5221de41b3488427339acc9b6c8b82190a65c4aadcd27b313172ba","kind":"rule-candidate","status":"pending","body":{"title":"Ensure AI-dataset traceability","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.5(b)","actor":"AI actors","modality":"should","action":"ensure","object":"AI dataset traceability","condition":"Where traceability supports analysis of outputs and responses to inquiry.","evidenceSummary":"Principle 1.5(b) includes dataset traceability as an accountability mechanism.","url":"https://oecd.ai/en/ai-principles","exception":"Appropriate to context and consistent with the state of the art.","timing":"Throughout relevant lifecycle phases","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-B560A4296B","intent":"ensure ai dataset traceability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-ab42d124126c5912e00b348fbd90612083be2858d34731dc7b4a776583e76a52","kind":"rule-candidate","status":"pending","body":{"title":"Maintain AI robustness, security and safety","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.4(a)","actor":"AI actors","modality":"should","action":"maintain","object":"AI system robustness security and safety","condition":"Under normal use, foreseeable use or misuse, and other adverse conditions.","evidenceSummary":"Principle 1.4(a) recommends lifecycle-wide robustness, security and safety so systems function appropriately without unreasonable risks.","url":"https://oecd.ai/en/ai-principles","exception":"The recommendation targets unreasonable safety or security risks and depends on actor role and context.","timing":"Throughout the AI system lifecycle","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-F634CFE326","intent":"maintain ai system robustness security and safety","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-ac4f2ab102b94be62e0e8ad573803ab34da403214214332c5869b06a393d7ae8","kind":"rule-candidate","status":"pending","body":{"title":"Enable effective human oversight of AI systems","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.2(b)","actor":"AI actors, according to their lifecycle roles","modality":"should","action":"enable","object":"effective human oversight","condition":"Where needed to address risks from intended use, use outside intended purpose, intentional misuse or unintentional misuse.","evidenceSummary":"Principle 1.2(b) recommends mechanisms and safeguards that preserve human agency and oversight.","url":"https://oecd.ai/en/ai-principles","exception":"Implementation should be appropriate to the context and consistent with the state of the art.","timing":"During relevant lifecycle phases","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-9F0606F820","intent":"enable effective human oversight","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-ae71438687970045f20ebd365f7ca6e60089d9c04862a4865841268986dfd658","kind":"rule-candidate","status":"pending","body":{"title":"Ensure AI lifecycle-decision traceability","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.5(b)","actor":"AI actors","modality":"should","action":"ensure","object":"AI lifecycle decision traceability","condition":"Where traceability supports analysis of outputs and responses to inquiry.","evidenceSummary":"Principle 1.5(b) includes traceability of decisions made during the AI lifecycle.","url":"https://oecd.ai/en/ai-principles","exception":"Appropriate to context and consistent with the state of the art.","timing":"Throughout relevant lifecycle phases","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-0E0C140628","intent":"ensure ai lifecycle decision traceability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-ae92d01631f036a088fab5d833f5e6b4ad257d21a434fafc0ff8d59a7b916a95","kind":"rule-candidate","status":"pending","body":{"title":"Respect human rights throughout the AI lifecycle","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.2(a)","actor":"AI actors, according to their lifecycle roles","modality":"should","action":"respect","object":"human rights throughout the AI system lifecycle","condition":"Across planning, data processing, model building, testing, deployment, operation, monitoring and retirement, as applicable to the actor's role.","evidenceSummary":"Principle 1.2(a) recommends that AI actors respect human rights and human-centred democratic values throughout the AI lifecycle.","url":"https://oecd.ai/en/ai-principles","exception":"Role- and context-dependent; rights include non-discrimination, privacy, dignity, autonomy, fairness and internationally recognised labour rights.","timing":"Throughout the AI system lifecycle","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-F48890400A","intent":"respect human rights throughout the ai system lifecycle","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-b8ee999a5f91f8bf5e1aa311e7df6c497d3a82ce471962d76350f317f7526d73","kind":"rule-candidate","status":"pending","body":{"title":"Develop comparable indicators of AI activity","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.5(d)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"develop","object":"internationally comparable AI indicators","condition":"To measure AI research, development and deployment and assess implementation progress.","evidenceSummary":"Recommendation 2.5(d) recommends internationally comparable indicators and an evidence base for implementation progress.","url":"https://oecd.ai/en/ai-principles","exception":"Indicators should be internationally comparable and tied to research, development and deployment evidence.","timing":"Ongoing measurement and assessment","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-3D3C10AB41","intent":"develop internationally comparable ai indicators","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-b9bf89024bef3a1454fb465d69d4964de40e6e7fb4d899aaaca9ca3cd9e87c81","kind":"rule-candidate","status":"pending","body":{"title":"Promote responsible AI use at work","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.4(c)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"promote","object":"responsible AI use at work","condition":"Working closely with stakeholders to improve worker safety, job quality and public services.","evidenceSummary":"Recommendation 2.4(c) calls on governments to promote responsible workplace AI use and broadly shared benefits.","url":"https://oecd.ai/en/ai-principles","exception":"Implementation should enhance safety and job quality and account for stakeholder roles.","timing":"During workplace AI adoption and operation","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-59C3D0945B","intent":"promote responsible ai use at work","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-c38b54abe73007a67fb8cf0a2cd0bd125ebd12795e044b3d6b46a85bfe28e33c","kind":"rule-candidate","status":"pending","body":{"title":"Explain sources of AI data and inputs","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.3(iii)","actor":"AI actors","modality":"should","action":"explain","object":"sources of AI data and inputs","condition":"When explanation is feasible and useful for people affected by an AI output.","evidenceSummary":"Principle 1.3(iii) identifies plain information on data and input sources as part of contextual explanation.","url":"https://oecd.ai/en/ai-principles","exception":"Only where feasible and useful; detail should be context-appropriate and consistent with the state of the art.","timing":"When providing an explanation of an AI output","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-ADAE26B414","intent":"explain sources of ai data and inputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-c3b6083512d27741aa65376373042988cb3b0946aed7a88cb9e4e2b2a099ce20","kind":"rule-candidate","status":"pending","body":{"title":"Equip people with skills to use AI effectively","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.4(a)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"equip","object":"people with skills to use AI effectively","condition":"In preparation for transformation of work and society, working closely with stakeholders.","evidenceSummary":"Recommendation 2.4(a) calls for empowering people to use and interact with AI by equipping them with necessary skills.","url":"https://oecd.ai/en/ai-principles","exception":"Implementation should cover the breadth of AI applications and reflect stakeholder needs.","timing":"As part of workforce and societal transition planning","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-0CA4CB8FA7","intent":"equip people with skills to use ai effectively","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-cd0ac74387b7e04be64b981b25c839f516e6961f587df992fb17780b616b1c2b","kind":"rule-candidate","status":"pending","body":{"title":"Bolster information integrity in AI systems","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.4(c)","actor":"AI actors","modality":"should","action":"bolster","object":"information integrity in AI systems","condition":"When information-integrity mechanisms are technically feasible.","evidenceSummary":"Principle 1.4(c) recommends mechanisms that strengthen information integrity while protecting freedom of expression.","url":"https://oecd.ai/en/ai-principles","exception":"Only where technically feasible, and measures must respect freedom of expression.","timing":"Across relevant design and operation phases","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-768D94AE56","intent":"bolster information integrity in ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-d07556a64e0b52b92c9c6648ac29648bbafef3a6e474820bc01e0d72941e09ab","kind":"rule-candidate","status":"pending","body":{"title":"Inform stakeholders when they interact with AI","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.3(ii)","actor":"AI actors","modality":"should","action":"inform","object":"stakeholders of AI interactions","condition":"When stakeholders interact with an AI system, including in the workplace.","evidenceSummary":"Principle 1.3(ii) recommends making stakeholders aware of their interactions with AI systems.","url":"https://oecd.ai/en/ai-principles","exception":"Information should be appropriate to context and consistent with the state of the art.","timing":"At or before the interaction","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-E8F30C1AB6","intent":"inform stakeholders of ai interactions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-d4f704305a179dbe2264e44eb347372bcd61ae1d05b829a636a54a379867e015","kind":"rule-candidate","status":"pending","body":{"title":"Invest in AI research on social, legal and ethical impacts","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.1(a)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"invest","object":"AI research on social legal and ethical impacts","condition":"As part of long-term public investment and encouragement of private investment in trustworthy AI research and open science.","evidenceSummary":"Recommendation 2.1(a) calls for interdisciplinary investment addressing AI-related social, legal, ethical and policy issues.","url":"https://oecd.ai/en/ai-principles","exception":"Governments are asked to consider public investment and encourage private investment rather than meet a fixed spending level.","timing":"Long-term","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-2D29284F7D","intent":"invest ai research on social legal and ethical impacts","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-d8dd6a8a646053bf2a68cd03c74f4c34041d0e8fe30f9a5a6085bf4d28bdd3c7","kind":"rule-candidate","status":"pending","body":{"title":"Explain factors and logic behind AI outputs","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.3(iii)","actor":"AI actors","modality":"should","action":"explain","object":"factors processes and logic behind AI outputs","condition":"When explanation is feasible and useful for affected people to understand a prediction, content, recommendation or decision.","evidenceSummary":"Principle 1.3(iii) recommends plain information on the factors, processes or logic leading to an AI output.","url":"https://oecd.ai/en/ai-principles","exception":"Only where feasible and useful; explanation should be context-appropriate and consistent with the state of the art.","timing":"When providing an explanation of an AI output","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-F193592F11","intent":"explain factors processes and logic behind ai outputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"change-eu-ai-act-131b49699f7f9f7d911d511e1ac6eeed9109576c33f1492aa5321ab07b92273b","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-10T13:05:46.577Z","fingerprint":"131b49699f7f9f7d911d511e1ac6eeed9109576c33f1492aa5321ab07b92273b","previousFingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","bytes":1534744,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-10T13:05:46.577Z","reviewed_at":null},{"id":"change-eu-gdpr-f9f622ce4ac6b1148dd0935711ecb56f8fac6ff65d8e6d68a906942e93b6d114","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-10T13:05:46.577Z","fingerprint":"f9f622ce4ac6b1148dd0935711ecb56f8fac6ff65d8e6d68a906942e93b6d114","previousFingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","bytes":1071097,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-10T13:05:46.577Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-93bb4040ed7ccd48aa107314ac0f0d630cf5141e3a6f980149e1b771d8f57c1c","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-10T13:05:46.577Z","fingerprint":"93bb4040ed7ccd48aa107314ac0f0d630cf5141e3a6f980149e1b771d8f57c1c","previousFingerprint":"e401974ad10a50b26c705292f1284b59860797d908a3854bee6eea7c18018e46","bytes":708342,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-10T13:05:46.577Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-503fc5dcc843e7fb433e1cda18709296ac7528b890bad601f188ba5a787d4cf3","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-10T13:05:44.088Z","fingerprint":"503fc5dcc843e7fb433e1cda18709296ac7528b890bad601f188ba5a787d4cf3","previousFingerprint":"ff473b03393de39a1b19fa71fee25fdbe1ea6909d03a9f4f2eccb7dc000fd7d2","bytes":235219,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-10T13:05:44.088Z","reviewed_at":null},{"id":"finding-031d7a66d053c0ce362aa27d7700a9d7ee8f8decf5bc91969b8d42f8994e5d76","kind":"rule-candidate","status":"pending","body":{"title":"Do not facilitate unlawful sexually explicit deepfakes with AI","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.057(1)(B)","actor":"Persons developing or distributing AI systems within the subtitle's Texas scope","modality":"must not","action":"facilitate","object":"unlawful sexually explicit deepfakes with AI","condition":"The AI system is developed or distributed with the sole intent of producing, assisting, aiding in producing, or distributing deepfake videos or images prohibited by Penal Code § 21.165.","evidenceSummary":"Section 552.057(1)(B) establishes a sole-intent prohibition tied to Penal Code § 21.165.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The prohibition requires sole intent and incorporates the elements of Penal Code § 21.165.","timing":"At development or distribution; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-2FBC24A41B","intent":"facilitate unlawful sexually explicit deepfakes with ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-06893cbe816a62069a8b065a1aa56d77571862547866d52f6794b9d684217fcd","kind":"rule-candidate","status":"pending","body":{"title":"Report sandbox AI risk-mitigation updates quarterly","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.102(a), (b)(2)","actor":"Texas AI regulatory-sandbox participants","modality":"must","action":"report","object":"updates on AI operational risk mitigation","condition":"The participant is testing an AI system in the Texas regulatory sandbox.","evidenceSummary":"Section 553.102 requires quarterly participant reports and specifically includes updates on how the system mitigates operational risks.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"DIR must keep intellectual property, trade secrets, and other sensitive program information confidential.","timing":"Quarterly during sandbox participation; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-C4C05465F4","intent":"report updates on ai operational risk mitigation","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-12782e48a31c14b3852ce83f93743c505c776954d3728552462c35540150d1bc","kind":"rule-candidate","status":"pending","body":{"title":"Do not identify people from public biometric media without consent","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.054(b)","actor":"Texas governmental entities developing or deploying AI systems","modality":"must not","action":"identify","object":"individuals using biometric data gathered from public sources without consent","condition":"The governmental entity develops or deploys AI for unique identification using biometric data or images/media gathered from the Internet or another public source, without consent, and the gathering would infringe a protected right.","evidenceSummary":"Section 552.054(b) links the ban to unique identification, public-source gathering without consent, and infringement of constitutional or statutory rights.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The statute excludes ordinary photos, video/audio recordings and their derived data, plus HIPAA treatment, payment, or operations information, from its biometric-data definition; all elements must be met.","timing":"At development or deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-1F8D5A27D6","intent":"identify individuals using biometric data gathered from public sources without consent","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-1334fbaa2f510ee8debba48783826f48aa99b27b056054eb7fbe7f4b3131954f","kind":"rule-candidate","status":"pending","body":{"title":"Do not enable AI to incite criminal activity","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.052(3)","actor":"Persons developing or deploying AI systems within the subtitle's Texas scope","modality":"must not","action":"enable","object":"AI systems to incite criminal activity","condition":"The system is developed or deployed in a manner intentionally aimed at inciting or encouraging criminal activity.","evidenceSummary":"Section 552.052(3) prohibits intentional development or deployment aimed at inciting or encouraging criminal activity.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The prohibition contains an intent element and applies only within Section 551.002's Texas nexus.","timing":"At development and deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-BD074F57DB","intent":"enable ai systems to incite criminal activity","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-3ef088fc0d5831548b0fca53182b99fa41a50d659e6e6ecd06e8608e26131a2c","kind":"rule-candidate","status":"pending","body":{"title":"Report sandbox AI performance metrics quarterly","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.102(a), (b)(1)","actor":"Texas AI regulatory-sandbox participants","modality":"must","action":"report","object":"AI system performance metrics","condition":"The participant is testing an AI system in the Texas regulatory sandbox.","evidenceSummary":"Section 553.102 requires quarterly participant reports and specifically includes system performance metrics.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"DIR must keep intellectual property, trade secrets, and other sensitive program information confidential.","timing":"Quarterly during sandbox participation; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-CD45DCD123","intent":"report ai system performance metrics","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-56c31e2c81fe928cb8115609bdbd78d1bfd77babe6fb4ac96ce8559215d14c4c","kind":"rule-candidate","status":"pending","body":{"title":"Obtain approval before Texas AI sandbox testing","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.052(a)","actor":"Applicants to the Texas AI regulatory sandbox","modality":"must","action":"obtain","object":"approval for AI sandbox testing","condition":"The applicant seeks to test an AI system under the Texas regulatory sandbox.","evidenceSummary":"Section 553.052(a) requires approval from the Department of Information Resources and each applicable agency before testing.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"Sandbox participation can last no more than 36 months unless DIR finds good cause for extension; Chapter 552 Subchapter B duties cannot be waived.","timing":"Before testing; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-B07A3B1B97","intent":"obtain approval for ai sandbox testing","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-64dbcbc5f00309ed8b61dd590a6ff937d88ffb8c7238e82eb26e2aeb95b72c04","kind":"rule-candidate","status":"pending","body":{"title":"Inventory state-agency AI systems in information-resource reviews","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Government Code § 2054.0965(b)(2), as amended by H.B. 149 § 7","actor":"Texas state agencies performing required information-resource deployment reviews","modality":"must","action":"inventory","object":"agency AI systems","condition":"The agency performs the review required by Government Code § 2054.0965, unless DIR rules modify the review.","evidenceSummary":"H.B. 149 adds artificial intelligence systems to the databases and applications that must be inventoried in the state-agency review.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"DIR rules may modify the review, and mandatory state-agency implementation is conditioned on specific fiscal-year appropriation under H.B. 149 § 9; implementation may proceed with other available funding.","timing":"During the required information-resource deployment review; effective January 1, 2026","authority":"Binding enacted Texas statute within scope, subject to DIR rules and the funding proviso","jurisdiction":"Texas, United States","ruleId":"AIR-C315EAF7F0","intent":"inventory agency ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-685ce5cea91ba836e247497bb5d25deab0f2020806f4312a101a72faec4d75e9","kind":"rule-candidate","status":"pending","body":{"title":"Disclose consumer interaction with government AI","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.051(b)-(e)","actor":"Texas governmental agencies making consumer-facing AI available","modality":"must","action":"disclose","object":"AI interaction","condition":"The agency makes an AI system intended to interact with Texas consumers available; disclosure is required even when the interaction would be obvious.","evidenceSummary":"Section 552.051 requires notice before or at interaction and specifies clear, conspicuous, plain-language presentation without dark patterns.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The governmental-entity definition excludes hospital districts and Texas institutions of higher education; a hyperlink may provide the disclosure.","timing":"Before or at the time of interaction; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-C8E01637B6","intent":"disclose ai interaction","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-6a1cde9387714feeb00f6a6b46ee99ca4823460c3322d7759ad4f64c74d0545e","kind":"rule-candidate","status":"pending","body":{"title":"Prove federal AI-law compliance for sandbox admission","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.052(b)(4)","actor":"Applicants to the Texas AI regulatory sandbox","modality":"must","action":"provide","object":"proof of compliance with applicable federal AI laws and regulations","condition":"The person applies to test an AI system in the regulatory sandbox.","evidenceSummary":"Section 553.052(b)(4) makes proof of applicable federal AI-law compliance part of the sandbox application.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"Only applicable federal AI laws and regulations are covered; other application and nonwaivable state protections remain separate.","timing":"With the sandbox application; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-E3F0C98DE0","intent":"provide proof of compliance with applicable federal ai laws and regulations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-6a65bf1ea3e8a6ae60e011762d307bbafa28b1589e453224d5bd36b62985e41c","kind":"rule-candidate","status":"pending","body":{"title":"Report sandbox user and stakeholder feedback quarterly","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.102(a), (b)(3)","actor":"Texas AI regulatory-sandbox participants","modality":"must","action":"report","object":"feedback from consumers and affected stakeholders using sandbox AI","condition":"The participant is testing an AI system in the Texas regulatory sandbox.","evidenceSummary":"Section 553.102 requires quarterly participant reports and specifically includes feedback from consumers and affected stakeholders using the tested system.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"DIR must keep intellectual property, trade secrets, and other sensitive program information confidential.","timing":"Quarterly during sandbox participation; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-1C7320ACE2","intent":"report feedback from consumers and affected stakeholders using sandbox ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-6d11790ce2db394d45f80458ebcc592920a26f7e3824073acc4ab4614ee0677f","kind":"rule-candidate","status":"pending","body":{"title":"Document a sandbox adverse-consequence mitigation plan","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.052(b)(3)","actor":"Applicants to the Texas AI regulatory sandbox","modality":"must","action":"document","object":"a plan to mitigate adverse consequences during AI sandbox testing","condition":"The person applies to test an AI system in the regulatory sandbox.","evidenceSummary":"Section 553.052(b)(3) requires the applicant to describe its plan for mitigating adverse consequences that may occur during the test.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The mitigation plan is an application requirement and does not waive Chapter 552 Subchapter B protections.","timing":"With the sandbox application; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-CA307F333F","intent":"document a plan to mitigate adverse consequences during ai sandbox testing","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-70e1948a09941d1956abdea0955690adb262cd4eac76703e4c02ded3052bf343","kind":"rule-candidate","status":"pending","body":{"title":"Disclose AI use in health care services","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.051(f)","actor":"Licensed, registered, or certified health care service providers using AI in service or treatment","modality":"must","action":"disclose","object":"AI interaction","condition":"An AI system is used in relation to human health services or diagnosis, prevention, or treatment.","evidenceSummary":"Section 552.051(f) applies the statutory AI-interaction disclosure to health care recipients or their personal representatives.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"In an emergency, disclosure may follow when reasonably possible.","timing":"No later than the date service or treatment is first provided; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-C8E01637B6","intent":"disclose ai interaction","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-7cb8efb4c991326c567ec0ed796e8c800928f49c00842d9ad25ac8f8bd02f42b","kind":"rule-candidate","status":"pending","body":{"title":"Do not build AI solely to impair federal constitutional rights","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.055(a)","actor":"Persons developing or deploying AI systems within the subtitle's Texas scope","modality":"must not","action":"build","object":"AI systems solely intended to impair federal constitutional rights","condition":"The person's sole intent is for the AI system to infringe, restrict, or otherwise impair an individual's rights guaranteed by the United States Constitution.","evidenceSummary":"Section 552.055(a) establishes a sole-intent prohibition tied specifically to federal constitutional rights.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The section does not create or expand constitutional rights and requires proof of sole intent.","timing":"At development or deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-B85A6FD731","intent":"build ai systems solely intended to impair federal constitutional rights","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-831db0ab4ae99e85cf30e0410bedd891dd284232da9e9894de1f779518375fa9","kind":"rule-candidate","status":"pending","body":{"title":"Do not facilitate prohibited child sexual material with AI","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.057(1)(A)","actor":"Persons developing or distributing AI systems within the subtitle's Texas scope","modality":"must not","action":"facilitate","object":"prohibited child sexual material with AI","condition":"The AI system is developed or distributed with the sole intent of producing, assisting, aiding in producing, or distributing material prohibited by Penal Code § 43.26.","evidenceSummary":"Section 552.057(1)(A) establishes a sole-intent prohibition tied to Penal Code § 43.26.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The prohibition requires sole intent and incorporates the elements of Penal Code § 43.26.","timing":"At development or distribution; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-9A07928A58","intent":"facilitate prohibited child sexual material with ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-838848bbd7c854bbfc3613a384c15d76c2044d7b9ae87bd3fbdadfd15ea5aae2","kind":"rule-candidate","status":"pending","body":{"title":"Do not make AI sexual conversations impersonate minors","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.057(2)","actor":"Persons developing or distributing AI systems within the subtitle's Texas scope","modality":"must not","action":"enable","object":"AI sexual conversations that impersonate minors","condition":"The person intentionally develops or distributes an AI system that engages in text conversations simulating or describing Penal Code § 43.25 sexual conduct while impersonating or imitating a child younger than 18.","evidenceSummary":"Section 552.057(2) separately prohibits intentional AI text conversations that combine defined sexual conduct with impersonation or imitation of a minor.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"All statutory elements, including intentional development/distribution, text conversation, defined sexual conduct, and under-18 impersonation or imitation, must be met.","timing":"At development or distribution; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-61E981ADBC","intent":"enable ai sexual conversations that impersonate minors","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-be6ee16945868245be7d68cc29ae361cc25c7b760d3de66c86ff98a70e66e2fe","kind":"rule-candidate","status":"pending","body":{"title":"Do not enable AI to incite harm to others","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.052(2)","actor":"Persons developing or deploying AI systems within the subtitle's Texas scope","modality":"must not","action":"enable","object":"AI systems to incite harm to another person","condition":"The system is developed or deployed in a manner intentionally aimed at inciting or encouraging harm to another person.","evidenceSummary":"Section 552.052(2) prohibits intentional development or deployment aimed at inciting or encouraging harm to another person.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The prohibition contains an intent element and applies only within Section 551.002's Texas nexus.","timing":"At development and deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-85B79C5488","intent":"enable ai systems to incite harm to another person","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f1acf67d0dffcbc102b5f71fab0ee35aa2ecccc2af9d2880440a1e6fa76a522e","kind":"rule-candidate","status":"pending","body":{"title":"Do not intentionally discriminate against protected classes through AI","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.056(b)-(e)","actor":"Persons developing or deploying AI systems within the subtitle's Texas scope","modality":"must not","action":"discriminate","object":"against protected classes through AI","condition":"The person intends to unlawfully discriminate against a class protected by state or federal civil-rights law.","evidenceSummary":"Section 552.056 prohibits intentional unlawful discrimination through AI and states that disparate impact alone does not prove intent.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"Insurance services governed by specified insurance discrimination laws are excluded; federally insured financial institutions comply by meeting applicable federal and state banking law; disparate impact alone is insufficient.","timing":"At development or deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-F682447E01","intent":"discriminate against protected classes through ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f26e64ede6555d6431011a09dbbd1cbab285b6d494cfa604670fdf0bbce3641b","kind":"rule-candidate","status":"pending","body":{"title":"Do not enable AI to incite physical self-harm","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.052(1)","actor":"Persons developing or deploying AI systems within the subtitle's Texas scope","modality":"must not","action":"enable","object":"AI systems to incite physical self-harm","condition":"The system is developed or deployed in a manner intentionally aimed at inciting or encouraging self-harm, including suicide.","evidenceSummary":"Section 552.052(1) prohibits intentional development or deployment aimed at inciting or encouraging physical self-harm.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The prohibition contains an intent element and applies only within Section 551.002's Texas nexus.","timing":"At development and deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-33461AFACA","intent":"enable ai systems to incite physical self harm","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f53e0f8b45f9f2bd50e596b8e4682a15830316e9620c7cb0abc28fed385b1891","kind":"rule-candidate","status":"pending","body":{"title":"Assess sandbox impacts on consumers, privacy, and safety","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.052(b)(2)","actor":"Applicants to the Texas AI regulatory sandbox","modality":"must","action":"assess","object":"sandbox AI impacts on consumers, privacy, and public safety","condition":"The person applies to test an AI system in the regulatory sandbox.","evidenceSummary":"Section 553.052(b)(2) requires a benefit assessment addressing potential consumer, privacy, and public-safety impacts.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The assessment is an application requirement and does not waive Chapter 552 Subchapter B protections.","timing":"With the sandbox application; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-56526F7063","intent":"assess sandbox ai impacts on consumers privacy and public safety","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f7858dcea97069749f5064bf367fe6dfa2383a37b6a87e6de520d6b4c5ddb064","kind":"rule-candidate","status":"pending","body":{"title":"Do not apply prohibited government social scoring","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.053","actor":"Texas governmental entities using or deploying AI systems","modality":"must not","action":"apply","object":"prohibited social scoring","condition":"AI evaluates or classifies natural persons from social behavior or personal characteristics to assign a social score that may cause unrelated-context, unjustified, or disproportionate adverse treatment or infringe protected rights.","evidenceSummary":"Section 552.053 prohibits government social scoring when the specified scoring purpose and adverse-result elements are present.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"All statutory elements must be assessed; the governmental-entity definition excludes hospital districts and Texas institutions of higher education.","timing":"At use or deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-342C0977BB","intent":"apply prohibited social scoring","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f829606994b0a18d70951db3c95eecf3dc22935e18aaf7ac165b3b11c010281b","kind":"rule-candidate","status":"pending","body":{"title":"Evaluate state-agency AI use and contemplated use","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Government Code § 2054.068(b)(5), as amended by H.B. 149 § 6","actor":"Texas state agencies reporting information-technology infrastructure status to the Department of Information Resources","modality":"must","action":"evaluate","object":"agency use or contemplated use of AI systems","condition":"The Department of Information Resources collects the agency's required infrastructure-status information.","evidenceSummary":"H.B. 149 adds an evaluation of each state agency's current or considered AI use to the information DIR collects.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"A mandatory state-agency implementation duty is conditioned on specific fiscal-year appropriation under H.B. 149 § 9; implementation may proceed with other available funding.","timing":"As part of the statutory infrastructure-status collection; effective January 1, 2026","authority":"Binding enacted Texas statute within scope, subject to the funding proviso","jurisdiction":"Texas, United States","ruleId":"AIR-FAC09DC006","intent":"evaluate agency use or contemplated use of ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f83200b2b4327e031dd392f3f23e66b8ee9c928d14cb5be45b37f96c1c42b0a2","kind":"rule-candidate","status":"pending","body":{"title":"Format AI interaction disclosures without dark patterns","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.051(d)","actor":"Persons required to provide the Section 552.051 AI-interaction disclosure","modality":"must","action":"format","object":"AI interaction disclosures clearly and conspicuously in plain language without dark patterns","condition":"A disclosure is required under Section 552.051(b).","evidenceSummary":"Subsection (d) defines three presentation requirements for the required disclosure: clarity and conspicuousness, plain language, and no dark patterns.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"A hyperlink to a separate web page is permitted under subsection (e).","timing":"Whenever the Section 552.051 disclosure is presented; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-C7BB07CC59","intent":"format ai interaction disclosures clearly and conspicuously in plain language without dark patterns","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-e401974ad10a50b26c705292f1284b59860797d908a3854bee6eea7c18018e46","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-09T13:06:23.666Z","fingerprint":"e401974ad10a50b26c705292f1284b59860797d908a3854bee6eea7c18018e46","previousFingerprint":"72750156679660d6dedd4f444c9b2f5c049b57f228b982757a4fd3c6c065f826","bytes":707970,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-09T13:06:23.666Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-ff473b03393de39a1b19fa71fee25fdbe1ea6909d03a9f4f2eccb7dc000fd7d2","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-09T13:06:21.064Z","fingerprint":"ff473b03393de39a1b19fa71fee25fdbe1ea6909d03a9f4f2eccb7dc000fd7d2","previousFingerprint":"6aee8985f80d193faf6144c99d157fa5d42c73cc0bd0397bfa32129f904a1eb8","bytes":235219,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-09T13:06:21.064Z","reviewed_at":null},{"id":"finding-0470c7718a6ad7c1f2e176e73814c6a59b672728bcb8bc0b1717707e371d0b88","kind":"rule-candidate","status":"pending","body":{"title":"Inventory AI assets and dependencies","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 5, clause 5.1","actor":"Developers, Data Custodians, and System Operators","modality":"must","action":"maintain","object":"an inventory of AI assets and dependencies","condition":"The organisation develops, deploys, or controls data for an AI system.","evidenceSummary":"Clause 5.1 calls for a comprehensive asset inventory that includes connectivity and interdependencies.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Throughout the AI-system lifecycle","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-FC1F24F621","intent":"maintain an inventory of ai assets and dependencies","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-06da2a924cc611b002dca003c8b7aeb3c15cd69e37f649dc109e444110eefa81","kind":"rule-candidate","status":"pending","body":{"title":"Security-test AI systems before release","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 9, clause 9.1","actor":"Developers","modality":"must","action":"security-test","object":"AI models, applications, and systems before release","condition":"The model, application, or system will be released to System Operators or End-users.","evidenceSummary":"Clause 9.1 requires released AI artifacts to pass through a security-assessment process.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Before release","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-2D4B88FD46","intent":"security test ai models applications and systems before release","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-12e4cc15733aa42e67036212c7d57779588fa81b0e1b54d51b82f219105b2021","kind":"rule-candidate","status":"pending","body":{"title":"Tailor AI security training to staff roles","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 1, clause 1.1.1","actor":"System Operators, Developers, and Data Custodians","modality":"must","action":"tailor","object":"AI security training to staff roles","condition":"Staff receive AI security training; this is a requirement within a voluntary code.","evidenceSummary":"Clause 1.1.1 makes role and responsibility relevant to the content of AI security training.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"When designing and refreshing staff training","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-28C86060C1","intent":"tailor ai security training to staff roles","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-192da38cb421d5f25f0f38facf666103deb50a847bea1902d015171e20e6dff8","kind":"rule-candidate","status":"pending","body":{"title":"Justify use of poorly documented AI components","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 7, clause 7.2","actor":"System Operators","modality":"must","action":"document","object":"the justification for using poorly documented or unsecured AI components","condition":"The operator chooses to use or adapt a model or component that is not well documented or secured.","evidenceSummary":"Clause 7.2 makes the decision record explicit when component assurance is weak, including cases where no alternative supplier exists.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"The example recognizes that no alternative supplier may exist; it does not waive documentation.","timing":"Before or when approving the component for use","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-40509CE90B","intent":"document the justification for using poorly documented or unsecured ai components","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-1d08ecd8015e66e8da24c2113c086d8caff0997c91bbd90e763e9c3ff7f96fe7","kind":"rule-candidate","status":"pending","body":{"title":"Tailor disaster recovery to AI-specific attacks","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 5, clause 5.3","actor":"System Operators","modality":"must","action":"tailor","object":"disaster-recovery plans to AI-specific attacks","condition":"The organisation operates an AI system.","evidenceSummary":"Clause 5.3 requires ordinary recovery planning to account for attacks directed at AI systems.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"During recovery planning and maintenance","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-E35BC83D85","intent":"tailor disaster recovery plans to ai specific attacks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-4b8dbfc06e536b0d159217c9adc6f473bb6fcdcb844d09c2c1a77884c8e4288d","kind":"rule-candidate","status":"pending","body":{"title":"Repeat data sanitization after adaptive model revisions","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 5, clause 5.4.1","actor":"Developers, Data Custodians, and System Operators","modality":"must","action":"repeat","object":"data and input sanitization after model revisions","condition":"A model is revised in response to user feedback or continuous learning, subject to the actor's access to the relevant data and inputs.","evidenceSummary":"Clause 5.4.1 extends checks and sanitization beyond initial design to feedback-driven or continuously learned revisions.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Responsibility follows each actor's access to the data and inputs and where they are stored.","timing":"After revisions driven by feedback or continuous learning","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-320C95E6DC","intent":"repeat data and input sanitization after model revisions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-4ce83d5b67a7912e924d92c564b4d85407a6cd4252e5413c6711db580e105a5f","kind":"rule-candidate","status":"pending","body":{"title":"Disclose AI data handling to end users","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 10, clause 10.1","actor":"System Operators","modality":"must","action":"disclose","object":"AI data use, access, and storage to End-users","condition":"An AI system is deployed for end users; external Developers must first provide the necessary information to operators.","evidenceSummary":"Clause 10.1 requires accessible disclosure of where and how user data is used, accessed, and stored, including retraining or human review.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"Before or at deployment and when practices change","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-4591031280","intent":"disclose ai data use access and storage to end users","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-4d42e68e669f554d5c6090aea5051d2f28d483b37e3ddf38ff8e030429553157","kind":"rule-candidate","status":"pending","body":{"title":"Test AI incident-management plans","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 6, clause 6.5 — testing component","actor":"Developers and System Operators","modality":"must","action":"test","object":"AI incident-management plans","condition":"The organisation develops or operates an AI system.","evidenceSummary":"Clause 6.5 requires AI-specific incident planning to be exercised, not only documented.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"Before deployment and periodically during operation","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-D60E646B27","intent":"test ai incident management plans","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-59acbdd6fd36b9d02880e3e69bb50a86c5cae3a0f1cdf96eb95b5d386227c1ef","kind":"rule-candidate","status":"pending","body":{"title":"Conduct operator testing before AI deployment","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 9, clause 9.2","actor":"System Operators","modality":"must","action":"test","object":"AI systems before deployment","condition":"An AI system is being prepared for deployment; Developers support the testing.","evidenceSummary":"Clause 9.2 assigns pre-deployment testing responsibility to the operator with developer support.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Before deployment","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-36AAFBCE03","intent":"test ai systems before deployment","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-6a1f6f1b9352844a33d2247723af7cf9a938bebae0f96454636905bce98ea7be","kind":"rule-candidate","status":"pending","body":{"title":"Isolate AI development and tuning environments","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 6, clause 6.3","actor":"Developers","modality":"must","action":"isolate","object":"AI development and model-tuning environments","condition":"Development or tuning uses non-public training data; separation and least-privilege controls are required.","evidenceSummary":"Clause 6.3 requires dedicated environments backed by technical separation and least-privilege controls.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"The clause specifically highlights training data that is not publicly available.","timing":"During development and model tuning","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-517A77B73E","intent":"isolate ai development and model tuning environments","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-6a22ba03376d26e7571041123ab9d916b4fef15c722c1e354065f22da0a9ddb9","kind":"rule-candidate","status":"pending","body":{"title":"Assess AI-specific risks in external components","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 2, clause 2.4","actor":"Developers and System Operators","modality":"must","action":"assess","object":"AI-specific risks in external components","condition":"An external component is used in an AI system; apply due diligence consistent with existing software-development processes.","evidenceSummary":"Clause 2.4 adds AI-specific risk assessment to component due diligence.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Before accepting or integrating an external component","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-ACEEBA73D0","intent":"assess ai specific risks in external components","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-6d6a13916e11b9d077446cc623beeffd80bb4a0ef0a2598724a6b41fc574cbfb","kind":"rule-candidate","status":"pending","body":{"title":"Design AI systems to resist adversarial attacks","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 2, clause 2.2","actor":"System Operators and Developers","modality":"must","action":"design","object":"AI systems to withstand adversarial attacks","condition":"An AI system is being designed or implemented; this is a requirement within a voluntary code.","evidenceSummary":"Clause 2.2 requires resilience against adversarial AI attacks; unexpected inputs and system failure are separate aspects of the same provision.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"During system design and implementation","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-6DA8E52373","intent":"design ai systems to withstand adversarial attacks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-8113e5fc68b5cb6e1f6ca95f6b5d0bd38d83e805490b1a919e0cc7a8f6b075ea","kind":"rule-candidate","status":"pending","body":{"title":"Use independent AI security testers","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 9, clause 9.2.1","actor":"System Operators and Developers","modality":"should","action":"use","object":"independent AI security testers","condition":"Security testing is performed; testers need technical skills relevant to the system.","evidenceSummary":"Clause 9.2.1 recommends independence and system-relevant technical competence for AI security testing.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"The code does not define required credentials or organizational independence.","timing":"During AI security testing","authority":"voluntary-code recommendation; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-675CEF85E0","intent":"use independent ai security testers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-88d32ee2f437cce7a003253ae275626689b5b71ec06c00bf6b6e57cd5cf4dc6c","kind":"rule-candidate","status":"pending","body":{"title":"Include AI security in cyber training","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 1, clause 1.1","actor":"System Operators, Developers, and Data Custodians","modality":"must","action":"include","object":"AI security content in cyber security training","condition":"The organisation operates, develops, or controls data for deployed AI systems; this is a requirement within a voluntary code.","evidenceSummary":"Clause 1.1 places AI-specific security material inside the organisation's cyber training programme and calls for continuing review.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"During the AI-system lifecycle; review when substantial new AI threats emerge","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-E4A7FE4D30","intent":"include ai security content in cyber security training","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-a3af0037f6a1d025dae3b4f4c7a4c743f2c632e700d6939ba645f9dba6f9d9fc","kind":"rule-candidate","status":"pending","body":{"title":"Maintain human-oversight capabilities","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 4, clause 4.1","actor":"Developers and System Operators","modality":"should","action":"maintain","object":"human-oversight capabilities for AI systems","condition":"An AI system is being designed or operated.","evidenceSummary":"Clause 4.1 recommends incorporating oversight at design time and maintaining that capability over time.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"From system design through operation","authority":"voluntary-code recommendation; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-4FACE99125","intent":"maintain human oversight capabilities for ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-adeb6d44fe35b0c2d4c8a4ce1dd15a595eaa0244a8f114f8f50ac2cec8d0c092","kind":"rule-candidate","status":"pending","body":{"title":"Reassess AI risks after configuration changes","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 3, clause 3.1.1","actor":"Developers and System Operators","modality":"must","action":"reassess","object":"AI security risks after configuration changes","condition":"A new setting or configuration option is implemented or updated at any lifecycle stage.","evidenceSummary":"Clause 3.1.1 links configuration changes to another pass through threat modelling and risk management.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Whenever a setting or configuration option is introduced or changed","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-69CA8EABE2","intent":"reassess ai security risks after configuration changes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-c57ac100cd95ac317586672565180be9ff802d13271246f77cd47bbf6f087018","kind":"rule-candidate","status":"pending","body":{"title":"Train developers in AI-specific secure engineering","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 1, clause 1.2.2","actor":"System Operators, Developers, and Data Custodians","modality":"must","action":"provide","object":"AI-specific secure coding and system-design training","condition":"The organisation has developers working on deployed or deployable AI systems; this is a requirement within a voluntary code.","evidenceSummary":"Clause 1.2.2 requires developer training focused on preventing and mitigating vulnerabilities in AI models, algorithms, and related software.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Before and during AI development responsibilities","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-240B04378C","intent":"provide ai specific secure coding and system design training","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-ccb329626ac39259e0c183af79f955a1328b0082d5e66497470971cd0bc2c958","kind":"rule-candidate","status":"pending","body":{"title":"Communicate unresolved AI threats downstream","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 3, clause 3.2","actor":"Developers","modality":"must","action":"communicate","object":"unresolved AI security threats to System Operators","condition":"Developers identify an AI security threat they cannot resolve.","evidenceSummary":"Clause 3.2 assigns the first downstream notification step to developers so operators can threat-model their deployments.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"When an identified threat cannot be resolved by the Developer","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-F97B3855F8","intent":"communicate unresolved ai security threats to system operators","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-e65ef0126a13d435f7d9dbaa37e4d38cd0b0b4eec984e4a6fc3592f0240ea12e","kind":"rule-candidate","status":"pending","body":{"title":"Log AI system and user actions","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 12, clause 12.1","actor":"System Operators","modality":"must","action":"log","object":"AI system and user actions","condition":"Logs support security compliance, investigations, and vulnerability remediation.","evidenceSummary":"Clause 12.1 establishes an operational logging obligation for both system behavior and user activity.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No retention period or log content minimum is specified in the clause.","timing":"Continuously during operation","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-463F6EF08F","intent":"log ai system and user actions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-e9761eb0778d23b744b62cd61bfe4d099c539cf36f3dfa70b1d6e042269ae2c9","kind":"rule-candidate","status":"pending","body":{"title":"Review AI threat models regularly","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 3, clause 3.1","actor":"Developers and System Operators","modality":"should","action":"review","object":"AI threat models regularly","condition":"Threat modelling addresses AI-specific attacks such as data poisoning, model inversion, and membership inference.","evidenceSummary":"Clause 3.1 recommends recurring threat-model review as part of security-risk management.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Review frequency is risk-based and not fixed by the code.","timing":"Regularly throughout the AI lifecycle","authority":"voluntary-code recommendation; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-4BDA78DD85","intent":"review ai threat models regularly","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-eb70a56c61bfa2c0b1486411061feb66e84a3e3c6cb64eb5d5a50cc82174c980","kind":"rule-candidate","status":"pending","body":{"title":"Notify end users before model updates","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 7, clause 7.4","actor":"System Operators","modality":"must","action":"notify","object":"End-users of planned model updates","condition":"The operator intends to update a model; communication must be accessible.","evidenceSummary":"Clause 7.4 requires advance notice of intended model updates to end users.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"Before the model is updated","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-B7785F80BE","intent":"notify end users of planned model updates","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-eec8d1cceba6385a38fc53f9ed0cbb459ed39e2249fce80306606004ad0cb0ca","kind":"rule-candidate","status":"pending","body":{"title":"Document AI security risks before creating a system","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 2, clause 2.1","actor":"System Operators and Developers","modality":"must","action":"document","object":"AI security risks and mitigation strategies","condition":"The organisation is deciding whether to create an AI system; this is a requirement within a voluntary code.","evidenceSummary":"Clause 2.1 requires the creation decision to record the problem or business need together with associated AI security risks and planned mitigations.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Before deciding to create the AI system","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-F3A86B168B","intent":"document ai security risks and mitigation strategies","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-f9717e2e0865dc35f4296280f8683e92328e335a7b146b39e5d0dc09d04d9895","kind":"rule-candidate","status":"pending","body":{"title":"Publish an AI vulnerability disclosure policy","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 6, clause 6.4","actor":"Developers and System Operators","modality":"must","action":"publish","object":"an accessible AI vulnerability disclosure policy","condition":"The organisation develops or operates a deployed AI system.","evidenceSummary":"Clause 6.4 requires both implementation and public accessibility of a vulnerability disclosure policy.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"Before and during operation","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-88274A0109","intent":"publish an accessible ai vulnerability disclosure policy","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-fb9aaeb3be6a36010f0ca72b08d7f6ad2c6a0392e9f1fe14db75fe4c3f79d094","kind":"rule-candidate","status":"pending","body":{"title":"Re-evaluate released models before reuse","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 7, clause 7.3","actor":"Developers and System Operators","modality":"must","action":"re-evaluate","object":"released AI models before intended use","condition":"A released model is being considered for use or adaptation.","evidenceSummary":"Clause 7.3 requires evaluations to be run again on released models that an organisation intends to use.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"Before using the released model","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-1436898CB8","intent":"re evaluate released ai models before intended use","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-72750156679660d6dedd4f444c9b2f5c049b57f228b982757a4fd3c6c065f826","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-08T12:59:29.361Z","fingerprint":"72750156679660d6dedd4f444c9b2f5c049b57f228b982757a4fd3c6c065f826","previousFingerprint":"c39277654a4ed4cfcb8722dc4a59eaddb3567d86a9eb872b7c7d4f6bc2cda2bd","bytes":707590,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-08T12:59:29.361Z","reviewed_at":null},{"id":"change-brookline-genai-755e2c904ae7401070b7338e2a00a2f7a24c634d404a78b87e2f62581915f9c3","kind":"source-change","status":"pending","body":{"sourceId":"brookline-genai","title":"Generative Artificial Intelligence Use Policy","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","status":"publisher-bytes-changed","checkedAt":"2026-10-08T12:59:26.100Z","fingerprint":"755e2c904ae7401070b7338e2a00a2f7a24c634d404a78b87e2f62581915f9c3","previousFingerprint":"3eb9d05b8739fa8021c873c2aae060aca74b30f3ef7f53fdc778d5b456cf48da","bytes":110630,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-08T12:59:26.100Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-6aee8985f80d193faf6144c99d157fa5d42c73cc0bd0397bfa32129f904a1eb8","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-08T12:59:26.100Z","fingerprint":"6aee8985f80d193faf6144c99d157fa5d42c73cc0bd0397bfa32129f904a1eb8","previousFingerprint":"8d2c8a497b9cd3d22136891a7c92638bdc2ad53c4060ad823a3f3bd2fe7e3887","bytes":136664,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-08T12:59:26.100Z","reviewed_at":null},{"id":"finding-a5887fc28cab7d9316dd704dba4618a50e3f2b28a90551be055db4cd6ecf3e80","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Do not reimburse AI-conducted psychotherapy","control":"C.R.S. 25.5-4-426(2), signed-act PDF p.5","actor":"Colorado Medicaid and Children's Basic Health Plan payers","modality":"must not","action":"reimburse","object":"AI-conducted psychotherapy services","condition":"Psychotherapy is delivered directly to a client and conducted by AI.","exception":"AI-assisted ambient transcription or documentation supporting licensed providers is not barred.","timing":"On and after January 1, 2027","evidenceSummary":"The same nonpayment rule applies to public medical-assistance and children's health-plan payers.","url":"https://leg.colorado.gov/bill_files/117025/download#page=5","ruleId":"AIR-CAD7DC63E5","intent":"reimburse ai conducted psychotherapy services","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:21:02.259Z","reviewed_at":null},{"id":"finding-96ed8e7d6ed225603464df1112aebee4dc7a71a518aa76dc78fe763f7884e28d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Do not reimburse AI-conducted psychotherapy","control":"C.R.S. 10-16-148(2), signed-act PDF p.4","actor":"Health insurance carriers","modality":"must not","action":"reimburse","object":"AI-conducted psychotherapy services","condition":"Psychotherapy is delivered directly to an enrollee and conducted by AI.","exception":"AI-assisted ambient transcription or documentation supporting licensed providers is not barred.","timing":"On and after January 1, 2027","evidenceSummary":"The act prohibits carrier payment for psychotherapy conducted by AI while preserving provider-support tools.","url":"https://leg.colorado.gov/bill_files/117025/download#page=4","ruleId":"AIR-CAD7DC63E5","intent":"reimburse ai conducted psychotherapy services","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:20:35.193Z","reviewed_at":null},{"id":"finding-ff3491bdb39a3538729a016d9456938ece775761dad3084034492752187cbe46","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Require qualified human review before AI-influenced coverage denial","control":"C.R.S. 10-3-1104.8(5), signed-act PDF p.3","actor":"Carriers issuing medical-necessity coverage denials","modality":"must","action":"require","object":"qualified human review of AI-influenced medical-necessity denials","condition":"A denial is based in whole or part on medical necessity and AI contributed to utilization review.","exception":"Reviewer must be a licensed clinician, physician, or other competent regulated professional qualified for the issue and plan terms.","timing":"Before issuing the denial on and after January 1, 2027","evidenceSummary":"The act bars issuing the covered denial solely from AI output and without qualified human review.","url":"https://leg.colorado.gov/bill_files/117025/download#page=3","ruleId":"AIR-B6676761C1","intent":"require qualified human review of ai influenced medical necessity denials","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:20:03.271Z","reviewed_at":null},{"id":"finding-6ba6cba0cba33f2693021553ba205c9266fd43ae8a6a81937bcaf001decf1b44","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Limit AI use of health data to stated purposes","control":"C.R.S. 10-3-1104.8(3)(d)(II), signed-act PDF p.2","actor":"Entities using AI systems for health-care utilization review","modality":"must not","action":"use","object":"individual health data beyond its intended or stated purpose","condition":"An AI system is used in health-care utilization review.","exception":"No clause-specific exception stated.","timing":"Throughout covered use on and after January 1, 2027","evidenceSummary":"The act requires periodic review to ensure individual health data is not reused beyond its intended or stated purpose.","url":"https://leg.colorado.gov/bill_files/117025/download#page=2","ruleId":"AIR-FFD08A3AF3","intent":"use individual health data beyond its intended or stated purpose","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:19:22.273Z","reviewed_at":null},{"id":"finding-0592eae9b1f961491ca380abde534443eb7c73c2b1f5be8b47715b3615ee745e","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Review health-care AI outcomes for accuracy and reliability","control":"C.R.S. 10-3-1104.8(3)(d)(I), signed-act PDF p.2","actor":"Entities using AI systems for health-care utilization review","modality":"must","action":"review","object":"health-care AI outcomes for accuracy and reliability","condition":"An AI system is used to determine coverage.","exception":"No numeric interval is stated; review must be periodic.","timing":"Periodically on and after January 1, 2027","evidenceSummary":"The act creates a periodic review duty for outcome accuracy and reliability.","url":"https://leg.colorado.gov/bill_files/117025/download#page=2","ruleId":"AIR-03B91E9572","intent":"review health care ai outcomes for accuracy and reliability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:18:51.335Z","reviewed_at":null},{"id":"finding-781418825111f6e0b6b701bd0b65fb15b826fb42c7335416b945dd71344ceee0","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Do not decide coverage solely from group data","control":"C.R.S. 10-3-1104.8(3)(b), signed-act PDF p.2","actor":"Entities using AI systems for health-care utilization review","modality":"must not","action":"base","object":"AI coverage determinations solely on group data","condition":"An AI system is used to determine coverage for health-care services.","exception":"Group data may inform the determination only with reference to the individual's history and circumstances.","timing":"On and after January 1, 2027","evidenceSummary":"The act prohibits sole reliance on group data without reference to the individual patient.","url":"https://leg.colorado.gov/bill_files/117025/download#page=2","ruleId":"AIR-A17EB8B00B","intent":"base ai coverage determinations solely on group data","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:18:21.671Z","reviewed_at":null},{"id":"finding-024db1688418a75a842337472c4efbe11c94f3216ff364ad2895f3559ef4cdc0","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Base AI utilization review on patient-specific clinical facts","control":"C.R.S. 10-3-1104.8(3)(a), signed-act PDF pp.1–2","actor":"Entities using AI systems for health-care utilization review","modality":"must","action":"base","object":"AI utilization-review determinations on patient-specific clinical facts","condition":"An AI system is used to determine coverage for health-care services.","exception":"Relevant factors include clinical history, individual circumstances, written criteria, and plan terms.","timing":"On and after January 1, 2027","evidenceSummary":"The act requires coverage determinations to use the patient's individual clinical record and other specified factors.","url":"https://leg.colorado.gov/bill_files/117025/download#page=2","ruleId":"AIR-CE3A16C0C0","intent":"base ai utilization review determinations on patient specific clinical facts","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:17:51.461Z","reviewed_at":null},{"id":"finding-b9361e306bf33136cc1681fdfa6487d3eff5dadfe2e24d9e104d2fe931b0a90d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1263 — Conversational Artificial Intelligence Service Operator Requirements","sourceVersion":"HB26-1263 Signed Act — June 1, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Detect repeated chatbot self-harm statements","control":"C.R.S. 6-1-1704(1)(a), signed-act PDF p.6","actor":"Operators of publicly available conversational AI services","modality":"must","action":"detect","object":"repeated user statements of suicidal ideation or self-harm","condition":"A user repeatedly expresses suicidal ideation, intent to self-harm, or desire to harm others.","exception":"No clause-specific exception stated.","timing":"During covered interactions beginning January 1, 2027","evidenceSummary":"The self-harm protocol must detect repeated covered statements and inquiries.","url":"https://leg.colorado.gov/bill_files/116851/download#page=6","ruleId":"AIR-1D0300EE76","intent":"detect repeated user statements of suicidal ideation or self harm","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:17:06.653Z","reviewed_at":null},{"id":"finding-5e884e24641558ae48cf6e92d5d970a811403e821702e83093ef602081e1f54f","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1263 — Conversational Artificial Intelligence Service Operator Requirements","sourceVersion":"HB26-1263 Signed Act — June 1, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Block simulated emotional dependence for minors","control":"C.R.S. 6-1-1703(3)(b)(II), signed-act PDF p.5","actor":"Conversational AI operators that know an account holder or user is a minor","modality":"must","action":"prevent","object":"chatbot outputs that simulate emotional dependence for minors","condition":"The account holder or user is known to be under 18.","exception":"Measures are required to the extent technically feasible.","timing":"During covered minor use beginning January 1, 2027","evidenceSummary":"The act requires measures against statements that simulate mutual existential or emotional dependence between the AI and a minor.","url":"https://leg.colorado.gov/bill_files/116851/download#page=5","ruleId":"AIR-D40CD44A27","intent":"prevent chatbot outputs that simulate emotional dependence for minors","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:16:34.641Z","reviewed_at":null},{"id":"finding-282f17b213be35227570efa281756d03a784dcc8571e7b84cd8e0282f3ca8739","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1263 — Conversational Artificial Intelligence Service Operator Requirements","sourceVersion":"HB26-1263 Signed Act — June 1, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Block explicit sexual chatbot content for minors","control":"C.R.S. 6-1-1703(3)(b)(I), signed-act PDF p.5","actor":"Conversational AI operators that know an account holder or user is a minor","modality":"must","action":"prevent","object":"explicit sexual chatbot content for minors","condition":"The account holder or user is known to be under 18.","exception":"Measures are required to the extent technically feasible.","timing":"During covered minor use beginning January 1, 2027","evidenceSummary":"The act requires technically feasible measures against explicit sexual conduct and intimate digital depictions for known minors.","url":"https://leg.colorado.gov/bill_files/116851/download#page=5","ruleId":"AIR-5C61952BC1","intent":"prevent explicit sexual chatbot content for minors","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:16:02.670Z","reviewed_at":null},{"id":"finding-02f5aca4e49a27657e913000ca1104a925816b7dae443c6f6eefb84de206899e","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1263 — Conversational Artificial Intelligence Service Operator Requirements","sourceVersion":"HB26-1263 Signed Act — June 1, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Estimate conversational-AI user ages","control":"C.R.S. 6-1-1702(4)(a), signed-act PDF p.3","actor":"Operators of publicly available conversational AI services","modality":"must","action":"estimate","object":"ages of conversational-AI account holders and users","condition":"The operator opens or serves an account or profile.","exception":"Use commercially reasonable or generally accepted methods; statutory service-scope exclusions apply.","timing":"Beginning January 1, 2027","evidenceSummary":"Covered operators must estimate the age of account holders and other users.","url":"https://leg.colorado.gov/bill_files/116851/download#page=3","ruleId":"AIR-DB2A798EF7","intent":"estimate ages of conversational ai account holders and users","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:15:36.462Z","reviewed_at":null},{"id":"finding-3734a7133dac0aff0233f871bd204c9cb477a5e36698f18b72af834facd8d32e","kind":"rule-candidate","status":"pending","body":{"title":"Disclose conversational-AI identity","sourceTitle":"Colorado HB26-1263 — Conversational Artificial Intelligence Service Operator Requirements","sourceVersion":"HB26-1263 Signed Act — June 1, 2026","control":"C.R.S. 6-1-1703(1), signed-act PDF p.4","actor":"Operators of publicly available conversational AI services","modality":"must","action":"inform","object":"people they are interacting with AI","condition":"A user interacts with a covered conversational AI service.","exception":"General statutory scope and constitutional limits apply.","timing":"Before first interaction and at least every three hours during continuous interaction, beginning January 1, 2027","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","evidenceSummary":"The act requires a clear AI identity notice before first interaction and at least every three hours during continuous use.","url":"https://leg.colorado.gov/bill_files/116851/download#page=4","ruleId":"AIR-86AF529571","intent":"inform people they are interacting with ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-07T13:14:46.822Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-c39277654a4ed4cfcb8722dc4a59eaddb3567d86a9eb872b7c7d4f6bc2cda2bd","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-07T13:00:06.079Z","fingerprint":"c39277654a4ed4cfcb8722dc4a59eaddb3567d86a9eb872b7c7d4f6bc2cda2bd","previousFingerprint":"a78484c1ebeaee493ce7b1b3068258565739e7b7a2b3e721a38b2887d8709681","bytes":707590,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-07T13:00:06.079Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-8d2c8a497b9cd3d22136891a7c92638bdc2ad53c4060ad823a3f3bd2fe7e3887","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-07T13:00:02.724Z","fingerprint":"8d2c8a497b9cd3d22136891a7c92638bdc2ad53c4060ad823a3f3bd2fe7e3887","previousFingerprint":"1c70944dae1f01d9bf42f72d7230a112384f50e02d92b4bf9544c53b11f232d2","bytes":136664,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-07T13:00:02.724Z","reviewed_at":null},{"id":"finding-2d57e2dba45ef60e8308320619e8664f0a781842a085f503db533c0f9d83800d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved August 12, 2025; no revisions listed","authority":"organization-specific","jurisdiction":"Michigan State University, United States","url":"https://ai.msu.edu/guidelines","title":"Disclose AI-detector use to students","control":"Permissible Uses → Teaching and Learning, detection-tools paragraph","actor":"MSU instructors choosing to use generative AI detection tools","modality":"must","action":"disclose","object":"intended use of generative AI detection tools to students","condition":"An instructor elects to use detection tools despite the guideline's general discouragement; explain rationale, interpretation and potential follow-up.","exception":"Not triggered if no detection tool is used; disclosure does not authorize treating detector output as conclusive evidence.","timing":"When choosing to use the detector, as part of informing students of intended use.","evidenceSummary":"The detection paragraph requires clear disclosure of intended use, including rationale, how results will be interpreted and possible actions.","ruleId":"AIR-D2002846E6","intent":"disclose intended use of generative ai detection tools to students","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-38479119e5044fee600724951b129b181ec8a9d6abaa28f596de1bcae3393935","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved August 12, 2025; no revisions listed","authority":"organization-specific","jurisdiction":"Michigan State University, United States","url":"https://ai.msu.edu/guidelines","title":"Give students an opportunity to respond to alleged AI misuse","control":"Implementation, Procurement and Resources → Reporting Misuse, second paragraph","actor":"MSU personnel handling allegations of student generative AI misuse","modality":"should","action":"afford","object":"students an opportunity to respond to alleged AI misuse","condition":"A student is accused of generative AI misuse; existing Student Rights and Responsibilities procedures govern.","exception":"No exception stated; this is an institutional procedural expectation, not a universal legal rule.","timing":"During the university's misconduct process before its resolution.","evidenceSummary":"The reporting paragraph promises a fair, transparent process that lets accused students respond, present evidence and access support.","ruleId":"AIR-5DF0307196","intent":"afford students an opportunity to respond to alleged ai misuse","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-46fce5a365618568fd385448dca0a4ab8958fd7e5ae7b2c4ef311fa973c21ce0","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Publish the AEDT bias audit summary","control":"FAQ II.3, p.3; 6 RCNY §5-303(a)(1),(b)","modality":"must","action":"publish","object":"AEDT bias audit summary","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Summary includes audit date, data source/explanation, unknown-category count, category applicant counts, rates and impact ratios.","exception":"An identified active hyperlink to the required summary may satisfy publication.","timing":"Before AEDT use.","evidenceSummary":"FAQ II.3 requires public results and lists summary contents; §5-303(a)(1),(b) establishes website publication or identified active link.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=3","ruleId":"AIR-D7781FB4C4","intent":"publish aedt bias audit summary","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-5ca250b875be0fb50c2027491a8fee19cd58a387d65edec2c4bc9432784c2f3a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved August 12, 2025; no revisions listed","authority":"organization-specific","jurisdiction":"Michigan State University, United States","url":"https://ai.msu.edu/guidelines","title":"Use MSU-approved tools for university work","control":"Introduction, paragraphs 5–6; At a Glance, university-work bullet","actor":"Members of the MSU community conducting work on behalf of MSU","modality":"should","action":"use","object":"approved tools","condition":"Conducting work on behalf of MSU; tool approval and permissible data handling are specific to university standards and role.","exception":"No general exception is stated for university work; supervisor consultation clarifies permissible applications. Other personal/public uses require separate scope assessment.","timing":"When selecting and using generative AI tools for university work.","evidenceSummary":"MSU expects university-work use of institutionally approved/supported tools, with compliance/security review and role-specific consultation.","ruleId":"AIR-32BF4E5A3E","intent":"use approved tools","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-a40845f549cbbf473c7b73ef200be324a53bda4d63977311f917ec6d85061329","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Independent auditors conducting required NYC AEDT bias audits","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Calculate category impact ratios for AEDT bias audits","control":"FAQ II.1, p.2 and III.9, p.4; 6 RCNY §5-301(b)(2)–(3),(c)(3)–(4),(d)","modality":"must","action":"calculate","object":"AEDT category impact ratios","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Assess sex, race/ethnicity and their intersections; compare category selection/scoring rates with the highest category rate.","exception":"Categories under 2% may be excluded from impact-ratio calculations if the summary supplies justification, applicant count and applicable rate; other categories remain required.","timing":"During each required bias audit.","evidenceSummary":"FAQ II.1 requires impact ratios across sex, race/ethnicity and intersections; III.9 describes the under-2% exception, elaborated in §5-301(d).","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=2","ruleId":"AIR-FF118BBCC7","intent":"calculate aedt category impact ratios","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-ada27771f834c849a2bbce25cc32f0037b2dcb42d35a5b73a3244ebb3e0d63eb","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved August 12, 2025; no revisions listed","authority":"organization-specific","jurisdiction":"Michigan State University, United States","url":"https://ai.msu.edu/guidelines","title":"Include generative AI guidance in each syllabus","control":"Permissible Uses → Teaching and Learning → Educators, first paragraph","actor":"MSU course instructors","modality":"should","action":"include","object":"generative AI guidance in every course syllabus","condition":"Teaching an MSU course; guidance states whether AI is allowed, applicable contexts and expected acknowledgment/citation.","exception":"Guidance is course-specific and may permit or restrict use; no blanket permission is created.","timing":"In each syllabus, with expectations communicated at the outset of term.","evidenceSummary":"The Educators paragraph expects every syllabus to contain a clear generative AI statement addressing permitted contexts and acknowledgment.","ruleId":"AIR-45C22D7E04","intent":"include generative ai guidance in every course syllabus","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-c4bd557148509cda1c46d013f8de3ac20861aac52a09fbf81b5f36dd9dfed559","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Use independent assessors for AEDT bias audits","control":"FAQ II.1, p.2 and IV.2, p.5; 6 RCNY §5-300 Independent Auditor","modality":"must","action":"involve","object":"independent assessors in AI evaluation","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Bias auditor must exercise impartial judgment, have no prior involvement in using/developing/distributing the AEDT, and have no disqualifying employment or financial interest during the audit.","exception":"Auditors need not be approved by DCWP; a vendor may coordinate an independent audit, but the employer or agency remains responsible.","timing":"For each required bias audit before reliance on the AEDT.","evidenceSummary":"FAQ II.1 and IV.2 define impartial, independent bias auditing; IV.1 rejects a DCWP-approved-auditor requirement and V preserves employer responsibility.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=5","ruleId":"AIR-DFA60F69C7","intent":"involve independent assessors in ai evaluation","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-ccee5d16830abc09aec6300fe248f3336f064b6bceb84bb5e91c1bfcdef75574","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Publish the AEDT distribution date","control":"FAQ II.3, p.3; 6 RCNY §5-303(a)(2),(b)","modality":"must","action":"publish","object":"AEDT distribution date","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Distribution date means when the employer or agency began using the specific AEDT.","exception":"An identified active hyperlink to a site containing the required information may satisfy publication.","timing":"Before AEDT use.","evidenceSummary":"FAQ II.3 separately requires the date use began, in addition to audit results; §5-303(a)(2),(b) specifies its publication.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=3","ruleId":"AIR-79DB50E701","intent":"publish aedt distribution date","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-ddb93b13d70761cf84907ea7112d02e5e61ef56d988d3142bb559c3bf4a1f8bf","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Notify NYC residents before AEDT assessment","control":"FAQ VI.1–2, p.5; NYC Code §20-871(b)(1),(2); 6 RCNY §5-304(a)–(c)","modality":"must","action":"provide","object":"notice of automated decision-making","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Candidate or employee resides in NYC. Notice identifies AEDT use and qualifications/characteristics assessed, with reasonable-accommodation request instructions.","exception":"Permitted notice channels include job posting, mail or email; applicants may receive website notice and promotion candidates a provided written policy. This rule does not itself require an alternative selection process.","timing":"At least 10 business days before AEDT use.","evidenceSummary":"FAQ VI.1–2 explains notice content, channels and lead time; §5-304 distinguishes applicant and promotion-candidate channels.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=5","ruleId":"AIR-9F12707A1E","intent":"provide notice of automated decision making","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-e215d96370c5c1e762df90f24855611b0132bcd3c98be973768e62219ceb9d57","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"regulator-guidance-interpreting-NYC-AEDT-requirements","jurisdiction":"New York City, United States","title":"Exclude inferred demographics from AEDT bias audits","control":"FAQ III.6, p.4","modality":"must not","action":"use","object":"imputed or inferred demographic data in AEDT bias audits","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Rule concerns audit demographics, rather than a universal prohibition on demographic inference.","exception":"FAQ identifies no allowance for imputed/inferred audit demographics; insufficient historical data may instead permit other historical data or test data.","timing":"When preparing and conducting the bias audit.","evidenceSummary":"FAQ III.6 expressly disallows imputed or algorithmically inferred demographics for the bias audit and identifies alternative data options.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=4","ruleId":"AIR-6190106E33","intent":"use imputed or inferred demographic data in aedt bias audits","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-e803525e253ee797543d3a6777325a8c0dd4cff01458994453e22f4e8d9bf501","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Explain bias-audit test-data provenance","control":"FAQ III.7–8, p.4; 6 RCNY §5-302(b)","modality":"must","action":"explain","object":"AEDT bias audit test-data provenance","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Audit uses test data because historical data are insufficient for a statistically significant audit.","exception":"Not triggered when audit uses only adequate historical data.","timing":"In the public summary of the test-data audit.","evidenceSummary":"FAQ III.7–8 requires the summary to state why test data were used and explain their source/development; §5-302(b) requires reasons and generation/acquisition description.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=4","ruleId":"AIR-7B6A0342EC","intent":"explain aedt bias audit test data provenance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-ec81a3502aa372ff1fb4836980f39e248268a2545d5df549032424819190ca47","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Use historical AEDT data for bias auditing","control":"FAQ III.1–2, p.3 and III.4–5, p.4; 6 RCNY §5-302(a),(b)","modality":"must","action":"use","object":"historical data for AEDT bias audits","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Historical data are collected from use of the same AEDT to assess applicants or promotion candidates.","exception":"Test data may be used if historical data are insufficient for a statistically significant audit. Reliance on other employers' historical data requires supplying one's own historical data or never having used the AEDT.","timing":"When conducting each required bias audit.","evidenceSummary":"FAQ III describes historical-data default, shared-data reliance conditions and insufficient-data exception; §5-302 preserves those distinctions.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=3","ruleId":"AIR-58ABBD6E09","intent":"use historical data for aedt bias audits","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-edaad0cc3a6cc7dc62be92d31d0dd6c8571c0709bd5fa3004ba14e8b6b66824f","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Do not use an AEDT with an expired bias audit","control":"FAQ II.4, p.3; 6 RCNY §5-301(a)","modality":"must not","action":"use","object":"AEDTs without a current bias audit","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope.","exception":"Tools outside the statutory AEDT definition and non-assessment outreach are out of scope.","timing":"Before use and throughout continued use; most recent audit must be within the preceding year. Law effective January 1, 2023; enforcement July 5, 2023.","evidenceSummary":"FAQ II.4 limits reliance on a bias audit to one year; §5-301(a) prohibits continued use after that interval.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=3","ruleId":"AIR-D1A2B1E180","intent":"use aedts without a current bias audit","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-a78484c1ebeaee493ce7b1b3068258565739e7b7a2b3e721a38b2887d8709681","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-06T13:02:31.921Z","fingerprint":"a78484c1ebeaee493ce7b1b3068258565739e7b7a2b3e721a38b2887d8709681","previousFingerprint":"f0db429e44f8e635475937b5156f09de92fcc9033cc5c11a6fb85c18ec66399d","bytes":708180,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-06T13:02:31.921Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-1c70944dae1f01d9bf42f72d7230a112384f50e02d92b4bf9544c53b11f232d2","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-06T13:02:29.706Z","fingerprint":"1c70944dae1f01d9bf42f72d7230a112384f50e02d92b4bf9544c53b11f232d2","previousFingerprint":"84295cc322ed732913ef3a8fbdeafc856d022d8bd183153ff78751219d0a39f8","bytes":136664,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-06T13:02:29.706Z","reviewed_at":null},{"id":"finding-1f6b2c4af5ca0343a3403f577f271db360b05081779054c32b2201a6ee7266a1","kind":"rule-candidate","status":"pending","body":{"title":"Monitor AI behavior in production","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"5.2.1 Production monitoring","actor":"Organizations operating AI systems","modality":"should","action":"monitor","object":"AI behavior in production","condition":"Monitoring must use system-specific performance metrics and indicators relevant to identified risks.","exception":"Monitoring scope and intensity may be proportionate to the system's documented risks and deployment context.","timing":"Continuously or at a frequency defined before deployment and reviewed over the lifecycle.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 5.2.1 requires monitoring systems for each AI system that track performance measures and indicators tied to identified risks.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-F6290E21EB","intent":"monitor ai behavior in production","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-37c7264cba5abd2b5c1ac5f50bc133e900f48f6ef803e7ba56e585c80ff43682","kind":"rule-candidate","status":"pending","body":{"title":"Reassess AI risks after controls","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"3.3.1 AI risk treatment","actor":"Organizations developing or deploying AI systems","modality":"should","action":"reassess","object":"AI risks after controls","condition":"After implementing selected risk-treatment options and controls for identified AI-system risks.","exception":"Treatment options may include avoidance, transfer, acceptance, or reduction, subject to the organization's documented risk criteria.","timing":"After controls are implemented and before relying on them as effective.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 3.3.1 directs organizations to implement a documented treatment plan and reassess risk after controls to verify effectiveness.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-96428BE149","intent":"reassess ai risks after controls","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-3848028ed10c35da99f070491661f0ba1d40d345aef2f2d6e2e28effeaf811cd","kind":"rule-candidate","status":"pending","body":{"title":"Inventory organizational AI systems","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"4.1.1 AI register","actor":"Organizations developing or deploying AI systems","modality":"should","action":"inventory","object":"organizational AI systems","condition":"The organization-wide inventory must contain enough detail to inform stakeholders and support future conformance assessments.","exception":"Inventory detail should be sufficient for governance and conformance needs while respecting applicable confidentiality and security constraints.","timing":"Create and keep the inventory up to date, including review dates.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 4.1.1 calls for a current organization-wide inventory of each AI model and system with ownership, purpose, provenance, tests, risks, controls, audits, and review dates.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-9365A6ADE2","intent":"inventory organizational ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-8821d5683602803de6d7ec29ea8a312eb5105b805cf16de4b6ddbf980aa38922","kind":"rule-candidate","status":"pending","body":{"title":"Define safe AI decommissioning procedures","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"6.2.1 AI decommissioning","actor":"Organizations operating AI systems","modality":"should","action":"define","object":"safe AI decommissioning procedures","condition":"Procedures must address termination criteria, accountable roles, critical dependencies, shutdown impacts, timing, treatment, data extraction, asset return or deletion, and record retention.","exception":"Critical infrastructure and service-delivery dependencies require impact assessment and a disruption-minimization plan before shutdown.","timing":"Define before decommissioning and apply when termination criteria are met.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 6.2.1 specifies the decisions and safeguards organizations should define for intervening in and decommissioning AI systems.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-B098FE0267","intent":"define safe ai decommissioning procedures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-940811c9ce2e185738e88fdd544fce1ed3cad53dbfa27dd92d39b71c0256e4df","kind":"rule-candidate","status":"pending","body":{"title":"Maintain alternative pathways for critical functions","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"6.2.4 Operational continuity","actor":"Organizations relying on AI for critical functions","modality":"should","action":"maintain","object":"alternative pathways for critical functions","condition":"Where AI systems support functions that must continue through malfunction or shutdown.","exception":"Alternative pathways may be manual or non-AI systems if they preserve required service continuity.","timing":"Available before an AI malfunction or planned or unplanned shutdown.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 6.2.4 directs organizations to preserve alternate ways to perform critical functions when AI systems malfunction or are taken offline.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-B7C8569952","intent":"maintain alternative pathways for critical functions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-a72cb97e55f6cea0630130f3b5c857cf6c3f1e13234fb86a34ec5b3eabeebdd3","kind":"rule-candidate","status":"pending","body":{"title":"Obtain documented AI deployment authorization","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"5.1.5 Pre-deployment testing","actor":"Organizations deploying AI systems","modality":"should","action":"obtain","object":"documented AI deployment authorization","condition":"Authorization must come from the accountable person and be based on documented test results.","exception":"The authorization decision may withhold deployment when acceptance criteria are not met.","timing":"Before deployment.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 5.1.5 calls for documented deployment authorization and rationale from the accountable person based on test results.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-76A82C58C5","intent":"obtain documented ai deployment authorization","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-bea3d432160d43ed6dc7ba95a14e2a2af535d604aa82f1bfc6537107dc3aef2d","kind":"rule-candidate","status":"pending","body":{"title":"Assign and communicate AI system accountability","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"1.1.1 Accountable people","actor":"Organizations building, customising, or using AI in complex or higher-risk ways","modality":"should","action":"assign","object":"AI system accountability","condition":"For operation of the AI management system, including policies, deployment, oversight, testing, redress, and continual improvement across employees, contractors, and third-party providers.","exception":"Accountable roles may be distributed, but responsibility must be documented and clearly communicated.","timing":"Before and throughout development, deployment, and operation.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 1.1.1 directs organizations to assign, document, and clearly communicate who is accountable across the organization for specified AI-management responsibilities.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-A332E21BFB","intent":"assign ai system accountability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-c9e61e406a54ee0edcdc24ab7464129a3aa276cdbfcee0be934fe4a188cdc396","kind":"rule-candidate","status":"pending","body":{"title":"Document shared AI supply-chain accountability","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"1.2.1 Supply chain accountabilities","actor":"AI supply-chain participants","modality":"should","action":"document","object":"shared AI supply chain accountability","condition":"Across model developers, system developers, and deployers for monitoring and evaluation, human oversight, issue escalation, incident response, resolution, and updates.","exception":"Responsibilities may be shared across parties; each allocation still needs to be identified and communicated.","timing":"Before integration or deployment and maintained throughout the lifecycle.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 1.2.1 calls for identifying, documenting, and communicating shared responsibility across the AI supply chain for performance, safety, oversight, incidents, and updates.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-7A6D7EDE8E","intent":"document shared ai supply chain accountability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-f29a20415821414e04c6d4a65d906450209ef8309a31f4fe2fc09969e3fae9b1","kind":"rule-candidate","status":"pending","body":{"title":"Establish mechanisms to appeal AI outcomes","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"2.2.2 Feedback and redress","actor":"Organizations deploying AI systems","modality":"should","action":"establish","object":"mechanisms to appeal AI outcomes","condition":"For AI use and decisions affecting stakeholders; mechanisms must be accessible, understandable, and available at the appropriate time.","exception":"The mechanism should be proportionate to affected stakeholder needs and applicable regulatory requirements.","timing":"Available during the affected person's interaction with the AI system.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 2.2.2 requires system-level contestability mechanisms enabling stakeholders to understand, challenge, and appeal AI use and decisions.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-6E499BCE84","intent":"establish mechanisms to appeal ai outcomes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-f600c471f6d60b51102a22e951629126b669d212dafd530f38971aec8aac0f05","kind":"rule-candidate","status":"pending","body":{"title":"Request upstream AI test methods and results","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"5.1.4 Pre-deployment testing","actor":"Organizations procuring or deploying third-party AI systems","modality":"should","action":"request","object":"upstream AI test methods and results","condition":"When an upstream provider performed model or system testing during development.","exception":"The receiving organization must still evaluate whether the provider's testing aligns with its own acceptance criteria.","timing":"Before deployment authorization.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 5.1.4 tells deployers to request upstream testing methods and results and check them against the deployer's acceptance criteria.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-23441717D0","intent":"request upstream ai test methods and results","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"change-eu-ai-act-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-05T13:06:46.084Z","fingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","previousFingerprint":"d0956a30a24ee076ab16aced7ce7030c58170b900f79f5d70653d9b02c49939c","bytes":0,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-05T13:06:46.084Z","reviewed_at":null},{"id":"change-eu-gdpr-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-05T13:06:46.084Z","fingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","previousFingerprint":"83b5dc401f75b59ebed22bea83b410443ce36e008268ada5345a1ccb1a9d0df9","bytes":0,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-05T13:06:46.084Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-f0db429e44f8e635475937b5156f09de92fcc9033cc5c11a6fb85c18ec66399d","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-05T13:06:46.084Z","fingerprint":"f0db429e44f8e635475937b5156f09de92fcc9033cc5c11a6fb85c18ec66399d","previousFingerprint":"d681d7fcf48a367b8abf1b7ac97baa47b03b39aeed9a79082f8aadd5e1c5b096","bytes":707428,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-05T13:06:46.084Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-84295cc322ed732913ef3a8fbdeafc856d022d8bd183153ff78751219d0a39f8","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-05T13:06:42.736Z","fingerprint":"84295cc322ed732913ef3a8fbdeafc856d022d8bd183153ff78751219d0a39f8","previousFingerprint":"637ba1b2f5d0bc7ba678246a53d59048109c9bbcf0dae938324601144fb28e3b","bytes":136664,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-05T13:06:42.736Z","reviewed_at":null},{"id":"finding-09ca06eae6f1de4bb68d81e41fcc7059fd6cc35716c04fd384de1fd8475b43ce","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","authority":"voluntary-code-requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","exception":"No clause-specific exception stated.","topic":"Security","title":"Release hashes for distributed model components","control":"Principle 8, clause 8.1.2","actor":"Developers","modality":"must","action":"release","object":"cryptographic hashes for distributed model components","condition":"Model components are made available to other stakeholders; requirement within a voluntary code.","timing":"With component distribution","evidenceSummary":"Clause 8.1.2 supports stakeholder authenticity verification through published component hashes.","ruleId":"AIR-017A3F57AD","intent":"release cryptographic hashes for distributed model components","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-0de9da9f5d0a36e4af974e9ad063f5e39343d9d4e98cc7d5d1778bef45e082eb","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative AI Profile","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=18","authority":"voluntary","jurisdiction":"United States; voluntary use elsewhere","modality":"should","exception":"No clause-specific exception stated.","topic":"Safety","title":"Plan periodic offensive-cyber misuse evaluations","control":"GV-1.3-003 · PDF page 18 · offensive-cyber test-plan component","actor":"Developers of highly capable generative AI models","action":"establish","object":"a test plan for periodic offensive-cyber misuse evaluations","condition":"Before highly capable model development, following the voluntary suggested action.","timing":"Before development; evaluations periodically","evidenceSummary":"Completes the cyber-testing portion alongside the existing CBRN planning candidate. This is planning, not evidence of completed evaluations.","ruleId":"AIR-1DD98BB162","intent":"establish a test plan for periodic offensive cyber misuse evaluations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-2ee56b3ef46f145a2a2daf7c4939e810c52d664ab3c0501fb1f6d998298160b1","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","authority":"voluntary-code-requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","exception":"No clause-specific exception stated.","topic":"Security","title":"Audit prompt and configuration changes","control":"Principle 8, clause 8.3 — audit-log recommendation","actor":"Developers","modality":"should","action":"maintain","object":"an audit log of system-prompt and model-configuration changes","condition":"Changes affect how the AI system operates.","timing":"As relevant configuration changes occur","evidenceSummary":"Clause 8.3 recommends a configuration-change audit trail; optional sharing is excluded from this candidate.","ruleId":"AIR-EC7664C68A","intent":"maintain an audit log of system prompt and model configuration changes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-31b1e0e9ffc935eceaafdf50f30dfa9cbe097d0cb75099f7dc09de9c9f8efef1","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative Artificial Intelligence Use Policy","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","authority":"organizational-policy; applicable Town scope only","jurisdiction":"Town of Brookline, Massachusetts, United States","modality":"must","exception":"Case-by-case IT Security Team exception process; do not infer an exception has been granted. Conflicting applicable law prevails.","topic":"Governance","title":"Terminate unprotected contractor data access","control":"Policy / Use — contractor responsibilities, fourth sub-bullet","actor":"Employees accountable for contractor relationships","action":"terminate","object":"contractor access to data forbidden from entry into unconstrained GenAI tools","condition":"Contractor provides no policy, has none, or its policy is less restrictive than the Town policy.","timing":"When the stated deficient-policy condition applies; no numeric deadline stated","evidenceSummary":"This is scoped data-access termination, not termination of the contractor's agreement.","ruleId":"AIR-AB6F26A8FE","intent":"terminate contractor access to data forbidden from entry into unconstrained genai tools","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-540830f0d6650546d4d62108156c20342ab7154379823e0d7d29f3e4728b0e2f","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","authority":"voluntary-code-requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","exception":"No clause-specific exception stated.","topic":"Security","title":"Document model, dataset and prompt lifecycle — UK mapping","control":"Principle 2, clause 2.3 — lifecycle-audit-trail component","actor":"Developers","modality":"must","action":"document","object":"model, dataset and prompt lifecycle","condition":"Models, datasets or prompts are incorporated into an AI system; record operation and lifecycle management in an audit trail.","timing":"Throughout operation and lifecycle management","evidenceSummary":"Clause 2.3 adds a UK voluntary-code requirement to existing intent AIR-AB2476BBAB. It does not overwrite the NCSC guidance variant.","ruleId":"AIR-AB2476BBAB","intent":"document model dataset and prompt lifecycle","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-7ded22be70b5b304316f3744ca92e4e0f1cf1623692a866b1ca664364f760351","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative AI Profile","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=20","authority":"voluntary","jurisdiction":"United States; voluntary use elsewhere","modality":"should","exception":"No clause-specific exception stated.","topic":"Governance","title":"Record model access modes in GAI inventories","control":"GV-1.6-003 · PDF page 20 · model-access-mode component","actor":"AI governance owners","action":"record","object":"model access modes in GAI inventories","condition":"Consider additional GAI inventory fields; voluntary recommendation interpreted for owner validation.","timing":"At inventory creation and access-mode changes","evidenceSummary":"Captures the separate access-mode field; semantic overlap with model inventory rules remains for owner review.","ruleId":"AIR-265655957B","intent":"record model access modes in gai inventories","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-80ddb705075930fec0f060a33dd08e2bc1e3730a4c19e8f47d784586ac1ce1c0","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","authority":"voluntary-code-requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","exception":"No clause-specific exception stated.","topic":"Security","title":"Risk-assess AI permissions on connected systems","control":"Principle 2, clause 2.6 — risk-assessment component","actor":"Developers and System Operators","modality":"must","action":"risk-assess","object":"AI permissions on connected systems","condition":"An AI system interacts with other systems or data sources; a requirement within a voluntary code.","timing":"When granting connected-system permissions","evidenceSummary":"Clause 2.6 separately requires assessing the risk of those permissions.","ruleId":"AIR-AD5A513030","intent":"risk assess ai permissions on connected systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-87eacd6043dcbd989c3c31daa145fb6f65b9a8c59460f08aba025ac1a02216db","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative AI Profile","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=20","authority":"voluntary","jurisdiction":"United States; voluntary use elsewhere","modality":"should","exception":"No clause-specific exception stated.","topic":"Governance","title":"Record underlying model versions in GAI inventories","control":"GV-1.6-003 · PDF page 20 · underlying-model-version component","actor":"AI governance owners","action":"record","object":"underlying foundation-model versions in GAI inventories","condition":"Consider additional GAI inventory fields beyond general governance and risk information; recommendation interpreted for owner validation.","timing":"At inventory creation and model-version changes","evidenceSummary":"The version field is one atomic interpretation of the suggested inventory fields; other recommended fields remain separate.","ruleId":"AIR-12D64D5511","intent":"record underlying foundation model versions in gai inventories","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-a3d0cbd2010162dce2272e3d366f74ed2d13b0d0b82f4b51f14d4debad33f74d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative Artificial Intelligence Use Policy","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","authority":"organizational-policy; applicable Town scope only","jurisdiction":"Town of Brookline, Massachusetts, United States","modality":"must","exception":"Case-by-case IT Security Team exception process; do not infer an exception has been granted. Conflicting applicable law prevails.","topic":"Governance","title":"Report unsolicited AI privilege escalation","control":"Policy / Use — reporting bullet, first sub-bullet (privilege-escalation component)","actor":"Users of Town Technology Resources","action":"report","object":"indications of unsolicited AI privilege escalation to the IT Cybersecurity Team","condition":"Town systems or data may be exposed to GenAI; escalation occurs without explicit prompting.","timing":"When indications are observed; no numeric deadline stated","evidenceSummary":"This reporting duty excludes the separate sensitive-data and physical-interaction components. The current displayed revision is still 1.7, so the byte-change alert is not proof of a new policy edition.","ruleId":"AIR-FB75F669C0","intent":"report indications of unsolicited ai privilege escalation to the it cybersecurity team","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-b6ea03c14df435d03cedf14ffde730ac38284b5dd3270229f144edde6f0b8260","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative AI Profile","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=18","authority":"voluntary","jurisdiction":"United States; voluntary use elsewhere","modality":"should","exception":"No clause-specific exception stated.","topic":"Safety","title":"Plan responses to highly capable model misuse","control":"GV-1.3-003 · PDF page 18 · response-policy component","actor":"Developers of highly capable generative AI models","action":"establish","object":"a response policy for highly capable model misuse","condition":"Potential misuse of CBRN information or capabilities, or offensive cyber capabilities; voluntary suggested action.","timing":"Before model development","evidenceSummary":"The response-policy action is separated from periodic testing; both capability classes remain scope conditions.","ruleId":"AIR-3C106D9655","intent":"establish a response policy for highly capable model misuse","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-cc123951957a5ecbedbcac5d686327b041a37417e7ddd3b6e4057d6a11c547bf","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative Artificial Intelligence Use Policy","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","authority":"organizational-policy; applicable Town scope only","jurisdiction":"Town of Brookline, Massachusetts, United States","modality":"must","exception":"Case-by-case IT Security Team exception process; do not infer an exception has been granted. Conflicting applicable law prevails.","topic":"Governance","title":"Request a contractor's written GenAI policy","control":"Policy / Use — contractor responsibilities, second sub-bullet","actor":"Employees accountable for contractor relationships","action":"request","object":"a contractor's written unconstrained-GenAI policy or summary","condition":"The contractor can access information forbidden from entry into unconstrained GenAI tools.","timing":"Before signing any agreement","evidenceSummary":"Requires written policy evidence before agreement; comparative review and termination are distinct actions.","ruleId":"AIR-9D20F6040D","intent":"request a contractor s written unconstrained genai policy or summary","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-d1a646587cf27e73a5db96577afa7b53ab887f1209fdebfd7d1e7c2797a9a4d4","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","authority":"voluntary-code-requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","exception":"No clause-specific exception stated.","topic":"Security","title":"Limit AI permissions on connected systems","control":"Principle 2, clause 2.6 — permission-limitation component","actor":"Developers and System Operators","modality":"must","action":"limit","object":"AI permissions on connected systems to required functionality","condition":"An AI system interacts with internal or external systems or data sources. 'Shall' is a requirement within this voluntary code.","timing":"When granting connected-system permissions","evidenceSummary":"Clause 2.6 confines permissions to functional need. The risk-assessment component is staged separately; semantic overlap with least-privilege rules requires owner review.","ruleId":"AIR-1575D8EDBD","intent":"limit ai permissions on connected systems to required functionality","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"change-eu-ai-act-d0956a30a24ee076ab16aced7ce7030c58170b900f79f5d70653d9b02c49939c","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-04T12:59:58.143Z","fingerprint":"d0956a30a24ee076ab16aced7ce7030c58170b900f79f5d70653d9b02c49939c","previousFingerprint":"f2992af811eaa9a490df6f9d437698086ff850986b14be5701e86e57c43ad16a","bytes":1535248,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-04T12:59:58.143Z","reviewed_at":null},{"id":"change-eu-gdpr-83b5dc401f75b59ebed22bea83b410443ce36e008268ada5345a1ccb1a9d0df9","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-04T12:59:58.143Z","fingerprint":"83b5dc401f75b59ebed22bea83b410443ce36e008268ada5345a1ccb1a9d0df9","previousFingerprint":"44a3f97ed40dc0fb9f7edf75ed1ae1fc1a00e0854d962b9b5774a36c8927ed67","bytes":1071098,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-04T12:59:58.143Z","reviewed_at":null},{"id":"change-brookline-genai-3eb9d05b8739fa8021c873c2aae060aca74b30f3ef7f53fdc778d5b456cf48da","kind":"source-change","status":"pending","body":{"sourceId":"brookline-genai","title":"Generative Artificial Intelligence Use Policy","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","status":"publisher-bytes-changed","checkedAt":"2026-10-04T12:59:54.281Z","fingerprint":"3eb9d05b8739fa8021c873c2aae060aca74b30f3ef7f53fdc778d5b456cf48da","previousFingerprint":"1b9f66483321faf06e0f2f8c778da2405dae63e4e2858f64138d871c7c9aed9f","bytes":110652,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-04T12:59:54.281Z","reviewed_at":null},{"id":"finding-f183563e664459e9595d9adb996b353a0036f4407c08b7797042fc273d1a8185","kind":"rule-candidate","status":"pending","body":{"title":"Plan periodic CBRN misuse evaluations","sourceTitle":"Generative AI Profile","sourceVersion":"AI 600-1","control":"GV-1.3-003 · PDF page 18","actor":"Developers of highly capable generative AI models","modality":"should","action":"establish","object":"a test plan for periodic CBRN misuse evaluations","condition":"Before developing highly capable models; the CBRN evaluation-planning portion of the voluntary NIST GenAI risk profile. Organization applicability requires review.","evidenceSummary":"NIST recommends preparing evaluation planning before highly capable model development. This atomic candidate covers CBRN misuse testing; the same action also discusses a response policy and offensive cyber capability, which need separate candidates.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=18","exception":null,"timing":"Before model development; evaluate periodically","authority":"voluntary","jurisdiction":"United States; voluntary use elsewhere","topic":"Safety","ruleId":"AIR-171D954EEE","intent":"establish a test plan for periodic cbrn misuse evaluations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-03T23:27:38.373Z","reviewed_at":null}],"reviews":[]}},"legacyDiscovery":{"findings":[{"id":"finding-f183563e664459e9595d9adb996b353a0036f4407c08b7797042fc273d1a8185","kind":"rule-candidate","status":"pending","body":{"title":"Plan periodic CBRN misuse evaluations","sourceTitle":"Generative AI Profile","sourceVersion":"AI 600-1","control":"GV-1.3-003 · PDF page 18","actor":"Developers of highly capable generative AI models","modality":"should","action":"establish","object":"a test plan for periodic CBRN misuse evaluations","condition":"Before developing highly capable models; the CBRN evaluation-planning portion of the voluntary NIST GenAI risk profile. Organization applicability requires review.","evidenceSummary":"NIST recommends preparing evaluation planning before highly capable model development. This atomic candidate covers CBRN misuse testing; the same action also discusses a response policy and offensive cyber capability, which need separate candidates.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=18","exception":null,"timing":"Before model development; evaluate periodically","authority":"voluntary","jurisdiction":"United States; voluntary use elsewhere","topic":"Safety","ruleId":"AIR-171D954EEE","intent":"establish a test plan for periodic cbrn misuse evaluations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-03T23:27:38.373Z","reviewed_at":null},{"id":"change-brookline-genai-3eb9d05b8739fa8021c873c2aae060aca74b30f3ef7f53fdc778d5b456cf48da","kind":"source-change","status":"pending","body":{"sourceId":"brookline-genai","title":"Generative Artificial Intelligence Use Policy","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","status":"publisher-bytes-changed","checkedAt":"2026-10-04T12:59:54.281Z","fingerprint":"3eb9d05b8739fa8021c873c2aae060aca74b30f3ef7f53fdc778d5b456cf48da","previousFingerprint":"1b9f66483321faf06e0f2f8c778da2405dae63e4e2858f64138d871c7c9aed9f","bytes":110652,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-04T12:59:54.281Z","reviewed_at":null},{"id":"change-eu-ai-act-d0956a30a24ee076ab16aced7ce7030c58170b900f79f5d70653d9b02c49939c","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-04T12:59:58.143Z","fingerprint":"d0956a30a24ee076ab16aced7ce7030c58170b900f79f5d70653d9b02c49939c","previousFingerprint":"f2992af811eaa9a490df6f9d437698086ff850986b14be5701e86e57c43ad16a","bytes":1535248,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-04T12:59:58.143Z","reviewed_at":null},{"id":"change-eu-gdpr-83b5dc401f75b59ebed22bea83b410443ce36e008268ada5345a1ccb1a9d0df9","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-04T12:59:58.143Z","fingerprint":"83b5dc401f75b59ebed22bea83b410443ce36e008268ada5345a1ccb1a9d0df9","previousFingerprint":"44a3f97ed40dc0fb9f7edf75ed1ae1fc1a00e0854d962b9b5774a36c8927ed67","bytes":1071098,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-04T12:59:58.143Z","reviewed_at":null},{"id":"finding-09ca06eae6f1de4bb68d81e41fcc7059fd6cc35716c04fd384de1fd8475b43ce","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","authority":"voluntary-code-requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","exception":"No clause-specific exception stated.","topic":"Security","title":"Release hashes for distributed model components","control":"Principle 8, clause 8.1.2","actor":"Developers","modality":"must","action":"release","object":"cryptographic hashes for distributed model components","condition":"Model components are made available to other stakeholders; requirement within a voluntary code.","timing":"With component distribution","evidenceSummary":"Clause 8.1.2 supports stakeholder authenticity verification through published component hashes.","ruleId":"AIR-017A3F57AD","intent":"release cryptographic hashes for distributed model components","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-0de9da9f5d0a36e4af974e9ad063f5e39343d9d4e98cc7d5d1778bef45e082eb","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative AI Profile","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=18","authority":"voluntary","jurisdiction":"United States; voluntary use elsewhere","modality":"should","exception":"No clause-specific exception stated.","topic":"Safety","title":"Plan periodic offensive-cyber misuse evaluations","control":"GV-1.3-003 · PDF page 18 · offensive-cyber test-plan component","actor":"Developers of highly capable generative AI models","action":"establish","object":"a test plan for periodic offensive-cyber misuse evaluations","condition":"Before highly capable model development, following the voluntary suggested action.","timing":"Before development; evaluations periodically","evidenceSummary":"Completes the cyber-testing portion alongside the existing CBRN planning candidate. This is planning, not evidence of completed evaluations.","ruleId":"AIR-1DD98BB162","intent":"establish a test plan for periodic offensive cyber misuse evaluations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-2ee56b3ef46f145a2a2daf7c4939e810c52d664ab3c0501fb1f6d998298160b1","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","authority":"voluntary-code-requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","exception":"No clause-specific exception stated.","topic":"Security","title":"Audit prompt and configuration changes","control":"Principle 8, clause 8.3 — audit-log recommendation","actor":"Developers","modality":"should","action":"maintain","object":"an audit log of system-prompt and model-configuration changes","condition":"Changes affect how the AI system operates.","timing":"As relevant configuration changes occur","evidenceSummary":"Clause 8.3 recommends a configuration-change audit trail; optional sharing is excluded from this candidate.","ruleId":"AIR-EC7664C68A","intent":"maintain an audit log of system prompt and model configuration changes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-31b1e0e9ffc935eceaafdf50f30dfa9cbe097d0cb75099f7dc09de9c9f8efef1","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative Artificial Intelligence Use Policy","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","authority":"organizational-policy; applicable Town scope only","jurisdiction":"Town of Brookline, Massachusetts, United States","modality":"must","exception":"Case-by-case IT Security Team exception process; do not infer an exception has been granted. Conflicting applicable law prevails.","topic":"Governance","title":"Terminate unprotected contractor data access","control":"Policy / Use — contractor responsibilities, fourth sub-bullet","actor":"Employees accountable for contractor relationships","action":"terminate","object":"contractor access to data forbidden from entry into unconstrained GenAI tools","condition":"Contractor provides no policy, has none, or its policy is less restrictive than the Town policy.","timing":"When the stated deficient-policy condition applies; no numeric deadline stated","evidenceSummary":"This is scoped data-access termination, not termination of the contractor's agreement.","ruleId":"AIR-AB6F26A8FE","intent":"terminate contractor access to data forbidden from entry into unconstrained genai tools","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-540830f0d6650546d4d62108156c20342ab7154379823e0d7d29f3e4728b0e2f","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","authority":"voluntary-code-requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","exception":"No clause-specific exception stated.","topic":"Security","title":"Document model, dataset and prompt lifecycle — UK mapping","control":"Principle 2, clause 2.3 — lifecycle-audit-trail component","actor":"Developers","modality":"must","action":"document","object":"model, dataset and prompt lifecycle","condition":"Models, datasets or prompts are incorporated into an AI system; record operation and lifecycle management in an audit trail.","timing":"Throughout operation and lifecycle management","evidenceSummary":"Clause 2.3 adds a UK voluntary-code requirement to existing intent AIR-AB2476BBAB. It does not overwrite the NCSC guidance variant.","ruleId":"AIR-AB2476BBAB","intent":"document model dataset and prompt lifecycle","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-7ded22be70b5b304316f3744ca92e4e0f1cf1623692a866b1ca664364f760351","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative AI Profile","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=20","authority":"voluntary","jurisdiction":"United States; voluntary use elsewhere","modality":"should","exception":"No clause-specific exception stated.","topic":"Governance","title":"Record model access modes in GAI inventories","control":"GV-1.6-003 · PDF page 20 · model-access-mode component","actor":"AI governance owners","action":"record","object":"model access modes in GAI inventories","condition":"Consider additional GAI inventory fields; voluntary recommendation interpreted for owner validation.","timing":"At inventory creation and access-mode changes","evidenceSummary":"Captures the separate access-mode field; semantic overlap with model inventory rules remains for owner review.","ruleId":"AIR-265655957B","intent":"record model access modes in gai inventories","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-80ddb705075930fec0f060a33dd08e2bc1e3730a4c19e8f47d784586ac1ce1c0","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","authority":"voluntary-code-requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","exception":"No clause-specific exception stated.","topic":"Security","title":"Risk-assess AI permissions on connected systems","control":"Principle 2, clause 2.6 — risk-assessment component","actor":"Developers and System Operators","modality":"must","action":"risk-assess","object":"AI permissions on connected systems","condition":"An AI system interacts with other systems or data sources; a requirement within a voluntary code.","timing":"When granting connected-system permissions","evidenceSummary":"Clause 2.6 separately requires assessing the risk of those permissions.","ruleId":"AIR-AD5A513030","intent":"risk assess ai permissions on connected systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-87eacd6043dcbd989c3c31daa145fb6f65b9a8c59460f08aba025ac1a02216db","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative AI Profile","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=20","authority":"voluntary","jurisdiction":"United States; voluntary use elsewhere","modality":"should","exception":"No clause-specific exception stated.","topic":"Governance","title":"Record underlying model versions in GAI inventories","control":"GV-1.6-003 · PDF page 20 · underlying-model-version component","actor":"AI governance owners","action":"record","object":"underlying foundation-model versions in GAI inventories","condition":"Consider additional GAI inventory fields beyond general governance and risk information; recommendation interpreted for owner validation.","timing":"At inventory creation and model-version changes","evidenceSummary":"The version field is one atomic interpretation of the suggested inventory fields; other recommended fields remain separate.","ruleId":"AIR-12D64D5511","intent":"record underlying foundation model versions in gai inventories","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-a3d0cbd2010162dce2272e3d366f74ed2d13b0d0b82f4b51f14d4debad33f74d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative Artificial Intelligence Use Policy","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","authority":"organizational-policy; applicable Town scope only","jurisdiction":"Town of Brookline, Massachusetts, United States","modality":"must","exception":"Case-by-case IT Security Team exception process; do not infer an exception has been granted. Conflicting applicable law prevails.","topic":"Governance","title":"Report unsolicited AI privilege escalation","control":"Policy / Use — reporting bullet, first sub-bullet (privilege-escalation component)","actor":"Users of Town Technology Resources","action":"report","object":"indications of unsolicited AI privilege escalation to the IT Cybersecurity Team","condition":"Town systems or data may be exposed to GenAI; escalation occurs without explicit prompting.","timing":"When indications are observed; no numeric deadline stated","evidenceSummary":"This reporting duty excludes the separate sensitive-data and physical-interaction components. The current displayed revision is still 1.7, so the byte-change alert is not proof of a new policy edition.","ruleId":"AIR-FB75F669C0","intent":"report indications of unsolicited ai privilege escalation to the it cybersecurity team","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-b6ea03c14df435d03cedf14ffde730ac38284b5dd3270229f144edde6f0b8260","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative AI Profile","sourceVersion":"AI 600-1","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=18","authority":"voluntary","jurisdiction":"United States; voluntary use elsewhere","modality":"should","exception":"No clause-specific exception stated.","topic":"Safety","title":"Plan responses to highly capable model misuse","control":"GV-1.3-003 · PDF page 18 · response-policy component","actor":"Developers of highly capable generative AI models","action":"establish","object":"a response policy for highly capable model misuse","condition":"Potential misuse of CBRN information or capabilities, or offensive cyber capabilities; voluntary suggested action.","timing":"Before model development","evidenceSummary":"The response-policy action is separated from periodic testing; both capability classes remain scope conditions.","ruleId":"AIR-3C106D9655","intent":"establish a response policy for highly capable model misuse","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-cc123951957a5ecbedbcac5d686327b041a37417e7ddd3b6e4057d6a11c547bf","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Generative Artificial Intelligence Use Policy","sourceVersion":"1.7 — August 2025","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","authority":"organizational-policy; applicable Town scope only","jurisdiction":"Town of Brookline, Massachusetts, United States","modality":"must","exception":"Case-by-case IT Security Team exception process; do not infer an exception has been granted. Conflicting applicable law prevails.","topic":"Governance","title":"Request a contractor's written GenAI policy","control":"Policy / Use — contractor responsibilities, second sub-bullet","actor":"Employees accountable for contractor relationships","action":"request","object":"a contractor's written unconstrained-GenAI policy or summary","condition":"The contractor can access information forbidden from entry into unconstrained GenAI tools.","timing":"Before signing any agreement","evidenceSummary":"Requires written policy evidence before agreement; comparative review and termination are distinct actions.","ruleId":"AIR-9D20F6040D","intent":"request a contractor s written unconstrained genai policy or summary","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"finding-d1a646587cf27e73a5db96577afa7b53ab887f1209fdebfd7d1e7c2797a9a4d4","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","authority":"voluntary-code-requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","exception":"No clause-specific exception stated.","topic":"Security","title":"Limit AI permissions on connected systems","control":"Principle 2, clause 2.6 — permission-limitation component","actor":"Developers and System Operators","modality":"must","action":"limit","object":"AI permissions on connected systems to required functionality","condition":"An AI system interacts with internal or external systems or data sources. 'Shall' is a requirement within this voluntary code.","timing":"When granting connected-system permissions","evidenceSummary":"Clause 2.6 confines permissions to functional need. The risk-assessment component is staged separately; semantic overlap with least-privilege rules requires owner review.","ruleId":"AIR-1575D8EDBD","intent":"limit ai permissions on connected systems to required functionality","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-04T13:05:57.998Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-84295cc322ed732913ef3a8fbdeafc856d022d8bd183153ff78751219d0a39f8","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-05T13:06:42.736Z","fingerprint":"84295cc322ed732913ef3a8fbdeafc856d022d8bd183153ff78751219d0a39f8","previousFingerprint":"637ba1b2f5d0bc7ba678246a53d59048109c9bbcf0dae938324601144fb28e3b","bytes":136664,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-05T13:06:42.736Z","reviewed_at":null},{"id":"change-eu-ai-act-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-05T13:06:46.084Z","fingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","previousFingerprint":"d0956a30a24ee076ab16aced7ce7030c58170b900f79f5d70653d9b02c49939c","bytes":0,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-05T13:06:46.084Z","reviewed_at":null},{"id":"change-eu-gdpr-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-05T13:06:46.084Z","fingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","previousFingerprint":"83b5dc401f75b59ebed22bea83b410443ce36e008268ada5345a1ccb1a9d0df9","bytes":0,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-05T13:06:46.084Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-f0db429e44f8e635475937b5156f09de92fcc9033cc5c11a6fb85c18ec66399d","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-05T13:06:46.084Z","fingerprint":"f0db429e44f8e635475937b5156f09de92fcc9033cc5c11a6fb85c18ec66399d","previousFingerprint":"d681d7fcf48a367b8abf1b7ac97baa47b03b39aeed9a79082f8aadd5e1c5b096","bytes":707428,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-05T13:06:46.084Z","reviewed_at":null},{"id":"finding-1f6b2c4af5ca0343a3403f577f271db360b05081779054c32b2201a6ee7266a1","kind":"rule-candidate","status":"pending","body":{"title":"Monitor AI behavior in production","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"5.2.1 Production monitoring","actor":"Organizations operating AI systems","modality":"should","action":"monitor","object":"AI behavior in production","condition":"Monitoring must use system-specific performance metrics and indicators relevant to identified risks.","exception":"Monitoring scope and intensity may be proportionate to the system's documented risks and deployment context.","timing":"Continuously or at a frequency defined before deployment and reviewed over the lifecycle.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 5.2.1 requires monitoring systems for each AI system that track performance measures and indicators tied to identified risks.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-F6290E21EB","intent":"monitor ai behavior in production","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-37c7264cba5abd2b5c1ac5f50bc133e900f48f6ef803e7ba56e585c80ff43682","kind":"rule-candidate","status":"pending","body":{"title":"Reassess AI risks after controls","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"3.3.1 AI risk treatment","actor":"Organizations developing or deploying AI systems","modality":"should","action":"reassess","object":"AI risks after controls","condition":"After implementing selected risk-treatment options and controls for identified AI-system risks.","exception":"Treatment options may include avoidance, transfer, acceptance, or reduction, subject to the organization's documented risk criteria.","timing":"After controls are implemented and before relying on them as effective.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 3.3.1 directs organizations to implement a documented treatment plan and reassess risk after controls to verify effectiveness.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-96428BE149","intent":"reassess ai risks after controls","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-3848028ed10c35da99f070491661f0ba1d40d345aef2f2d6e2e28effeaf811cd","kind":"rule-candidate","status":"pending","body":{"title":"Inventory organizational AI systems","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"4.1.1 AI register","actor":"Organizations developing or deploying AI systems","modality":"should","action":"inventory","object":"organizational AI systems","condition":"The organization-wide inventory must contain enough detail to inform stakeholders and support future conformance assessments.","exception":"Inventory detail should be sufficient for governance and conformance needs while respecting applicable confidentiality and security constraints.","timing":"Create and keep the inventory up to date, including review dates.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 4.1.1 calls for a current organization-wide inventory of each AI model and system with ownership, purpose, provenance, tests, risks, controls, audits, and review dates.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-9365A6ADE2","intent":"inventory organizational ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-8821d5683602803de6d7ec29ea8a312eb5105b805cf16de4b6ddbf980aa38922","kind":"rule-candidate","status":"pending","body":{"title":"Define safe AI decommissioning procedures","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"6.2.1 AI decommissioning","actor":"Organizations operating AI systems","modality":"should","action":"define","object":"safe AI decommissioning procedures","condition":"Procedures must address termination criteria, accountable roles, critical dependencies, shutdown impacts, timing, treatment, data extraction, asset return or deletion, and record retention.","exception":"Critical infrastructure and service-delivery dependencies require impact assessment and a disruption-minimization plan before shutdown.","timing":"Define before decommissioning and apply when termination criteria are met.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 6.2.1 specifies the decisions and safeguards organizations should define for intervening in and decommissioning AI systems.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-B098FE0267","intent":"define safe ai decommissioning procedures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-940811c9ce2e185738e88fdd544fce1ed3cad53dbfa27dd92d39b71c0256e4df","kind":"rule-candidate","status":"pending","body":{"title":"Maintain alternative pathways for critical functions","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"6.2.4 Operational continuity","actor":"Organizations relying on AI for critical functions","modality":"should","action":"maintain","object":"alternative pathways for critical functions","condition":"Where AI systems support functions that must continue through malfunction or shutdown.","exception":"Alternative pathways may be manual or non-AI systems if they preserve required service continuity.","timing":"Available before an AI malfunction or planned or unplanned shutdown.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 6.2.4 directs organizations to preserve alternate ways to perform critical functions when AI systems malfunction or are taken offline.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-B7C8569952","intent":"maintain alternative pathways for critical functions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-a72cb97e55f6cea0630130f3b5c857cf6c3f1e13234fb86a34ec5b3eabeebdd3","kind":"rule-candidate","status":"pending","body":{"title":"Obtain documented AI deployment authorization","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"5.1.5 Pre-deployment testing","actor":"Organizations deploying AI systems","modality":"should","action":"obtain","object":"documented AI deployment authorization","condition":"Authorization must come from the accountable person and be based on documented test results.","exception":"The authorization decision may withhold deployment when acceptance criteria are not met.","timing":"Before deployment.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 5.1.5 calls for documented deployment authorization and rationale from the accountable person based on test results.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-76A82C58C5","intent":"obtain documented ai deployment authorization","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-bea3d432160d43ed6dc7ba95a14e2a2af535d604aa82f1bfc6537107dc3aef2d","kind":"rule-candidate","status":"pending","body":{"title":"Assign and communicate AI system accountability","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"1.1.1 Accountable people","actor":"Organizations building, customising, or using AI in complex or higher-risk ways","modality":"should","action":"assign","object":"AI system accountability","condition":"For operation of the AI management system, including policies, deployment, oversight, testing, redress, and continual improvement across employees, contractors, and third-party providers.","exception":"Accountable roles may be distributed, but responsibility must be documented and clearly communicated.","timing":"Before and throughout development, deployment, and operation.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 1.1.1 directs organizations to assign, document, and clearly communicate who is accountable across the organization for specified AI-management responsibilities.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-A332E21BFB","intent":"assign ai system accountability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-c9e61e406a54ee0edcdc24ab7464129a3aa276cdbfcee0be934fe4a188cdc396","kind":"rule-candidate","status":"pending","body":{"title":"Document shared AI supply-chain accountability","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"1.2.1 Supply chain accountabilities","actor":"AI supply-chain participants","modality":"should","action":"document","object":"shared AI supply chain accountability","condition":"Across model developers, system developers, and deployers for monitoring and evaluation, human oversight, issue escalation, incident response, resolution, and updates.","exception":"Responsibilities may be shared across parties; each allocation still needs to be identified and communicated.","timing":"Before integration or deployment and maintained throughout the lifecycle.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 1.2.1 calls for identifying, documenting, and communicating shared responsibility across the AI supply chain for performance, safety, oversight, incidents, and updates.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-7A6D7EDE8E","intent":"document shared ai supply chain accountability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-f29a20415821414e04c6d4a65d906450209ef8309a31f4fe2fc09969e3fae9b1","kind":"rule-candidate","status":"pending","body":{"title":"Establish mechanisms to appeal AI outcomes","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"2.2.2 Feedback and redress","actor":"Organizations deploying AI systems","modality":"should","action":"establish","object":"mechanisms to appeal AI outcomes","condition":"For AI use and decisions affecting stakeholders; mechanisms must be accessible, understandable, and available at the appropriate time.","exception":"The mechanism should be proportionate to affected stakeholder needs and applicable regulatory requirements.","timing":"Available during the affected person's interaction with the AI system.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 2.2.2 requires system-level contestability mechanisms enabling stakeholders to understand, challenge, and appeal AI use and decisions.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-6E499BCE84","intent":"establish mechanisms to appeal ai outcomes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"finding-f600c471f6d60b51102a22e951629126b669d212dafd530f38971aec8aac0f05","kind":"rule-candidate","status":"pending","body":{"title":"Request upstream AI test methods and results","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"Published 5 May 2026","control":"5.1.4 Pre-deployment testing","actor":"Organizations procuring or deploying third-party AI systems","modality":"should","action":"request","object":"upstream AI test methods and results","condition":"When an upstream provider performed model or system testing during development.","exception":"The receiving organization must still evaluate whether the provider's testing aligns with its own acceptance criteria.","timing":"Before deployment authorization.","authority":"voluntary","jurisdiction":"Australia","evidenceSummary":"Control 5.1.4 tells deployers to request upstream testing methods and results and check them against the deployer's acceptance criteria.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-23441717D0","intent":"request upstream ai test methods and results","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-05T13:33:57.433Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-1c70944dae1f01d9bf42f72d7230a112384f50e02d92b4bf9544c53b11f232d2","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-06T13:02:29.706Z","fingerprint":"1c70944dae1f01d9bf42f72d7230a112384f50e02d92b4bf9544c53b11f232d2","previousFingerprint":"84295cc322ed732913ef3a8fbdeafc856d022d8bd183153ff78751219d0a39f8","bytes":136664,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-06T13:02:29.706Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-a78484c1ebeaee493ce7b1b3068258565739e7b7a2b3e721a38b2887d8709681","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-06T13:02:31.921Z","fingerprint":"a78484c1ebeaee493ce7b1b3068258565739e7b7a2b3e721a38b2887d8709681","previousFingerprint":"f0db429e44f8e635475937b5156f09de92fcc9033cc5c11a6fb85c18ec66399d","bytes":708180,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-06T13:02:31.921Z","reviewed_at":null},{"id":"finding-2d57e2dba45ef60e8308320619e8664f0a781842a085f503db533c0f9d83800d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved August 12, 2025; no revisions listed","authority":"organization-specific","jurisdiction":"Michigan State University, United States","url":"https://ai.msu.edu/guidelines","title":"Disclose AI-detector use to students","control":"Permissible Uses → Teaching and Learning, detection-tools paragraph","actor":"MSU instructors choosing to use generative AI detection tools","modality":"must","action":"disclose","object":"intended use of generative AI detection tools to students","condition":"An instructor elects to use detection tools despite the guideline's general discouragement; explain rationale, interpretation and potential follow-up.","exception":"Not triggered if no detection tool is used; disclosure does not authorize treating detector output as conclusive evidence.","timing":"When choosing to use the detector, as part of informing students of intended use.","evidenceSummary":"The detection paragraph requires clear disclosure of intended use, including rationale, how results will be interpreted and possible actions.","ruleId":"AIR-D2002846E6","intent":"disclose intended use of generative ai detection tools to students","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-38479119e5044fee600724951b129b181ec8a9d6abaa28f596de1bcae3393935","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved August 12, 2025; no revisions listed","authority":"organization-specific","jurisdiction":"Michigan State University, United States","url":"https://ai.msu.edu/guidelines","title":"Give students an opportunity to respond to alleged AI misuse","control":"Implementation, Procurement and Resources → Reporting Misuse, second paragraph","actor":"MSU personnel handling allegations of student generative AI misuse","modality":"should","action":"afford","object":"students an opportunity to respond to alleged AI misuse","condition":"A student is accused of generative AI misuse; existing Student Rights and Responsibilities procedures govern.","exception":"No exception stated; this is an institutional procedural expectation, not a universal legal rule.","timing":"During the university's misconduct process before its resolution.","evidenceSummary":"The reporting paragraph promises a fair, transparent process that lets accused students respond, present evidence and access support.","ruleId":"AIR-5DF0307196","intent":"afford students an opportunity to respond to alleged ai misuse","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-46fce5a365618568fd385448dca0a4ab8958fd7e5ae7b2c4ef311fa973c21ce0","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Publish the AEDT bias audit summary","control":"FAQ II.3, p.3; 6 RCNY §5-303(a)(1),(b)","modality":"must","action":"publish","object":"AEDT bias audit summary","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Summary includes audit date, data source/explanation, unknown-category count, category applicant counts, rates and impact ratios.","exception":"An identified active hyperlink to the required summary may satisfy publication.","timing":"Before AEDT use.","evidenceSummary":"FAQ II.3 requires public results and lists summary contents; §5-303(a)(1),(b) establishes website publication or identified active link.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=3","ruleId":"AIR-D7781FB4C4","intent":"publish aedt bias audit summary","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-5ca250b875be0fb50c2027491a8fee19cd58a387d65edec2c4bc9432784c2f3a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved August 12, 2025; no revisions listed","authority":"organization-specific","jurisdiction":"Michigan State University, United States","url":"https://ai.msu.edu/guidelines","title":"Use MSU-approved tools for university work","control":"Introduction, paragraphs 5–6; At a Glance, university-work bullet","actor":"Members of the MSU community conducting work on behalf of MSU","modality":"should","action":"use","object":"approved tools","condition":"Conducting work on behalf of MSU; tool approval and permissible data handling are specific to university standards and role.","exception":"No general exception is stated for university work; supervisor consultation clarifies permissible applications. Other personal/public uses require separate scope assessment.","timing":"When selecting and using generative AI tools for university work.","evidenceSummary":"MSU expects university-work use of institutionally approved/supported tools, with compliance/security review and role-specific consultation.","ruleId":"AIR-32BF4E5A3E","intent":"use approved tools","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-a40845f549cbbf473c7b73ef200be324a53bda4d63977311f917ec6d85061329","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Independent auditors conducting required NYC AEDT bias audits","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Calculate category impact ratios for AEDT bias audits","control":"FAQ II.1, p.2 and III.9, p.4; 6 RCNY §5-301(b)(2)–(3),(c)(3)–(4),(d)","modality":"must","action":"calculate","object":"AEDT category impact ratios","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Assess sex, race/ethnicity and their intersections; compare category selection/scoring rates with the highest category rate.","exception":"Categories under 2% may be excluded from impact-ratio calculations if the summary supplies justification, applicant count and applicable rate; other categories remain required.","timing":"During each required bias audit.","evidenceSummary":"FAQ II.1 requires impact ratios across sex, race/ethnicity and intersections; III.9 describes the under-2% exception, elaborated in §5-301(d).","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=2","ruleId":"AIR-FF118BBCC7","intent":"calculate aedt category impact ratios","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-ada27771f834c849a2bbce25cc32f0037b2dcb42d35a5b73a3244ebb3e0d63eb","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved August 12, 2025; no revisions listed","authority":"organization-specific","jurisdiction":"Michigan State University, United States","url":"https://ai.msu.edu/guidelines","title":"Include generative AI guidance in each syllabus","control":"Permissible Uses → Teaching and Learning → Educators, first paragraph","actor":"MSU course instructors","modality":"should","action":"include","object":"generative AI guidance in every course syllabus","condition":"Teaching an MSU course; guidance states whether AI is allowed, applicable contexts and expected acknowledgment/citation.","exception":"Guidance is course-specific and may permit or restrict use; no blanket permission is created.","timing":"In each syllabus, with expectations communicated at the outset of term.","evidenceSummary":"The Educators paragraph expects every syllabus to contain a clear generative AI statement addressing permitted contexts and acknowledgment.","ruleId":"AIR-45C22D7E04","intent":"include generative ai guidance in every course syllabus","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-c4bd557148509cda1c46d013f8de3ac20861aac52a09fbf81b5f36dd9dfed559","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Use independent assessors for AEDT bias audits","control":"FAQ II.1, p.2 and IV.2, p.5; 6 RCNY §5-300 Independent Auditor","modality":"must","action":"involve","object":"independent assessors in AI evaluation","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Bias auditor must exercise impartial judgment, have no prior involvement in using/developing/distributing the AEDT, and have no disqualifying employment or financial interest during the audit.","exception":"Auditors need not be approved by DCWP; a vendor may coordinate an independent audit, but the employer or agency remains responsible.","timing":"For each required bias audit before reliance on the AEDT.","evidenceSummary":"FAQ II.1 and IV.2 define impartial, independent bias auditing; IV.1 rejects a DCWP-approved-auditor requirement and V preserves employer responsibility.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=5","ruleId":"AIR-DFA60F69C7","intent":"involve independent assessors in ai evaluation","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-ccee5d16830abc09aec6300fe248f3336f064b6bceb84bb5e91c1bfcdef75574","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Publish the AEDT distribution date","control":"FAQ II.3, p.3; 6 RCNY §5-303(a)(2),(b)","modality":"must","action":"publish","object":"AEDT distribution date","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Distribution date means when the employer or agency began using the specific AEDT.","exception":"An identified active hyperlink to a site containing the required information may satisfy publication.","timing":"Before AEDT use.","evidenceSummary":"FAQ II.3 separately requires the date use began, in addition to audit results; §5-303(a)(2),(b) specifies its publication.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=3","ruleId":"AIR-79DB50E701","intent":"publish aedt distribution date","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-ddb93b13d70761cf84907ea7112d02e5e61ef56d988d3142bb559c3bf4a1f8bf","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Notify NYC residents before AEDT assessment","control":"FAQ VI.1–2, p.5; NYC Code §20-871(b)(1),(2); 6 RCNY §5-304(a)–(c)","modality":"must","action":"provide","object":"notice of automated decision-making","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Candidate or employee resides in NYC. Notice identifies AEDT use and qualifications/characteristics assessed, with reasonable-accommodation request instructions.","exception":"Permitted notice channels include job posting, mail or email; applicants may receive website notice and promotion candidates a provided written policy. This rule does not itself require an alternative selection process.","timing":"At least 10 business days before AEDT use.","evidenceSummary":"FAQ VI.1–2 explains notice content, channels and lead time; §5-304 distinguishes applicant and promotion-candidate channels.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=5","ruleId":"AIR-9F12707A1E","intent":"provide notice of automated decision making","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-e215d96370c5c1e762df90f24855611b0132bcd3c98be973768e62219ceb9d57","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"regulator-guidance-interpreting-NYC-AEDT-requirements","jurisdiction":"New York City, United States","title":"Exclude inferred demographics from AEDT bias audits","control":"FAQ III.6, p.4","modality":"must not","action":"use","object":"imputed or inferred demographic data in AEDT bias audits","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Rule concerns audit demographics, rather than a universal prohibition on demographic inference.","exception":"FAQ identifies no allowance for imputed/inferred audit demographics; insufficient historical data may instead permit other historical data or test data.","timing":"When preparing and conducting the bias audit.","evidenceSummary":"FAQ III.6 expressly disallows imputed or algorithmically inferred demographics for the bias audit and identifies alternative data options.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=4","ruleId":"AIR-6190106E33","intent":"use imputed or inferred demographic data in aedt bias audits","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-e803525e253ee797543d3a6777325a8c0dd4cff01458994453e22f4e8d9bf501","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Explain bias-audit test-data provenance","control":"FAQ III.7–8, p.4; 6 RCNY §5-302(b)","modality":"must","action":"explain","object":"AEDT bias audit test-data provenance","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Audit uses test data because historical data are insufficient for a statistically significant audit.","exception":"Not triggered when audit uses only adequate historical data.","timing":"In the public summary of the test-data audit.","evidenceSummary":"FAQ III.7–8 requires the summary to state why test data were used and explain their source/development; §5-302(b) requires reasons and generation/acquisition description.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=4","ruleId":"AIR-7B6A0342EC","intent":"explain aedt bias audit test data provenance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-ec81a3502aa372ff1fb4836980f39e248268a2545d5df549032424819190ca47","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Use historical AEDT data for bias auditing","control":"FAQ III.1–2, p.3 and III.4–5, p.4; 6 RCNY §5-302(a),(b)","modality":"must","action":"use","object":"historical data for AEDT bias audits","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope. Historical data are collected from use of the same AEDT to assess applicants or promotion candidates.","exception":"Test data may be used if historical data are insufficient for a statistically significant audit. Reliance on other employers' historical data requires supplying one's own historical data or never having used the AEDT.","timing":"When conducting each required bias audit.","evidenceSummary":"FAQ III describes historical-data default, shared-data reliance conditions and insufficient-data exception; §5-302 preserves those distinctions.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=3","ruleId":"AIR-58ABBD6E09","intent":"use historical data for aedt bias audits","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"finding-edaad0cc3a6cc7dc62be92d31d0dd6c8571c0709bd5fa3004ba14e8b6b66824f","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Local Law 144 AEDT controls — DCWP official FAQ","sourceVersion":"FAQ dated June 29, 2023; Local Law 144 of 2021 and final implementing rules","actor":"Employers and employment agencies using an AEDT in New York City","authority":"binding-within-NYC-AEDT-scope; regulator FAQ explains law and rules","jurisdiction":"New York City, United States","title":"Do not use an AEDT with an expired bias audit","control":"FAQ II.4, p.3; 6 RCNY §5-301(a)","modality":"must not","action":"use","object":"AEDTs without a current bias audit","condition":"An AEDT substantially assists or replaces discretionary screening of applicants for a specific job or employees for promotion in NYC; includes jobs linked to a NYC office. Resume-bank outreach alone is outside scope.","exception":"Tools outside the statutory AEDT definition and non-assessment outreach are out of scope.","timing":"Before use and throughout continued use; most recent audit must be within the preceding year. Law effective January 1, 2023; enforcement July 5, 2023.","evidenceSummary":"FAQ II.4 limits reliance on a bias audit to one year; §5-301(a) prohibits continued use after that interval.","url":"https://www.nyc.gov/assets/dca/downloads/pdf/about/DCWP-AEDT-FAQ.pdf#page=3","ruleId":"AIR-D1A2B1E180","intent":"use aedts without a current bias audit","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-06T13:07:51.068Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-8d2c8a497b9cd3d22136891a7c92638bdc2ad53c4060ad823a3f3bd2fe7e3887","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-07T13:00:02.724Z","fingerprint":"8d2c8a497b9cd3d22136891a7c92638bdc2ad53c4060ad823a3f3bd2fe7e3887","previousFingerprint":"1c70944dae1f01d9bf42f72d7230a112384f50e02d92b4bf9544c53b11f232d2","bytes":136664,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-07T13:00:02.724Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-c39277654a4ed4cfcb8722dc4a59eaddb3567d86a9eb872b7c7d4f6bc2cda2bd","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-07T13:00:06.079Z","fingerprint":"c39277654a4ed4cfcb8722dc4a59eaddb3567d86a9eb872b7c7d4f6bc2cda2bd","previousFingerprint":"a78484c1ebeaee493ce7b1b3068258565739e7b7a2b3e721a38b2887d8709681","bytes":707590,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-07T13:00:06.079Z","reviewed_at":null},{"id":"finding-3734a7133dac0aff0233f871bd204c9cb477a5e36698f18b72af834facd8d32e","kind":"rule-candidate","status":"pending","body":{"title":"Disclose conversational-AI identity","sourceTitle":"Colorado HB26-1263 — Conversational Artificial Intelligence Service Operator Requirements","sourceVersion":"HB26-1263 Signed Act — June 1, 2026","control":"C.R.S. 6-1-1703(1), signed-act PDF p.4","actor":"Operators of publicly available conversational AI services","modality":"must","action":"inform","object":"people they are interacting with AI","condition":"A user interacts with a covered conversational AI service.","exception":"General statutory scope and constitutional limits apply.","timing":"Before first interaction and at least every three hours during continuous interaction, beginning January 1, 2027","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","evidenceSummary":"The act requires a clear AI identity notice before first interaction and at least every three hours during continuous use.","url":"https://leg.colorado.gov/bill_files/116851/download#page=4","ruleId":"AIR-86AF529571","intent":"inform people they are interacting with ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-07T13:14:46.822Z","reviewed_at":null},{"id":"finding-02f5aca4e49a27657e913000ca1104a925816b7dae443c6f6eefb84de206899e","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1263 — Conversational Artificial Intelligence Service Operator Requirements","sourceVersion":"HB26-1263 Signed Act — June 1, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Estimate conversational-AI user ages","control":"C.R.S. 6-1-1702(4)(a), signed-act PDF p.3","actor":"Operators of publicly available conversational AI services","modality":"must","action":"estimate","object":"ages of conversational-AI account holders and users","condition":"The operator opens or serves an account or profile.","exception":"Use commercially reasonable or generally accepted methods; statutory service-scope exclusions apply.","timing":"Beginning January 1, 2027","evidenceSummary":"Covered operators must estimate the age of account holders and other users.","url":"https://leg.colorado.gov/bill_files/116851/download#page=3","ruleId":"AIR-DB2A798EF7","intent":"estimate ages of conversational ai account holders and users","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:15:36.462Z","reviewed_at":null},{"id":"finding-282f17b213be35227570efa281756d03a784dcc8571e7b84cd8e0282f3ca8739","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1263 — Conversational Artificial Intelligence Service Operator Requirements","sourceVersion":"HB26-1263 Signed Act — June 1, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Block explicit sexual chatbot content for minors","control":"C.R.S. 6-1-1703(3)(b)(I), signed-act PDF p.5","actor":"Conversational AI operators that know an account holder or user is a minor","modality":"must","action":"prevent","object":"explicit sexual chatbot content for minors","condition":"The account holder or user is known to be under 18.","exception":"Measures are required to the extent technically feasible.","timing":"During covered minor use beginning January 1, 2027","evidenceSummary":"The act requires technically feasible measures against explicit sexual conduct and intimate digital depictions for known minors.","url":"https://leg.colorado.gov/bill_files/116851/download#page=5","ruleId":"AIR-5C61952BC1","intent":"prevent explicit sexual chatbot content for minors","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:16:02.670Z","reviewed_at":null},{"id":"finding-5e884e24641558ae48cf6e92d5d970a811403e821702e83093ef602081e1f54f","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1263 — Conversational Artificial Intelligence Service Operator Requirements","sourceVersion":"HB26-1263 Signed Act — June 1, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Block simulated emotional dependence for minors","control":"C.R.S. 6-1-1703(3)(b)(II), signed-act PDF p.5","actor":"Conversational AI operators that know an account holder or user is a minor","modality":"must","action":"prevent","object":"chatbot outputs that simulate emotional dependence for minors","condition":"The account holder or user is known to be under 18.","exception":"Measures are required to the extent technically feasible.","timing":"During covered minor use beginning January 1, 2027","evidenceSummary":"The act requires measures against statements that simulate mutual existential or emotional dependence between the AI and a minor.","url":"https://leg.colorado.gov/bill_files/116851/download#page=5","ruleId":"AIR-D40CD44A27","intent":"prevent chatbot outputs that simulate emotional dependence for minors","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:16:34.641Z","reviewed_at":null},{"id":"finding-b9361e306bf33136cc1681fdfa6487d3eff5dadfe2e24d9e104d2fe931b0a90d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1263 — Conversational Artificial Intelligence Service Operator Requirements","sourceVersion":"HB26-1263 Signed Act — June 1, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Detect repeated chatbot self-harm statements","control":"C.R.S. 6-1-1704(1)(a), signed-act PDF p.6","actor":"Operators of publicly available conversational AI services","modality":"must","action":"detect","object":"repeated user statements of suicidal ideation or self-harm","condition":"A user repeatedly expresses suicidal ideation, intent to self-harm, or desire to harm others.","exception":"No clause-specific exception stated.","timing":"During covered interactions beginning January 1, 2027","evidenceSummary":"The self-harm protocol must detect repeated covered statements and inquiries.","url":"https://leg.colorado.gov/bill_files/116851/download#page=6","ruleId":"AIR-1D0300EE76","intent":"detect repeated user statements of suicidal ideation or self harm","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:17:06.653Z","reviewed_at":null},{"id":"finding-024db1688418a75a842337472c4efbe11c94f3216ff364ad2895f3559ef4cdc0","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Base AI utilization review on patient-specific clinical facts","control":"C.R.S. 10-3-1104.8(3)(a), signed-act PDF pp.1–2","actor":"Entities using AI systems for health-care utilization review","modality":"must","action":"base","object":"AI utilization-review determinations on patient-specific clinical facts","condition":"An AI system is used to determine coverage for health-care services.","exception":"Relevant factors include clinical history, individual circumstances, written criteria, and plan terms.","timing":"On and after January 1, 2027","evidenceSummary":"The act requires coverage determinations to use the patient's individual clinical record and other specified factors.","url":"https://leg.colorado.gov/bill_files/117025/download#page=2","ruleId":"AIR-CE3A16C0C0","intent":"base ai utilization review determinations on patient specific clinical facts","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:17:51.461Z","reviewed_at":null},{"id":"finding-781418825111f6e0b6b701bd0b65fb15b826fb42c7335416b945dd71344ceee0","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Do not decide coverage solely from group data","control":"C.R.S. 10-3-1104.8(3)(b), signed-act PDF p.2","actor":"Entities using AI systems for health-care utilization review","modality":"must not","action":"base","object":"AI coverage determinations solely on group data","condition":"An AI system is used to determine coverage for health-care services.","exception":"Group data may inform the determination only with reference to the individual's history and circumstances.","timing":"On and after January 1, 2027","evidenceSummary":"The act prohibits sole reliance on group data without reference to the individual patient.","url":"https://leg.colorado.gov/bill_files/117025/download#page=2","ruleId":"AIR-A17EB8B00B","intent":"base ai coverage determinations solely on group data","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:18:21.671Z","reviewed_at":null},{"id":"finding-0592eae9b1f961491ca380abde534443eb7c73c2b1f5be8b47715b3615ee745e","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Review health-care AI outcomes for accuracy and reliability","control":"C.R.S. 10-3-1104.8(3)(d)(I), signed-act PDF p.2","actor":"Entities using AI systems for health-care utilization review","modality":"must","action":"review","object":"health-care AI outcomes for accuracy and reliability","condition":"An AI system is used to determine coverage.","exception":"No numeric interval is stated; review must be periodic.","timing":"Periodically on and after January 1, 2027","evidenceSummary":"The act creates a periodic review duty for outcome accuracy and reliability.","url":"https://leg.colorado.gov/bill_files/117025/download#page=2","ruleId":"AIR-03B91E9572","intent":"review health care ai outcomes for accuracy and reliability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:18:51.335Z","reviewed_at":null},{"id":"finding-6ba6cba0cba33f2693021553ba205c9266fd43ae8a6a81937bcaf001decf1b44","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Limit AI use of health data to stated purposes","control":"C.R.S. 10-3-1104.8(3)(d)(II), signed-act PDF p.2","actor":"Entities using AI systems for health-care utilization review","modality":"must not","action":"use","object":"individual health data beyond its intended or stated purpose","condition":"An AI system is used in health-care utilization review.","exception":"No clause-specific exception stated.","timing":"Throughout covered use on and after January 1, 2027","evidenceSummary":"The act requires periodic review to ensure individual health data is not reused beyond its intended or stated purpose.","url":"https://leg.colorado.gov/bill_files/117025/download#page=2","ruleId":"AIR-FFD08A3AF3","intent":"use individual health data beyond its intended or stated purpose","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:19:22.273Z","reviewed_at":null},{"id":"finding-ff3491bdb39a3538729a016d9456938ece775761dad3084034492752187cbe46","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Require qualified human review before AI-influenced coverage denial","control":"C.R.S. 10-3-1104.8(5), signed-act PDF p.3","actor":"Carriers issuing medical-necessity coverage denials","modality":"must","action":"require","object":"qualified human review of AI-influenced medical-necessity denials","condition":"A denial is based in whole or part on medical necessity and AI contributed to utilization review.","exception":"Reviewer must be a licensed clinician, physician, or other competent regulated professional qualified for the issue and plan terms.","timing":"Before issuing the denial on and after January 1, 2027","evidenceSummary":"The act bars issuing the covered denial solely from AI output and without qualified human review.","url":"https://leg.colorado.gov/bill_files/117025/download#page=3","ruleId":"AIR-B6676761C1","intent":"require qualified human review of ai influenced medical necessity denials","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:20:03.271Z","reviewed_at":null},{"id":"finding-96ed8e7d6ed225603464df1112aebee4dc7a71a518aa76dc78fe763f7884e28d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Do not reimburse AI-conducted psychotherapy","control":"C.R.S. 10-16-148(2), signed-act PDF p.4","actor":"Health insurance carriers","modality":"must not","action":"reimburse","object":"AI-conducted psychotherapy services","condition":"Psychotherapy is delivered directly to an enrollee and conducted by AI.","exception":"AI-assisted ambient transcription or documentation supporting licensed providers is not barred.","timing":"On and after January 1, 2027","evidenceSummary":"The act prohibits carrier payment for psychotherapy conducted by AI while preserving provider-support tools.","url":"https://leg.colorado.gov/bill_files/117025/download#page=4","ruleId":"AIR-CAD7DC63E5","intent":"reimburse ai conducted psychotherapy services","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:20:35.193Z","reviewed_at":null},{"id":"finding-a5887fc28cab7d9316dd704dba4618a50e3f2b28a90551be055db4cd6ecf3e80","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Colorado HB26-1139 — Use of Artificial Intelligence in Health Care","sourceVersion":"HB26-1139 Signed Act — June 3, 2026","authority":"enacted Colorado state law","jurisdiction":"Colorado, United States","title":"Do not reimburse AI-conducted psychotherapy","control":"C.R.S. 25.5-4-426(2), signed-act PDF p.5","actor":"Colorado Medicaid and Children's Basic Health Plan payers","modality":"must not","action":"reimburse","object":"AI-conducted psychotherapy services","condition":"Psychotherapy is delivered directly to a client and conducted by AI.","exception":"AI-assisted ambient transcription or documentation supporting licensed providers is not barred.","timing":"On and after January 1, 2027","evidenceSummary":"The same nonpayment rule applies to public medical-assistance and children's health-plan payers.","url":"https://leg.colorado.gov/bill_files/117025/download#page=5","ruleId":"AIR-CAD7DC63E5","intent":"reimburse ai conducted psychotherapy services","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-07T13:21:02.259Z","reviewed_at":null},{"id":"change-brookline-genai-755e2c904ae7401070b7338e2a00a2f7a24c634d404a78b87e2f62581915f9c3","kind":"source-change","status":"pending","body":{"sourceId":"brookline-genai","title":"Generative Artificial Intelligence Use Policy","url":"https://www.brooklinema.gov/3975/Generative-AI-Use","status":"publisher-bytes-changed","checkedAt":"2026-10-08T12:59:26.100Z","fingerprint":"755e2c904ae7401070b7338e2a00a2f7a24c634d404a78b87e2f62581915f9c3","previousFingerprint":"3eb9d05b8739fa8021c873c2aae060aca74b30f3ef7f53fdc778d5b456cf48da","bytes":110630,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-08T12:59:26.100Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-6aee8985f80d193faf6144c99d157fa5d42c73cc0bd0397bfa32129f904a1eb8","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-08T12:59:26.100Z","fingerprint":"6aee8985f80d193faf6144c99d157fa5d42c73cc0bd0397bfa32129f904a1eb8","previousFingerprint":"8d2c8a497b9cd3d22136891a7c92638bdc2ad53c4060ad823a3f3bd2fe7e3887","bytes":136664,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-08T12:59:26.100Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-72750156679660d6dedd4f444c9b2f5c049b57f228b982757a4fd3c6c065f826","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-08T12:59:29.361Z","fingerprint":"72750156679660d6dedd4f444c9b2f5c049b57f228b982757a4fd3c6c065f826","previousFingerprint":"c39277654a4ed4cfcb8722dc4a59eaddb3567d86a9eb872b7c7d4f6bc2cda2bd","bytes":707590,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-08T12:59:29.361Z","reviewed_at":null},{"id":"finding-0470c7718a6ad7c1f2e176e73814c6a59b672728bcb8bc0b1717707e371d0b88","kind":"rule-candidate","status":"pending","body":{"title":"Inventory AI assets and dependencies","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 5, clause 5.1","actor":"Developers, Data Custodians, and System Operators","modality":"must","action":"maintain","object":"an inventory of AI assets and dependencies","condition":"The organisation develops, deploys, or controls data for an AI system.","evidenceSummary":"Clause 5.1 calls for a comprehensive asset inventory that includes connectivity and interdependencies.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Throughout the AI-system lifecycle","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-FC1F24F621","intent":"maintain an inventory of ai assets and dependencies","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-06da2a924cc611b002dca003c8b7aeb3c15cd69e37f649dc109e444110eefa81","kind":"rule-candidate","status":"pending","body":{"title":"Security-test AI systems before release","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 9, clause 9.1","actor":"Developers","modality":"must","action":"security-test","object":"AI models, applications, and systems before release","condition":"The model, application, or system will be released to System Operators or End-users.","evidenceSummary":"Clause 9.1 requires released AI artifacts to pass through a security-assessment process.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Before release","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-2D4B88FD46","intent":"security test ai models applications and systems before release","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-12e4cc15733aa42e67036212c7d57779588fa81b0e1b54d51b82f219105b2021","kind":"rule-candidate","status":"pending","body":{"title":"Tailor AI security training to staff roles","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 1, clause 1.1.1","actor":"System Operators, Developers, and Data Custodians","modality":"must","action":"tailor","object":"AI security training to staff roles","condition":"Staff receive AI security training; this is a requirement within a voluntary code.","evidenceSummary":"Clause 1.1.1 makes role and responsibility relevant to the content of AI security training.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"When designing and refreshing staff training","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-28C86060C1","intent":"tailor ai security training to staff roles","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-192da38cb421d5f25f0f38facf666103deb50a847bea1902d015171e20e6dff8","kind":"rule-candidate","status":"pending","body":{"title":"Justify use of poorly documented AI components","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 7, clause 7.2","actor":"System Operators","modality":"must","action":"document","object":"the justification for using poorly documented or unsecured AI components","condition":"The operator chooses to use or adapt a model or component that is not well documented or secured.","evidenceSummary":"Clause 7.2 makes the decision record explicit when component assurance is weak, including cases where no alternative supplier exists.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"The example recognizes that no alternative supplier may exist; it does not waive documentation.","timing":"Before or when approving the component for use","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-40509CE90B","intent":"document the justification for using poorly documented or unsecured ai components","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-1d08ecd8015e66e8da24c2113c086d8caff0997c91bbd90e763e9c3ff7f96fe7","kind":"rule-candidate","status":"pending","body":{"title":"Tailor disaster recovery to AI-specific attacks","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 5, clause 5.3","actor":"System Operators","modality":"must","action":"tailor","object":"disaster-recovery plans to AI-specific attacks","condition":"The organisation operates an AI system.","evidenceSummary":"Clause 5.3 requires ordinary recovery planning to account for attacks directed at AI systems.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"During recovery planning and maintenance","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-E35BC83D85","intent":"tailor disaster recovery plans to ai specific attacks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-4b8dbfc06e536b0d159217c9adc6f473bb6fcdcb844d09c2c1a77884c8e4288d","kind":"rule-candidate","status":"pending","body":{"title":"Repeat data sanitization after adaptive model revisions","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 5, clause 5.4.1","actor":"Developers, Data Custodians, and System Operators","modality":"must","action":"repeat","object":"data and input sanitization after model revisions","condition":"A model is revised in response to user feedback or continuous learning, subject to the actor's access to the relevant data and inputs.","evidenceSummary":"Clause 5.4.1 extends checks and sanitization beyond initial design to feedback-driven or continuously learned revisions.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Responsibility follows each actor's access to the data and inputs and where they are stored.","timing":"After revisions driven by feedback or continuous learning","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-320C95E6DC","intent":"repeat data and input sanitization after model revisions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-4ce83d5b67a7912e924d92c564b4d85407a6cd4252e5413c6711db580e105a5f","kind":"rule-candidate","status":"pending","body":{"title":"Disclose AI data handling to end users","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 10, clause 10.1","actor":"System Operators","modality":"must","action":"disclose","object":"AI data use, access, and storage to End-users","condition":"An AI system is deployed for end users; external Developers must first provide the necessary information to operators.","evidenceSummary":"Clause 10.1 requires accessible disclosure of where and how user data is used, accessed, and stored, including retraining or human review.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"Before or at deployment and when practices change","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-4591031280","intent":"disclose ai data use access and storage to end users","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-4d42e68e669f554d5c6090aea5051d2f28d483b37e3ddf38ff8e030429553157","kind":"rule-candidate","status":"pending","body":{"title":"Test AI incident-management plans","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 6, clause 6.5 — testing component","actor":"Developers and System Operators","modality":"must","action":"test","object":"AI incident-management plans","condition":"The organisation develops or operates an AI system.","evidenceSummary":"Clause 6.5 requires AI-specific incident planning to be exercised, not only documented.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"Before deployment and periodically during operation","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-D60E646B27","intent":"test ai incident management plans","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-59acbdd6fd36b9d02880e3e69bb50a86c5cae3a0f1cdf96eb95b5d386227c1ef","kind":"rule-candidate","status":"pending","body":{"title":"Conduct operator testing before AI deployment","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 9, clause 9.2","actor":"System Operators","modality":"must","action":"test","object":"AI systems before deployment","condition":"An AI system is being prepared for deployment; Developers support the testing.","evidenceSummary":"Clause 9.2 assigns pre-deployment testing responsibility to the operator with developer support.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Before deployment","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-36AAFBCE03","intent":"test ai systems before deployment","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-6a1f6f1b9352844a33d2247723af7cf9a938bebae0f96454636905bce98ea7be","kind":"rule-candidate","status":"pending","body":{"title":"Isolate AI development and tuning environments","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 6, clause 6.3","actor":"Developers","modality":"must","action":"isolate","object":"AI development and model-tuning environments","condition":"Development or tuning uses non-public training data; separation and least-privilege controls are required.","evidenceSummary":"Clause 6.3 requires dedicated environments backed by technical separation and least-privilege controls.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"The clause specifically highlights training data that is not publicly available.","timing":"During development and model tuning","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-517A77B73E","intent":"isolate ai development and model tuning environments","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-6a22ba03376d26e7571041123ab9d916b4fef15c722c1e354065f22da0a9ddb9","kind":"rule-candidate","status":"pending","body":{"title":"Assess AI-specific risks in external components","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 2, clause 2.4","actor":"Developers and System Operators","modality":"must","action":"assess","object":"AI-specific risks in external components","condition":"An external component is used in an AI system; apply due diligence consistent with existing software-development processes.","evidenceSummary":"Clause 2.4 adds AI-specific risk assessment to component due diligence.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Before accepting or integrating an external component","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-ACEEBA73D0","intent":"assess ai specific risks in external components","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-6d6a13916e11b9d077446cc623beeffd80bb4a0ef0a2598724a6b41fc574cbfb","kind":"rule-candidate","status":"pending","body":{"title":"Design AI systems to resist adversarial attacks","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 2, clause 2.2","actor":"System Operators and Developers","modality":"must","action":"design","object":"AI systems to withstand adversarial attacks","condition":"An AI system is being designed or implemented; this is a requirement within a voluntary code.","evidenceSummary":"Clause 2.2 requires resilience against adversarial AI attacks; unexpected inputs and system failure are separate aspects of the same provision.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"During system design and implementation","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-6DA8E52373","intent":"design ai systems to withstand adversarial attacks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-8113e5fc68b5cb6e1f6ca95f6b5d0bd38d83e805490b1a919e0cc7a8f6b075ea","kind":"rule-candidate","status":"pending","body":{"title":"Use independent AI security testers","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 9, clause 9.2.1","actor":"System Operators and Developers","modality":"should","action":"use","object":"independent AI security testers","condition":"Security testing is performed; testers need technical skills relevant to the system.","evidenceSummary":"Clause 9.2.1 recommends independence and system-relevant technical competence for AI security testing.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"The code does not define required credentials or organizational independence.","timing":"During AI security testing","authority":"voluntary-code recommendation; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-675CEF85E0","intent":"use independent ai security testers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-88d32ee2f437cce7a003253ae275626689b5b71ec06c00bf6b6e57cd5cf4dc6c","kind":"rule-candidate","status":"pending","body":{"title":"Include AI security in cyber training","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 1, clause 1.1","actor":"System Operators, Developers, and Data Custodians","modality":"must","action":"include","object":"AI security content in cyber security training","condition":"The organisation operates, develops, or controls data for deployed AI systems; this is a requirement within a voluntary code.","evidenceSummary":"Clause 1.1 places AI-specific security material inside the organisation's cyber training programme and calls for continuing review.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"During the AI-system lifecycle; review when substantial new AI threats emerge","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-E4A7FE4D30","intent":"include ai security content in cyber security training","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-a3af0037f6a1d025dae3b4f4c7a4c743f2c632e700d6939ba645f9dba6f9d9fc","kind":"rule-candidate","status":"pending","body":{"title":"Maintain human-oversight capabilities","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 4, clause 4.1","actor":"Developers and System Operators","modality":"should","action":"maintain","object":"human-oversight capabilities for AI systems","condition":"An AI system is being designed or operated.","evidenceSummary":"Clause 4.1 recommends incorporating oversight at design time and maintaining that capability over time.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"From system design through operation","authority":"voluntary-code recommendation; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-4FACE99125","intent":"maintain human oversight capabilities for ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-adeb6d44fe35b0c2d4c8a4ce1dd15a595eaa0244a8f114f8f50ac2cec8d0c092","kind":"rule-candidate","status":"pending","body":{"title":"Reassess AI risks after configuration changes","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 3, clause 3.1.1","actor":"Developers and System Operators","modality":"must","action":"reassess","object":"AI security risks after configuration changes","condition":"A new setting or configuration option is implemented or updated at any lifecycle stage.","evidenceSummary":"Clause 3.1.1 links configuration changes to another pass through threat modelling and risk management.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Whenever a setting or configuration option is introduced or changed","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-69CA8EABE2","intent":"reassess ai security risks after configuration changes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-c57ac100cd95ac317586672565180be9ff802d13271246f77cd47bbf6f087018","kind":"rule-candidate","status":"pending","body":{"title":"Train developers in AI-specific secure engineering","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 1, clause 1.2.2","actor":"System Operators, Developers, and Data Custodians","modality":"must","action":"provide","object":"AI-specific secure coding and system-design training","condition":"The organisation has developers working on deployed or deployable AI systems; this is a requirement within a voluntary code.","evidenceSummary":"Clause 1.2.2 requires developer training focused on preventing and mitigating vulnerabilities in AI models, algorithms, and related software.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Before and during AI development responsibilities","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-240B04378C","intent":"provide ai specific secure coding and system design training","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-ccb329626ac39259e0c183af79f955a1328b0082d5e66497470971cd0bc2c958","kind":"rule-candidate","status":"pending","body":{"title":"Communicate unresolved AI threats downstream","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 3, clause 3.2","actor":"Developers","modality":"must","action":"communicate","object":"unresolved AI security threats to System Operators","condition":"Developers identify an AI security threat they cannot resolve.","evidenceSummary":"Clause 3.2 assigns the first downstream notification step to developers so operators can threat-model their deployments.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"When an identified threat cannot be resolved by the Developer","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-F97B3855F8","intent":"communicate unresolved ai security threats to system operators","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-e65ef0126a13d435f7d9dbaa37e4d38cd0b0b4eec984e4a6fc3592f0240ea12e","kind":"rule-candidate","status":"pending","body":{"title":"Log AI system and user actions","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 12, clause 12.1","actor":"System Operators","modality":"must","action":"log","object":"AI system and user actions","condition":"Logs support security compliance, investigations, and vulnerability remediation.","evidenceSummary":"Clause 12.1 establishes an operational logging obligation for both system behavior and user activity.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No retention period or log content minimum is specified in the clause.","timing":"Continuously during operation","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-463F6EF08F","intent":"log ai system and user actions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-e9761eb0778d23b744b62cd61bfe4d099c539cf36f3dfa70b1d6e042269ae2c9","kind":"rule-candidate","status":"pending","body":{"title":"Review AI threat models regularly","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 3, clause 3.1","actor":"Developers and System Operators","modality":"should","action":"review","object":"AI threat models regularly","condition":"Threat modelling addresses AI-specific attacks such as data poisoning, model inversion, and membership inference.","evidenceSummary":"Clause 3.1 recommends recurring threat-model review as part of security-risk management.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Review frequency is risk-based and not fixed by the code.","timing":"Regularly throughout the AI lifecycle","authority":"voluntary-code recommendation; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-4BDA78DD85","intent":"review ai threat models regularly","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-eb70a56c61bfa2c0b1486411061feb66e84a3e3c6cb64eb5d5a50cc82174c980","kind":"rule-candidate","status":"pending","body":{"title":"Notify end users before model updates","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 7, clause 7.4","actor":"System Operators","modality":"must","action":"notify","object":"End-users of planned model updates","condition":"The operator intends to update a model; communication must be accessible.","evidenceSummary":"Clause 7.4 requires advance notice of intended model updates to end users.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"Before the model is updated","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-B7785F80BE","intent":"notify end users of planned model updates","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-eec8d1cceba6385a38fc53f9ed0cbb459ed39e2249fce80306606004ad0cb0ca","kind":"rule-candidate","status":"pending","body":{"title":"Document AI security risks before creating a system","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 2, clause 2.1","actor":"System Operators and Developers","modality":"must","action":"document","object":"AI security risks and mitigation strategies","condition":"The organisation is deciding whether to create an AI system; this is a requirement within a voluntary code.","evidenceSummary":"Clause 2.1 requires the creation decision to record the problem or business need together with associated AI security risks and planned mitigations.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"Research-only AI systems that will not be deployed are outside the code's scope.","timing":"Before deciding to create the AI system","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-F3A86B168B","intent":"document ai security risks and mitigation strategies","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-f9717e2e0865dc35f4296280f8683e92328e335a7b146b39e5d0dc09d04d9895","kind":"rule-candidate","status":"pending","body":{"title":"Publish an AI vulnerability disclosure policy","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 6, clause 6.4","actor":"Developers and System Operators","modality":"must","action":"publish","object":"an accessible AI vulnerability disclosure policy","condition":"The organisation develops or operates a deployed AI system.","evidenceSummary":"Clause 6.4 requires both implementation and public accessibility of a vulnerability disclosure policy.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"Before and during operation","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-88274A0109","intent":"publish an accessible ai vulnerability disclosure policy","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"finding-fb9aaeb3be6a36010f0ca72b08d7f6ad2c6a0392e9f1fe14db75fe4c3f79d094","kind":"rule-candidate","status":"pending","body":{"title":"Re-evaluate released models before reuse","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025","control":"Principle 7, clause 7.3","actor":"Developers and System Operators","modality":"must","action":"re-evaluate","object":"released AI models before intended use","condition":"A released model is being considered for use or adaptation.","evidenceSummary":"Clause 7.3 requires evaluations to be run again on released models that an organisation intends to use.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai","exception":"No clause-specific exception stated.","timing":"Before using the released model","authority":"voluntary-code requirement; not legislation","jurisdiction":"United Kingdom; voluntary use elsewhere","ruleId":"AIR-1436898CB8","intent":"re evaluate released ai models before intended use","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-08T13:03:07.203Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-ff473b03393de39a1b19fa71fee25fdbe1ea6909d03a9f4f2eccb7dc000fd7d2","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-09T13:06:21.064Z","fingerprint":"ff473b03393de39a1b19fa71fee25fdbe1ea6909d03a9f4f2eccb7dc000fd7d2","previousFingerprint":"6aee8985f80d193faf6144c99d157fa5d42c73cc0bd0397bfa32129f904a1eb8","bytes":235219,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-09T13:06:21.064Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-e401974ad10a50b26c705292f1284b59860797d908a3854bee6eea7c18018e46","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-09T13:06:23.666Z","fingerprint":"e401974ad10a50b26c705292f1284b59860797d908a3854bee6eea7c18018e46","previousFingerprint":"72750156679660d6dedd4f444c9b2f5c049b57f228b982757a4fd3c6c065f826","bytes":707970,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-09T13:06:23.666Z","reviewed_at":null},{"id":"finding-031d7a66d053c0ce362aa27d7700a9d7ee8f8decf5bc91969b8d42f8994e5d76","kind":"rule-candidate","status":"pending","body":{"title":"Do not facilitate unlawful sexually explicit deepfakes with AI","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.057(1)(B)","actor":"Persons developing or distributing AI systems within the subtitle's Texas scope","modality":"must not","action":"facilitate","object":"unlawful sexually explicit deepfakes with AI","condition":"The AI system is developed or distributed with the sole intent of producing, assisting, aiding in producing, or distributing deepfake videos or images prohibited by Penal Code § 21.165.","evidenceSummary":"Section 552.057(1)(B) establishes a sole-intent prohibition tied to Penal Code § 21.165.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The prohibition requires sole intent and incorporates the elements of Penal Code § 21.165.","timing":"At development or distribution; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-2FBC24A41B","intent":"facilitate unlawful sexually explicit deepfakes with ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-06893cbe816a62069a8b065a1aa56d77571862547866d52f6794b9d684217fcd","kind":"rule-candidate","status":"pending","body":{"title":"Report sandbox AI risk-mitigation updates quarterly","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.102(a), (b)(2)","actor":"Texas AI regulatory-sandbox participants","modality":"must","action":"report","object":"updates on AI operational risk mitigation","condition":"The participant is testing an AI system in the Texas regulatory sandbox.","evidenceSummary":"Section 553.102 requires quarterly participant reports and specifically includes updates on how the system mitigates operational risks.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"DIR must keep intellectual property, trade secrets, and other sensitive program information confidential.","timing":"Quarterly during sandbox participation; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-C4C05465F4","intent":"report updates on ai operational risk mitigation","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-12782e48a31c14b3852ce83f93743c505c776954d3728552462c35540150d1bc","kind":"rule-candidate","status":"pending","body":{"title":"Do not identify people from public biometric media without consent","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.054(b)","actor":"Texas governmental entities developing or deploying AI systems","modality":"must not","action":"identify","object":"individuals using biometric data gathered from public sources without consent","condition":"The governmental entity develops or deploys AI for unique identification using biometric data or images/media gathered from the Internet or another public source, without consent, and the gathering would infringe a protected right.","evidenceSummary":"Section 552.054(b) links the ban to unique identification, public-source gathering without consent, and infringement of constitutional or statutory rights.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The statute excludes ordinary photos, video/audio recordings and their derived data, plus HIPAA treatment, payment, or operations information, from its biometric-data definition; all elements must be met.","timing":"At development or deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-1F8D5A27D6","intent":"identify individuals using biometric data gathered from public sources without consent","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-1334fbaa2f510ee8debba48783826f48aa99b27b056054eb7fbe7f4b3131954f","kind":"rule-candidate","status":"pending","body":{"title":"Do not enable AI to incite criminal activity","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.052(3)","actor":"Persons developing or deploying AI systems within the subtitle's Texas scope","modality":"must not","action":"enable","object":"AI systems to incite criminal activity","condition":"The system is developed or deployed in a manner intentionally aimed at inciting or encouraging criminal activity.","evidenceSummary":"Section 552.052(3) prohibits intentional development or deployment aimed at inciting or encouraging criminal activity.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The prohibition contains an intent element and applies only within Section 551.002's Texas nexus.","timing":"At development and deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-BD074F57DB","intent":"enable ai systems to incite criminal activity","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-3ef088fc0d5831548b0fca53182b99fa41a50d659e6e6ecd06e8608e26131a2c","kind":"rule-candidate","status":"pending","body":{"title":"Report sandbox AI performance metrics quarterly","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.102(a), (b)(1)","actor":"Texas AI regulatory-sandbox participants","modality":"must","action":"report","object":"AI system performance metrics","condition":"The participant is testing an AI system in the Texas regulatory sandbox.","evidenceSummary":"Section 553.102 requires quarterly participant reports and specifically includes system performance metrics.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"DIR must keep intellectual property, trade secrets, and other sensitive program information confidential.","timing":"Quarterly during sandbox participation; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-CD45DCD123","intent":"report ai system performance metrics","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-56c31e2c81fe928cb8115609bdbd78d1bfd77babe6fb4ac96ce8559215d14c4c","kind":"rule-candidate","status":"pending","body":{"title":"Obtain approval before Texas AI sandbox testing","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.052(a)","actor":"Applicants to the Texas AI regulatory sandbox","modality":"must","action":"obtain","object":"approval for AI sandbox testing","condition":"The applicant seeks to test an AI system under the Texas regulatory sandbox.","evidenceSummary":"Section 553.052(a) requires approval from the Department of Information Resources and each applicable agency before testing.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"Sandbox participation can last no more than 36 months unless DIR finds good cause for extension; Chapter 552 Subchapter B duties cannot be waived.","timing":"Before testing; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-B07A3B1B97","intent":"obtain approval for ai sandbox testing","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-64dbcbc5f00309ed8b61dd590a6ff937d88ffb8c7238e82eb26e2aeb95b72c04","kind":"rule-candidate","status":"pending","body":{"title":"Inventory state-agency AI systems in information-resource reviews","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Government Code § 2054.0965(b)(2), as amended by H.B. 149 § 7","actor":"Texas state agencies performing required information-resource deployment reviews","modality":"must","action":"inventory","object":"agency AI systems","condition":"The agency performs the review required by Government Code § 2054.0965, unless DIR rules modify the review.","evidenceSummary":"H.B. 149 adds artificial intelligence systems to the databases and applications that must be inventoried in the state-agency review.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"DIR rules may modify the review, and mandatory state-agency implementation is conditioned on specific fiscal-year appropriation under H.B. 149 § 9; implementation may proceed with other available funding.","timing":"During the required information-resource deployment review; effective January 1, 2026","authority":"Binding enacted Texas statute within scope, subject to DIR rules and the funding proviso","jurisdiction":"Texas, United States","ruleId":"AIR-C315EAF7F0","intent":"inventory agency ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-685ce5cea91ba836e247497bb5d25deab0f2020806f4312a101a72faec4d75e9","kind":"rule-candidate","status":"pending","body":{"title":"Disclose consumer interaction with government AI","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.051(b)-(e)","actor":"Texas governmental agencies making consumer-facing AI available","modality":"must","action":"disclose","object":"AI interaction","condition":"The agency makes an AI system intended to interact with Texas consumers available; disclosure is required even when the interaction would be obvious.","evidenceSummary":"Section 552.051 requires notice before or at interaction and specifies clear, conspicuous, plain-language presentation without dark patterns.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The governmental-entity definition excludes hospital districts and Texas institutions of higher education; a hyperlink may provide the disclosure.","timing":"Before or at the time of interaction; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-C8E01637B6","intent":"disclose ai interaction","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-6a1cde9387714feeb00f6a6b46ee99ca4823460c3322d7759ad4f64c74d0545e","kind":"rule-candidate","status":"pending","body":{"title":"Prove federal AI-law compliance for sandbox admission","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.052(b)(4)","actor":"Applicants to the Texas AI regulatory sandbox","modality":"must","action":"provide","object":"proof of compliance with applicable federal AI laws and regulations","condition":"The person applies to test an AI system in the regulatory sandbox.","evidenceSummary":"Section 553.052(b)(4) makes proof of applicable federal AI-law compliance part of the sandbox application.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"Only applicable federal AI laws and regulations are covered; other application and nonwaivable state protections remain separate.","timing":"With the sandbox application; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-E3F0C98DE0","intent":"provide proof of compliance with applicable federal ai laws and regulations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-6a65bf1ea3e8a6ae60e011762d307bbafa28b1589e453224d5bd36b62985e41c","kind":"rule-candidate","status":"pending","body":{"title":"Report sandbox user and stakeholder feedback quarterly","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.102(a), (b)(3)","actor":"Texas AI regulatory-sandbox participants","modality":"must","action":"report","object":"feedback from consumers and affected stakeholders using sandbox AI","condition":"The participant is testing an AI system in the Texas regulatory sandbox.","evidenceSummary":"Section 553.102 requires quarterly participant reports and specifically includes feedback from consumers and affected stakeholders using the tested system.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"DIR must keep intellectual property, trade secrets, and other sensitive program information confidential.","timing":"Quarterly during sandbox participation; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-1C7320ACE2","intent":"report feedback from consumers and affected stakeholders using sandbox ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-6d11790ce2db394d45f80458ebcc592920a26f7e3824073acc4ab4614ee0677f","kind":"rule-candidate","status":"pending","body":{"title":"Document a sandbox adverse-consequence mitigation plan","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.052(b)(3)","actor":"Applicants to the Texas AI regulatory sandbox","modality":"must","action":"document","object":"a plan to mitigate adverse consequences during AI sandbox testing","condition":"The person applies to test an AI system in the regulatory sandbox.","evidenceSummary":"Section 553.052(b)(3) requires the applicant to describe its plan for mitigating adverse consequences that may occur during the test.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The mitigation plan is an application requirement and does not waive Chapter 552 Subchapter B protections.","timing":"With the sandbox application; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-CA307F333F","intent":"document a plan to mitigate adverse consequences during ai sandbox testing","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-70e1948a09941d1956abdea0955690adb262cd4eac76703e4c02ded3052bf343","kind":"rule-candidate","status":"pending","body":{"title":"Disclose AI use in health care services","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.051(f)","actor":"Licensed, registered, or certified health care service providers using AI in service or treatment","modality":"must","action":"disclose","object":"AI interaction","condition":"An AI system is used in relation to human health services or diagnosis, prevention, or treatment.","evidenceSummary":"Section 552.051(f) applies the statutory AI-interaction disclosure to health care recipients or their personal representatives.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"In an emergency, disclosure may follow when reasonably possible.","timing":"No later than the date service or treatment is first provided; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-C8E01637B6","intent":"disclose ai interaction","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-7cb8efb4c991326c567ec0ed796e8c800928f49c00842d9ad25ac8f8bd02f42b","kind":"rule-candidate","status":"pending","body":{"title":"Do not build AI solely to impair federal constitutional rights","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.055(a)","actor":"Persons developing or deploying AI systems within the subtitle's Texas scope","modality":"must not","action":"build","object":"AI systems solely intended to impair federal constitutional rights","condition":"The person's sole intent is for the AI system to infringe, restrict, or otherwise impair an individual's rights guaranteed by the United States Constitution.","evidenceSummary":"Section 552.055(a) establishes a sole-intent prohibition tied specifically to federal constitutional rights.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The section does not create or expand constitutional rights and requires proof of sole intent.","timing":"At development or deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-B85A6FD731","intent":"build ai systems solely intended to impair federal constitutional rights","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-831db0ab4ae99e85cf30e0410bedd891dd284232da9e9894de1f779518375fa9","kind":"rule-candidate","status":"pending","body":{"title":"Do not facilitate prohibited child sexual material with AI","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.057(1)(A)","actor":"Persons developing or distributing AI systems within the subtitle's Texas scope","modality":"must not","action":"facilitate","object":"prohibited child sexual material with AI","condition":"The AI system is developed or distributed with the sole intent of producing, assisting, aiding in producing, or distributing material prohibited by Penal Code § 43.26.","evidenceSummary":"Section 552.057(1)(A) establishes a sole-intent prohibition tied to Penal Code § 43.26.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The prohibition requires sole intent and incorporates the elements of Penal Code § 43.26.","timing":"At development or distribution; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-9A07928A58","intent":"facilitate prohibited child sexual material with ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-838848bbd7c854bbfc3613a384c15d76c2044d7b9ae87bd3fbdadfd15ea5aae2","kind":"rule-candidate","status":"pending","body":{"title":"Do not make AI sexual conversations impersonate minors","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.057(2)","actor":"Persons developing or distributing AI systems within the subtitle's Texas scope","modality":"must not","action":"enable","object":"AI sexual conversations that impersonate minors","condition":"The person intentionally develops or distributes an AI system that engages in text conversations simulating or describing Penal Code § 43.25 sexual conduct while impersonating or imitating a child younger than 18.","evidenceSummary":"Section 552.057(2) separately prohibits intentional AI text conversations that combine defined sexual conduct with impersonation or imitation of a minor.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"All statutory elements, including intentional development/distribution, text conversation, defined sexual conduct, and under-18 impersonation or imitation, must be met.","timing":"At development or distribution; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-61E981ADBC","intent":"enable ai sexual conversations that impersonate minors","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-be6ee16945868245be7d68cc29ae361cc25c7b760d3de66c86ff98a70e66e2fe","kind":"rule-candidate","status":"pending","body":{"title":"Do not enable AI to incite harm to others","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.052(2)","actor":"Persons developing or deploying AI systems within the subtitle's Texas scope","modality":"must not","action":"enable","object":"AI systems to incite harm to another person","condition":"The system is developed or deployed in a manner intentionally aimed at inciting or encouraging harm to another person.","evidenceSummary":"Section 552.052(2) prohibits intentional development or deployment aimed at inciting or encouraging harm to another person.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The prohibition contains an intent element and applies only within Section 551.002's Texas nexus.","timing":"At development and deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-85B79C5488","intent":"enable ai systems to incite harm to another person","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f1acf67d0dffcbc102b5f71fab0ee35aa2ecccc2af9d2880440a1e6fa76a522e","kind":"rule-candidate","status":"pending","body":{"title":"Do not intentionally discriminate against protected classes through AI","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.056(b)-(e)","actor":"Persons developing or deploying AI systems within the subtitle's Texas scope","modality":"must not","action":"discriminate","object":"against protected classes through AI","condition":"The person intends to unlawfully discriminate against a class protected by state or federal civil-rights law.","evidenceSummary":"Section 552.056 prohibits intentional unlawful discrimination through AI and states that disparate impact alone does not prove intent.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"Insurance services governed by specified insurance discrimination laws are excluded; federally insured financial institutions comply by meeting applicable federal and state banking law; disparate impact alone is insufficient.","timing":"At development or deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-F682447E01","intent":"discriminate against protected classes through ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f26e64ede6555d6431011a09dbbd1cbab285b6d494cfa604670fdf0bbce3641b","kind":"rule-candidate","status":"pending","body":{"title":"Do not enable AI to incite physical self-harm","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.052(1)","actor":"Persons developing or deploying AI systems within the subtitle's Texas scope","modality":"must not","action":"enable","object":"AI systems to incite physical self-harm","condition":"The system is developed or deployed in a manner intentionally aimed at inciting or encouraging self-harm, including suicide.","evidenceSummary":"Section 552.052(1) prohibits intentional development or deployment aimed at inciting or encouraging physical self-harm.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The prohibition contains an intent element and applies only within Section 551.002's Texas nexus.","timing":"At development and deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-33461AFACA","intent":"enable ai systems to incite physical self harm","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f53e0f8b45f9f2bd50e596b8e4682a15830316e9620c7cb0abc28fed385b1891","kind":"rule-candidate","status":"pending","body":{"title":"Assess sandbox impacts on consumers, privacy, and safety","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 553.052(b)(2)","actor":"Applicants to the Texas AI regulatory sandbox","modality":"must","action":"assess","object":"sandbox AI impacts on consumers, privacy, and public safety","condition":"The person applies to test an AI system in the regulatory sandbox.","evidenceSummary":"Section 553.052(b)(2) requires a benefit assessment addressing potential consumer, privacy, and public-safety impacts.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"The assessment is an application requirement and does not waive Chapter 552 Subchapter B protections.","timing":"With the sandbox application; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-56526F7063","intent":"assess sandbox ai impacts on consumers privacy and public safety","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f7858dcea97069749f5064bf367fe6dfa2383a37b6a87e6de520d6b4c5ddb064","kind":"rule-candidate","status":"pending","body":{"title":"Do not apply prohibited government social scoring","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.053","actor":"Texas governmental entities using or deploying AI systems","modality":"must not","action":"apply","object":"prohibited social scoring","condition":"AI evaluates or classifies natural persons from social behavior or personal characteristics to assign a social score that may cause unrelated-context, unjustified, or disproportionate adverse treatment or infringe protected rights.","evidenceSummary":"Section 552.053 prohibits government social scoring when the specified scoring purpose and adverse-result elements are present.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"All statutory elements must be assessed; the governmental-entity definition excludes hospital districts and Texas institutions of higher education.","timing":"At use or deployment; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-342C0977BB","intent":"apply prohibited social scoring","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f829606994b0a18d70951db3c95eecf3dc22935e18aaf7ac165b3b11c010281b","kind":"rule-candidate","status":"pending","body":{"title":"Evaluate state-agency AI use and contemplated use","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Government Code § 2054.068(b)(5), as amended by H.B. 149 § 6","actor":"Texas state agencies reporting information-technology infrastructure status to the Department of Information Resources","modality":"must","action":"evaluate","object":"agency use or contemplated use of AI systems","condition":"The Department of Information Resources collects the agency's required infrastructure-status information.","evidenceSummary":"H.B. 149 adds an evaluation of each state agency's current or considered AI use to the information DIR collects.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"A mandatory state-agency implementation duty is conditioned on specific fiscal-year appropriation under H.B. 149 § 9; implementation may proceed with other available funding.","timing":"As part of the statutory infrastructure-status collection; effective January 1, 2026","authority":"Binding enacted Texas statute within scope, subject to the funding proviso","jurisdiction":"Texas, United States","ruleId":"AIR-FAC09DC006","intent":"evaluate agency use or contemplated use of ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"finding-f83200b2b4327e031dd392f3f23e66b8ee9c928d14cb5be45b37f96c1c42b0a2","kind":"rule-candidate","status":"pending","body":{"title":"Format AI interaction disclosures without dark patterns","sourceTitle":"Texas Responsible Artificial Intelligence Governance Act","sourceVersion":"H.B. 149 enrolled; Acts 2025, 89th Leg., R.S., ch. 1174; effective January 1, 2026","control":"Business & Commerce Code § 552.051(d)","actor":"Persons required to provide the Section 552.051 AI-interaction disclosure","modality":"must","action":"format","object":"AI interaction disclosures clearly and conspicuously in plain language without dark patterns","condition":"A disclosure is required under Section 552.051(b).","evidenceSummary":"Subsection (d) defines three presentation requirements for the required disclosure: clarity and conspicuousness, plain language, and no dark patterns.","url":"https://capitol.texas.gov/tlodocs/89R/billtext/html/HB00149F.htm","exception":"A hyperlink to a separate web page is permitted under subsection (e).","timing":"Whenever the Section 552.051 disclosure is presented; effective January 1, 2026","authority":"Binding enacted Texas statute within scope","jurisdiction":"Texas, United States","ruleId":"AIR-C7BB07CC59","intent":"format ai interaction disclosures clearly and conspicuously in plain language without dark patterns","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-09T13:11:03.845Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-503fc5dcc843e7fb433e1cda18709296ac7528b890bad601f188ba5a787d4cf3","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-10T13:05:44.088Z","fingerprint":"503fc5dcc843e7fb433e1cda18709296ac7528b890bad601f188ba5a787d4cf3","previousFingerprint":"ff473b03393de39a1b19fa71fee25fdbe1ea6909d03a9f4f2eccb7dc000fd7d2","bytes":235219,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-10T13:05:44.088Z","reviewed_at":null},{"id":"change-eu-ai-act-131b49699f7f9f7d911d511e1ac6eeed9109576c33f1492aa5321ab07b92273b","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-10T13:05:46.577Z","fingerprint":"131b49699f7f9f7d911d511e1ac6eeed9109576c33f1492aa5321ab07b92273b","previousFingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","bytes":1534744,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-10T13:05:46.577Z","reviewed_at":null},{"id":"change-eu-gdpr-f9f622ce4ac6b1148dd0935711ecb56f8fac6ff65d8e6d68a906942e93b6d114","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-10T13:05:46.577Z","fingerprint":"f9f622ce4ac6b1148dd0935711ecb56f8fac6ff65d8e6d68a906942e93b6d114","previousFingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","bytes":1071097,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-10T13:05:46.577Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-93bb4040ed7ccd48aa107314ac0f0d630cf5141e3a6f980149e1b771d8f57c1c","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-10T13:05:46.577Z","fingerprint":"93bb4040ed7ccd48aa107314ac0f0d630cf5141e3a6f980149e1b771d8f57c1c","previousFingerprint":"e401974ad10a50b26c705292f1284b59860797d908a3854bee6eea7c18018e46","bytes":708342,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-10T13:05:46.577Z","reviewed_at":null},{"id":"finding-01e224a495c23605319f42e0e1e5a0bee13ad5df854268f2aa43f6b38ed085c1","kind":"rule-candidate","status":"pending","body":{"title":"Support workers displaced by AI","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.4(b)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"support","object":"workers displaced by AI","condition":"As AI is deployed and affects labour-market transitions.","evidenceSummary":"Recommendation 2.4(b) recommends support for people affected by displacement, including social protection and access to new opportunities.","url":"https://oecd.ai/en/ai-principles","exception":"Measures may include training, social protection and labour-market opportunities and should be shaped through social dialogue.","timing":"During AI-driven labour transitions","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-C810ED9CC5","intent":"support workers displaced by ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-0d41db6d12f1f56327cb5deddf8f2bf2378a8009f156fa2269893ae3b4b40649","kind":"rule-candidate","status":"pending","body":{"title":"Establish mechanisms to appeal AI outcomes","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.3(iv)","actor":"AI actors","modality":"should","action":"establish","object":"mechanisms to appeal AI outcomes","condition":"When a person is adversely affected by an AI system output.","evidenceSummary":"Principle 1.3(iv) recommends information that enables adversely affected people to challenge an AI output.","url":"https://oecd.ai/en/ai-principles","exception":"Mechanism and information should be appropriate to context and consistent with the state of the art.","timing":"After or in connection with an adverse AI output","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-6E499BCE84","intent":"establish mechanisms to appeal ai outcomes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-314a7b9c7515fdf90097a17855536fbf98bad5ca691957c7da0d6a596f551922","kind":"rule-candidate","status":"pending","body":{"title":"Disclose AI capabilities and limitations","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.3(i)","actor":"AI actors","modality":"should","action":"disclose","object":"AI system capabilities and limitations","condition":"When meaningful information can foster general understanding of the AI system.","evidenceSummary":"Principle 1.3(i) calls for meaningful information that supports understanding of system capabilities and limitations.","url":"https://oecd.ai/en/ai-principles","exception":"Information should be appropriate to context and consistent with the state of the art.","timing":"When communicating about or making the AI system available","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-3A544071D1","intent":"disclose ai system capabilities and limitations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-373bc73aa3f3e1277d2b8e0fa92652fc4b87a15b69ed0a89fa600a29ff1839d0","kind":"rule-candidate","status":"pending","body":{"title":"Define safe AI decommissioning procedures","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.4(b)","actor":"AI actors","modality":"should","action":"define","object":"safe AI decommissioning procedures","condition":"For AI systems that risk undue harm or exhibit undesired behavior.","evidenceSummary":"Principle 1.4(b) recommends mechanisms that allow AI systems to be decommissioned safely as needed.","url":"https://oecd.ai/en/ai-principles","exception":"As appropriate to the system and context.","timing":"Before deployment and available when decommissioning becomes necessary","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-B098FE0267","intent":"define safe ai decommissioning procedures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-428970aef084bfe451a8d1f878bf8ffb0511eaf3e3bce816e5ab719516ab3e17","kind":"rule-candidate","status":"pending","body":{"title":"Apply ongoing systematic AI risk management","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.5(c)","actor":"AI actors","modality":"should","action":"apply","object":"ongoing systematic AI risk management","condition":"To each AI lifecycle phase, based on role, context and ability to act.","evidenceSummary":"Principle 1.5(c) recommends an ongoing systematic risk-management approach across the AI lifecycle.","url":"https://oecd.ai/en/ai-principles","exception":"Risk treatment is role-, context- and capability-dependent.","timing":"Ongoing across every lifecycle phase","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-175EC9774A","intent":"apply ongoing systematic ai risk management","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-5da30aa402de13696a9ad4976db356468e31b15b5c346e5da2ec16454b30bf6b","kind":"rule-candidate","status":"pending","body":{"title":"Invest in representative privacy-respecting open datasets","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.1(b)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"invest","object":"representative privacy-respecting open datasets","condition":"To support AI research and development that is free from harmful bias and improves interoperability and standards use.","evidenceSummary":"Recommendation 2.1(b) recommends public investment and encouragement of private investment in representative, privacy-respecting open datasets.","url":"https://oecd.ai/en/ai-principles","exception":"Governments are asked to consider public investment and encourage private investment; privacy and data-protection constraints remain.","timing":"As part of AI research and development policy","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-7E9156278D","intent":"invest representative privacy respecting open datasets","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-721f3ec1f140b00b50d75ba8ad8ec03025afbaabbd2372a5c20124594919a1b0","kind":"rule-candidate","status":"pending","body":{"title":"Enable safe AI-system override","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.4(b)","actor":"AI actors","modality":"should","action":"enable","object":"safe override of harmful AI behavior","condition":"When an AI system risks undue harm or exhibits undesired behavior.","evidenceSummary":"Principle 1.4(b) recommends mechanisms that permit safe override when AI risks undue harm or behaves undesirably.","url":"https://oecd.ai/en/ai-principles","exception":"As appropriate to the system and context.","timing":"Available during operation and incident response","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-818859099F","intent":"enable safe override of harmful ai behavior","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-78e17c1cb390ada2172749fcf01222c6388b3ce6a8db653efbaaaafa12f2a99c","kind":"rule-candidate","status":"pending","body":{"title":"Develop global technical standards for trustworthy AI","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.5(c)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"develop","object":"global technical standards for trustworthy AI","condition":"Through multi-stakeholder and consensus-driven processes.","evidenceSummary":"Recommendation 2.5(c) recommends promoting global technical standards for interoperable and trustworthy AI.","url":"https://oecd.ai/en/ai-principles","exception":"Standards should be multi-stakeholder, consensus-driven, interoperable and global.","timing":"Through ongoing international cooperation","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-FADE655905","intent":"develop global technical standards for trustworthy ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-8051e6c48381365d7f52d81d8b100d494fba0596d45029dbd659a89314b47ade","kind":"rule-candidate","status":"pending","body":{"title":"Enable controlled environments for AI testing","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.3(a)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"enable","object":"controlled environments for AI testing","condition":"When supporting trustworthy AI transition from research and development to deployment and operation.","evidenceSummary":"Recommendation 2.3(a) says governments should consider experimentation in controlled environments for testing and scaling trustworthy AI.","url":"https://oecd.ai/en/ai-principles","exception":"Use experimentation and scaling only as appropriate; prefer outcome-based and interoperable approaches.","timing":"Before or during transition to deployment","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-00C55B6E08","intent":"enable controlled environments for ai testing","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-8164bd45e3f0b09cb5901178411547c84eea3f516381edeb8d10eb0259051534","kind":"rule-candidate","status":"pending","body":{"title":"Enable repair of harmful AI behavior","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.4(b)","actor":"AI actors","modality":"should","action":"enable","object":"repair of harmful AI behavior","condition":"When an AI system risks undue harm or exhibits undesired behavior.","evidenceSummary":"Principle 1.4(b) recommends mechanisms that permit repair when AI risks undue harm or behaves undesirably.","url":"https://oecd.ai/en/ai-principles","exception":"As appropriate to the system and context.","timing":"Available during operation and incident response","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-6C4AF0912E","intent":"enable repair of harmful ai behavior","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-8adcb8c7111044230241ba4804e36bddf9876e652a7d6b59090a13c125826500","kind":"rule-candidate","status":"pending","body":{"title":"Adapt policy frameworks for trustworthy AI","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.3(b)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"adapt","object":"policy frameworks for trustworthy AI","condition":"After reviewing how existing policy and regulatory frameworks and assessment mechanisms apply to AI systems.","evidenceSummary":"Recommendation 2.3(b) recommends reviewing and adapting frameworks to encourage trustworthy-AI innovation and competition.","url":"https://oecd.ai/en/ai-principles","exception":"Adaptation is required only as appropriate after review.","timing":"Periodically as AI systems and evidence evolve","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-258BC7584E","intent":"adapt policy frameworks for trustworthy ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-8bbdfd0dca5c4a80a6b5a9808cac48effb9572ca2f6fb5e7b99ebeba953eba88","kind":"rule-candidate","status":"pending","body":{"title":"Ensure AI-process traceability","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.5(b)","actor":"AI actors","modality":"should","action":"ensure","object":"AI process traceability","condition":"Where traceability supports analysis of outputs and responses to inquiry.","evidenceSummary":"Principle 1.5(b) includes process traceability as an accountability mechanism.","url":"https://oecd.ai/en/ai-principles","exception":"Appropriate to context and consistent with the state of the art.","timing":"Throughout relevant lifecycle phases","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-A26D278094","intent":"ensure ai process traceability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-a0a14a297a5221de41b3488427339acc9b6c8b82190a65c4aadcd27b313172ba","kind":"rule-candidate","status":"pending","body":{"title":"Ensure AI-dataset traceability","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.5(b)","actor":"AI actors","modality":"should","action":"ensure","object":"AI dataset traceability","condition":"Where traceability supports analysis of outputs and responses to inquiry.","evidenceSummary":"Principle 1.5(b) includes dataset traceability as an accountability mechanism.","url":"https://oecd.ai/en/ai-principles","exception":"Appropriate to context and consistent with the state of the art.","timing":"Throughout relevant lifecycle phases","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-B560A4296B","intent":"ensure ai dataset traceability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-ab42d124126c5912e00b348fbd90612083be2858d34731dc7b4a776583e76a52","kind":"rule-candidate","status":"pending","body":{"title":"Maintain AI robustness, security and safety","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.4(a)","actor":"AI actors","modality":"should","action":"maintain","object":"AI system robustness security and safety","condition":"Under normal use, foreseeable use or misuse, and other adverse conditions.","evidenceSummary":"Principle 1.4(a) recommends lifecycle-wide robustness, security and safety so systems function appropriately without unreasonable risks.","url":"https://oecd.ai/en/ai-principles","exception":"The recommendation targets unreasonable safety or security risks and depends on actor role and context.","timing":"Throughout the AI system lifecycle","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-F634CFE326","intent":"maintain ai system robustness security and safety","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-ac4f2ab102b94be62e0e8ad573803ab34da403214214332c5869b06a393d7ae8","kind":"rule-candidate","status":"pending","body":{"title":"Enable effective human oversight of AI systems","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.2(b)","actor":"AI actors, according to their lifecycle roles","modality":"should","action":"enable","object":"effective human oversight","condition":"Where needed to address risks from intended use, use outside intended purpose, intentional misuse or unintentional misuse.","evidenceSummary":"Principle 1.2(b) recommends mechanisms and safeguards that preserve human agency and oversight.","url":"https://oecd.ai/en/ai-principles","exception":"Implementation should be appropriate to the context and consistent with the state of the art.","timing":"During relevant lifecycle phases","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-9F0606F820","intent":"enable effective human oversight","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-ae71438687970045f20ebd365f7ca6e60089d9c04862a4865841268986dfd658","kind":"rule-candidate","status":"pending","body":{"title":"Ensure AI lifecycle-decision traceability","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.5(b)","actor":"AI actors","modality":"should","action":"ensure","object":"AI lifecycle decision traceability","condition":"Where traceability supports analysis of outputs and responses to inquiry.","evidenceSummary":"Principle 1.5(b) includes traceability of decisions made during the AI lifecycle.","url":"https://oecd.ai/en/ai-principles","exception":"Appropriate to context and consistent with the state of the art.","timing":"Throughout relevant lifecycle phases","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-0E0C140628","intent":"ensure ai lifecycle decision traceability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-ae92d01631f036a088fab5d833f5e6b4ad257d21a434fafc0ff8d59a7b916a95","kind":"rule-candidate","status":"pending","body":{"title":"Respect human rights throughout the AI lifecycle","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.2(a)","actor":"AI actors, according to their lifecycle roles","modality":"should","action":"respect","object":"human rights throughout the AI system lifecycle","condition":"Across planning, data processing, model building, testing, deployment, operation, monitoring and retirement, as applicable to the actor's role.","evidenceSummary":"Principle 1.2(a) recommends that AI actors respect human rights and human-centred democratic values throughout the AI lifecycle.","url":"https://oecd.ai/en/ai-principles","exception":"Role- and context-dependent; rights include non-discrimination, privacy, dignity, autonomy, fairness and internationally recognised labour rights.","timing":"Throughout the AI system lifecycle","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-F48890400A","intent":"respect human rights throughout the ai system lifecycle","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-b8ee999a5f91f8bf5e1aa311e7df6c497d3a82ce471962d76350f317f7526d73","kind":"rule-candidate","status":"pending","body":{"title":"Develop comparable indicators of AI activity","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.5(d)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"develop","object":"internationally comparable AI indicators","condition":"To measure AI research, development and deployment and assess implementation progress.","evidenceSummary":"Recommendation 2.5(d) recommends internationally comparable indicators and an evidence base for implementation progress.","url":"https://oecd.ai/en/ai-principles","exception":"Indicators should be internationally comparable and tied to research, development and deployment evidence.","timing":"Ongoing measurement and assessment","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-3D3C10AB41","intent":"develop internationally comparable ai indicators","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-b9bf89024bef3a1454fb465d69d4964de40e6e7fb4d899aaaca9ca3cd9e87c81","kind":"rule-candidate","status":"pending","body":{"title":"Promote responsible AI use at work","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.4(c)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"promote","object":"responsible AI use at work","condition":"Working closely with stakeholders to improve worker safety, job quality and public services.","evidenceSummary":"Recommendation 2.4(c) calls on governments to promote responsible workplace AI use and broadly shared benefits.","url":"https://oecd.ai/en/ai-principles","exception":"Implementation should enhance safety and job quality and account for stakeholder roles.","timing":"During workplace AI adoption and operation","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-59C3D0945B","intent":"promote responsible ai use at work","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-c38b54abe73007a67fb8cf0a2cd0bd125ebd12795e044b3d6b46a85bfe28e33c","kind":"rule-candidate","status":"pending","body":{"title":"Explain sources of AI data and inputs","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.3(iii)","actor":"AI actors","modality":"should","action":"explain","object":"sources of AI data and inputs","condition":"When explanation is feasible and useful for people affected by an AI output.","evidenceSummary":"Principle 1.3(iii) identifies plain information on data and input sources as part of contextual explanation.","url":"https://oecd.ai/en/ai-principles","exception":"Only where feasible and useful; detail should be context-appropriate and consistent with the state of the art.","timing":"When providing an explanation of an AI output","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-ADAE26B414","intent":"explain sources of ai data and inputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-c3b6083512d27741aa65376373042988cb3b0946aed7a88cb9e4e2b2a099ce20","kind":"rule-candidate","status":"pending","body":{"title":"Equip people with skills to use AI effectively","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.4(a)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"equip","object":"people with skills to use AI effectively","condition":"In preparation for transformation of work and society, working closely with stakeholders.","evidenceSummary":"Recommendation 2.4(a) calls for empowering people to use and interact with AI by equipping them with necessary skills.","url":"https://oecd.ai/en/ai-principles","exception":"Implementation should cover the breadth of AI applications and reflect stakeholder needs.","timing":"As part of workforce and societal transition planning","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-0CA4CB8FA7","intent":"equip people with skills to use ai effectively","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-cd0ac74387b7e04be64b981b25c839f516e6961f587df992fb17780b616b1c2b","kind":"rule-candidate","status":"pending","body":{"title":"Bolster information integrity in AI systems","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.4(c)","actor":"AI actors","modality":"should","action":"bolster","object":"information integrity in AI systems","condition":"When information-integrity mechanisms are technically feasible.","evidenceSummary":"Principle 1.4(c) recommends mechanisms that strengthen information integrity while protecting freedom of expression.","url":"https://oecd.ai/en/ai-principles","exception":"Only where technically feasible, and measures must respect freedom of expression.","timing":"Across relevant design and operation phases","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-768D94AE56","intent":"bolster information integrity in ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-d07556a64e0b52b92c9c6648ac29648bbafef3a6e474820bc01e0d72941e09ab","kind":"rule-candidate","status":"pending","body":{"title":"Inform stakeholders when they interact with AI","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.3(ii)","actor":"AI actors","modality":"should","action":"inform","object":"stakeholders of AI interactions","condition":"When stakeholders interact with an AI system, including in the workplace.","evidenceSummary":"Principle 1.3(ii) recommends making stakeholders aware of their interactions with AI systems.","url":"https://oecd.ai/en/ai-principles","exception":"Information should be appropriate to context and consistent with the state of the art.","timing":"At or before the interaction","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-E8F30C1AB6","intent":"inform stakeholders of ai interactions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-d4f704305a179dbe2264e44eb347372bcd61ae1d05b829a636a54a379867e015","kind":"rule-candidate","status":"pending","body":{"title":"Invest in AI research on social, legal and ethical impacts","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 2, Recommendation 2.1(a)","actor":"Governments of OECD Recommendation adherents","modality":"should","action":"invest","object":"AI research on social legal and ethical impacts","condition":"As part of long-term public investment and encouragement of private investment in trustworthy AI research and open science.","evidenceSummary":"Recommendation 2.1(a) calls for interdisciplinary investment addressing AI-related social, legal, ethical and policy issues.","url":"https://oecd.ai/en/ai-principles","exception":"Governments are asked to consider public investment and encourage private investment rather than meet a fixed spending level.","timing":"Long-term","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-2D29284F7D","intent":"invest ai research on social legal and ethical impacts","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"finding-d8dd6a8a646053bf2a68cd03c74f4c34041d0e8fe30f9a5a6085bf4d28bdd3c7","kind":"rule-candidate","status":"pending","body":{"title":"Explain factors and logic behind AI outputs","sourceTitle":"OECD Recommendation of the Council on Artificial Intelligence","sourceVersion":"OECD/LEGAL/0449; adopted 2019-05-22; amended 2024-05-03","control":"Section 1, Principle 1.3(iii)","actor":"AI actors","modality":"should","action":"explain","object":"factors processes and logic behind AI outputs","condition":"When explanation is feasible and useful for affected people to understand a prediction, content, recommendation or decision.","evidenceSummary":"Principle 1.3(iii) recommends plain information on the factors, processes or logic leading to an AI output.","url":"https://oecd.ai/en/ai-principles","exception":"Only where feasible and useful; explanation should be context-appropriate and consistent with the state of the art.","timing":"When providing an explanation of an AI output","authority":"Voluntary intergovernmental OECD Recommendation","jurisdiction":"International","ruleId":"AIR-F193592F11","intent":"explain factors processes and logic behind ai outputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-10T13:13:39.270Z","reviewed_at":null},{"id":"change-eu-ai-act-d32741d8f24e35430c54acdc6fef90be02cf2989bdc8cbbd516036caa3776117","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-11T13:02:32.325Z","fingerprint":"d32741d8f24e35430c54acdc6fef90be02cf2989bdc8cbbd516036caa3776117","previousFingerprint":"131b49699f7f9f7d911d511e1ac6eeed9109576c33f1492aa5321ab07b92273b","bytes":1534741,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-11T13:02:32.325Z","reviewed_at":null},{"id":"change-eu-gdpr-c1db6de6e2eacd1b35a45fad77332fa761f2205912aa7e4f166a5ffd3e34f8bc","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-11T13:02:32.325Z","fingerprint":"c1db6de6e2eacd1b35a45fad77332fa761f2205912aa7e4f166a5ffd3e34f8bc","previousFingerprint":"f9f622ce4ac6b1148dd0935711ecb56f8fac6ff65d8e6d68a906942e93b6d114","bytes":1071098,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-11T13:02:32.325Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-6eea7382848332286deaadfa923a4fccb85184b52867f1097cbc63b19943863c","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-11T13:02:32.325Z","fingerprint":"6eea7382848332286deaadfa923a4fccb85184b52867f1097cbc63b19943863c","previousFingerprint":"93bb4040ed7ccd48aa107314ac0f0d630cf5141e3a6f980149e1b771d8f57c1c","bytes":708514,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-11T13:02:32.325Z","reviewed_at":null},{"id":"finding-0f24246ba7041e243ee57c2d6ed288d6e48f1454b9a472836f7a3b9e40713fc8","kind":"rule-candidate","status":"pending","body":{"title":"Allow refusal of human-mimicking AI and human intervention","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 127","actor":"UNESCO Member States and AI actors","modality":"should","action":"allow","object":"refusal of human mimicking AI and human intervention","condition":"When users interact with an AI system imitating human or animal characteristics.","evidenceSummary":"Paragraph 127 calls for users to be able to refuse the AI interaction and request human intervention effectively.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"The Recommendation does not state an exception.","timing":"Throughout the interaction","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-4D0E0234A5","intent":"allow refusal of human mimicking ai and human intervention","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-106e578c98b205a949738c969493f76356cda6e5d0e88d6ecac87c7c8a66f1e6","kind":"rule-candidate","status":"pending","body":{"title":"Inform people that they are interacting with AI","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 127","actor":"UNESCO Member States and AI actors","modality":"should","action":"inform","object":"people they are interacting with AI","condition":"When an AI system imitates human or animal characteristics.","evidenceSummary":"Paragraph 127 calls for users to be able to identify easily whether they are interacting with a living being or an AI system.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"None stated for identification of the interaction.","timing":"At the start and during the interaction","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-86AF529571","intent":"inform people they are interacting with ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-15abe5d56ce8bfa06daa4f08c2afa766abb6119185db06437629b04bed9a5012","kind":"rule-candidate","status":"pending","body":{"title":"Support workers displaced by AI","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 118","actor":"UNESCO Member States","modality":"should","action":"support","object":"workers displaced by AI","condition":"During AI-driven labour transitions affecting at-risk employees.","evidenceSummary":"Paragraph 118 calls for fair-transition measures including reskilling, retention, safety nets, social protection and sufficient public funding.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Measures should be developed with companies, civil society, workers and unions and adapted to national conditions.","timing":"Before and during workforce transitions","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-C810ED9CC5","intent":"support workers displaced by ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-19f6b1493553854bc8f23afdad207140d3874988866f86a2b41364feb8087bcd","kind":"rule-candidate","status":"pending","body":{"title":"Evaluate training-data quality continuously","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 71","actor":"UNESCO Member States","modality":"should","action":"evaluate","object":"training data quality continuously","condition":"Within AI data-governance strategies, including collection, selection, security, protection and feedback processes.","evidenceSummary":"Paragraph 71 calls for continual evaluation of training-data quality and the adequacy of collection and selection processes.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Methods should match the dataset, sector and system context.","timing":"Continuously throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-B9421D0247","intent":"evaluate training data quality continuously","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-1b37ed980c194fc23a070da96b24508ec75fa3f4bcef24b2eb199185065e9227","kind":"rule-candidate","status":"pending","body":{"title":"Explain factors, processes and logic behind AI outputs","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 40","actor":"AI actors","modality":"should","action":"explain","object":"factors, processes and logic behind AI outputs","condition":"For non-temporary, difficult-to-reverse or more-than-low-risk decisions affecting end users.","evidenceSummary":"Paragraph 40 calls for explainable algorithms and a meaningful explanation accompanying higher-impact decisions.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Explainability should be appropriate to context and balanced with privacy, safety and security.","timing":"With the consequential decision","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-F193592F11","intent":"explain factors processes and logic behind ai outputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-1b7ea3899b5340c63aaf09a60c7fb1cd225c3737bb9424200052a7013db0dd3e","kind":"rule-candidate","status":"pending","body":{"title":"Minimize discriminatory or biased AI outcomes","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 29","actor":"AI actors","modality":"should","action":"minimize","object":"discriminatory or biased AI outcomes","condition":"Throughout the AI-system lifecycle.","evidenceSummary":"Paragraph 29 asks AI actors to make reasonable efforts to minimize and avoid reinforcing or perpetuating discriminatory or biased applications and outcomes.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"The Recommendation frames the duty as all reasonable efforts.","timing":"Throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-89F2838F2B","intent":"minimize discriminatory or biased ai outcomes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-1e47541f8f814223ae14d0fe87214894af5a340026cfefc61819e25bf4cd84be","kind":"rule-candidate","status":"pending","body":{"title":"Require human final diagnosis and treatment decisions","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 123(e)","actor":"UNESCO Member States and health-care providers","modality":"should","action":"require","object":"human final diagnosis and treatment decisions","condition":"When AI assists health-care prediction, detection, diagnosis or treatment.","evidenceSummary":"Paragraph 123(e) calls for human care and final diagnosis and treatment decisions always to be taken by humans, while allowing AI assistance.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"AI systems may assist health professionals but do not replace the final human decision.","timing":"At diagnosis and treatment decision time","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-B40AC286CA","intent":"require human final diagnosis and treatment decisions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-202dc103681e14056b9948ee92199cba17d406cbea2977987f330e5f14d0a270","kind":"rule-candidate","status":"pending","body":{"title":"Justify the selected AI method","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 26(a)-(c)","actor":"AI actors and UNESCO Member States","modality":"should","action":"justify","object":"the selected AI method","condition":"When choosing whether and how to use an AI system.","evidenceSummary":"Paragraph 26 calls for an AI method to be appropriate and proportionate to a legitimate aim, consistent with the Recommendation's values and human rights, context-appropriate, and scientifically grounded.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"The method may vary by legitimate aim and context, but it must not violate or abuse human rights.","timing":"Before selecting or deploying an AI method","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-E052965EDE","intent":"justify the selected ai method","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-2066c1c4ca6b2866f089c2c69b25e4ae46332539b878b7bdb0d9d9cad6aea2da","kind":"rule-candidate","status":"pending","body":{"title":"Test human-rights-risk AI before market release","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 51","actor":"AI actors","modality":"should","action":"test","object":"human-rights-risk AI before market release","condition":"When an AI system is identified as posing potential risks to human rights.","evidenceSummary":"Paragraph 51 calls for broad testing, including real-world testing when needed, as part of an ethical impact assessment before market release.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Real-world conditions are used when needed and remain subject to applicable safeguards.","timing":"Before market release","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-5A829F7830","intent":"test human rights risk ai before market release","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-24156d582554536870e3e2dacb15a905bcd0536c779dce853dc85d19f0ec7264","kind":"rule-candidate","status":"pending","body":{"title":"Obtain informed consent for health-data analysis","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 123(d)","actor":"UNESCO Member States and health-AI actors","modality":"should","action":"obtain","object":"informed consent for health data analysis","condition":"When personal data is analyzed by AI for prediction, detection or treatment in health care.","evidenceSummary":"Paragraph 123(d) calls for effective mechanisms so data subjects are aware of and consent to use and analysis of their personal data.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Consent mechanisms should not prevent access to health care and remain subject to applicable law.","timing":"Before use or analysis of personal health data","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-69428D74D8","intent":"obtain informed consent for health data analysis","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-2f63183763fe1be93fc6386b89edfeaab8a70c50f5f5b594dd547e0cba5a3928","kind":"rule-candidate","status":"pending","body":{"title":"Regulate health AI for safety and clinical evidence","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 122","actor":"UNESCO Member States","modality":"should","action":"regulate","object":"health AI for safety and clinical evidence","condition":"For development and deployment of AI systems related to physical or mental health, with attention to children and youth.","evidenceSummary":"Paragraph 122 calls for health AI to be safe, effective, efficient, scientifically and medically proven and supportive of evidence-based innovation.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Regulation should remain consistent with evidence-based innovation and medical progress.","timing":"Before clinical deployment and during operation","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-0CEAB16BD8","intent":"regulate health ai for safety and clinical evidence","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-31acfcdef222251837bc7099f4afcd60e4fb3fad041ebd29f99242dbf3d11d37","kind":"rule-candidate","status":"pending","body":{"title":"Redress harms caused by AI systems","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 55","actor":"UNESCO Member States and private- and public-sector companies","modality":"should","action":"redress","object":"harms caused by AI systems","condition":"When investigation establishes AI-related harm.","evidenceSummary":"Paragraph 55 calls for remedial actions and remediation mechanisms to redress AI harms and protect human rights and the rule of law.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Remediation should follow applicable legal and institutional processes.","timing":"After harm is established","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-2683D90976","intent":"redress harms caused by ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-4db0629c51fc8c13b884c25417d8d515cea88d76408b8b9a696ec11b0de88e6d","kind":"rule-candidate","status":"pending","body":{"title":"Monitor every AI-system lifecycle phase","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 52","actor":"UNESCO Member States and business enterprises","modality":"should","action":"monitor","object":"all AI system lifecycle phases","condition":"Including decision algorithms, data and involved AI actors, especially in public services and direct-user contexts.","evidenceSummary":"Paragraph 52 calls for measures to monitor all lifecycle phases as part of ethical impact assessment.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Monitoring measures should reflect the system and use context.","timing":"Continuously throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-1EEC637757","intent":"monitor all ai system lifecycle phases","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-567d15be52cd2b910d6846d9838b06155f34e06638a2a0b3438904045518f389","kind":"rule-candidate","status":"pending","body":{"title":"Do not cede life-and-death decisions to AI","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraphs 26 and 36","actor":"AI actors and UNESCO Member States","modality":"must not","action":"cede","object":"life-and-death decisions to AI systems","condition":"Where a decision may be irreversible, difficult to reverse, or involve life and death.","evidenceSummary":"Paragraphs 26 and 36 reserve final determination for humans in irreversible or life-and-death contexts and state that such decisions should not be ceded to AI systems.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"AI may assist human decision-making, but ultimate responsibility remains human.","timing":"At decision time","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-FE48418DC7","intent":"cede life and death decisions to ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-5e27b96aa2f4dd415e2a0f3e7a6824722432f3e899843377b0c98ef75b50a070","kind":"rule-candidate","status":"pending","body":{"title":"Introduce ethical-impact-assessment frameworks","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 50","actor":"UNESCO Member States","modality":"should","action":"introduce","object":"ethical impact assessment frameworks","condition":"For AI systems and their human-rights, labour, environmental, ethical and social impacts.","evidenceSummary":"Paragraph 50 calls for assessment frameworks that identify benefits, concerns and risks and define prevention, mitigation, monitoring and assurance measures.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Frameworks should reflect national circumstances and facilitate citizen participation.","timing":"Before deployment and during monitoring","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-D235002FA2","intent":"introduce ethical impact assessment frameworks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-5e4ca39564a4f1ca2f6befc4d3275f68a76bc521249e39ef702c85e668799345","kind":"rule-candidate","status":"pending","body":{"title":"Self-assess existing and proposed public AI systems","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 57","actor":"UNESCO Member States and public authorities","modality":"should","action":"self-assess","object":"existing and proposed public AI systems","condition":"Before deciding whether adoption is appropriate and during review of existing systems.","evidenceSummary":"Paragraph 57 calls for transparent self-assessment of existing and proposed AI systems, including whether adoption and the selected method are appropriate.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Assessment depth should reflect the system's context and potential human-rights impact.","timing":"Before adoption and during periodic review","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-F3DC6726AA","intent":"self assess existing and proposed public ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-5e651364ad04542e190470187cab7fa30442fa6a6a36eee13825b040dcad7a69","kind":"rule-candidate","status":"pending","body":{"title":"Attribute AI responsibility to persons or legal entities","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 35","actor":"UNESCO Member States","modality":"should","action":"attribute","object":"AI ethical and legal responsibility to persons or legal entities","condition":"For every lifecycle stage and remedy involving an AI system.","evidenceSummary":"Paragraph 35 calls for ethical and legal responsibility to remain attributable to physical persons or existing legal entities.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Oversight may be individual or inclusive public oversight as appropriate.","timing":"Throughout the lifecycle and during remedy","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-60A1D85D1C","intent":"attribute ai ethical and legal responsibility to persons or legal entities","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-6116d662a6bfc18835123f7c1754b0ca25877e1a3322ddc19e97367eef815e5d","kind":"rule-candidate","status":"pending","body":{"title":"Do not apply prohibited social scoring","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 26","actor":"AI actors and UNESCO Member States","modality":"must not","action":"apply","object":"prohibited social scoring","condition":"When selecting or using AI methods.","evidenceSummary":"Paragraph 26 states that AI systems should not be used for social scoring purposes.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"None stated for social scoring in the Recommendation.","timing":"Throughout selection, deployment and use","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-342C0977BB","intent":"apply prohibited social scoring","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-6934a1adfdc69e62923520b060bacfc58138a37b39d44d1856387ab0501a8d15","kind":"rule-candidate","status":"pending","body":{"title":"Evaluate AI sustainability impacts continuously","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 31","actor":"UNESCO Member States and AI actors","modality":"should","action":"evaluate","object":"AI sustainability impacts continuously","condition":"Across human, social, cultural, economic and environmental dimensions.","evidenceSummary":"Paragraph 31 calls for continuous assessment of AI's impacts on sustainability, informed by evolving objectives such as the UN Sustainable Development Goals.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Assessment dimensions evolve with sustainability goals and system context.","timing":"Continuously throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-CCA033749A","intent":"evaluate ai sustainability impacts continuously","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-6ba575c4453c8a3a77c88b5fac0f90cf3f0cbb14e2ee283c458ad4acbc352685","kind":"rule-candidate","status":"pending","body":{"title":"Combat stereotypes in AI outputs","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 66","actor":"UNESCO Member States and AI actors","modality":"should","action":"combat","object":"stereotypes in AI outputs","condition":"Whether stereotypes arise by design or negligence, with particular attention to data-scarce regions.","evidenceSummary":"Paragraph 66 calls for mechanisms requiring AI actors to disclose and combat stereotyping in AI-system outcomes and data.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Implementation should respect freedom of expression and access to information.","timing":"During development, evaluation and operation","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-38F34770A2","intent":"combat stereotypes in ai outputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-6dd1ba79f9f79b759464fd40ff2a60a83649ed783319253354cfd5efe33ed78c","kind":"rule-candidate","status":"pending","body":{"title":"Prohibit AI use that violates human-rights obligations","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 57","actor":"UNESCO Member States and public authorities","modality":"must not","action":"use","object":"AI that violates human rights obligations","condition":"When a transparent self-assessment finds that adoption would cause violations or abuses of human-rights obligations.","evidenceSummary":"Paragraph 57 calls for public authorities to prohibit AI use when assessment shows that adoption would violate or abuse the State's human-rights obligations.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"The prohibition follows a documented assessment under the Member State's legal framework.","timing":"Before adoption or continued use","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-BE5C54B56C","intent":"use ai that violates human rights obligations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-7272e160b2c9766396f4f07b786db5773c76c54ec4db1746d900dd284e10949e","kind":"rule-candidate","status":"pending","body":{"title":"Implement data protection by design","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 34","actor":"AI actors","modality":"should","action":"implement","object":"data protection by design","condition":"When designing and implementing AI systems that process personal information.","evidenceSummary":"Paragraph 34 calls for an innovative privacy-by-design approach and accountability for protecting personal information throughout the AI lifecycle.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Implementation should be proportionate to the system and processing context.","timing":"From design through end-of-use","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-6BBD510385","intent":"implement data protection by design","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-72b54400f50bbfd45929486180740b9def20b15fa633aff6183e79a5a175379c","kind":"rule-candidate","status":"pending","body":{"title":"Establish public-sector ethical-impact-assessment procedures","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 53","actor":"Governments","modality":"should","action":"establish","object":"public sector ethical impact assessment procedures","condition":"Particularly for public authorities adopting or deploying AI systems.","evidenceSummary":"Paragraph 53 calls for a regulatory procedure for public authorities to predict consequences, mitigate risks, avoid harms, support participation and address societal challenges.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Assessments may be public where appropriate and should be multidisciplinary, pluralistic and inclusive.","timing":"Before adoption and throughout monitoring","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-E33B4DC8D1","intent":"establish public sector ethical impact assessment procedures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-84965ff4df6029b27b4501be10428b00d6df52ce31ac0a0902ebdbc42da78840","kind":"rule-candidate","status":"pending","body":{"title":"Provide an effective remedy for algorithmic discrimination","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 29","actor":"UNESCO Member States and AI actors","modality":"should","action":"provide","object":"an effective remedy against algorithmic discrimination","condition":"When discrimination or biased algorithmic determination occurs.","evidenceSummary":"Paragraph 29 states that an effective remedy should be available against discrimination and biased algorithmic determination.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Remedy mechanisms operate under applicable national and international law.","timing":"When affected persons challenge discriminatory outcomes","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-5987C9FFC0","intent":"provide an effective remedy against algorithmic discrimination","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-86d8b5827f14decf03a304cf344aecc9fbc8829d2f4990105d18aded5b35e0c7","kind":"rule-candidate","status":"pending","body":{"title":"Appoint an independent AI Ethics Officer","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 58","actor":"Public entities, private-sector companies and civil-society organizations","modality":"may","action":"appoint","object":"an independent AI Ethics Officer","condition":"To oversee ethical impact assessment, auditing, continuous monitoring and ethical guidance.","evidenceSummary":"Paragraph 58 encourages organizations to consider an independent AI Ethics Officer or equivalent mechanism for oversight.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"An equivalent oversight mechanism may be used instead of a named officer.","timing":"Before and during AI governance activities","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-3C84D30D8C","intent":"appoint an independent ai ethics officer","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-8828b5520fc1d7ed297a5735e859aef00a05d9e84ae7058d32c004c7a7cbf2bb","kind":"rule-candidate","status":"pending","body":{"title":"Investigate harms caused by AI systems","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 55","actor":"UNESCO Member States","modality":"should","action":"investigate","object":"harms caused by AI systems","condition":"When AI systems may have caused harm in digital or physical contexts.","evidenceSummary":"Paragraph 55 calls for AI harms to be investigated through strong enforcement mechanisms and institutional capacity.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Investigation should comply with applicable law and due process.","timing":"After suspected or reported harm","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-CC0AFE2F97","intent":"investigate harms caused by ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-8ee46d2d708661cda8c5610a686389cd6f4120c02afe347dba3c56bb3b426600","kind":"rule-candidate","status":"pending","body":{"title":"Assess lifecycle environmental impacts of AI","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 84","actor":"UNESCO Member States and business enterprises","modality":"should","action":"assess","object":"direct and indirect AI lifecycle environmental impacts","condition":"Including carbon footprint, energy use and raw-material extraction supporting AI technologies.","evidenceSummary":"Paragraph 84 calls for lifecycle assessment and reduction of AI-system and data-infrastructure environmental impacts.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Assessment should reflect direct and indirect impacts and applicable environmental law.","timing":"Throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-E2FCA42DFE","intent":"assess direct and indirect ai lifecycle environmental impacts","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-9078a029da7c24c9df4e1f6bf145a94daefd377fde1256e7129d0e4e6f82134e","kind":"rule-candidate","status":"pending","body":{"title":"Perform a data-protection impact assessment","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 34","actor":"AI actors","modality":"should","action":"perform","object":"a data protection impact assessment","condition":"For algorithmic systems that process personal information.","evidenceSummary":"Paragraph 34 calls for adequate privacy impact assessments that include societal and ethical considerations.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Scope should reflect the system's use and personal-data processing context.","timing":"Before deployment and when processing changes materially","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-54647B2218","intent":"perform a data protection impact assessment","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-9692673835adb623c1fcd6775fb14d5ffcac5b0fcc96de116e8dd2955a3f3e2e","kind":"rule-candidate","status":"pending","body":{"title":"Disclose AI interaction","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 38","actor":"AI actors","modality":"should","action":"disclose","object":"AI interaction","condition":"When a product or service is provided directly by or with the assistance of AI.","evidenceSummary":"Paragraph 38 calls for users to be informed properly and promptly when AI directly provides or assists a product or service.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Disclosure depth should reflect context and impact.","timing":"Properly and promptly during the interaction","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-C8E01637B6","intent":"disclose ai interaction","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-a4dba778f45c56b2075db4e8f4ffac87a753c3848b2e259ca32e739175cfab7b","kind":"rule-candidate","status":"pending","body":{"title":"Inform people about AI-based decisions","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 38","actor":"Relevant AI actors and public-sector institutions","modality":"should","action":"inform","object":"people of decisions informed by AI","condition":"When a decision is informed by or based on AI, especially where safety or human rights are affected.","evidenceSummary":"Paragraph 38 says people should be fully informed when a decision is informed by or made on the basis of AI algorithms.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"The transparency level may be balanced against privacy, safety and security according to context and impact.","timing":"At or before communicating the decision","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-D1348F48FB","intent":"inform people of decisions informed by ai","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-b3acf33e982f54a3059fb75da8bf84932bc907ba20284fc3f7f6990477ba8e83","kind":"rule-candidate","status":"pending","body":{"title":"Promote public AI-literacy education","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 44","actor":"Governments, intergovernmental organizations, civil society, academia, media, community leaders and the private sector","modality":"should","action":"promote","object":"public AI literacy education","condition":"For diverse technical and non-technical publics.","evidenceSummary":"Paragraph 44 calls for open and accessible education, civic engagement, digital skills, AI-ethics training and media and information literacy.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Programs should account for linguistic, social and cultural diversity.","timing":"Ongoing","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-0E2968834F","intent":"promote public ai literacy education","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-cab1670be9880a87a14700c71d4fd05a2a4ee4608072030f2bea94c7d0edd3ec","kind":"rule-candidate","status":"pending","body":{"title":"Secure sensitive personal data","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 74","actor":"UNESCO Member States","modality":"should","action":"secure","object":"sensitive personal data","condition":"Where disclosure may cause exceptional damage, injury or hardship.","evidenceSummary":"Paragraph 74 calls for data policies or equivalent frameworks that ensure full security for personal and sensitive data.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Examples include offence, biometric, genetic, health and protected-characteristic data; applicable law controls classification.","timing":"Throughout collection, use, sharing, storage and deletion","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-71AB7A284C","intent":"secure sensitive personal data","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-d20f4f57c7191ee40db2f304d9f1b55b865885b04e622506f7b0e8438e403a80","kind":"rule-candidate","status":"pending","body":{"title":"Ensure AI-process traceability","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 43","actor":"AI actors and UNESCO Member States","modality":"should","action":"ensure","object":"AI process traceability","condition":"To support accountability and identify conflicts with human-rights norms or environmental well-being.","evidenceSummary":"Paragraph 43 calls for technical and institutional designs that make AI systems auditable and traceable throughout their lifecycle.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Designs should account for applicable privacy, security and legal limits.","timing":"Throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-A26D278094","intent":"ensure ai process traceability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-d45ac8cfddbd64f61e22c945ce58ab5404be2c702bf46307bb24eee075136924","kind":"rule-candidate","status":"pending","body":{"title":"Develop AI human-rights due-diligence mechanisms","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 51","actor":"UNESCO Member States and private-sector companies","modality":"should","action":"develop","object":"AI human rights due diligence mechanisms","condition":"To identify, prevent, mitigate and account for AI impacts on human rights, the rule of law and inclusive societies.","evidenceSummary":"Paragraph 51 calls for due-diligence and oversight mechanisms covering identification, prevention, mitigation and accountability for AI impacts.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Mechanisms should be tailored to the actor's role and system context.","timing":"Before release and throughout operation","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-FDFFEEE98F","intent":"develop ai human rights due diligence mechanisms","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-d8af7557e83a9b59f6c17a937c4473e909e05a231a20e145aaeeaafa66ca33e1","kind":"rule-candidate","status":"pending","body":{"title":"Monitor acquired AI in human-rights-sensitive uses","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 62","actor":"UNESCO Member States acquiring AI systems","modality":"should","action":"monitor","object":"acquired AI in human rights sensitive use cases","condition":"For uses such as law enforcement, welfare, employment, media, health care and the judiciary.","evidenceSummary":"Paragraph 62 calls for appropriate oversight authorities to monitor the social and economic impact of acquired AI in human-rights-sensitive use cases.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Oversight can be performed by data-protection, sectoral or other public oversight bodies.","timing":"During procurement, deployment and operation","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-BACFD21F80","intent":"monitor acquired ai in human rights sensitive use cases","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"finding-fbc675d433f2de53bdc548a3a1edf04e428cbe4984e666a135a022517f4a16af","kind":"rule-candidate","status":"pending","body":{"title":"Maintain AI-system robustness, security and safety","sourceTitle":"UNESCO Recommendation on the Ethics of Artificial Intelligence","sourceVersion":"Adopted 23 November 2021, UNESCO General Conference 41st session","control":"Paragraph 27","actor":"AI actors","modality":"should","action":"maintain","object":"AI system robustness, security and safety","condition":"Across the AI-system lifecycle.","evidenceSummary":"Paragraph 27 calls for safety harms and security vulnerabilities to be avoided, addressed, prevented and eliminated throughout the AI lifecycle.","url":"https://www.unesco.org/en/legal-affairs/recommendation-ethics-artificial-intelligence","exception":"Measures should remain proportionate to the system and context.","timing":"Continuously throughout the lifecycle","authority":"Voluntary UNESCO Recommendation","jurisdiction":"International / UNESCO Member States","ruleId":"AIR-F634CFE326","intent":"maintain ai system robustness security and safety","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-11T13:07:31.128Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-ff6b00a00ce1f1afb385710a026bff767bc2a854527a6d768830515c0eefa22f","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-12T13:13:00.506Z","fingerprint":"ff6b00a00ce1f1afb385710a026bff767bc2a854527a6d768830515c0eefa22f","previousFingerprint":"503fc5dcc843e7fb433e1cda18709296ac7528b890bad601f188ba5a787d4cf3","bytes":235219,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-12T13:13:00.506Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-e8425ab97d884bb531c36eefb28b74372aabf460e0fa8cae48d732265f90a19d","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-12T13:13:08.595Z","fingerprint":"e8425ab97d884bb531c36eefb28b74372aabf460e0fa8cae48d732265f90a19d","previousFingerprint":"6eea7382848332286deaadfa923a4fccb85184b52867f1097cbc63b19943863c","bytes":708342,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-12T13:13:08.595Z","reviewed_at":null},{"id":"finding-031dbf13a624bfdb2439df957bfe272c741d7b5e2bfbc5a5d7dcc88ae3b02429","kind":"rule-candidate","status":"pending","body":{"title":"Retain prior model documentation","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.1, PDF page 5","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"retain","object":"prior versions of model documentation","condition":"After documenting a general-purpose AI model placed on the Union market.","evidenceSummary":"Measure 1.1 commits signatories to keep prior documentation versions for a ten-year period.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The Article 53(2) open-source exception applies unless the model has systemic risk.","timing":"Until 10 years after the model is placed on the market","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-8DE80BBC1E","intent":"retain prior versions of model documentation","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-0337625108f2237b5d292425ed2a71c9ec66e7832627dd5a337cba4e2cd08979","kind":"rule-candidate","status":"pending","body":{"title":"Implement a copyright compliance policy","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.1(1), PDF page 4","actor":"Signatory providers placing general-purpose AI models on the Union market","modality":"should","action":"implement","object":"a copyright compliance policy","condition":"For every general-purpose AI model the signatory places on the Union market.","evidenceSummary":"Measure 1.1 commits signatories to draw up, update and implement a single-document policy addressing Union copyright law.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The measure demonstrates a policy obligation but does not itself establish compliance with Union copyright law.","timing":"Before and while placing covered models on the Union market","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-9A5BD1A87A","intent":"implement a copyright compliance policy","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-05f7ce79729141ff09acd41a89d03bfd940aef99f792dddc47a0f35d9bbfedc6","kind":"rule-candidate","status":"pending","body":{"title":"Assess systemic risks","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 1, Measure 1.2, PDF page 8","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"assess","object":"systemic risks","condition":"Through a full identification, analysis, acceptance and mitigation cycle before market placement and on specified material-change triggers.","evidenceSummary":"Measure 1.2 requires a full systemic-risk assessment and mitigation process before the model enters the market and at later triggers.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Still-appropriate portions of earlier assessments need not be duplicated.","timing":"At least before market placement and whenever Measure 7.6 trigger conditions are met","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-9E7F166E73","intent":"assess systemic risks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-0dade33246b6b826d3aea9043e521b8fdfca633bf3b8bfab0428d04bc17f07fc","kind":"rule-candidate","status":"pending","body":{"title":"Provide requested model documentation to the AI Office","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.2, PDF page 5","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"provide","object":"requested model documentation to the AI Office","condition":"Upon an AI Office request under Articles 91 or 75(3) for information necessary to perform AI Act tasks.","evidenceSummary":"Measure 1.2 commits signatories to supply the requested information in its most current form.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The request must identify a lawful purpose and concern information necessary for the relevant supervisory task.","timing":"Within the period specified in the AI Office request","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-422B3BFDBA","intent":"provide requested model documentation to the ai office","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-0fcfe4cd4ae526a8a831b4953915dd26502fae744d479eccb297a961d8ac6f3b","kind":"rule-candidate","status":"pending","body":{"title":"Develop scenarios for identified systemic risks","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 2, Measure 2.2, PDF page 11","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"develop","object":"scenarios for identified systemic risks","condition":"After identifying systemic risks stemming from the model.","evidenceSummary":"Measure 2.2 requires an appropriate number and level of detail of scenarios for each identified systemic risk.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Scenario number and detail are proportionate to the risk.","timing":"During systemic-risk identification and before acceptance determination","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-634ED1EFE9","intent":"develop scenarios for identified systemic risks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-17e0664153cd38998834437df950d83be74af79b4c88e4a650c756b7726962d0","kind":"rule-candidate","status":"pending","body":{"title":"Retain serious-incident documentation","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 9, Measure 9.4, PDF page 27","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"retain","object":"serious-incident documentation","condition":"For relevant information gathered under the Code's serious-incident commitment.","evidenceSummary":"Measure 9.4 establishes a minimum five-year retention period measured from the later of documentation or incident date.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Other applicable Union law may impose additional constraints.","timing":"At least five years from documentation or incident date, whichever is later","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-F812056EAF","intent":"retain serious incident documentation","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-1f1824cbeac327f2ff929f276136c354b20a7f92cb28daa5e5c171ac5c200a0a","kind":"rule-candidate","status":"pending","body":{"title":"Answer necessary downstream information requests","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.2, PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"provide","object":"additional information necessary for downstream AI Act compliance","condition":"Upon a downstream provider request for information necessary to understand relevant model capabilities and limitations or comply with the AI Act.","evidenceSummary":"Measure 1.2 sets a reasonable-time response commitment capped at fourteen days absent exceptional circumstances.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Exceptional circumstances may justify more than 14 days; intellectual-property and confidentiality protections remain applicable.","timing":"Within a reasonable timeframe and no later than 14 days after the request","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-8BA004AE3B","intent":"provide additional information necessary for downstream ai act compliance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-23b28331c5952314fbcd27fa10d918f270e77215da5846182a8e7bc924d59b0b","kind":"rule-candidate","status":"pending","body":{"title":"Prevent infringing reproduction of training content","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.4(1)(a), PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"prevent","object":"copyright-infringing reproduction of training content","condition":"When downstream systems generate outputs from the signatory's model.","evidenceSummary":"Measure 1.4(a) commits signatories to appropriate, proportionate technical safeguards against infringing reproduction.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Safeguards are proportionate; the measure applies whether the model is vertically integrated or supplied contractually.","timing":"Before deployment and during model operation","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-3DE78E9151","intent":"prevent copyright infringing reproduction of training content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-23d4a92b292fcd3aac6aca3df6b67c8e8a84ba8c02e386708ebeac4f3ec1ed16","kind":"rule-candidate","status":"pending","body":{"title":"Create a safety and security framework","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 1, Measure 1.1, PDF pages 6–7","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"create","object":"a safety and security framework","condition":"For covered models being developed, placed on the market or used by the signatory.","evidenceSummary":"Measure 1.1 requires a state-of-the-art framework describing systemic-risk assessment and mitigation processes.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The chapter applies to providers of GPAI models with systemic risk; proportional simplifications may apply to SMEs and small mid-caps.","timing":"During development and before market placement","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-BD536D5F40","intent":"create a safety and security framework","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-2e4f3a17b975ab7c06562a349aa02a33ac9ef21e5c55def206db51ada46935be","kind":"rule-candidate","status":"pending","body":{"title":"Withhold models with unacceptable systemic risk","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 4, Measure 4.2, PDF page 16","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"withhold","object":"models with unacceptable systemic risk","condition":"The model's systemic risks are not acceptable or are reasonably foreseeable soon to become unacceptable.","evidenceSummary":"Measure 4.2 requires the provider not to proceed and, as necessary, not to market, restrict, withdraw or recall the model until risk is acceptable.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Appropriate safety or security mitigations and reassessment may support later proceeding once risk is acceptable.","timing":"Before development continues, market placement or use","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-677FAA1CCA","intent":"withhold models with unacceptable systemic risk","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-36c6266fc7586914199f6492f8fe1ebbbcdb9178c788847ebe1ba6685cc0cceb","kind":"rule-candidate","status":"pending","body":{"title":"Define systemic-risk acceptance criteria","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 4, Measure 4.1, PDF pages 15–16","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"define","object":"systemic-risk acceptance criteria","condition":"For each identified systemic risk and the overall risk determination.","evidenceSummary":"Measure 4.1 requires measurable tiers or other appropriate criteria and a justified safety margin that accounts for uncertainty.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Other criteria may replace tiers when tiers are unsuitable and the risk is not a specified Appendix 1.4 risk.","timing":"Before deciding whether to continue development, market placement or use","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-F1F56E4EAE","intent":"define systemic risk acceptance criteria","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-37ad0e370cf101fcd942b1dafb93dc100dcaa7d7a0e1b11bb7986134ad22d0ae","kind":"rule-candidate","status":"pending","body":{"title":"Assign copyright-policy responsibility","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.1(1), PDF page 4","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"assign","object":"responsibility for copyright-policy implementation and oversight","condition":"When establishing the signatory's Union copyright compliance policy.","evidenceSummary":"Measure 1.1 separately commits signatories to assign implementation and oversight responsibilities within the organisation.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Organisational form is not prescribed.","timing":"When establishing and maintaining the policy","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-012BD71EC6","intent":"assign responsibility for copyright policy implementation and oversight","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-3fa415c35257ea0760e0ab064a71cc60cf60bc210226e41a58f2c3633fdfe8db","kind":"rule-candidate","status":"pending","body":{"title":"Define systemic-risk management responsibilities","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 8, Measure 8.1, PDF pages 23–24","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"define","object":"systemic-risk management responsibilities","condition":"Across supervisory, executive, operational and assurance levels appropriate to the organisation.","evidenceSummary":"Measure 8.1 requires clear allocation of oversight, ownership, support, monitoring and assurance responsibilities.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"SMEs and small mid-caps may use simplified allocations suited to their governance structure.","timing":"Before and throughout covered model development and operation","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-4053E5A771","intent":"define systemic risk management responsibilities","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-4949bb67929de99fa9292a88792be595f18ca4933db6e37050c0b639707caeec","kind":"rule-candidate","status":"pending","body":{"title":"Exclude persistently infringing websites from AI crawling","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.2(1)(b), PDF pages 4–5","actor":"Signatory providers using web crawlers directly or through another party","modality":"should","action":"exclude","object":"persistently infringing websites from AI web crawling","condition":"A court or public authority in the EU or EEA recognises the website as persistently and repeatedly infringing copyright commercially at crawl time.","evidenceSummary":"Measure 1.2(b) commits signatories to exclude listed commercial-scale infringing sites from training-data crawling.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The recognition must come from the specified courts or public authorities and apply at the time of crawling.","timing":"At each applicable web crawl","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union and European Economic Area","ruleId":"AIR-68AE3CE50C","intent":"exclude persistently infringing websites from ai web crawling","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-498ef747aff7bee5c695423778ede85c010461cf40b2696714f5770e7d9b4cac","kind":"rule-candidate","status":"pending","body":{"title":"Notify rightsholders of crawler-information updates","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.3(4), PDF page 6","actor":"Signatory providers using web crawlers","modality":"should","action":"notify","object":"affected rightsholders of crawler-information updates","condition":"When published information about crawler features or rights-reservation measures changes.","evidenceSummary":"Measure 1.3(4) calls for an automated notification means, such as a syndicated web feed.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The mechanism may use a feed or another automatic method.","timing":"When the published crawler information is updated","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-0586B4E6D4","intent":"notify affected rightsholders of crawler information updates","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-4ca6f1e19b48a392e422e6da72122bf4d74c8d81d067d7e209f9d5ea441d24f0","kind":"rule-candidate","status":"pending","body":{"title":"Do not circumvent access-control technologies when crawling","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.2(1)(a), PDF page 4","actor":"Signatory providers using web crawlers directly or through another party","modality":"must not","action":"circumvent","object":"technological access controls on copyright-protected content","condition":"When web crawling for text and data mining and general-purpose AI model training.","evidenceSummary":"Measure 1.2(a) commits signatories not to bypass effective technological measures, including subscription and paywall restrictions.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The measure is tied to effective technological measures under Article 6(3) of Directive 2001/29/EC.","timing":"At web-crawl access time","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-4C41C35712","intent":"circumvent technological access controls on copyright protected content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-534a784efed01ce0c3695778c9404d0d28d8165dc0241cc8c992333d47e72541","kind":"rule-candidate","status":"pending","body":{"title":"Follow robots.txt rights reservations","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.3(1)(a), PDF page 5","actor":"Signatory providers using web crawlers directly or through another party","modality":"should","action":"follow","object":"robots.txt rights-reservation instructions","condition":"When crawling publicly available online content for text and data mining and model training.","evidenceSummary":"Measure 1.3(a) commits signatories to crawlers that read and follow RFC 9309 robots.txt instructions and feasible successor versions.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Successor protocol versions apply when the IETF shows they are technically feasible and implementable for providers and rightsholders.","timing":"At crawl time","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-C683FD122D","intent":"follow robots txt rights reservation instructions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-5c36b53977e2287a08901caf313f160f9169e00c83240f626fe60a9ebdc07489","kind":"rule-candidate","status":"pending","body":{"title":"Designate a rightsholder contact","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.5(1), PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"designate","object":"an electronic rightsholder contact","condition":"For affected rightsholders to communicate with the provider.","evidenceSummary":"Measure 1.5(1) requires a designated electronic contact and easily accessible contact information.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"No clause-specific exception is stated.","timing":"While the covered model is available","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-99CC893DDC","intent":"designate an electronic rightsholder contact","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-608005629e283a302bb42d8b4ca98604edec0241a5a49f3ed2a3c3e1544ee94d","kind":"rule-candidate","status":"pending","body":{"title":"Implement mitigations that meet the model-security goal","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 6, Measure 6.2, PDF page 18","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"implement","object":"mitigations that meet the model-security goal","condition":"While protected model parameters remain non-public and not securely deleted.","evidenceSummary":"Measure 6.2 requires appropriate Appendix 4 mitigations or alternatives that achieve the same objectives.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Equivalent alternative mitigations may be used when listed measures do not fit the organisational or technical context.","timing":"Throughout the lifecycle until parameters are public or securely deleted","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-F1C44EBF07","intent":"implement mitigations that meet the model security goal","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-66465f258871c3f90476af387059ad1be905c4f8867e6ccca830bf0f427e6dcd","kind":"rule-candidate","status":"pending","body":{"title":"Publish AI web-crawler compliance information","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.3(4), PDF page 6","actor":"Signatory providers using web crawlers","modality":"should","action":"publish","object":"AI web-crawler rights-reservation compliance information","condition":"For crawlers and measures used to identify and comply with Article 4(3) rights reservations.","evidenceSummary":"Measure 1.3(4) commits signatories to make crawler identities, robots.txt features and other reservation-compliance measures public.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The measure is without prejudice to the information right under Directive 2004/48/EC Article 8.","timing":"While the crawler and measures are in use","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-D511525F2C","intent":"publish ai web crawler rights reservation compliance information","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-670775fe4a2ff80ec0705b1327ac97faf4bd9baa0d74ca720ef7b9f31148f9c3","kind":"rule-candidate","status":"pending","body":{"title":"Provide current model documentation to downstream providers","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.2, PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"provide","object":"current model documentation to downstream providers","condition":"For information in the Model Documentation intended for downstream providers integrating the model.","evidenceSummary":"Measure 1.2 commits signatories to provide the most current downstream-facing documentation.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Confidentiality safeguards and protection of intellectual property, confidential business information and trade secrets apply.","timing":"When supporting downstream integration and compliance","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-5C65C34756","intent":"provide current model documentation to downstream providers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-6e7e7c3f07158a09a63b4538903d1cd4f4d94c92ba161a69aa74b1cb9fd35683","kind":"rule-candidate","status":"pending","body":{"title":"Comply with other machine-readable rights reservations","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.3(1)(b), PDF page 5","actor":"Signatory providers using web crawlers directly or through another party","modality":"should","action":"comply","object":"machine-readable copyright rights reservations","condition":"When appropriate reservation protocols are standardised or are technically implementable, state of the art, widely adopted and generally agreed through an inclusive EU process.","evidenceSummary":"Measure 1.3(b) covers qualifying asset-based and location-based reservation protocols beyond robots.txt.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The protocol must meet the measure's standardisation or state-of-the-art, implementability, adoption and consensus conditions.","timing":"At crawl time","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-A82ECCFA13","intent":"comply machine readable copyright rights reservations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-78033c7c8395da6f900eb353d96fd30f2febe34b67b9dd8aee2d16dab20d5b6f","kind":"rule-candidate","status":"pending","body":{"title":"Create a safety and security model report","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 7, Measures 7.1–7.5, PDF pages 18–21","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"create","object":"a safety and security model report","condition":"For a covered model and its systemic-risk assessment and mitigation evidence.","evidenceSummary":"Commitment 7 requires a Model Report describing the model, reasons to proceed, risk work, external reports and material changes.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"SMEs and small mid-caps may reduce detail to reflect size and capacity; cross-references and multi-model reports are permitted where appropriate.","timing":"Before placing the model on the market","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-AC0E8FFF57","intent":"create a safety and security model report","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-7e4f0a10a5cd01dde4d937b9040f941ca9980760e25accfddb76ed87b4341dc3","kind":"rule-candidate","status":"pending","body":{"title":"Perform model evaluations","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 3, Measure 3.2, PDF pages 12–13","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"perform","object":"model evaluations","condition":"For modalities relevant to each identified systemic risk, using methods appropriate to the model and risk.","evidenceSummary":"Measure 3.2 requires at least state-of-the-art evaluations, including open-ended testing to identify unexpected behaviour and capability boundaries.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Evaluation design is risk- and model-specific and informed by model-independent information.","timing":"During systemic-risk analysis and at relevant lifecycle triggers","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-95915B3947","intent":"perform model evaluations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-7f83426dfa8c901061dbb120ed761dfd304eb7da64d54ed723862c1b68e3df6a","kind":"rule-candidate","status":"pending","body":{"title":"Protect model documentation from unintended alteration","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.3, PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"protect","object":"model documentation from unintended alteration","condition":"While drawing up, updating, retaining and evidencing model documentation.","evidenceSummary":"Measure 1.3 requires quality and integrity controls and protection against unintended changes.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"No clause-specific exception is stated.","timing":"Throughout documentation creation, maintenance and retention","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-D6481064E5","intent":"protect model documentation from unintended alteration","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-877c97e8813ced1651cef819ad7b133c454fb834f9f3b667303d9793bd37bc71","kind":"rule-candidate","status":"pending","body":{"title":"Report serious incidents to the AI Office","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 9, Measures 9.2–9.3, PDF pages 25–27","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"report","object":"serious incidents to the AI Office","condition":"When the provider establishes or reasonably suspects the model directly or indirectly caused a qualifying serious incident.","evidenceSummary":"Measures 9.2 and 9.3 specify report content and risk-specific initial deadlines, followed by intermediate and final reports.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Information may be redacted as necessary for other applicable Union law; exceptional circumstances may affect initial timing.","timing":"Initial report within 2, 5, 10 or 15 days by incident type; updates every four weeks; final report within 60 days after resolution","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-D711D2E5E0","intent":"report serious incidents to the ai office","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-8f98f1c52956a7e6cd654f31bb1a322424cd68f3f1c42e9af4de2c5373f75c61","kind":"rule-candidate","status":"pending","body":{"title":"Document general-purpose AI models","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.1, PDF page 5","actor":"Signatory providers placing general-purpose AI models on the Union market","modality":"should","action":"document","object":"general-purpose AI models","condition":"When placing a general-purpose AI model on the Union market under the voluntary Code.","evidenceSummary":"Measure 1.1 commits signatories to document at least the information listed in the Model Documentation Form.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The measure does not apply to qualifying free-and-open-source providers under Article 53(2), unless the model has systemic risk.","timing":"By the time the model is placed on the Union market","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance; not an additional legal obligation","jurisdiction":"European Union","ruleId":"AIR-EE45A1F342","intent":"document general purpose ai models","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-91ce894c964c682d4d5e34eb887b2dd4fbf4ecdcd040a44474f40c3339ce231f","kind":"rule-candidate","status":"pending","body":{"title":"Confirm the systemic-risk framework before market placement","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 1, Measure 1.1, PDF page 7","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"confirm","object":"the systemic-risk framework before market placement","condition":"After notifying the Commission under AI Act Article 52(1) and before placing the model on the market.","evidenceSummary":"Measure 1.1 specifies both a post-notification and pre-market confirmation deadline.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Both deadlines apply; the earlier practical deadline controls.","timing":"No later than four weeks after Article 52(1) notification and no later than two weeks before market placement","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-622DE8A4D9","intent":"confirm the systemic risk framework before market placement","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-a4b34c5d0152952a16f630d9e5ec6c402b3bc17d4bf7b9b0ac395a365a97b20d","kind":"rule-candidate","status":"pending","body":{"title":"Provide an electronic copyright-complaint mechanism","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.5(2), PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"provide","object":"an electronic copyright-complaint mechanism","condition":"For affected rightsholders and authorised representatives to submit precise, substantiated Code-compliance complaints.","evidenceSummary":"Measure 1.5(2) calls for electronic submission and easily accessible mechanism information.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The mechanism does not replace statutory copyright remedies.","timing":"While the covered model is available","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-401F58C1AD","intent":"provide an electronic copyright complaint mechanism","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-a59db682a24cda879025969026c3dc7d30b5630fc670b949c35a831798b6d9cb","kind":"rule-candidate","status":"pending","body":{"title":"Publish systemic-risk framework and model-report summaries","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 10, Measure 10.2, PDF page 28","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"publish","object":"systemic-risk framework and model-report summaries","condition":"Insofar as publication is necessary to assess or mitigate systemic risks.","evidenceSummary":"Measure 10.2 calls for public summaries and updates, including high-level risk results and mitigations, with safety and confidentiality removals.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Publication may omit information to protect mitigation effectiveness and sensitive commercial information and is unnecessary for qualifying similarly-safe-or-safer models under Appendix 2.2.","timing":"When necessary to assess or mitigate systemic risk and when summaries are updated","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-766D44E977","intent":"publish systemic risk framework and model report summaries","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-b5fa4cafdff2b59090d9f521833a75538391c586e7e4fabe81e09542d5d5e92d","kind":"rule-candidate","status":"pending","body":{"title":"Implement adversarially robust safety mitigations","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 5, Measure 5.1, PDF page 17","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"implement","object":"adversarially robust safety mitigations","condition":"Throughout the lifecycle, taking account of the model's release and distribution strategy.","evidenceSummary":"Measure 5.1 requires appropriate safety mitigations that remain sufficiently robust to attacks such as jailbreaks and hostile fine-tuning.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The selected mitigations are proportionate to the model and systemic risks.","timing":"Throughout the model lifecycle","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-2A16933CC6","intent":"implement adversarially robust safety mitigations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-bf883d9aeb8be63d4e3523636984f7429cc2618743e1d67a629bcb7b24849308","kind":"rule-candidate","status":"pending","body":{"title":"Process substantiated copyright complaints diligently","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.5(2), PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"process","object":"substantiated copyright complaints diligently","condition":"After receiving a sufficiently precise and adequately substantiated complaint under the Code.","evidenceSummary":"Measure 1.5(2) requires diligent, non-arbitrary action within a reasonable time.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The provider need not repeat a response to an identical complaint from the same rightsholder and may reject manifestly unfounded complaints.","timing":"Within a reasonable time after receipt","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-54E3B89D3D","intent":"process substantiated copyright complaints diligently","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-c59b93f61445335c54cd51796ef0569863aeba9ebda60a6c2f1fc13c15cea1d2","kind":"rule-candidate","status":"pending","body":{"title":"Update the systemic-risk framework","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 1, Measure 1.3, PDF pages 9–10","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"update","object":"the systemic-risk framework","condition":"When a framework assessment finds an update appropriate or material adequacy or adherence concerns arise.","evidenceSummary":"Measure 1.3 requires updates, a versioned changelog and periodic or event-triggered framework assessments.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"No update is needed when the assessment supports the current framework, but the annual-or-sooner assessment cadence remains.","timing":"Without undue delay after an assessment; assess at least every 12 months or sooner on reasonable grounds","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-79B6F75D3C","intent":"update the systemic risk framework","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-cde3f484ee3d7e76dd5db89cf66c01e5b07a4226e838e0f544647ec3e495e55e","kind":"rule-candidate","status":"pending","body":{"title":"Publish documentation-request contact information","sourceTitle":"Code of Practice for General-Purpose AI Models — Transparency Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Transparency Commitment 1, Measure 1.2, PDF page 5","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"publish","object":"contact information for model-documentation requests","condition":"When placing a general-purpose AI model on the Union market.","evidenceSummary":"Measure 1.2 calls for website or other appropriate contact information for AI Office and downstream-provider requests.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"A provider without a website may use another appropriate public means.","timing":"When placing the model on the market","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53 compliance","jurisdiction":"European Union","ruleId":"AIR-22EC51C7C3","intent":"publish contact information for model documentation requests","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-d316516f6932ee70363a514e09c318fb11c40c537c0815a9297607f4ffb3e8df","kind":"rule-candidate","status":"pending","body":{"title":"Provide independent evaluators free model access","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 3, Measure 3.5, PDF page 14","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"provide","object":"independent evaluators free access to relevant model versions","condition":"To facilitate post-market monitoring of covered systemic risks.","evidenceSummary":"Measure 3.5 requires adequate free access for an adequate number of evaluators to capable and minimally mitigated versions and available chains of thought.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The access commitment does not apply when the model qualifies as similarly safe or safer for the same systemic risk under Appendix 2.2.","timing":"During post-market monitoring","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-695F78887A","intent":"provide independent evaluators free access to relevant model versions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-d507f17f6ce0abc1c129ebf2a5c2b52224cd18fdad6ea73e3465504b1b35f88e","kind":"rule-candidate","status":"pending","body":{"title":"Provide the systemic-risk framework to the AI Office","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 1, Measure 1.4, PDF page 10","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"provide","object":"the systemic-risk framework to the AI Office","condition":"After confirming the framework or an update.","evidenceSummary":"Measure 1.4 requires unredacted AI Office access to confirmed frameworks and updates.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"No clause-specific redaction exception is stated for this measure.","timing":"Within five business days after confirmation","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-A0C58383B9","intent":"provide the systemic risk framework to the ai office","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-d69059a0c621773f651fd07b8a5fe18fd653d1d07824dccc0fa49f2bab62b193","kind":"rule-candidate","status":"pending","body":{"title":"Establish a post-market monitoring system","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 3, Measure 3.5, PDF pages 13–14","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"establish","object":"a post-market monitoring system","condition":"After a covered model is placed on the market.","evidenceSummary":"Measure 3.5 requires monitoring information relevant to risk acceptability and Model Report updates.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Monitoring methods are selected proportionately; signatory-deployed systems integrating the model are included.","timing":"Continuously after market placement","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-96F8E30D4E","intent":"establish a post market monitoring system","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-db669283bf4ba41594cade37583f29d7869a6c631fb5d9307c2dd9edf9d0ff1d","kind":"rule-candidate","status":"pending","body":{"title":"Prohibit copyright-infringing model uses","sourceTitle":"Code of Practice for General-Purpose AI Models — Copyright Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Copyright Commitment 1, Measure 1.4(1)(b), PDF page 6","actor":"Signatory providers of general-purpose AI models","modality":"should","action":"prohibit","object":"copyright-infringing model uses","condition":"In acceptable-use policies, terms or equivalent model-governance documents.","evidenceSummary":"Measure 1.4(b) commits signatories to prohibit infringing uses or warn users in documentation for free and open-source models.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"For free and open-source models, accompanying documentation may alert users to the prohibition without changing the licence's open-source nature.","timing":"Before making the model available and throughout availability","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 53(1)(c) compliance","jurisdiction":"European Union","ruleId":"AIR-34CAEED939","intent":"prohibit copyright infringing model uses","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-df33c21c150e62cc8765918b83ccae588eebeb02069d7c8d678cbfdd195ebb15","kind":"rule-candidate","status":"pending","body":{"title":"Define a model-security threat-actor goal","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 6, Measure 6.1, PDF page 18","actor":"Signatory providers of general-purpose AI models with systemic risk","modality":"should","action":"define","object":"a model-security threat-actor goal","condition":"For models covered by the Code's systemic-risk security commitment.","evidenceSummary":"Measure 6.1 requires a security goal covering non-state external, insider and other expected threat actors in light of current and expected capabilities.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"The commitment does not apply where model capabilities are inferior to at least one model whose parameters are publicly downloadable.","timing":"Before selecting and implementing security mitigations","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-5E0C8818B2","intent":"define a model security threat actor goal","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"finding-ff9d79c1a9f6e51c9d08ce547ba922854a7719142d30b0d6b0e5fea9104ec479","kind":"rule-candidate","status":"pending","body":{"title":"Allocate resources for systemic-risk management","sourceTitle":"Code of Practice for General-Purpose AI Models — Safety and Security Chapter","sourceVersion":"Final Code published 10 July 2025; adequacy confirmed 1 August 2025","control":"Safety and Security Commitment 8, Measure 8.2, PDF page 24","actor":"Management bodies of signatory providers of systemic-risk GPAI models","modality":"should","action":"allocate","object":"resources for systemic-risk management","condition":"To people assigned responsibilities under Measure 8.1 and proportionate to the model's systemic risks.","evidenceSummary":"Measure 8.2 covers human, financial, information, knowledge and computational resources.","url":"https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai","exception":"Resource levels are proportionate to the systemic risks.","timing":"Throughout systemic-risk assessment and mitigation","authority":"Voluntary GPAI Code used to demonstrate AI Act Article 55 compliance","jurisdiction":"European Union","ruleId":"AIR-DF3CA2B6CF","intent":"allocate resources for systemic risk management","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-12T13:29:27.878Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-9e70446e08f90873fce594e89339839ed1c9123de6c0c060670bb752c3b47c05","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-13T13:07:43.620Z","fingerprint":"9e70446e08f90873fce594e89339839ed1c9123de6c0c060670bb752c3b47c05","previousFingerprint":"ff6b00a00ce1f1afb385710a026bff767bc2a854527a6d768830515c0eefa22f","bytes":235219,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-13T13:07:43.620Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-d8483523ef2e20efe11bd41752c6cf80915acac37d3598592539445f84443056","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-13T13:07:51.702Z","fingerprint":"d8483523ef2e20efe11bd41752c6cf80915acac37d3598592539445f84443056","previousFingerprint":"e8425ab97d884bb531c36eefb28b74372aabf460e0fa8cae48d732265f90a19d","bytes":708342,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-13T13:07:51.702Z","reviewed_at":null},{"id":"finding-03ec1911de65548efcf04c70b5cfb6f53d60817140aeb26a215319b8dfffdb83","kind":"rule-candidate","status":"pending","body":{"title":"Separate tasks by authorization context","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM08:2026 Prevention Strategy 3","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"separate","object":"tasks by authorization context","condition":"When LLM tasks require different access levels.","evidenceSummary":"The guidance separates tasks and grants each context only the privileges it needs.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Authorization must be deterministic and auditable.","timing":"Before execution","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-CBC4109CB3","intent":"separate tasks by authorization context","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-07557cc3dbe6a572b39fc4325a6ecf4f34619bf21bda29249699fc31f76ede2b","kind":"rule-candidate","status":"pending","body":{"title":"Verify model provenance and integrity","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM04:2026 Prevention Strategy 5","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"model provenance and integrity","condition":"Before promoting a model from an external or shared source.","evidenceSummary":"The guidance combines verifiable sources, signatures, hashes, immutable references and release gates.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"A valid signature proves origin and integrity, not model safety.","timing":"Before deployment and continuously upstream","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-20E5C620DA","intent":"verify model provenance and integrity","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-07ab644d67a9314e6cd0ef4dd13b9f5d176b074636e7de7b3bce2e779909d9e0","kind":"rule-candidate","status":"pending","body":{"title":"Use parameterized queries for model-generated database operations","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM10:2026 Prevention Strategy 5","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"use","object":"parameterized queries for model-generated database operations","condition":"When LLM output influences a database query.","evidenceSummary":"The guidance requires parameterized queries or prepared statements.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Parameterization does not authorize an otherwise prohibited operation.","timing":"Before database execution","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-BA72D5E60A","intent":"use parameterized queries for model generated database operations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-11ecf381e1e891ef80a91037416d292f29063a2e0a8ca8d3d0b765cbcb7ebd97","kind":"rule-candidate","status":"pending","body":{"title":"Enforce behavior controls outside the model","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM08:2026 Prevention Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"enforce","object":"behavior controls outside the model","condition":"When a critical behavior or safety boundary must be reliable.","evidenceSummary":"The guidance uses deterministic external safeguards rather than hidden instructions as the primary control.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Fine-tuning may reduce risk but provides no consistent guarantee.","timing":"At every relevant decision point","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-B25B8057B5","intent":"enforce behavior controls outside the model","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-18edebc8a1aa3f8a6c32463a56e9913412536fdd0a3a60f5edf327737c9e29ab","kind":"rule-candidate","status":"pending","body":{"title":"Detect recursive or resource-intensive agent actions","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM06:2026 Prevention Strategy 8","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"detect","object":"recursive or resource-intensive agent actions","condition":"When agent-tool interaction deviates from established normal consumption patterns.","evidenceSummary":"The guidance monitors sessions for loops and resource-heavy tool behavior without a clear end state.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Baselines must be maintained as tools and workloads change.","timing":"Continuously during agent runs","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-49A72C4549","intent":"detect recursive or resource intensive agent actions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-1bd1cfc43e31f544dcc00ca1d0a24b8c75df353c6711e5699fcd7ac40960ead8","kind":"rule-candidate","status":"pending","body":{"title":"Validate every model response in trusted code","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM01:2026 Prevention and Mitigation Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"validate","object":"every model response in trusted application code","condition":"Before any downstream system acts on an LLM response.","evidenceSummary":"The guidance calls for structural validation in trusted code rather than a second model call.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Structural validation catches format violations but not necessarily semantic manipulation.","timing":"Before downstream use","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-4E0B5E4900","intent":"validate every model response in trusted application code","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-1d8ad63a4a84bd74baf84657ac3813695c213a7b27437bb6df341430ca4c5eff","kind":"rule-candidate","status":"pending","body":{"title":"Strip invisible Unicode at ingest and render boundaries","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM01:2026 Prevention and Mitigation Strategy 5","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"strip","object":"invisible Unicode at ingest and render boundaries","condition":"When ingesting or rendering content that may reach or leave an LLM context.","evidenceSummary":"The guidance identifies tag-block, variation-selector and zero-width characters as smuggling channels.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"This does not address visible-text payloads or future steganographic classes.","timing":"At every ingest and render boundary","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-23C6FB27BE","intent":"strip invisible unicode at ingest and render boundaries","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-2466cd6e96527ce36718aca579bd1c878e93c2d53030ad73176d144d426c7804","kind":"rule-candidate","status":"pending","body":{"title":"Enforce tenant scope inside vector queries","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM09:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"enforce","object":"tenant scope inside vector queries","condition":"When a shared retrieval system serves multiple tenants or trust zones.","evidenceSummary":"The guidance validates tenant scope server-side within the index query.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"High-sensitivity workloads may require physically separate indexes.","timing":"At query time","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-31CFFA6E61","intent":"enforce tenant scope inside vector queries","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-309f564c9feaac4005af882c8d83219a2a5ec70d15093c5957112b84dd2b048e","kind":"rule-candidate","status":"pending","body":{"title":"Enforce hard AI spending caps","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM06:2026 Prevention Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"enforce","object":"hard AI spending caps","condition":"For each API key, user, team and cloud account consuming paid inference.","evidenceSummary":"The guidance requires non-overridable ceilings that stop inference when exceeded.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Caps should account for modality and tool-protocol cost differences.","timing":"Continuously during inference","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-0527253C36","intent":"enforce hard ai spending caps","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-346b80433436c35ad69331e132d7d636f2f5f4219737e7addbcaada12af070c1","kind":"rule-candidate","status":"pending","body":{"title":"Govern automated retraining loops","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM05:2026 Prevention Strategy 9","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"govern","object":"automated retraining and feedback loops","condition":"When preference signals or user feedback can change a model automatically.","evidenceSummary":"The guidance validates inputs, requires human oversight and rate-limits feedback-driven updates.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Controls address gradual poisoning but do not eliminate all manipulation.","timing":"Before accepting feedback and before retraining","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-799E96112C","intent":"govern automated retraining and feedback loops","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-4206d8e88bd140ab04c2a22fc58cb8f910d6d611be83cf0b414e478495e50830","kind":"rule-candidate","status":"pending","body":{"title":"Version datasets for rollback","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM05:2026 Prevention Strategy 8","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"version","object":"datasets for rollback and forensic analysis","condition":"Across training, fine-tuning and embedding data pipelines.","evidenceSummary":"The guidance uses data version control to track changes and support rollback after poisoning.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Versioning must be paired with access and integrity controls.","timing":"Continuously across dataset changes","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-9168F8CFD2","intent":"version datasets for rollback and forensic analysis","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-42cc8e5e2d605af8301fa8ad5eda676ee9bf94706f7046352fa1e4edb79594ec","kind":"rule-candidate","status":"pending","body":{"title":"Verify claims before execution","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM07:2026 Prevention Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"LLM-generated claims before execution","condition":"When generated claims would trigger a tool, workflow or external action.","evidenceSummary":"The guidance separates claim generation from execution and inserts verification.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Verification should use independent evidence and current system state.","timing":"Before acting","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-E7BF5547F0","intent":"verify llm generated claims before execution","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-5bb606ab629ae76dbbcb641b1b57a74050bdd6ebab2cf79798bc16ccccf3feb2","kind":"rule-candidate","status":"pending","body":{"title":"Require human confirmation before privileged actions","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM01:2026 Prevention and Mitigation Strategy 7","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"require","object":"human confirmation before privileged actions","condition":"For privileged, irreversible or externally visible actions proposed by an LLM application.","evidenceSummary":"The guidance requires confirmation against the exact rendered action.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Approval fatigue can degrade review quality.","timing":"Immediately before action execution","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-67CAE3665A","intent":"require human confirmation before privileged actions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-620cc55d77c3c8b6e3bf33a3ef6f766cd89d135d47c7378bc1decc8696810193","kind":"rule-candidate","status":"pending","body":{"title":"Mediate downstream actions independently of the LLM","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM03:2026 Prevention Strategy 7","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"mediate","object":"downstream actions independently of the LLM","condition":"Whenever an LLM proposes an action against a downstream system.","evidenceSummary":"The guidance validates every request at a deterministic policy point or downstream system.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Graduated policies may auto-approve low-consequence reversible actions.","timing":"Before each downstream action","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-0376A55328","intent":"mediate downstream actions independently of the llm","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-64484b5f3ae210bdb8ffe25d37567d495fb7faca16ba414d22b73f0c52084c23","kind":"rule-candidate","status":"pending","body":{"title":"Block automatic outbound requests from rendered model output","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM10:2026 Prevention Strategy 9","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"block","object":"automatic outbound requests from rendered model output","condition":"When chat, IDE, email or mobile clients render LLM-generated content.","evidenceSummary":"The guidance disables automatic images, previews, iframes and similar fetches by default.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"If fetching is required, use an origin allowlist or a server-side proxy that strips data-bearing parameters.","timing":"At render time","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-19242DD653","intent":"block automatic outbound requests from rendered model output","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-658efaa31aa02be1264281c5ad8484cf776364f01939d140d1f0db2eafd2adf3","kind":"rule-candidate","status":"pending","body":{"title":"Minimize context sent to external providers","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM02:2026 Tier 1 Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"minimize","object":"context sent to external model providers","condition":"When an application sends user or organizational data to an external model provider.","evidenceSummary":"The guidance limits provider context to task-required fields and requires justification for auto-context features.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Additional context may be justified when documented and controlled.","timing":"Before each external model request","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-7D56E83B4D","intent":"minimize context sent to external model providers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-67a01c9bf0d63ccf3059b48d5a2971e972f40ed312fba5ef6d93e19115f1873c","kind":"rule-candidate","status":"pending","body":{"title":"Validate model outputs before backend use","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM10:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"validate","object":"model outputs before backend use","condition":"When model output is passed to a backend function or downstream component.","evidenceSummary":"The guidance treats model output as untrusted user input.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Validation must be appropriate to the receiving function.","timing":"Before backend processing","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-91F1E724D7","intent":"validate model outputs before backend use","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-6824ea4c6492ff59245d49dd8b0796cd7451d19687b2ff47dc6a62432aa9a1f8","kind":"rule-candidate","status":"pending","body":{"title":"Reject oversized inputs before inference","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM06:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"reject","object":"oversized inputs before inference","condition":"When an input exceeds the application's documented size or token limits.","evidenceSummary":"The guidance uses pre-flight token estimation and input-size validation.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Limits should be risk- and workload-appropriate.","timing":"Before inference begins","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-B02AAFF7C0","intent":"reject oversized inputs before inference","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-6aba5353e0925ff7fc8f929bf8f3e9249709ff14952820ed7402e9e172b35c67","kind":"rule-candidate","status":"pending","body":{"title":"Avoid open-ended agent tools","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM03:2026 Prevention Strategy 3","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"avoid","object":"open-ended agent tools","condition":"When a specific narrow operation can replace shell, arbitrary URL or equivalent open-ended functionality.","evidenceSummary":"The guidance prefers granular tools with strict parameter schemas.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Open-ended tools may remain only where no safer granular alternative meets the need.","timing":"During tool selection and design","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-8F98427AF2","intent":"avoid open ended agent tools","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-6d73b2176b5d849b51beaab60d524ddc3ff162a0acfbdff871fb84f4ca8ee0d5","kind":"rule-candidate","status":"pending","body":{"title":"Reassess suppliers after security or contract changes","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM04:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"reassess","object":"AI suppliers after security or contract changes","condition":"When a supplier's security posture, access model, terms or privacy policy changes.","evidenceSummary":"The guidance requires recurring supplier review and change-triggered reassessment.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Only trusted suppliers should remain in use.","timing":"After relevant supplier changes","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-5BFA4011AC","intent":"reassess ai suppliers after security or contract changes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-6e28d8550e6e3e21c03049e1b50801cf8c240e55b40c40c20ba5085e068d825f","kind":"rule-candidate","status":"pending","body":{"title":"Limit agent-tool functions","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM03:2026 Prevention Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"limit","object":"agent-tool functions to necessary operations","condition":"When designing or selecting tools for an LLM agent.","evidenceSummary":"The guidance limits each tool to the operations required by the use case.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Separate narrowly scoped tools may replace multifunction tools.","timing":"During tool design and configuration","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-D3CFB869C0","intent":"limit agent tool functions to necessary operations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-71d03c842f1ff18f65bbd03bb8856d507779b4cbc87ceed289b58498268bb982","kind":"rule-candidate","status":"pending","body":{"title":"Keep credentials outside the model","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM01:2026 Prevention and Mitigation Strategy 4","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"keep","object":"credentials and state-change capability outside the model","condition":"For any privileged or state-changing operation exposed to an LLM application.","evidenceSummary":"The guidance places credentials and state-change authority in deterministic application code.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Broad downstream permissions or agent hops can reintroduce the risk.","timing":"During design and execution","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-E9A76989D8","intent":"keep credentials and state change capability outside the model","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-7f5cd4596f4af82470099c7b77908b71cc97a7f93a6f221df52e3e22bd18d2b4","kind":"rule-candidate","status":"pending","body":{"title":"Limit agent tools to the necessary set","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM03:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"limit","object":"agent tools to the necessary set","condition":"When configuring tools available to an LLM agent.","evidenceSummary":"The guidance removes tools that are unnecessary for the intended task.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"No broader tool set is justified by convenience alone.","timing":"Before deployment and when capabilities change","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-B8045D5BEB","intent":"limit agent tools to the necessary set","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-8766289bb7e4ee66d6d0b128cada1e14af85543ff24d4295906b4a3adeaf7e94","kind":"rule-candidate","status":"pending","body":{"title":"Verify MCP servers and third-party tool packages","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM01:2026 Prevention and Mitigation Strategy 10","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"MCP servers and third-party tool packages","condition":"Before connecting an MCP server or third-party tool package to an LLM application.","evidenceSummary":"The guidance calls for pinning, signing, verification and tool-description review.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Verification establishes provenance and integrity, not safety by itself.","timing":"Before installation and continuously after changes","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-E91FEB58FC","intent":"verify mcp servers and third party tool packages","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-881e7e23d4fabe9144285414adf707b50cded3b5124a5d6946f395e2971be644","kind":"rule-candidate","status":"pending","body":{"title":"Probe models for backdoors after alignment","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM05:2026 Prevention Strategy 10","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"probe","object":"models for backdoors after alignment","condition":"After each model alignment cycle and before deployment.","evidenceSummary":"The guidance requires trigger-focused testing rather than assuming alignment removes backdoors.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"General red teaming does not replace dedicated trigger probing.","timing":"After every alignment cycle","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-727C1A6948","intent":"probe models for backdoors after alignment","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-9540ffa541181c12c90f84ae8ac51317cc546228718529eb979db85d19dd5513","kind":"rule-candidate","status":"pending","body":{"title":"Enforce agent execution limits","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM06:2026 Prevention Strategy 9","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"enforce","object":"agent step recursion time and cost limits","condition":"For every autonomous or semi-autonomous agent execution.","evidenceSummary":"The guidance sets bounded steps, recursion depth, duration and per-run cost.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"State hashing is recommended to detect recursive loops.","timing":"At the start and throughout each run","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-341F31DDFD","intent":"enforce agent step recursion time and cost limits","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-96ce9efa8cceaf50e6888fbe4f7fdf664611311b5b1f5854b7c734b77cae54da","kind":"rule-candidate","status":"pending","body":{"title":"Redact reasoning traces before observability ingestion","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM02:2026 Tier 2 Strategy 11","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"redact","object":"reasoning traces before observability ingestion","condition":"When reasoning traces are logged, exported or sent to observability systems.","evidenceSummary":"The guidance treats reasoning traces as first-class output and bars unrestricted raw-trace logging.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Reasoning traces may be retained only within appropriately restricted handling paths.","timing":"Before logging or export","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-FA8BA326DF","intent":"redact reasoning traces before observability ingestion","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-981a7980af2a0d2ae9aac69b4aaaf1d271a106fcdb95fdde1d9e1cc8e7569203","kind":"rule-candidate","status":"pending","body":{"title":"Delete embeddings with deleted source documents","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM09:2026 Prevention Strategy 5","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"delete","object":"embeddings when source documents are deleted","condition":"When a source document is removed under retention, privacy or access policy.","evidenceSummary":"The guidance applies bounded deletion and reconciliation audits to derived embeddings.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Backups retain the same sensitivity as the source data.","timing":"Within the defined deletion period","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-E7A8BF872F","intent":"delete embeddings when source documents are deleted","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-99e296d9ab99a723fc6e35c55bcc32f1defa49fec2af09aeb4d275bf8e01f3b2","kind":"rule-candidate","status":"pending","body":{"title":"Require structured outputs with mandatory fields","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM07:2026 Prevention Strategy 6","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"require","object":"structured outputs with mandatory fields","condition":"When omissions could cause unsafe or incomplete downstream decisions.","evidenceSummary":"The guidance uses mandatory output fields to detect omission failures.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"A complete structure may still contain incorrect content.","timing":"Before accepting the output","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-3BD5F7160D","intent":"require structured outputs with mandatory fields","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-a21462daa7d4fe702824129ddf6359e86166b90a3cd2f62a2ed93c653f7c30f8","kind":"rule-candidate","status":"pending","body":{"title":"Exclude sensitive data from hidden context","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM08:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"exclude","object":"sensitive data from hidden model context","condition":"When constructing system prompts or other hidden context.","evidenceSummary":"The guidance assumes hidden context may become visible to users and removes secrets and security-critical configuration.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Sensitive operations should remain in systems the model cannot directly access.","timing":"Before model invocation","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-FAD77512B0","intent":"exclude sensitive data from hidden model context","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-a7a2ceb17b1a246f130bbf005f488e0bf6156ff8447a2ebd5725318259dde1a7","kind":"rule-candidate","status":"pending","body":{"title":"Encode model outputs for destination context","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM10:2026 Prevention Strategies 3–4","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"encode","object":"model outputs for the destination context","condition":"When rendering or passing model output to HTML, JavaScript or another interpreting context.","evidenceSummary":"The guidance applies context-aware output encoding to prevent code execution.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Encoding depends on the exact destination context.","timing":"Before rendering or interpretation","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-C295975FAC","intent":"encode model outputs for the destination context","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-a828081330940b0de0ccc9142c330c314c8f23295ef069221301d7b3bbc2374b","kind":"rule-candidate","status":"pending","body":{"title":"Authorize retrieval inside index queries","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM02:2026 Tier 1 Strategy 3","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"enforce","object":"authorization inside retrieval queries","condition":"When an LLM application retrieves documents or chunks from an index.","evidenceSummary":"The guidance places document- and chunk-level authorization inside the query rather than after retrieval.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"High-sensitivity workloads may require per-tenant indexes.","timing":"At retrieval time","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-7D6FAD1C1A","intent":"enforce authorization inside retrieval queries","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-b0eeb815877caa53dd4f8419512f60958c08f2e6a041d677390929d7a2952ef0","kind":"rule-candidate","status":"pending","body":{"title":"Verify inference artifacts before deployment","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM05:2026 Prevention Strategy 12","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"inference artifacts before deployment","condition":"For chat templates, tokenizer configurations, adapters and quantization artifacts.","evidenceSummary":"The guidance treats inference artifacts as security-relevant code and requires signatures, hashes, diffs and static analysis.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Verification must cover configuration artifacts as well as model weights.","timing":"Before deployment","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-BE76435EC8","intent":"verify inference artifacts before deployment","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-e527346d3933705bca5f6601fc18406dcf233600ab7eb93276ea0d6f19de3905","kind":"rule-candidate","status":"pending","body":{"title":"Log vector retrieval activity immutably","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM09:2026 Prevention Strategy 6","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"log","object":"vector retrieval activity immutably","condition":"For production retrieval requests involving vector or embedding stores.","evidenceSummary":"The guidance records tenant scope, query, returned identifiers and similarity scores for monitoring and response.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Logs remain sensitive and require their own access controls.","timing":"Continuously during retrieval","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-75C206D795","intent":"log vector retrieval activity immutably","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-ee3982593e3859a5ac72590265c05532bb8dcaf9432b62b023510a67e7d5b421","kind":"rule-candidate","status":"pending","body":{"title":"Ground outputs in current authoritative sources","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM07:2026 Prevention Strategy 1","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"ground","object":"LLM outputs in current authoritative sources","condition":"Before an LLM output informs a material decision or action.","evidenceSummary":"The guidance requires authoritative and current evidence for generated claims.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Grounding does not by itself prove the claim is correct.","timing":"Before action or decision","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-96D2CD94EC","intent":"ground llm outputs in current authoritative sources","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-ee68e130f796a03795603cee4dc0032b2d8bcc379d20d63509c49e0d5cb8f9e4","kind":"rule-candidate","status":"pending","body":{"title":"Preserve user authorization across chained calls","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM03:2026 Prevention Strategy 5","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"preserve","object":"user authorization across chained tool and agent calls","condition":"When an LLM system delegates work through tools or multiple agents on a user's behalf.","evidenceSummary":"The guidance carries the originating user's authorization scope through the chain.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Service identities must not silently expand the user's scope.","timing":"Throughout delegated execution","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-EEED31C620","intent":"preserve user authorization across chained tool and agent calls","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-f080b60b8666f516ddeea1710ceec006a4dbd93bba20ecc8d1c68960dd594a42","kind":"rule-candidate","status":"pending","body":{"title":"Verify erasure across sensitive AI artifacts","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM02:2026 Tier 3 Strategy 16","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"erasure across raw data embeddings checkpoints and adapters","condition":"When sensitive or regulated data must be removed from an AI system.","evidenceSummary":"The guidance requires erasure across major artifact classes with post-removal extraction and membership probes.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Verification must cover derived artifacts, not only the source record.","timing":"After deletion or unlearning","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-FE2D83FBFC","intent":"verify erasure across raw data embeddings checkpoints and adapters","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-f24a1c45fa60db88b20d1c8f26d102e6519438bdbd760388638222e6bbd3169e","kind":"rule-candidate","status":"pending","body":{"title":"Maintain a signed AI bill of materials","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM04:2026 Prevention Strategy 4","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"maintain","object":"a signed AI bill of materials","condition":"For models, adapters, datasets and software components used by an LLM application.","evidenceSummary":"The guidance extends component inventories to AI artifacts and their licenses.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Inventory does not establish that components are safe.","timing":"Continuously; audit regularly","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-A87B8A4534","intent":"maintain a signed ai bill of materials","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-f5ec7266f080f7ee9e623ab024f594ec15839b78fdcc018e972928d0d69f27bf","kind":"rule-candidate","status":"pending","body":{"title":"Verify AI-suggested dependencies","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM04:2026 Prevention Strategy 2","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"verify","object":"AI-suggested software dependencies","condition":"Before adopting a package or component recommended by an AI system.","evidenceSummary":"The guidance checks that suggested dependencies exist and are the intended package.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Verification supplements vulnerability management and patching.","timing":"Before installation or adoption","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-A4915FB892","intent":"verify ai suggested software dependencies","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"finding-fe9b1f05309e05ab662b630385df68d6566d5809a1bff44bd89eb0a18ce2ee05","kind":"rule-candidate","status":"pending","body":{"title":"Segregate vector indexes by trust tier","sourceTitle":"OWASP GenAI LLM Top 10 2026","sourceVersion":"2026 release — Site dated August 3, 2026; canonical source records August 4, 2026","control":"LLM09:2026 Prevention Strategy 3","actor":"Developers, architects, security teams and operators of LLM applications","modality":"should","action":"segregate","object":"vector indexes by trust tier","condition":"When external, partner and confidential content have different trust levels.","evidenceSummary":"The guidance uses index-level isolation instead of classification tags on a shared index.","url":"https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/","exception":"Mixed-trust content should not share an index without hard isolation.","timing":"Before embedding and retrieval","authority":"Voluntary community security guidance","jurisdiction":"Global","ruleId":"AIR-4BD004C832","intent":"segregate vector indexes by trust tier","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-13T13:13:05.968Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-8ac1ad46eff429e29577ee47b3a85199e5ffa654bc5e52891f9e1ae5bf6d347f","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-14T12:58:10.210Z","fingerprint":"8ac1ad46eff429e29577ee47b3a85199e5ffa654bc5e52891f9e1ae5bf6d347f","previousFingerprint":"9e70446e08f90873fce594e89339839ed1c9123de6c0c060670bb752c3b47c05","bytes":235219,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-14T12:58:10.210Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-a846fd3339fc751dfed295eaaa686ae188114b9b6504cac6cd03ffe131c339c6","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-14T12:58:12.923Z","fingerprint":"a846fd3339fc751dfed295eaaa686ae188114b9b6504cac6cd03ffe131c339c6","previousFingerprint":"d8483523ef2e20efe11bd41752c6cf80915acac37d3598592539445f84443056","bytes":706968,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-14T12:58:12.923Z","reviewed_at":null},{"id":"finding-13c2be5c6aea82b3834d25446c13de7ed1f583ead4cb145056f69cfc8920bd0b","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Document rationale for departures from corporate values","control":"3.12, p.29","action":"document","object":"rationale for AI deployment deviations from corporate values","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. A rationale does not authorize unlawful deployment.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When deciding on an inconsistent deployment or model","evidenceSummary":"Inconsistencies between AI deployment and corporate values should be conscious decisions with a clear documented rationale.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=29","ruleId":"AIR-6BD6A06201","intent":"document rationale for ai deployment deviations from corporate values","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-15abbd714d6bd45b40f5e6184d45257029979e0dd7e09526ee3a7bf0040c8d9d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Test models against dynamic production conditions","control":"3.35, p.48","action":"test","object":"AI models under dynamic production conditions","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Wherever possible; safety testing needs depend on context.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"During testing before and around deployment","evidenceSummary":"Where possible, testing should reflect production variability to assess generalisation and graceful failure.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=48","ruleId":"AIR-6CD9D072C7","intent":"test ai models under dynamic production conditions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-176dafe5a36f288d28100133f53ee6c8dd1a5847e6ba6c665320baf7b87ec327","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Transfer AI-governance knowledge when personnel change","control":"3.7(2)(b)(iii), p.24","action":"transfer","object":"AI governance knowledge during key personnel changes","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Whenever key AI personnel change","evidenceSummary":"Proper knowledge transfer reduces gaps in AI governance caused by movement of key staff.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=24","ruleId":"AIR-B744BB72AD","intent":"transfer ai governance knowledge during key personnel changes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-1c8e1f5fceb82c12933144277c11ca9deb10e692d4e043a7f0c4e46e126963cb","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Tell users when responses will train AI","control":"3.55, p.57","action":"inform","object":"individuals when their responses will train AI systems","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Applies when responses will be used for training; does not itself establish a legal basis to process them.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When collecting responses for AI training","evidenceSummary":"Where applicable, inform users that their responses will train the AI system.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=57","ruleId":"AIR-6E85F08651","intent":"inform individuals when their responses will train ai systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-2256abf579327c93428d21ca055f99a842abdacefbce5800868c090ef2e8bc95","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Test AI user interfaces before deployment","control":"3.55, p.57","action":"test","object":"AI user interfaces for usability before deployment","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Before deployment","evidenceSummary":"Test the interface and resolve usability problems before deployment so it serves its intended purpose.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=57","ruleId":"AIR-FBA2E9CEBB","intent":"test ai user interfaces for usability before deployment","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-277fa9be029217d4d50ed78fc8684a3203227e0870ff4133a93702ac38176c47","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Provide appeals for material AI decisions","control":"3.54(b), p.57","action":"establish","object":"mechanisms to appeal AI outcomes","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. This voluntary recommendation is additional to existing review obligations; not a universal appeal entitlement.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"After material decisions affecting an individual","evidenceSummary":"Consider an avenue for affected people to request review of material AI decisions; human review is reasonable for materially consequential autonomous decisions.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=57","ruleId":"AIR-6E499BCE84","intent":"establish mechanisms to appeal ai outcomes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-38b0f25ef5ac27b572cb854cb1fa4e08f85c3b088bd11ed6b69a0d53c9b47bec","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Train personnel in AI-risk responsibilities","control":"3.7(1)(b), p.22","action":"train","object":"personnel in their AI risk responsibilities","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Before and while discharging AI governance duties","evidenceSummary":"Internal AI governance personnel should understand their roles and receive suitable training, guidance and resources.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=22","ruleId":"AIR-E528E1DA42","intent":"train personnel in their ai risk responsibilities","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-44f1d9251394512e5a2b757516e8a300059510c5fecaeb294de8da10c47c9b00","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Ask AI suppliers about model reproducibility","control":"3.40(d), p.50","action":"ask","object":"AI solution providers whether procured model results are reproducible","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Concerns procurement of AI systems; distinguish from merely updating software that happens to add AI features under 2.2.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"During procurement or reproducibility assessment","evidenceSummary":"Organisations procuring off-the-shelf AI systems can check reproducibility of results with the original solution provider.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=50","ruleId":"AIR-DF06DD0948","intent":"ask ai solution providers whether procured model results are reproducible","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-4ff95725544f0f9ec22b943aaee4fc7d9483786b92a611ee3babd241a9031d58","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Enable human oversight of safety-critical AI","control":"3.18, p.31","action":"enable","object":"effective human oversight","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. If human control is not possible, sufficient information should support safe shutdown.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When operating safety-critical systems","evidenceSummary":"For safety-critical systems, allow a person to assume control and provide enough information for meaningful decisions or safe shutdown.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=31","ruleId":"AIR-9F0606F820","intent":"enable effective human oversight","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-58993f9dc6d928549470cdba57b58a0bbc1e4152ca151755e34c4de5b93cd41a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Assess risks of data with uncertain provenance","control":"3.23(a), p.37","action":"assess","object":"risks of using data with uncertain provenance","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Trusted third-party supply does not itself establish provenance.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Before and during use of data whose origin is uncertain","evidenceSummary":"Where origins are difficult to establish, including commingled third-party data, assess the risks of using the data.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=37","ruleId":"AIR-53EC5139B9","intent":"assess risks of using data with uncertain provenance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-5af70fc5e8250fd18712c9b09e2c92f4708986acdc14a050595d3536c5634e08","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Ensure AI-dataset traceability","control":"3.23(a), p.37","action":"ensure","object":"AI dataset traceability","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Data origin may be difficult to establish; assess and manage the resulting risk rather than assert complete provenance.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"During data management and model development","evidenceSummary":"Data accountability practices include understanding data origin, curation, transformation and movement; provenance records support tracing errors.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=37","ruleId":"AIR-B560A4296B","intent":"ensure ai dataset traceability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-6671a1804218c64a1faf6fbfb0f4c149caf3b272a7e406759f12fae3ed5d388a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Assign AI-system accountability","control":"3.7(1)(a), p.22","action":"assign","object":"AI system accountability","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"At allocation of AI deployment responsibilities","evidenceSummary":"Allocate oversight of deployment stages to appropriate personnel or departments; a coordinating body is conditional on need and feasibility.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=22","ruleId":"AIR-A332E21BFB","intent":"assign ai system accountability","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-6aad6db8d94b1a5e2a14fc945fa08a63f2a83ee7269c661fc3d328c2d51caf2a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Develop an AI-explanation policy","control":"3.48, p.53","action":"develop","object":"a policy defining AI explanations and their timing","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Explanations may be general or specific on request; tailor to purpose and context.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Before and during stakeholder communication","evidenceSummary":"An explanation policy specifies what to explain, when and organisational responsibilities; equivalent human decisions guide disclosure standards.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=53","ruleId":"AIR-E6D1E07495","intent":"develop a policy defining ai explanations and their timing","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-8c60987f5f9dca22446cb1ecb9144662821796a76623243c37722d03f6709deb","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Establish a regular model-tuning policy","control":"3.34, p.48","action":"establish","object":"a policy for regular AI model tuning","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Tuning must remain appropriate to the deployed system and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Regularly; also when objectives, risks or corporate values change","evidenceSummary":"An internal policy and process for regular tuning helps deployed models respond to changing customer behavior and updated data.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=48","ruleId":"AIR-06075B5F24","intent":"establish a policy for regular ai model tuning","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-8d9f08d38bafc1c0aff08078f36c53dbcaf5535a85ab39e615e6d3503423f728","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Review AI governance after structural changes","control":"3.7(2)(b)(iv), p.24","action":"review","object":"AI governance structures after organisational or key personnel changes","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"On significant organisational or key-personnel change","evidenceSummary":"Review internal governance structures and measures following significant organisational or key-personnel changes.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=24","ruleId":"AIR-80D754CF92","intent":"review ai governance structures after organisational or key personnel changes","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-9878a9f67108d8dd5c0530b65da745bedb1e46ebea5d485d66bb6fe46d803c37","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Assess whether to offer an AI opt-out","control":"3.52, p.56","action":"assess","object":"whether to offer an AI opt out","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. No universal opt-out mandate; if none is provided, consider review or recourse under 3.53.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When deciding whether and how to offer opt-out","evidenceSummary":"Consider opt-out availability and default versus on-request delivery against harm, reversibility, alternatives, costs and feasibility.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=56","ruleId":"AIR-50720EFBE6","intent":"assess whether to offer an ai opt out","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-be3cac7f934fd48781d050445e3654ce97fc27995543a4cc5e76a1e9d3bd171d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Monitor deployed AI-model behavior","control":"3.7(1)(c)(ii), p.23; 3.7(2)(b)(ii), p.24","action":"monitor","object":"AI behavior in production","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Monitoring design is proportionate; autonomous monitoring is optional where appropriate.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"During deployment","evidenceSummary":"Governance roles cover deployed-model monitoring and review; management reporting should surface performance and other issues.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=23","ruleId":"AIR-F6290E21EB","intent":"monitor ai behavior in production","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-c34820308e4e1d4c45576be47765fd0f63ed12766a30b5e4a851fd76df8a83a6","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Make model replication files available for testing","control":"3.40(c), p.50","action":"make available","object":"AI model replication files for reproducibility testing","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. External reproducibility testing can target a risk-selected subset of AI features (3.39); not a public release mandate.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When undertaking reproducibility testing","evidenceSummary":"Replication files that reconstruct development steps facilitate testing and reproduction of behavior.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=50","ruleId":"AIR-0B7460B97C","intent":"make available ai model replication files for reproducibility testing","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-e127e120e2fa2158fe9a4426a9a63553613ae1e75466a2babc24f0e737ee435a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Determine human involvement using harm probability and severity","control":"3.15-3.17, p.31","action":"determine","object":"human involvement using probability and severity of AI harm","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. These are not the only factors: nature and reversibility of harm, recourse and operational feasibility also matter (3.17 footnote 4).","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"When selecting or reassessing human involvement","evidenceSummary":"A proposed matrix helps select human involvement using likelihood and severity of harm.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=31","ruleId":"AIR-842F4DF31B","intent":"determine human involvement using probability and severity of ai harm","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-e8da1f2bbf50529ffd909f34da52b790da64589b31f38f68034be8abbcd093cb","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Retain AI traceability records for relevant durations","control":"3.37(c), p.49","action":"retain","object":"AI traceability records for industry relevant durations","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. No fixed retention duration is prescribed; contextual selection under 3.38 remains necessary.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"For industry-relevant retention durations","evidenceSummary":"Traceability data should be retained for durations relevant to the industry rather than a universal period.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=49","ruleId":"AIR-1CA65C58B8","intent":"retain ai traceability records for industry relevant durations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-f34717a48cab02e427a0a2076b6739dc92e6f6a1a86c849741f4738c029d8f37","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Maintain a response plan for failed AI-risk mitigations","control":"3.13, p.29","action":"maintain","object":"a response plan for failed AI risk mitigations","modality":"should","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Semantically related to existing risk-response planning; owner review should assess overlap before adoption.","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"Throughout the iterative deployment-risk process","evidenceSummary":"The iterative risk-management process includes maintaining a plan for cases where mitigation fails.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=29","ruleId":"AIR-0D19E4E892","intent":"maintain a response plan for failed ai risk mitigations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"finding-fcc93b61a733458d5bc21f59cf492241557d88310912b47b2161bedc9a295bf1","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Singapore Model AI Governance Framework","sourceVersion":"Second Edition, released 21 January 2020; official 70-page PDF retrieved 14 October 2026","actor":"Organisations adopting or deploying AI solutions at scale","authority":"Voluntary PDPC/IMDA governance guidance; not a statutory duty","jurisdiction":"Singapore; sector-agnostic voluntary reference elsewhere","title":"Protect AI traceability records from alteration","control":"3.37(c), p.49","action":"protect","object":"AI traceability records from degradation or alteration","modality":"may","condition":"Within the second-edition framework, primarily machine-learning deployment at scale; apply relevant measures proportionately to context and risk. Select traceability measures and product features proportionately to harm, experience and regulatory needs (3.38).","exception":"Not intended for merely updating commercial off-the-shelf packages that now include AI (2.2). Measures are adaptable and not all relevant (3.2); adoption does not replace applicable laws or sectoral requirements (2.12-2.13).","timing":"During storage of traceability data","evidenceSummary":"Store traceability data appropriately so it does not degrade or change.","url":"https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Resource-for-Organisation/AI/SGModelAIGovFramework2.pdf#page=49","ruleId":"AIR-66817D6B0A","intent":"protect ai traceability records from degradation or alteration","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-14T13:02:21.582Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-67293a0fe467a4278e31b98b0fac930419cc9fcfd1f5415d9b1661e88fb0cc75","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-15T13:05:22.316Z","fingerprint":"67293a0fe467a4278e31b98b0fac930419cc9fcfd1f5415d9b1661e88fb0cc75","previousFingerprint":"8ac1ad46eff429e29577ee47b3a85199e5ffa654bc5e52891f9e1ae5bf6d347f","bytes":235216,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-15T13:05:22.316Z","reviewed_at":null},{"id":"finding-06cddb029f18475f193edc616d373b81c3d49f890e148e11c63900f21fa6683a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Collect content-authenticity feedback from users","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"collect","object":"feedback from affected stakeholders","control":"MS-2.7-003 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Survey GAI users about satisfaction and perceived content authenticity; examine provenance concerns and understanding of content labels","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During user-feedback and security/resilience assessment","evidenceSummary":"User surveys collect satisfaction and authenticity perceptions and help identify provenance literacy concerns.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-E7F9A07274","intent":"collect feedback from affected stakeholders","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-07948c887997db39ad12b9fb6c940689510a727899d83b3a6d3f50247a44a175","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Review guardrails in novel operating circumstances","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"review","object":"GAI safety and security guardrails in novel operating circumstances","control":"MS-2.5-006 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Also revisit the rationale underlying the original safe-deployment assessment","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"Regularly, especially in novel circumstances","evidenceSummary":"Regular review includes guardrails and the reasons deployment was originally judged safe.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-21A69129AF","intent":"review gai safety and security guardrails in novel operating circumstances","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-08e35c00358754a28f2f19a52a051e17e64c22291a568158f36b01e6c500ce28","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Assess incident-driven adaptation speed","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"assess","object":"speed of GAI adaptation after security incidents and feedback","control":"MS-2.7-006 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Based on security-incident lessons and feedback","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"Following security incidents or feedback","evidenceSummary":"Assess how quickly the system adapts and improves after relevant security evidence.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-11CDA6B848","intent":"assess speed of gai adaptation after security incidents and feedback","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-110bd4a348545cfa65023dcbdff1035b12d9f53955676b99ff71018bcb0150e5","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Re-evaluate fine-tuned safety above risk tolerance","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"re evaluate","object":"fine tuned model safety when negative risk exceeds tolerance","control":"MS-2.6-003 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. When negative risk exceeds the organisation's risk tolerance","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"On exceeding organisational risk tolerance","evidenceSummary":"Reassess the safety features of a fine-tuned model when its negative risk exceeds the organisation's tolerance.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-C37BCC7CB3","intent":"re evaluate fine tuned model safety when negative risk exceeds tolerance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-31db51fd03e114a48b423acd6058e2b50e822b8541ced6be43f62f27197fc29c","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Define security-effectiveness metrics","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"define","object":"metrics of GAI security measure effectiveness","control":"MS-2.7-004 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Examples include provenance verification and unauthorised access or extraction attempts","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"When designing security measurement","evidenceSummary":"Identify measures that reflect how effectively security controls operate.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-31E0F1A846","intent":"define metrics of gai security measure effectiveness","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-32a2e557ca350d843a111a5e14ea20be66cc8d0904327282f8066c542e7112ec","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify generated-output validity and safety","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"verify","object":"outputs","control":"MS-2.6-004 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Review GAI outputs for validity and safety, including generated code and downstream decision risks","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During output review","evidenceSummary":"Review outputs for validity and safety and assess generated-code risks to downstream decisions. This mapping preserves NIST's voluntary force.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-7899BD6734","intent":"verify outputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-50e0390892b22be4aed943bd863cba161905096fec7c0106bdde3fa2722149e3","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify handling of misuse-enabling queries","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"verify","object":"handling of queries that enable malicious or illegal GAI use","control":"MS-2.6-006 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Examples include manipulation, extortion, impersonation, cyber-attacks and weapons-related misuse; this is defensive assurance","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During misuse-risk assessment and testing","evidenceSummary":"Check that the system handles queries that may facilitate inappropriate, malicious or illegal usage.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-1AAD1432EB","intent":"verify handling of queries that enable malicious or illegal gai use","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-5e14c5ffffbd310cd6a8c1138c669f7b3a4beb77c8358b4d0052795422b3a2fd","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Assess harmful-content exposure impacts on AI workers","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"assess","object":"health and wellbeing impacts of harmful content exposure on AI actors","control":"MS-2.6-001 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Value-chain or other AI actors exposed to sexually explicit, offensive or violent information in training or maintenance","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During GAI training and maintenance risk assessment","evidenceSummary":"Assess adverse impacts on people exposed to harmful material as part of GAI work.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-2F2F1B55B0","intent":"assess health and wellbeing impacts of harmful content exposure on ai actors","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-6221064e97819dcb57502c40a80c2b777a7c2712610c59536f07c9a559529e66","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Benchmark content-provenance security and resilience","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"benchmark","object":"GAI content provenance security and resilience","control":"MS-2.7-002 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Against industry standards, best practices and state-of-the-art provenance methods","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During security and resilience evaluation","evidenceSummary":"Compare provenance-related security and resilience with relevant industry baselines.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-D7FE687D05","intent":"benchmark gai content provenance security and resilience","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-79427325c4b51b3386cbec4eaa892ddd0973cbba6134270a7fdd572e5b2fe5c2","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify continuing security-control effectiveness","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"verify","object":"continuing effectiveness and integrity of GAI security measures","control":"MS-2.7-009 · PDF page 38","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Assess whether security measures remain effective and uncompromised","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"Regularly","evidenceSummary":"Check continuing effectiveness and absence of compromise rather than relying solely on an initial assessment.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=38","ruleId":"AIR-7D1FAC43F3","intent":"verify continuing effectiveness and integrity of gai security measures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-7be858bf38a0cd2716ee7f4a1dccd4d00484a4d0171a0762765198c855e414fc","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Document human-domain-knowledge contributions","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"document","object":"human domain knowledge used to improve GAI performance","control":"MS-2.5-002 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Includes knowledge contributed through RLHF, fine-tuning, RAG, moderation and business rules","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"When documenting GAI performance improvements","evidenceSummary":"Record the extent of human domain knowledge used in improving system performance.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-BE0700F5CB","intent":"document human domain knowledge used to improve gai performance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-840eb4d6006799c36f3e4d22879ca85f3074e2642cee3338a808d31106daeb0a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify fine-tuning preserves safety controls","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"verify","object":"fine tuning preservation of safety and security controls","control":"MS-2.7-008 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. When a GAI model is fine-tuned","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During fine-tuning assurance","evidenceSummary":"Verify that fine-tuning has not compromised safety or security controls.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-2B9003A861","intent":"verify fine tuning preservation of safety and security controls","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-88f3af26511a49e7d6905728e6cc1b2f0cb42abc36e78e8b60b555e2745dae45","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Measure implementation of security recommendations","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"measure","object":"implementation rate of recommendations from security checks and incidents","control":"MS-2.7-006 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Recommendations generated by security checks or incidents","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During security improvement assessment","evidenceSummary":"Measure the rate at which security recommendations are implemented; do not substitute an assertion that lessons were learned.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-CC045735D8","intent":"measure implementation rate of recommendations from security checks and incidents","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-8d0dd08ba1f8e52ec89aa5d2b013e80e494f142dcbbbfee72b549196c1a3780a","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Measure content-authentication error rates","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"measure","object":"content authentication false positive and false negative rates","control":"MS-2.7-005 · PDF page 37","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. For methods such as watermarks, signatures and fingerprints; evaluate true results as well","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During content-provenance reliability assessment","evidenceSummary":"Assess reliability using false-positive and false-negative rates alongside true positives and negatives.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=37","ruleId":"AIR-F2E27A486E","intent":"measure content authentication false positive and false negative rates","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-8fe4aed1bdf86542137c9e008e11128fa698a0d39b424fe6e2d49ed4dbdd4d4f","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Include independent AI evaluators","actor":"AI actors performing AI Design tasks","action":"involve","object":"independent assessors in AI evaluation","control":"GV-3.2-001 · PDF page 22","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Policies should support independent evaluations or assessments with type and robustness proportionate to identified risk","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"When establishing oversight and evaluation policy","evidenceSummary":"Independent evaluations bolster oversight; the evaluation design should match the risk.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=22","ruleId":"AIR-DFA60F69C7","intent":"involve independent assessors in ai evaluation","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-c0ab778586de7738a1bd348f024341ac5137e7adc8cf9ef6abdefee2af45e4a5","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Document interface anthropomorphization","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"document","object":"instances of anthropomorphization in GAI interfaces","control":"MS-2.5-004 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Examples include human imagery and mentions of human feelings; this is documentation, not a blanket ban","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During interface assessment","evidenceSummary":"Track and document humanlike features in GAI interfaces.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-1CA9890252","intent":"document instances of anthropomorphization in gai interfaces","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-c41cc914d628e54a8e15aa856e58e4d3398c827c660d3076968cc823417c3fcd","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Avoid anecdotal capability extrapolation","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"avoid","object":"extrapolating GAI performance from narrow anecdotal assessments","control":"MS-2.5-001 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. When assessing GAI performance or capabilities","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During capability and performance assessment","evidenceSummary":"NIST advises against extending narrow, non-systematic or anecdotal results into broader performance claims.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-4F4595BF99","intent":"avoid extrapolating gai performance from narrow anecdotal assessments","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-dfe573c1f133fffdeb5d5c40971477b9b39b929e82198ff638759c4882a1054c","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify grounding of fine-tuning and RAG data","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"verify","object":"grounding of fine tuning and retrieval augmented generation data","control":"MS-2.5-005 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. When those data are used by the GAI system","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During verification of fine-tuning or RAG datasets","evidenceSummary":"The action separately calls for checking that fine-tuning or retrieval-augmentation data are grounded.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-051CDCD71D","intent":"verify grounding of fine tuning and retrieval augmented generation data","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-eaadee02fdb7b9cd654aface06199398ecf52df674521ac1af53e01b11e8cd50","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify architectural error-recovery capability","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"verify","object":"GAI architecture capability to recover from detected security errors","control":"MS-2.6-005 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. When security anomalies, threats or impacts are detected; related monitoring and repair capabilities remain part of the source context","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During architecture assurance and relevant incident testing","evidenceSummary":"Verify that the system architecture supports handling and recovering from errors under detected security problems.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-F9A744D2EF","intent":"verify gai architecture capability to recover from detected security errors","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-f6fcadd687afc7aa544ac14ffa67ecb0d9bc1fd8892e40ad9894ea82a5f87cc5","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify sources and citations in GAI outputs","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"verify","object":"sources and citations in GAI outputs","control":"MS-2.5-003 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Within pre-deployment risk measurement and ongoing monitoring","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"Before deployment and during ongoing monitoring","evidenceSummary":"Check the sources and citations supplied in generated outputs rather than treating them as reliable by default.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-7C84EFA973","intent":"verify sources and citations in gai outputs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-f97632481694d3e8ae8721c0f34688429dad51e4556b380e63ec93711f1ca5ab","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Evaluate safety-measure circumvention vulnerabilities","actor":"AI actors performing AI Deployment, AI Impact Assessment, Domain Expert, Operation and Monitoring, or TEVV tasks","action":"evaluate","object":"GAI vulnerabilities to safety measure circumvention","control":"MS-2.6-007 · PDF page 36","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. Within authorised defensive evaluation","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"Regularly","evidenceSummary":"Assess susceptibility to circumvention of safety measures.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=36","ruleId":"AIR-FD39ED404D","intent":"evaluate gai vulnerabilities to safety measure circumvention","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"finding-ff0379325bf586b22b4f04020cd8d8d3ef45466d8e11ad44ed3c236b7da68666","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"NIST AI 600-1 — Generative Artificial Intelligence Profile","sourceVersion":"NIST AI 600-1, July 2024; publisher date 26 July 2024; verified 15 October 2026","modality":"should","authority":"Voluntary NIST suggested risk-management action; not a statutory requirement","jurisdiction":"United States; cross-sectoral voluntary use","title":"Verify training and evaluation data provenance","actor":"AI actors performing Domain Expert and TEVV (testing, evaluation, validation and verification) tasks","action":"verify","object":"provenance of GAI training and evaluation data","control":"MS-2.5-005 · PDF page 35","condition":"For generative AI risk management within the July 2024 profile; applicability depends on risk, lifecycle stage, relevant actor task and organisational use. TEVV data includes testing, evaluation, validation and verification data","exception":"Not every suggested action applies to every AI actor or task (Section 3, PDF p.17); tailor to organisational requirements, risk tolerance and resources. This guidance does not itself impose a legal duty.","timing":"During data verification for risk measurement","evidenceSummary":"Verify provenance of training and TEVV datasets. This is distinct from a claim that all dataset risks are resolved.","url":"https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf#page=35","ruleId":"AIR-37F8B8D4E2","intent":"verify provenance of gai training and evaluation data","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-15T13:08:40.276Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-67dbd2fc3af682ed557176113d621ce2ed770c11ed69ec3f8412de6ab94860e2","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-16T13:07:00.291Z","fingerprint":"67dbd2fc3af682ed557176113d621ce2ed770c11ed69ec3f8412de6ab94860e2","previousFingerprint":"67293a0fe467a4278e31b98b0fac930419cc9fcfd1f5415d9b1661e88fb0cc75","bytes":235216,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-16T13:07:00.291Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-a52faac3cc4647c69c3dbf34092a05b07955111a8190153c82789f5c677e1efa","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-16T13:07:03.884Z","fingerprint":"a52faac3cc4647c69c3dbf34092a05b07955111a8190153c82789f5c677e1efa","previousFingerprint":"a846fd3339fc751dfed295eaaa686ae188114b9b6504cac6cd03ffe131c339c6","bytes":706968,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-16T13:07:03.884Z","reviewed_at":null},{"id":"finding-009c977ad2f8be2f84f2ff72bc526800e74109d919f6a0209e11a54fdac50b84","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred. Article 9 permits requested supply without explicit labels only after agreement-based clarification of labeling obligations and use responsibilities and at least six months of relevant logs; it does not waive Article 5 metadata duties.","condition":"Network information service providers conducting labeling activities within Article 2; services fall within Deep Synthesis Provisions Article 17(1). Add a prominent cue at an appropriate image location.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Label generated images conspicuously","control":"Article 4(3)","actor":"Covered generation/synthesis service providers","action":"label","object":"generated images","ruleId":"AIR-EDEC4DCB77","intent":"label generated images","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-04c4307c79ba50ec7bd97abfdc4aa66aff141aa85fd92f139d3b1ff4a9ef3c0e","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred. Article 9 permits requested supply without explicit labels only after agreement-based clarification of labeling obligations and use responsibilities and at least six months of relevant logs; it does not waive Article 5 metadata duties.","condition":"Network information service providers conducting labeling activities within Article 2; services fall within Deep Synthesis Provisions Article 17(1). Place text/symbol cues at suitable text positions or prominent cues in the interface or around the text.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Label generated text visibly","control":"Article 4(1)","actor":"Covered generation/synthesis service providers","action":"label","object":"generated text visibly","ruleId":"AIR-23EE43CF93","intent":"label generated text visibly","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-05241de6ca242fd9f8c606c9a2f451d88209e390ca5cec87d5287406f4eda5d7","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; user service agreements must specify the labeling methods, styles and related specifications.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Describe labeling in user agreements","control":"Article 8 first limb","actor":"Covered service providers","action":"describe","object":"generated-content labeling methods and styles in user agreements","ruleId":"AIR-6D3C8487ED","intent":"describe generated content labeling methods and styles in user agreements","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-17a3bf1a8236a122c2b198b02161ed3b889c4084f0aa231eaf8cfd4dfa87bfd9","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred. Article 9 permits requested supply without explicit labels only after agreement-based clarification of labeling obligations and use responsibilities and at least six months of relevant logs; it does not waive Article 5 metadata duties.","condition":"Network information service providers conducting labeling activities within Article 2; services fall within Deep Synthesis Provisions Article 17(1). Prominent cues are required in the starting frame and around playback; intermediate/end cues are optional.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Label generated video at required locations","control":"Article 4(4)","actor":"Covered generation/synthesis service providers","action":"label","object":"generated video","ruleId":"AIR-2A37BD45F4","intent":"label generated video","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-3d15ef331a6b57a435235351556d6ea2b20fcd787c59970fe629fd0488f10599","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; app provider offers AI generation/synthesis services; during listing or launch review.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Verify app labeling materials","control":"Article 7 sentence 2","actor":"Internet application distribution platforms","action":"verify","object":"app generated-content labeling materials","ruleId":"AIR-DA28C8B948","intent":"verify app generated content labeling materials","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-414dd46daa7b507e72e8377382050c9b39a9f6ecd0b4e36f0af445c6f0a90a21","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved 12 August 2025; History says not revised to date; official page checked 16 October 2026","authority":"Organization-specific MSU institutional guidance; not a general statutory duty","jurisdiction":"Michigan State University, Michigan, US","url":"https://ai.msu.edu/guidelines","modality":"must not","exception":"Apply only within MSU's institutional scope; no automatic adoption into other organizations.","timing":"While the approved guidelines apply; approved 12 August 2025","evidenceSummary":"Official MSU page, History and exact subsection checked 16 October 2026. Today's byte-change signal does not establish a substantive revision.","title":"Do not use detector output as sole decision basis","control":"Permissible Uses / Teaching and Learning / detection-tools paragraph","actor":"MSU instructors using generative AI detection tools","action":"rely","object":"detector output","condition":"An instructor chooses a generative AI detector; its output is only a potential indicator of misuse. The prohibited reliance is using detector output as the sole basis for academic or grading decisions; this does not prohibit considering it as one potential indicator.","ruleId":"AIR-1A04293BCD","intent":"rely detector output","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-46590490c44f39d59c1bf6b008ced466a346280603cbfde7b8181fb17271b325","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; file metadata explicitly identifies generated/synthetic content. Add a prominent adjacent notice that the content is generated/synthetic.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Identify metadata-confirmed generated content","control":"Article 6(1), second limb","actor":"Network information content dissemination service providers","action":"label","object":"metadata-confirmed generated content","ruleId":"AIR-9E039F1858","intent":"label metadata confirmed generated content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-46593e5c95df0c4965d70c2d75c74ab6580926cb48624be11aaa618237221aaf","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; one of Article 6(1)-(3) applies. Include generation attributes, dissemination-platform name or code, and content identifier.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Add dissemination provenance metadata","control":"Article 6 final paragraph","actor":"Network information content dissemination service providers","action":"add","object":"dissemination provenance metadata","ruleId":"AIR-3FF151277F","intent":"add dissemination provenance metadata","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-513eb3973637d08950f6809fe882c2702eb6fd1dc74e06b0ca923709c0141f8d","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; publishing generated/synthetic content through dissemination services; use the provider's labeling functions.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Label generated content when publishing","control":"Article 10 paragraph 1, labeling limb","actor":"Users of network information content dissemination services","action":"label","object":"AI content","ruleId":"AIR-66E5FC0789","intent":"label ai content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-6da124847cdefa6ba7f3146402e4bfc5568a224b5e584cf8f65af221ce305a40","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; no implicit label is verified but the user declares generated/synthetic content. Add a prominent adjacent possible-generation notice.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Identify user-declared possible generated content","control":"Article 6(2)","actor":"Network information content dissemination service providers","action":"label","object":"user-declared possibly generated content","ruleId":"AIR-2A5EA1B6EE","intent":"label user declared possibly generated content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-78f4d8f16bfce462072aff539ba689b7da1bef47f48861d3c58f9b0a7803095f","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; neither metadata verification nor user declaration identifies generation, but explicit marks or other generation traces are detected. Add a prominent adjacent suspicion notice.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Identify suspected generated content","control":"Article 6(3)","actor":"Network information content dissemination service providers","action":"label","object":"suspected generated content","ruleId":"AIR-2BA8F53223","intent":"label suspected generated content","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-a446d757e292fe8fba359309141d8ed6248e66640de5ecb7527ada6651a11c43","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; reviewing app listing or launch. Require app providers to state whether their app offers AI generation/synthesis services.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Request AI-service disclosure during app review","control":"Article 7 sentence 1","actor":"Internet application distribution platforms","action":"request","object":"AI generation service disclosure from app providers","ruleId":"AIR-D10223F924","intent":"request ai generation service disclosure from app providers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-a69a5db12dc405f6c47fcac33777f6d2ae6b9e4cc291d9e7bd2038e33d0dcfe6","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"MSU Guidelines for the Use of Generative Artificial Intelligence Tools","sourceVersion":"Approved 12 August 2025; History says not revised to date; official page checked 16 October 2026","authority":"Organization-specific MSU institutional guidance; not a general statutory duty","jurisdiction":"Michigan State University, Michigan, US","url":"https://ai.msu.edu/guidelines","modality":"must","exception":"Apply only within MSU's institutional scope; no automatic adoption into other organizations.","timing":"Before access, license procurement or sign-up","evidenceSummary":"Official MSU page, History and exact subsection checked 16 October 2026. Today's byte-change signal does not establish a substantive revision.","title":"Consult IT before registering AI tools with MSU credentials","control":"Procuring or Registering for Available Generative AI Tools / second paragraph","actor":"MSU individuals and units using MSU credentials","action":"consult","object":"IT Services","condition":"Intending to use MSU credentials to access, license or sign up for a generative AI-enabled product or service; includes free and open-source tools.","ruleId":"AIR-242001C9D0","intent":"consult it services","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-c763851c853da877ec79a436534e430b02471cb34665f1e05da311a920d1db0b","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; under Deep Synthesis Provisions Article 16. File metadata must identify generated/synthetic attributes, provider name or code, and content identifier.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Mark generated content through file metadata","control":"Article 5 paragraph 1","actor":"Covered service providers","action":"mark","object":"generated content in machine-readable form","ruleId":"AIR-5C96C1D94B","intent":"mark generated content in machine readable form","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-d616efe2294bca885821737bb8753ae3abfd33fc3687f3eb0650179016712b38","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred. Article 9 permits requested supply without explicit labels only after agreement-based clarification of labeling obligations and use responsibilities and at least six months of relevant logs; it does not waive Article 5 metadata duties.","condition":"Network information service providers conducting labeling activities within Article 2; services fall within Deep Synthesis Provisions Article 17(1). Use speech/rhythm cues at suitable audio positions or a prominent interface cue.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Label generated audio visibly or audibly","control":"Article 4(2)","actor":"Covered generation/synthesis service providers","action":"label","object":"generated audio","ruleId":"AIR-517579FC73","intent":"label generated audio","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-eebccfebe03ae567afaa1d6fd3b5995d8edd96a44c19a4cb3ea603113e6033a3","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025; retain relevant logs for at least six months","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; a user requests content without explicit labels and the provider supplies it after clarifying the user's labeling obligations and usage responsibilities through the user agreement.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Retain logs for content without explicit labels","control":"Article 9","actor":"Covered service providers","action":"retain","object":"recipient information and related unlabeled-content logs","ruleId":"AIR-78F3C16946","intent":"retain recipient information and related unlabeled content logs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-ef2b7db9ee53d4022eafdcfc58b38052c8329bfdd568ec5f0da6b2e5ad4f67d5","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred.","condition":"Network information service providers conducting labeling activities within Article 2; disseminating content; inspect file metadata for implicit labeling.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Check file metadata for implicit labels","control":"Article 6(1), first limb","actor":"Network information content dissemination service providers","action":"verify","object":"implicit labels in content file metadata","ruleId":"AIR-D875748735","intent":"verify implicit labels in content file metadata","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"finding-f821c1692bea60f81be8cf9b4ec3dc7ab9d4ede90761724921e9bbc7e8e03194","kind":"rule-candidate","status":"pending","body":{"sourceTitle":"Measures for Labeling AI-Generated and Synthetic Content (人工智能生成合成内容标识办法)","sourceVersion":"Guoxinban Tong Zi [2025] No.2; issued 7 March 2025, published 14 March 2025; effective 1 September 2025; Chinese publisher text checked 16 October 2026","modality":"must","authority":"Binding regulatory measure within Article 2 scope; original English candidate paraphrase of Chinese official text, pending owner/legal review","jurisdiction":"China; applicability is limited by Article 2 and cross-referenced network-information-service provisions","url":"https://www.cac.gov.cn/2025-03/14/c_1743654684782215.htm","timing":"From 1 September 2025 (Article 14), during the applicable labeling activity","exception":"Article 2 applicability must be established; Article 11 preserves other applicable rules and mandatory standards. No general exemption inferred. Article 9 permits requested supply without explicit labels only after agreement-based clarification of labeling obligations and use responsibilities and at least six months of relevant logs; it does not waive Article 5 metadata duties.","condition":"Network information service providers conducting labeling activities within Article 2; download, copy or export functions are provided. Files must contain compliant explicit labels.","evidenceSummary":"Official CAC final measure, rather than the September 2024 consultation draft; exact article below. Source text checked 16 October 2026; no newly enacted duty claimed.","title":"Preserve explicit labels in exported files","control":"Article 4 final paragraph","actor":"Covered generation/synthesis service providers","action":"preserve","object":"explicit labels in downloaded copied or exported generated files","ruleId":"AIR-D0197E474F","intent":"preserve explicit labels in downloaded copied or exported generated files","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-16T13:08:55.724Z","reviewed_at":null},{"id":"change-cisa-ncsc-secure-ai-development-ce44a7cc4771a4d57db5c0b4d3f602fb42c1f51a2eb3af066b01e0b9467c852e","kind":"source-change","status":"pending","body":{"sourceId":"cisa-ncsc-secure-ai-development","title":"Guidelines for Secure AI System Development","url":"https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development/guidelines/secure-development","status":"publisher-bytes-changed","checkedAt":"2026-10-17T13:00:27.359Z","fingerprint":"ce44a7cc4771a4d57db5c0b4d3f602fb42c1f51a2eb3af066b01e0b9467c852e","previousFingerprint":"67dbd2fc3af682ed557176113d621ce2ed770c11ed69ec3f8412de6ab94860e2","bytes":235216,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-17T13:00:27.359Z","reviewed_at":null},{"id":"change-eu-ai-act-3dd0cecff16f621ca02e49038f6f44f1754414c8ae8ea2c3f3f91fafcbe456d4","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-17T13:00:32.672Z","fingerprint":"3dd0cecff16f621ca02e49038f6f44f1754414c8ae8ea2c3f3f91fafcbe456d4","previousFingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","bytes":1535183,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-17T13:00:32.672Z","reviewed_at":null},{"id":"change-eu-gdpr-32a0b17e91313c79b22d5c41eecb1d2220a48bc45af860134c46c0136af5a2fb","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-17T13:00:32.672Z","fingerprint":"32a0b17e91313c79b22d5c41eecb1d2220a48bc45af860134c46c0136af5a2fb","previousFingerprint":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","bytes":1071030,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-17T13:00:32.672Z","reviewed_at":null},{"id":"change-msu-genai-guidelines-db41f2bc66f43a9dd344d6b68fcb32480d564066b8518f8565af7a28220fb398","kind":"source-change","status":"pending","body":{"sourceId":"msu-genai-guidelines","title":"Guidelines for the Use of Generative Artificial Intelligence Tools","url":"https://ai.msu.edu/guidelines","status":"publisher-bytes-changed","checkedAt":"2026-10-17T13:00:32.672Z","fingerprint":"db41f2bc66f43a9dd344d6b68fcb32480d564066b8518f8565af7a28220fb398","previousFingerprint":"a52faac3cc4647c69c3dbf34092a05b07955111a8190153c82789f5c677e1efa","bytes":706968,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-17T13:00:32.672Z","reviewed_at":null},{"id":"finding-13c7fbd1b72599bea21d3ad6540c5dcafd7c68762ef1022516440558dcf4b87c","kind":"rule-candidate","status":"pending","body":{"title":"Analyze AI logs for anomalous behavior","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 12.2","actor":"System Operators","modality":"should","action":"analyze","object":"AI system logs","condition":"Within the voluntary Code's AI-system scope. Use logs to check continued desired output and detect anomalies, breaches or unexpected behavior, including drift or poisoning.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"Over time during operation","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-12-monitor-your-systems-behaviour","ruleId":"AIR-E79CF56C27","intent":"analyze ai system logs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-14df702d3e9d2bcd82976f0a783fbe5a520d05fd6deea215c5cee6ca47782492","kind":"rule-candidate","status":"pending","body":{"title":"Assess poorly documented or unsecured AI components","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 7.2.1 — assessment limb","actor":"Developers and System Operators","modality":"must","action":"assess","object":"third-party AI supply-chain risks","condition":"Within the voluntary Code's AI-system scope. The clause 7.2 situation applies: a model or component used or adapted is not well documented or secured. Mitigating controls are a separate companion action.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"When choosing or adapting those components","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty. Shares the existing supply-chain risk-assessment intent; the poorly-documented/unsecured-component trigger, actors and force remain a distinct variant.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-7-secure-your-supply-chain","ruleId":"AIR-3A61647692","intent":"assess third party ai supply chain risks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-2079b6ff138eeb152a3d51e3bcaec46ade4705324e0392b9d60bba8e6e1f5dcd","kind":"rule-candidate","status":"pending","body":{"title":"Define deployment acceptance criteria","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"5.1.2 — acceptance-criteria limb","actor":"Organizations developing or deploying AI systems","modality":"should","action":"define","object":"AI acceptance criteria","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Reflect intended use, deployment context and risks identified under Essential Practice 3. Test methods, communicating criteria and conducting tests are separate actions.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"Before deployment","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-07E86EC44F","intent":"define ai acceptance criteria","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-209e03aba5f12531b29845ede7b959b05c9b4dc5a6e484e5a63db9c4d0b3c7eb","kind":"rule-candidate","status":"pending","body":{"title":"Monitor internal states when useful for security","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 12.3","actor":"System Operators and Developers","modality":"should","action":"monitor","object":"AI internal states","condition":"Within the voluntary Code's AI-system scope. Do so where it could improve handling of security threats or enable future security analytics; not an unconditional demand for all internal states.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"During operation where the security-benefit condition applies","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-12-monitor-your-systems-behaviour","ruleId":"AIR-0B81A2B5B4","intent":"monitor ai internal states","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-20df3e2b9d565a19bb13012628d180ef352c614b9f90e6e0946af10cf46aa48e","kind":"rule-candidate","status":"pending","body":{"title":"Share justification for risky component choices","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 7.2.2","actor":"System Operators","modality":"must","action":"share","object":"component risk-acceptance documentation with End-users","condition":"Within the voluntary Code's AI-system scope. The clause 7.2 choice has been made; share the documentation accessibly. This does not itself authorize the component choice.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"When using or adapting those components","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-7-secure-your-supply-chain","ruleId":"AIR-2AEA7C34AC","intent":"share component risk acceptance documentation with end users","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-22f9046eba62e7c0a861a8cfacb276c252965c88de8c190bfb48a4ed1bd51a86","kind":"rule-candidate","status":"pending","body":{"title":"Document each AI system's use context","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"2.1.4","actor":"Organizations developing or deploying AI systems","modality":"should","action":"document","object":"intended AI use contexts","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. For each AI system, scope documentation includes intended uses, foreseeable misuse, capabilities, limitations and expected context.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"For each AI system","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-F61F6AC2CB","intent":"document intended ai use contexts","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-49d53ffb158fe19c9e2bb47350b3f58319f5c87ce39191e7b6585b98cfad764f","kind":"rule-candidate","status":"pending","body":{"title":"Triage high-risk AI systems","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"3.2.1","actor":"Organizations developing or deploying AI systems","modality":"should","action":"establish","object":"AI system risk triage","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Determine which systems may present enhanced or unacceptable risks using the organization's context and risk tolerance.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"During AI system risk assessment","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-C2B1B0D97A","intent":"establish ai system risk triage","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-52b71fea73580a43cb5383458e0679e9bfe66a610af3217f2ef37cff06e1e34e","kind":"rule-candidate","status":"pending","body":{"title":"Record public training data provenance","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 8.2","actor":"Developers","modality":"must","action":"document","object":"public training data provenance","condition":"Within the voluntary Code's AI-system scope. Training data comes from publicly available sources; documentation covers acquisition method, origin and use in the model.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"When publicly sourced training data is used","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-8-document-your-data-models-and-prompts","ruleId":"AIR-2B88FB47B2","intent":"document public training data provenance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-693d7fa9626a40c6af18969d510255d48b283c1dd6c229a8884f03f405bf2a2a","kind":"rule-candidate","status":"pending","body":{"title":"Assess AI supply-chain risk","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"3.1.2 — assessment limb","actor":"Organizations developing or deploying AI systems","modality":"should","action":"assess","object":"third-party AI supply-chain risks","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Risk processes cover other developers and deployers; both providers and consumers consider open-source model, system and component risks.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"Across AI supply-chain risk management","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-3A61647692","intent":"assess third party ai supply chain risks","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-7da53506c96698c0b198732950e17422c3040f415517eaa26da59d22f5d782f8","kind":"rule-candidate","status":"pending","body":{"title":"Evaluate outputs for reverse-engineering exposure","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 9.4","actor":"Developers","modality":"should","action":"evaluate","object":"outputs for non-public model or training-data disclosure","condition":"Within the voluntary Code's AI-system scope. Assess whether outputs let System Operators or End-users reverse engineer non-public model aspects or training data.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"During output security evaluation","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-9-conduct-appropriate-testing-and-evaluation","ruleId":"AIR-84C8BD3E44","intent":"evaluate outputs for non public model or training data disclosure","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-7e6142af874768d30aa5d2f8edde0624228e626e368e400e320d11712f93c568","kind":"rule-candidate","status":"pending","body":{"title":"Record organizational AI risk tolerance","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"3.1.1 — risk-tolerance limb","actor":"Organizations developing or deploying AI systems","modality":"should","action":"document","object":"AI risk tolerance","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Define organizational acceptable/unacceptable risk criteria with likelihood and significance of harms, aligned to AI policy and objectives.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"When establishing and revising AI risk management","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-9EE4AB873B","intent":"document ai risk tolerance","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":true},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-8a6e8e02d73762e294cb72f68ab4b4067d07f78f199f7861196ba8942758fc99","kind":"rule-candidate","status":"pending","body":{"title":"Plan mitigations when patching is unavailable","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 11.1.1","actor":"Developers","modality":"must","action":"maintain","object":"AI security contingency mechanisms","condition":"Within the voluntary Code's AI-system scope. Mitigate security risks, particularly when updates cannot be provided; mechanisms and contingency plans should cover this case.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"During maintenance, particularly where updates cannot be provided","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-11-maintain-regular-security-updates-patches-and-mitigations","ruleId":"AIR-7D7800B6DD","intent":"maintain ai security contingency mechanisms","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-90f547c0991e25c594bc26b8912747a74a3c1370b18adff48292e78f1aa0954b","kind":"rule-candidate","status":"pending","body":{"title":"Retest major AI updates","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 11.2","actor":"Developers","modality":"should","action":"security-test","object":"major AI system updates","condition":"Within the voluntary Code's AI-system scope. Treat a major update as a newly developed model version and undertake a fresh security testing/evaluation process.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"For major AI system updates","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-11-maintain-regular-security-updates-patches-and-mitigations","ruleId":"AIR-4616E50FCE","intent":"security test major ai system updates","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-bfb59a1748e25a9075180f5c6defb5027c7213ded1de2191d6d4623a69fa8070","kind":"rule-candidate","status":"pending","body":{"title":"Provide available AI security updates","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 11.1 — Developer patch limb","actor":"Developers","modality":"must","action":"provide","object":"AI security updates and patches","condition":"Within the voluntary Code's AI-system scope. Updates and patches can be provided. Notification to System Operators and delivery by System Operators remain separate source actions.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. The source expressly qualifies provision with 'where possible'; do not erase that limitation.","timing":"During secure maintenance, where possible","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-11-maintain-regular-security-updates-patches-and-mitigations","ruleId":"AIR-3480DB4BB0","intent":"provide ai security updates and patches","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-ce66a59ee02ca65590afe62b8a46c724460c7e25c7caae5c10c0dab6bf905343","kind":"rule-candidate","status":"pending","body":{"title":"Document AI training needs","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"1.3.1 — training-needs documentation limb","actor":"Organizations developing or deploying AI systems","modality":"should","action":"document","object":"organizational AI training needs","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Assess broad AI understanding and accountability culture; delivering training and checking skills are separate actions.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"As AI development and deployment evolves","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-940E938C1F","intent":"document organizational ai training needs","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-e59b0a77d894ac1f1f876a49c35436053d1d337d79ceba7e20fd5e595ce2c75d","kind":"rule-candidate","status":"pending","body":{"title":"Document AI data usage rights","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"5.4.2 — data-usage-rights bullet","actor":"Organizations developing or deploying AI systems","modality":"should","action":"document","object":"AI data usage rights","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. For each use case, include intellectual property/copyright, Indigenous Data Sovereignty, privacy, confidentiality and contractual rights.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"For each AI use case","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-DD6C2FB7A7","intent":"document ai data usage rights","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-e5ddfeb448373433476dd867a5fc7519c95148994ff7521b623a1a3edace1c1f","kind":"rule-candidate","status":"pending","body":{"title":"Monitor sensitive-data leakage from AI","sourceTitle":"Guidance for AI Adoption: Implementation Guidance","sourceVersion":"October 2025 document edition; official HTML checked 17 October 2026. Current PDF download listing says published 5 May 2026; that listing date is not treated as a revised edition.","control":"5.4.2 — leakage-monitoring bullet","actor":"Organizations developing or deploying AI systems","modality":"should","action":"monitor","object":"personal and sensitive information leakage from AI models and systems","condition":"Voluntary implementation practices for Australian AI developers and deployers, tailored to context and risk. Monitor for leakage of personal and sensitive information; detection and incident handling need appropriate mechanisms and authority.","exception":"No automatic adoption into another organization; independently applicable laws, contracts and stricter requirements remain separate. These recommendations do not certify compliance.","timing":"During model and system use","authority":"Australian government voluntary implementation guidance, not an independent statutory mandate","jurisdiction":"Australia","evidenceSummary":"Exact numbered control read 17 October 2026 through the official industry.gov.au publisher link, which now redirects to ai.gov.au/staying-safe-and-responsible/essential-ai-practices/guidance-ai-adoption-implementation-guidance. October 2025 PDF edition distinguished from its 5 May 2026 download-listing date. Original atomic paraphrase, pending review.","url":"https://www.industry.gov.au/publications/guidance-ai-adoption","ruleId":"AIR-5FC6C99AD4","intent":"monitor personal and sensitive information leakage from ai models and systems","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-ec3de3163d9f647b4e2753671d527e83855a169693482a946192f13fb53b373a","kind":"rule-candidate","status":"pending","body":{"title":"Delete applicable assets when decommissioning","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 13.2 — deletion limb","actor":"Developers or System Operators deciding to decommission a model or system","modality":"must","action":"delete","object":"decommissioned AI data and configuration","condition":"Within the voluntary Code's AI-system scope. Decommissioning is decided; securely delete applicable data and configuration details with Data Custodian involvement.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. Only applicable data and configuration are covered; this is not a blanket authorization to delete unrelated records.","timing":"On model or system decommissioning","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-13-ensure-proper-data-and-model-disposal","ruleId":"AIR-2B0E2D9575","intent":"delete decommissioned ai data and configuration","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-fcfa79b40f36f7174e894eb1ee55ad9af228c5ac8a32caca51cedfd66ad73a0b","kind":"rule-candidate","status":"pending","body":{"title":"Evaluate outputs for unintended system influence","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 9.4.1","actor":"Developers","modality":"should","action":"evaluate","object":"outputs for unintended system influence","condition":"Within the voluntary Code's AI-system scope. Assess whether model outputs give System Operators or End-users unintended influence over the system.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"During output security evaluation","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-9-conduct-appropriate-testing-and-evaluation","ruleId":"AIR-E39D075503","intent":"evaluate outputs for unintended system influence","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"finding-ff40fabdc11ce238d4582eb151d3d133df08d45b929a5b649198bbf502455222","kind":"rule-candidate","status":"pending","body":{"title":"Mitigate attacks through externally offered AI APIs","sourceTitle":"Code of Practice for the Cyber Security of AI","sourceVersion":"Published 31 January 2025; current official HTML and dateModified 2025-01-31 checked 17 October 2026","control":"Clause 6.2","actor":"Developers offering an AI API to external customers or collaborators","modality":"must","action":"apply","object":"AI API attack mitigations","condition":"Within the voluntary Code's AI-system scope. An API is offered externally; controls address attacks through that API. Rate limits are an example, not a universally mandated control.","exception":"The Code is not designed for research-only academic systems that will not be deployed. Open-source applicability requires the implementation guide. ","timing":"When offering the external API","authority":"Voluntary UK government code; 'must' preserves source 'shall' as a requirement for following this voluntary Code, not a freestanding statutory duty; 'should' preserves its recommendation.","jurisdiction":"United Kingdom; role-based voluntary AI supply-chain code","evidenceSummary":"Exact numbered clause in official GOV.UK HTML read 17 October 2026. Original atomic paraphrase; pending owner review. This is an additional extraction from the 2025 edition, not a newly enacted or revised duty.","url":"https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai#principle-6-secure-your-infrastructure","ruleId":"AIR-5A9E810E50","intent":"apply ai api attack mitigations","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-17T13:04:04.186Z","reviewed_at":null},{"id":"change-eu-ai-act-33400cad7f7b19a58e6d418f0d8539b8c1c41cbd9465061c5b36fd175a996e18","kind":"source-change","status":"pending","body":{"sourceId":"eu-ai-act","title":"EU Artificial Intelligence Act","url":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-18T13:03:10.096Z","fingerprint":"33400cad7f7b19a58e6d418f0d8539b8c1c41cbd9465061c5b36fd175a996e18","previousFingerprint":"3dd0cecff16f621ca02e49038f6f44f1754414c8ae8ea2c3f3f91fafcbe456d4","bytes":1535221,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-18T13:03:10.096Z","reviewed_at":null},{"id":"change-eu-gdpr-4f25679303fc908879f9a3c6eb190add841227bdf553c7dc991f3103e595ee2d","kind":"source-change","status":"pending","body":{"sourceId":"eu-gdpr","title":"General Data Protection Regulation","url":"https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng","status":"publisher-bytes-changed","checkedAt":"2026-10-18T13:03:10.096Z","fingerprint":"4f25679303fc908879f9a3c6eb190add841227bdf553c7dc991f3103e595ee2d","previousFingerprint":"32a0b17e91313c79b22d5c41eecb1d2220a48bc45af860134c46c0136af5a2fb","bytes":1071070,"note":"A byte change is an update lead, not a confirmed change of legal obligation. Extraction and applicability review required."},"created_at":"2026-10-18T13:03:10.096Z","reviewed_at":null},{"id":"finding-09c6c213bf7d4a66fdd5911929a14cf457ac5234e3899bf59dd1c5c4754428b8","kind":"rule-candidate","status":"pending","body":{"title":"Record unresolvable evaluation failures","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(3), final submission-content paragraph, failure-recording limb; PDF page 31 (printed page 27)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"record","object":"unresolvable PCCP performance-evaluation failures","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. The protocol should affirm failures will be recorded when a specific modification's performance evaluation has an unresolvable failure, such as unmet pre-defined criteria.","timing":"When an unresolvable evaluation failure occurs","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. If root-cause analysis shows the failure is unrelated to specific PCCP aspects, it is not considered unresolvable and testing may be repeated.","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=31","ruleId":"AIR-9D8B4C021B","intent":"record unresolvable pccp performance evaluation failures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-365c5ecdad2a8a76cff6c2f6f08a987049e7bb9c16f088fbe98cbd6ef0b5fb15","kind":"rule-candidate","status":"pending","body":{"title":"Specify expected device-update frequency","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VI.B, update-frequency sentence; PDF page 25 (printed page 21)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"specify","object":"expected PCCP device-update frequency","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Describe the expected frequency of modifications, whether infrequent locked-model changes or continuous adaptation.","timing":"When describing planned modifications","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=25","ruleId":"AIR-D212B365EB","intent":"specify expected pccp device update frequency","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-3bc7ec1bf2e8c76f9e24556ece3344a48ca99cf7a10317f38e12dc1b5d40dbb6","kind":"rule-candidate","status":"pending","body":{"title":"Summarize previously implemented PCCP changes","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"V.F, paragraph beginning 'Over time'; PDF page 24 (printed page 20)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"summarize","object":"previously implemented authorized PCCP modifications","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. A later marketing submission is made for additional changes; include the modifications previously implemented consistently with the authorized PCCP so the current device is understandable.","timing":"In the later marketing submission","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=24","ruleId":"AIR-CA3B1AEBD0","intent":"summarize previously implemented authorized pccp modifications","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-3e7e657af0690d41ac1241619133be68a20c533357fe24003342d4d814223cfb","kind":"rule-candidate","status":"pending","body":{"title":"Submit the revised PCCP clean copy","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"V.F, paragraph beginning 'As described in Section V.C.'; PDF page 23 (printed page 19)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"submit","object":"a clean version-identified revised PCCP","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. The PCCP has been revised during FDA review; provide a clean final copy with title and current version number.","timing":"After review revisions and before PCCP authorization","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=23","ruleId":"AIR-32E06D4340","intent":"submit a clean version identified revised pccp","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-4ccce89890c88d39bf0eb24fe40140bbdea0eb5ae82091b824704b0730c1eedb","kind":"rule-candidate","status":"pending","body":{"title":"Define modification acceptance criteria","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(3), first paragraph; PDF page 31 (printed page 27)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"define","object":"AI acceptance criteria","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Predefine criteria for each planned device modification alongside appropriate metrics, study design and statistics. Same reusable intent as the existing acceptance-criteria rule; device/PCCP scope remains a distinct mapping.","timing":"Before evaluating planned modifications","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=31","ruleId":"AIR-07E86EC44F","intent":"define ai acceptance criteria","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-5710e7dfd93ecba84f8907d4349e8913b86b45056a11e2d59a287fb3d1680c78","kind":"rule-candidate","status":"pending","body":{"title":"Enumerate proposed device changes","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VI.B, opening paragraph; PDF page 25 (printed page 21)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"enumerate","object":"individual proposed PCCP device modifications","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. In the Description of Modifications, list each planned modification. Rationale, testing and implementation methods remain separate source actions.","timing":"When preparing the proposed PCCP","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=25","ruleId":"AIR-263476C75F","intent":"enumerate individual proposed pccp device modifications","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-65338599b0ac85b51dd21e5c43f58d9aa39c3ea120ce067273c63591be2917f8","kind":"rule-candidate","status":"pending","body":{"title":"Describe communications about device updates","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(4), 'What manufacturers should include in a submission', item 4; PDF page 33 (printed page 29)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"document","object":"PCCP device-update communications to users","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Describe how modifications will be communicated, including performance/input differences and addressed known issues; performance-change communications are consistent with the protocol's evaluation.","timing":"In the update procedures before rollout","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=33","ruleId":"AIR-22FFBCB55A","intent":"document pccp device update communications to users","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-6699a30d3f0258ac06aa50c2cf78d831d7dd176199b2b50cf92d7fdbdd952247","kind":"rule-candidate","status":"pending","body":{"title":"Describe test-data access restrictions","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(1), final clause of submission-content paragraph; PDF page 30 (printed page 26)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"document","object":"performance-test-data access restrictions","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Describe protocols preventing access during training, tuning and testing to the data reserved for performance testing; preserve the source's specified purpose and scope.","timing":"In the Modification Protocol","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=30","ruleId":"AIR-F69D7851A2","intent":"document performance test data access restrictions","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-86ac83f3e8921a3b5205196762b9953229d1d0ccc79b09147f8e405b090983f0","kind":"rule-candidate","status":"pending","body":{"title":"Assess combined modification effects","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VIII, Impact Assessment item 5; PDF page 34 (printed page 30)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"assess","object":"cumulative impact of all PCCP modifications","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. The Impact Assessment describes the combined effects of implementing all planned modifications, separately from each modification's individual risks.","timing":"During the PCCP impact assessment","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=34","ruleId":"AIR-0A2F580F9A","intent":"assess cumulative impact of all pccp modifications","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-87907e8914af87adb80d90c1ed4dc779be776eb8edfac202097a2d446536ef2a","kind":"rule-candidate","status":"pending","body":{"title":"Withhold modifications that fail evaluation","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(3), final submission-content paragraph, non-implementation limb; PDF page 31 (printed page 27)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"withhold","object":"AI-device modifications with unresolvable evaluation failures","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. The protocol should affirm that the specific modification will not be implemented if its performance evaluation has an unresolvable failure. This is not a statement that all resolved or unrelated failures permanently prohibit updates.","timing":"Before implementation of a modification with unresolvable evaluation failure","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. A root-cause analysis showing failure unrelated to specific PCCP aspects permits repeat performance testing under the stated guidance.","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=31","ruleId":"AIR-B67DF35C10","intent":"withhold ai device modifications with unresolvable evaluation failures","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-95cc50b36c1f1e9f84719dcb4c8c180454b6fad84c8db161698a02f22aebcb92","kind":"rule-candidate","status":"pending","body":{"title":"Describe local adaptation triggers","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VI.B, paragraph beginning 'The Description of Modifications should also clearly specify'; PDF page 25 (printed page 21)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"document","object":"local AI-device adaptation triggers","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. If the proposed PCCP includes local rather than uniform/global adaptations, describe factors or conditions warranting the local change.","timing":"In the proposed PCCP before local adaptations","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=25","ruleId":"AIR-5BEDB33F22","intent":"document local ai device adaptation triggers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-a88d487ed401b40d2a60b01dbd2cbed0575f361fd2a1a65e06779f32129a4984","kind":"rule-candidate","status":"pending","body":{"title":"Document train/tune/test separation","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(1), 'What manufacturers should include in a submission'; PDF page 30 (printed page 26)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"document","object":"training tuning and test-data separation strategies","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Describe sequestration during collection for the modification's training, tuning and test sets; this candidate is for documentation, not proof of implemented separation.","timing":"In the Modification Protocol before modification testing","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=30","ruleId":"AIR-111A3152CD","intent":"document training tuning and test data separation strategies","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-ce3e2c5f322ef4451839b6ff66a2a3644989e0cf03c789ef24059e15839bdb8e","kind":"rule-candidate","status":"pending","body":{"title":"Identify retraining triggers","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.B(2), submission-content paragraph continued onto printed p.27; PDF page 31 (printed page 27)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"identify","object":"AI-device retraining triggers","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Triggers may include volume of new data or observed drift; these are examples rather than universally required trigger values.","timing":"When defining retraining practices","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=31","ruleId":"AIR-FB999AE28F","intent":"identify ai device retraining triggers","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null},{"id":"finding-d1f271f786194a8fe561cabdd84e67382b1d73e24480a80a8bf78adc9755b67d","kind":"rule-candidate","status":"pending","body":{"title":"Trace modifications to protocol methods","sourceTitle":"Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions","sourceVersion":"Final guidance issued 18 August 2025; originally issued 4 December 2024; current FDA listing and PDF checked 18 October 2026","control":"VII.C, opening paragraph; PDF page 33 (printed page 29)","actor":"Manufacturers of AI-enabled device software functions (AI-DSFs) seeking or using a PCCP","modality":"should","action":"map","object":"PCCP modifications to supporting protocol methods","condition":"Within this guidance's AI-DSF PCCP scope: device modifications planned over time, including eligible device constituents of device-led combination products; not general organizational AI use. Clearly identify which data-management, retraining, performance-evaluation and update-procedure methods apply to each described modification. A traceability table is an example, not the only permitted representation.","timing":"When assembling or revising a PCCP","exception":"Final guidance contains nonbinding recommendations; alternative approaches may satisfy applicable statutes and regulations. No exemption from required FDA authorization is inferred. Drug/biologic constituents are not covered by this guidance's device recommendations. ","authority":"FDA final nonbinding guidance; recommendation only, distinct from any cited statutory duties or device-specific authorization conditions","jurisdiction":"United States; FDA-regulated AI-enabled medical devices","evidenceSummary":"Exact section and physical PDF page read from the FDA's 49-page final guidance on 18 October 2026; printed page is also identified. Original atomic candidate paraphrase, not a new October 2026 requirement. The January 2025 lifecycle-management document is still listed separately as draft/not for implementation. Legacy QSR cross-references in the 2025 text were not extracted as current standalone duties.","url":"https://www.fda.gov/media/166704/download#page=33","ruleId":"AIR-7EA3DA63D9","intent":"map pccp modifications to supporting protocol methods","status":"pending","semanticStatus":"human-validation-required","discovery":"automation-source-linked-proposal","existingIntent":false},"created_at":"2026-10-18T13:06:08.468Z","reviewed_at":null}],"reviews":[]},"exportedAt":"2026-10-28T00:41:00.890Z"}